@vincemakes/kiso-tui 0.25.0 → 0.26.0

package/dist/editor.js

@@ -26,16 +26,22 @@ import { charWidth, displayWidth, leadWidth, widthOf } from "./width.js";
 // the width primitives moved to width.ts (W1, the single width
 // authority) — re-exported so the editor's public surface is unchanged.
 export { charWidth, displayWidth, widthOf };
-import { palette } from "./render.js";
-import { PICK_MAX, panelOptions, saferDegradedNote, } from "./approval-panel.js";
+import { palette } from "./lines.js";
+import {} from "./approval-panel.js";
 // KC3.5: the panel-slot dispatchers — the ask branch folded into the
 // W21 lead/rows, so this file keeps ONE panel and one key owner.
-import { askCommitCustom, askKey, askOnCustomRow, askStart, panelLead } from "./ask-panel.js";
+import { panelLead } from "./ask-panel.js";
 import { AT_VISIBLE, atFilter } from "./at-picker.js";
 // TUI2-R2 ②: the session picker — the band's THIRD occupant. Its filter
 // is the @ picker's rank aimed at the session id; the editor owns the
 // keys, the compositor draws the rows.
-import { sessionFilter } from "./session-picker.js";
+import {} from "./session-picker.js";
+// S5 (C10): the two bands with state machines of their own — the
+// approval/ask/pick panel and the session picker — are controllers.
+// The editor parses bytes and lends them the composer through
+// #bandHost; they answer keys.
+import { PanelInput } from "./panel-input.js";
+import { PickInput } from "./pick-input.js";
 // TUI v4 #16d: the input row is the blue brick + the edit area — the
 // "you>" text is gone (the brick IS the prompt; the pipe path's readline
 // prompt keeps its own "you> " — v2a line mode, byte-for-byte).
@@ -89,6 +95,16 @@ export function viewerCommand(text) {
             return null;
     }
 }
+/** E1 §1 — the two-byte alt spellings of word motion and word deletion.
+ *  A table because one gesture has several encodings, and a table is
+ *  what keeps them from drifting into several features. */
+const ALT_WORD = new Map([
+    ["b", "left"],
+    ["f", "right"],
+    ["d", "killFwd"],
+    ["\x7f", "killBack"],
+    ["\x08", "killBack"],
+]);
 export const MOUSE_ON = "\x1b[?1000h\x1b[?1006h";
 export const MOUSE_OFF = "\x1b[?1000l\x1b[?1006l";
 export const PROMPT = "▌ ";
@@ -139,6 +155,39 @@ const ellipsis = () => {
     const p = palette();
     return `${p.dim}\u2026${p.reset}`;
 };
+/**
+ * DC-55 — the composer's DISPLAY form of the buffer.
+ *
+ * A tab is kept as U+0009 in `#chars`, because the submitted line and
+ * the durable event must carry the indentation the human pasted. It
+ * cannot be PAINTED as itself: the terminal expands it to the next tab
+ * stop while `charWidth(0x09)` returns 1, so the row on screen becomes
+ * wider than the row kiso measured — invariant ① in its literal form —
+ * and every cursor column after it is wrong by the same amount.
+ *
+ * So the projection shows `→`, ONE code point for one code point: every
+ * index and every cursor column the compositor computes from this string
+ * stays true. `line()` and `#chars` never see it.
+ *
+ * ONE CELL, not an expansion to a tab stop. A tab's width is a property
+ * of its POSITION, and `charWidth(cp)` takes a code point with no
+ * context to answer that from. CJK's two cells work because two is a
+ * property of the character; these are different problems, and reusing
+ * that path for this one would be a mis-fit that surfaces later as
+ * drift. The cost is stated in design §8: a pasted block's alignment in
+ * the composer is approximate, while the block itself is exact.
+ *
+ * The dim is safe for the reason the ellipsis above is: `cursorCol`
+ * COUNTS markers and sums the buffer's own widths — it never measures
+ * this string — so an SGR span in it has never been part of the
+ * arithmetic.
+ */
+const shown = (chars) => {
+    if (!chars.includes(0x09))
+        return String.fromCodePoint(...chars);
+    const p = palette();
+    return chars.map((cp) => (cp === 0x09 ? `${p.dim}\u2192${p.reset}` : String.fromCodePoint(cp))).join("");
+};
 /**
  * The editor. Raw mode + bracketed paste (?2004h) on enter, restored on
  * exit. The input row is rendered by `onRender` (the CLI wires it to the
@@ -157,14 +206,10 @@ export class Editor {
     // or delete. Never stashed — it is a walk's state, not the buffer's.
     #verticalGoalCol = null;
     #questionCb = null;
-    // W21: the panel state machine — the approval/trust panel owns the
-    // interaction while up: the digit/y/n/esc/tab routing, the rule
-    // input, the tab-amend feedback, the phase/selection the compositor
-    // renders. The menu never opens while a panel is up; the pre-panel
-    // buffer is stashed at open and restored at close (commit AND
-    // cancel) — the panel's rule/feedback text never leaks into the
-    // user's next turn.
-    #panel = null;
+    /** The approval / ask / pick panel — its state machine and its keys
+     *  live in PanelInput (S5); the editor lends it the composer through
+     *  #bandHost. */
+    #panelInput = new PanelInput(this.#bandHost());
     #pasting = false;
     /**
      * REL-0152-D8 — the paste capsule.
@@ -254,9 +299,6 @@ export class Editor {
     #swallowEnter = false;
     /** TUI2-R3v2 ②: whether SGR 1006 reporting is currently enabled. */
     #mouseOn = false;
-    /** TUI2-R3v2 ③: the safer ask's generation. A panel the human escaped
-     *  must not be resurrected by a promise nobody is waiting for. */
-    #saferToken = 0;
     /** TUI2-R3v2 ②: where the compositor put the panel's option rows this
      *  frame (absolute 1-based screen rows). The editor owns no geometry —
      *  it asks the surface that placed them. */
@@ -280,6 +322,9 @@ export class Editor {
     // expanded block). Mirrors the escape list: multiple listeners can
     // coexist; the editor never interprets the key itself.
     #expandCbs = [];
+    /** E1 §3 — ctrl+x. Same shape as the expand key: the editor owns the
+     *  KEY, the CLI owns what it means. */
+    #copyCbs = [];
     #onRender;
     /** TUI2-R1 (D): the keys sheet — a static one-screen overlay opened by
      *  `?` on an empty composer and closed by the next key, whatever it
@@ -315,10 +360,8 @@ export class Editor {
     // a session exists, owns the whole composer, and the only ways out
     // are a pick and an esc. That is why the commit callback lives here
     // rather than on the line channel — the caller is waiting for an id,
-    // not for a turn.
-    #pickCards = null;
-    #pickCommit = null;
-    #pickSel = 0;
+    // not for a turn. S5: the state and the keys live in PickInput.
+    #pickInput = new PickInput(this.#bandHost());
     // A2 (the feel): the session-scoped input history — every submitted TURN
     // line (never a question answer), capped at 100, never persisted. ↑↓
     // navigate it ONLY from an empty input or while already browsing.
@@ -405,6 +448,10 @@ export class Editor {
     onModeCycle(cb) {
         this.#onModeCycle = cb;
     }
+    /** E1 §3 — the copy key (ctrl+x). */
+    onCopy(cb) {
+        this.#copyCbs.push(cb);
+    }
     onExpand(cb) {
         this.#expandCbs.push(cb);
     }
@@ -506,7 +553,7 @@ export class Editor {
      *  the frame's clamp is the authority. */
     #visibleRows(lineCount) {
         const H = process.stdout.rows ?? 24;
-        const bands = (this.#menuOpen ? this.#menuFiltered().length : 0) + this.#atRows() + this.#pickRows() + this.#queueState().length;
+        const bands = (this.#menuOpen ? this.#menuFiltered().length : 0) + this.#atRows() + this.#pickInput.rows() + this.#queueState().length;
         return Math.max(1, Math.min(lineCount, N_MAX, Math.max(1, H - 3 - bands)));
     }
     /** The dock's input-row state — ADDITIVE (§5): `line` + `cursor` keep
@@ -534,7 +581,7 @@ export class Editor {
             const scrolled = i === cursorLine && this.#scroll > 0 ? ellipsis() : "";
             const above = i === first && first > 0 ? ellipsis() : "";
             const below = i === first + n - 1 && first + n < bounds.length ? ellipsis() : "";
-            lines.push(`${above}${scrolled}${String.fromCodePoint(...this.#chars.slice(from, b.end))}${below}`);
+            lines.push(`${above}${scrolled}${shown(this.#chars.slice(from, b.end))}${below}`);
         }
         const cursorRow = cursorLine - first;
         // the window trails the cursor, so the hidden-above marker can only
@@ -568,7 +615,7 @@ export class Editor {
         return MENU_ITEMS.filter((m) => m.name.startsWith(line));
     }
     #refreshMenu() {
-        if (this.#panel !== null)
+        if (this.#panelInput.up())
             return; // W21: the menu never opens while the panel owns the keys
         const f = this.#menuFiltered();
         this.#menuOpen = f.length > 0;
@@ -620,7 +667,7 @@ export class Editor {
     #atView() {
         if (!this.#atOpen || this.#atList === null)
             return null;
-        if (this.#panel !== null || this.#menuOpen)
+        if (this.#panelInput.up() || this.#menuOpen)
             return null;
         const token = this.#atToken();
         if (token === null)
@@ -656,9 +703,9 @@ export class Editor {
         // TUI2-R2 ②: not inside a session filter. An `@` typed into the
         // picker's query is a character in a session id, and a file picker
         // opening over a session picker would put two bands in one slot.
-        if (this.#pickUp())
+        if (this.#pickInput.up())
             return;
-        if (this.#panel !== null || this.#menuOpen || this.#questionCb !== null)
+        if (this.#panelInput.up() || this.#menuOpen || this.#questionCb !== null)
             return;
         if (this.#atToken() === null)
             return; // not at a word boundary
@@ -708,71 +755,12 @@ export class Editor {
         return view === null ? 0 : Math.min(view.matches.length, AT_VISIBLE) + 1;
     }
     // ── TUI2-R2 ② — the session picker ───────────────────────────────
-    /** Open the picker on a bound card source. The composer is cleared
-     *  (the buffer becomes the filter query) and `onPick` receives the
-     *  chosen id — or null when the human leaves without picking, which
-     *  is a first-class outcome and not an error. */
+    /** Open the picker on a bound card source (PickInput, S5). */
     beginPick(cards, onPick) {
-        this.#pickCards = cards;
-        this.#pickCommit = onPick;
-        this.#pickSel = 0;
-        this.#syncMouse();
-        this.#chars = [];
-        this.#cursor = 0;
-        this.#reflow();
-        this.#onRender();
-    }
-    /** The picker's state, derived: the full card list (the id column
-     *  measures over ALL of them, so the columns never jump), the
-     *  filtered matches, and the selection CLAMPED at read time — the
-     *  same correction discipline the @ picker uses, for the same
-     *  reason: narrowing can only ever shrink the list. */
-    #pickView() {
-        if (this.#pickCards === null)
-            return null;
-        const cards = this.#pickCards();
-        const matches = sessionFilter(cards, this.line());
-        return { cards, matches, selected: Math.max(0, Math.min(this.#pickSel, matches.length - 1)) };
+        this.#pickInput.begin(cards, onPick);
     }
     pickState() {
-        return this.#pickView();
-    }
-    #pickUp() {
-        return this.#pickCards !== null;
-    }
-    /** The band's height estimate: the header + the windowed rows (or
-     *  the one "no match" row) + the counter. */
-    #pickRows() {
-        const view = this.#pickView();
-        return view === null ? 0 : Math.min(Math.max(view.matches.length, 1), AT_VISIBLE) + 2;
-    }
-    /** Close and hand the verdict back. The callback fires AFTER the
-     *  state is cleared, so a caller that re-enters (a second picker, a
-     *  session that starts) never sees the closing picker's rows. */
-    #pickClose(id) {
-        const cb = this.#pickCommit;
-        this.#pickCards = null;
-        this.#pickCommit = null;
-        this.#pickSel = 0;
-        this.#syncMouse();
-        this.#chars = [];
-        this.#cursor = 0;
-        this.#reflow();
-        cb?.(id);
-        this.#onRender();
-    }
-    /** Enter takes the SELECTED session. An empty match set takes
-     *  nothing and leaves the picker up: a picker that invented a pick
-     *  when the query matched nothing would resume the wrong session,
-     *  which is the one failure this surface must never have. */
-    #pickAccept() {
-        const view = this.#pickView();
-        if (view === null)
-            return;
-        const card = view.matches[view.selected];
-        if (card === undefined)
-            return;
-        this.#pickClose(card.id);
+        return this.#pickInput.state();
     }
     /** One-shot question mode: the NEXT submit answers, not a turn. */
     question(_query, cb) {
@@ -783,54 +771,20 @@ export class Editor {
     cancelQuestion() {
         this.#questionCb = null;
     }
-    /** W21: open the approval panel. The current buffer is stashed
-     *  (restored at close — commit AND cancel), the panel takes the
-     *  keys and the input row's lead, the menu closes. */
+    /** W21: open the approval panel (PanelInput, S5): the buffer is
+     *  stashed and restored at close, the panel takes the keys and the
+     *  input row's lead, the composer's own bands close. */
     beginPanel(view, onCommit, opts) {
-        this.#panel = {
-            view,
-            phase: "options",
-            cursor: 0,
-            note: null,
-            safer: opts?.safer,
-            saferRun: null,
-            ask: view.ask === undefined ? null : askStart(view.ask),
-            // TUI2-R2 ④: the pick's walk — present exactly when the view is
-            // a pick, the same contract the ask's runtime has.
-            pick: view.pick === undefined ? null : { cursor: 0, phase: "options" },
-            onCommit,
-            stash: { chars: this.#chars, cursor: this.#cursor, scroll: this.#scroll },
-        };
-        this.#chars = [];
-        this.#cursor = 0;
-        this.#scroll = 0;
-        this.#verticalGoalCol = null;
-        this.#menuOpen = false;
-        this.#menuSel = 0;
-        this.#queuePopMode = false; // W22: the panel owns the keys while up
-        this.#atClose(); // KC3 §3: and the picker closes with everything else
-        this.#syncMouse();
-        this.#onRender();
+        this.#panelInput.begin(view, onCommit, opts);
     }
     /** W21: cancel the panel — the SIGINT path's pair to beginPanel. */
     cancelPanel() {
-        this.#panelClose({ action: "cancel" });
+        this.#panelInput.cancel();
     }
     /** W21: the compositor's bound view — the phase/selection while the
      *  panel is up, null otherwise. */
     panelState() {
-        const panel = this.#panel;
-        if (panel === null)
-            return null;
-        return {
-            view: panel.view,
-            phase: panel.phase,
-            cursor: panel.cursor,
-            ...(panel.note === null ? {} : { note: panel.note }),
-            ...(panel.saferRun === null ? {} : { safer: panel.saferRun }),
-            ...(panel.ask === null ? {} : { ask: panel.ask }),
-            ...(panel.pick === null ? {} : { pick: panel.pick }),
-        };
+        return this.#panelInput.state();
     }
     enter() {
         if (this.#entered)
@@ -896,7 +850,7 @@ export class Editor {
     /** The surfaces that own a selection — the approval/ask/pick panel, the
      *  session picker and the @ picker. Any one of them up = reporting on. */
     #syncMouse() {
-        this.#setMouse(this.#panel !== null || this.#pickCards !== null || this.#atUp());
+        this.#setMouse(this.#panelInput.up() || this.#pickInput.up() || this.#atUp());
     }
     /** The row's own render when the dock is inactive (a TTY without a
      *  real size): \r + clear + blue brick prompt + visible + cursor
@@ -907,8 +861,8 @@ export class Editor {
         const W = (process.stdout.columns ?? 0) || 80; // a degenerate 0 size (no TIOCSWINSZ) falls back
         // W21: the panel's lead owns the row while up (the brick returns
         // when the panel closes).
-        const panel = this.#panel;
-        const lead = panel !== null ? panelLead(panel.view, panel.phase, panel.cursor, panel.ask ?? undefined) : `${p.bold}${PROMPT}${p.reset}`;
+        const panel = this.#panelInput.state();
+        const lead = panel !== null ? panelLead(panel.view, panel.phase, panel.cursor, panel.ask) : `${p.bold}${PROMPT}${p.reset}`;
         // W23: the ONE width authority — leadWidth(lead), the ANSI-stripped
         // visible width (the styled panel lead / the styled brick measure
         // the same as their plain text — a lead can never measure
@@ -954,246 +908,36 @@ export class Editor {
             // close, and it disarms on anything else in the same breath.
             if (this.#swallowEnter) {
                 this.#swallowEnter = false;
-                if (this.#panel === null && (c === "\x0d" || c === "\x0a")) {
+                if (!this.#panelInput.up() && (c === "\x0d" || c === "\x0a")) {
                     i += 1;
                     continue;
                 }
             }
-            if (this.#panel !== null) {
-                // W21: the panel owns the keys — a digit CONFIRMS its row in
-                // the options phase, tab opens the amend (approval only), esc
-                // backs out (amend → options, options → cancel), enter takes
-                // the highlighted row. CSI/SS3 and the editing keys still ride
-                // the normal chain below (the amend line is free text);
-                // ctrl-c still rides the SIGINT handler (which cancels the
-                // panel).
-                const panel = this.#panel;
-                // KC3.5: an ASK panel routes its own keys — the digits pick
-                // (single-select advances, multi toggles), space toggles at
-                // the cursor, `t` opens the type-your-own line (the
-                // rule-input phase's shape: the buffer is the editor's, so
-                // only esc and enter are intercepted while typing), esc
-                // declines the whole call. Everything else falls through to
-                // the ordinary editing chain below.
-                // TUI2-R2 ④: a PICK panel routes its own keys — a digit moves
-                // the cursor to that option (never commits: the choice is
-                // CONFIRMED, so a mistyped digit is a mistake you can see
-                // before it takes effect), `t` opens the type-it line, enter
-                // commits, esc backs out then cancels. The swallow rule below
-                // is the ask's, for the ask's reason: a typed `/` must not arm
-                // the menu under a panel that owns the keys.
-                if (panel.pick !== null) {
-                    const typing = panel.pick.phase === "custom";
-                    if (c === "\x1b" && !text.slice(i + 1).startsWith("[") && !text.slice(i + 1).startsWith("O")) {
-                        this.#pickPanelEsc();
-                        i += 1;
-                        continue;
-                    }
-                    if (c === "\x0d" || c === "\x0a") {
-                        // REL-0152-D10: a newline inside a PASTE is content, never a
-                        // commit. Bracketed paste marks its own boundaries, so a
-                        // \n between them is a line of the pasted text and nothing
-                        // else. Without this, pasting a stack trace into a typed
-                        // panel phase submitted the first line and dropped the
-                        // rest into the composer behind the closed panel — the
-                        // owner asked whether the type-your-own box takes a paste,
-                        // and the answer was no, in the worst way.
-                        if (this.#pasting) {
-                            this.#insert(NEWLINE);
-                            i += c === "\x0d" && text[i + 1] === "\x0a" ? 2 : 1;
-                            continue;
-                        }
-                        this.#pickPanelEnter();
-                        i += 1;
-                        continue;
-                    }
-                    if (!typing && c !== undefined && c >= "1" && c <= "9") {
-                        this.#pickPanelDigit(Number(c) - 1);
-                        i += 1;
-                        continue;
-                    }
-                    // DC-36: no `t` row means no custom phase to enter — the
-                    // option list IS the world (a closed set), and a key
-                    // that leads to a surface the panel does not draw is
-                    // worse than an absent key.
-                    if (!typing && (c === "t" || c === "T") && this.#panel?.view.pick?.typeHint !== undefined) {
-                        panel.pick = { cursor: panel.pick.cursor, phase: "custom" };
-                        this.#chars = [];
-                        this.#cursor = 0;
-                        this.#scroll = 0;
-                        this.#onRender();
-                        i += 1;
-                        continue;
-                    }
-                    if (!typing && c !== undefined && c >= " " && c !== "\x7f") {
-                        i += 1;
-                        continue;
-                    }
-                }
-                if (panel.ask !== null) {
-                    const typing = panel.ask.phase === "custom";
-                    if (c === "\x1b" && !text.slice(i + 1).startsWith("[") && !text.slice(i + 1).startsWith("O")) {
-                        this.#askStep("esc");
-                        i += 1;
-                        continue;
-                    }
-                    if (c === "\x0d" || c === "\x0a") {
-                        // REL-0152-D10: a newline inside a PASTE is content, never a
-                        // commit. Bracketed paste marks its own boundaries, so a
-                        // \n between them is a line of the pasted text and nothing
-                        // else. Without this, pasting a stack trace into a typed
-                        // panel phase submitted the first line and dropped the
-                        // rest into the composer behind the closed panel — the
-                        // owner asked whether the type-your-own box takes a paste,
-                        // and the answer was no, in the worst way.
-                        if (this.#pasting) {
-                            this.#insert(NEWLINE);
-                            i += c === "\x0d" && text[i + 1] === "\x0a" ? 2 : 1;
-                            continue;
-                        }
-                        this.#askStep(typing ? "commit" : "enter");
-                        i += 1;
-                        continue;
-                    }
-                    // REL-0152-D4 — on the custom row a printable key is TEXT.
-                    // The row names typing as its purpose and then swallowed
-                    // the first thing you typed; only enter or `t` opened the
-                    // phase. Now the keystroke opens it AND lands in the
-                    // buffer, so the character you meant is the character you
-                    // get. This is checked BEFORE the shortcut branch below on
-                    // purpose: on this row "3" and "t" are the start of an
-                    // answer, not a pick and not a mode key. Everywhere else
-                    // in the list they keep their fast-path meaning exactly.
-                    if (askOnCustomRow(panel.view.ask, panel.ask) && c !== undefined && c >= " " && c !== "\x7f") {
-                        this.#askStep("type");
-                        this.#insert(c.codePointAt(0));
-                        this.#onRender();
-                        i += 1;
-                        continue;
-                    }
-                    if (!typing && (c === " " || (c !== undefined && c >= "1" && c <= "4") || c === "t" || c === "T")) {
-                        this.#askStep(c === " " ? "space" : c === "T" ? "t" : c);
-                        i += 1;
-                        continue;
-                    }
-                    // an ask at rest swallows stray PRINTABLE keys — the panel
-                    // owns them, and a typed "/" or "@" must not arm the menu
-                    // or the picker underneath. Two things are never
-                    // swallowed: the CSI/SS3 introducer, because ←/↑/↓ are
-                    // the ask's own keys and the parser below routes them
-                    // (the T-Q1 red), and the CONTROL characters, because
-                    // ctrl-c must still reach the SIGINT handler that
-                    // cancels the panel — W21's own rule, and what the T-Q6
-                    // race red caught: an abort with the panel up did
-                    // nothing at all.
-                    if (!typing && c !== undefined && c >= " " && c !== "\x7f") {
-                        i += 1;
-                        continue;
-                    }
-                }
-                if (c === "\x1b" && !text.slice(i + 1).startsWith("[") && !text.slice(i + 1).startsWith("O")) {
-                    this.#panelEsc();
-                    i += 1;
-                    continue;
-                }
-                if (c === "\t") {
-                    if (panel.phase === "options")
-                        this.#panelTab();
-                    i += 1;
-                    continue;
-                }
-                if (c === "\x0d" || c === "\x0a") {
-                    // REL-0152-D10: a newline inside a PASTE is content, never a
-                    // commit. Bracketed paste marks its own boundaries, so a
-                    // \n between them is a line of the pasted text and nothing
-                    // else. Without this, pasting a stack trace into a typed
-                    // panel phase submitted the first line and dropped the
-                    // rest into the composer behind the closed panel — the
-                    // owner asked whether the type-your-own box takes a paste,
-                    // and the answer was no, in the worst way.
-                    if (this.#pasting) {
-                        this.#insert(NEWLINE);
-                        i += c === "\x0d" && text[i + 1] === "\x0a" ? 2 : 1;
-                        continue;
-                    }
-                    this.#panelEnter();
-                    i += 1;
-                    continue;
-                }
-                // TUI2-R3v2 ③: the safer list answers the SAME keys the approval
-                // list does — one interaction model means the new surface is not
-                // an exception to it. A digit takes its row (the way back
-                // included, as the last one).
-                if (panel.phase === "safer" && c !== undefined && c >= "1" && c <= "9") {
-                    this.#saferConfirm(Number(c) - 1);
-                    i += 1;
+            if (this.#panelInput.up()) {
+                // S5: the panel answers PARSED keys — a bare Esc, an Enter, a
+                // Tab, a character — and says how many bytes it took, or null
+                // when the key falls through to the composer (the amend
+                // reason, a custom answer and a custom pick are typed through
+                // the ordinary path below; an unclaimed control byte keeps its
+                // meaning). An ESC that opens a sequence is not a key yet: it
+                // goes to the sequence parser like any other.
+                const ahead = text.slice(i + 1);
+                const key = c === undefined
+                    ? null
+                    : c === "\x1b"
+                        ? ahead.startsWith("[") || ahead.startsWith("O")
+                            ? null
+                            : { kind: "esc" }
+                        : c === "\x0d" || c === "\x0a"
+                            ? { kind: "enter", crlf: c === "\x0d" && text[i + 1] === "\x0a" }
+                            : c === "\t"
+                                ? { kind: "tab" }
+                                : { kind: "char", ch: c };
+                const took = key === null ? null : this.#panelInput.feed(key, this.#pasting);
+                if (took !== null) {
+                    i += took;
                     continue;
                 }
-                // while the ask is in flight the panel owns every printable key
-                // and answers to none of them — esc (above) is the only gesture
-                // with a meaning, and a stray letter must not reach the composer.
-                if (panel.phase === "asking" && c !== undefined && c >= " " && c !== "\x7f") {
-                    i += 1;
-                    continue;
-                }
-                // TUI2-R3v2 ① — the digit CONFIRMS, and it confirms on the
-                // keypress.
-                //
-                // The retired model made a digit a selection and Enter the
-                // commit, which meant the fastest path through an approval was
-                // two keys and the hint line had to teach both. The list makes
-                // the digit redundant as a selector — the bar is already showing
-                // what is selected — so the digit becomes what a human pressing
-                // a number on a numbered list means by it: THAT one.
-                //
-                // A digit past the list is INERT (the R2 pick panel's rule,
-                // inherited whole): an option nobody has is never taken, and a
-                // mistyped 7 must not fall through to the composer underneath.
-                //
-                // The guard is the options phase and nothing else. The typed
-                // phase is prose — that is the R2 slice-⑧ finding, and it is
-                // why this branch sits below the enter/esc/tab handlers and
-                // above nothing at all: "yes, run 13 of them" keeps its digits.
-                if (panel.phase === "options" && panel.ask === null && panel.pick === null && c !== undefined && c >= "1" && c <= "9") {
-                    this.#panelConfirm(Number(c) - 1);
-                    i += 1;
-                    continue;
-                }
-                // TUI2-R2 ⑧, carried forward — the shortcut keys belong to the
-                // OPTIONS phase and to it alone.
-                //
-                // `y`/`n` used to be applied in every phase of every flavour:
-                // the `i += 1; continue;` sat OUTSIDE the phase check, so a
-                // phase where the key meant nothing swallowed it anyway — and a
-                // phase where a letter means nothing is exactly a phase where a
-                // human is typing prose. Every y and n vanished from the line,
-                // silently. "yes, run it now" committed as "es, ru it ow".
-                //
-                // The guard survives the migration unchanged in spirit and
-                // simpler in fact: there is now ONE typed phase instead of
-                // three, and the letters reach only the list.
-                //
-                // The letters stay because they are the two answers this panel
-                // has always taken and a decade of muscle memory types them.
-                // They are ALIASES for rows, not a second model: `y` is the
-                // first option, `n` is the last, and on an approval the last
-                // option opens the composer — so the old "n then enter" still
-                // lands the same bare denial it always did.
-                const optionsPhase = panel.pick === null && // a pick has no yes and no no
-                    panel.phase === "options" && // the amend line is prose
-                    (panel.ask === null || panel.ask.phase === "options"); // and so is a typed ask answer
-                if (optionsPhase && panel.ask === null) {
-                    if (c === "y" || c === "Y") {
-                        this.#panelConfirm(0);
-                        i += 1;
-                        continue;
-                    }
-                    if (c === "n" || c === "N") {
-                        this.#panelConfirm(panelOptions(panel.view).length - 1);
-                        i += 1;
-                        continue;
-                    }
-                }
             }
             if (c === "\x1b") {
                 const rest = text.slice(i + 1);
@@ -1245,6 +989,39 @@ export class Editor {
                 else if (rest.startsWith("O")) {
                     i += 3; // SS3 (function keys) — ignored
                 }
+                else if (rest !== "" && ALT_WORD.has(rest[0]) && !this.#pasting && this.#composerIdle()) {
+                    // E1 §1 — the two-byte alt spellings, SAME-CHUNK ONLY.
+                    //
+                    // This follows Alt+Enter below, which ruled the identical
+                    // question for the identical byte shape: "A terminal sends
+                    // Alt+X as ESC and X in ONE write, so SAME-CHUNK is the
+                    // whole test: no timer, no hold, nothing parked. The
+                    // identical two bytes arriving in SEPARATE chunks are NOT
+                    // combined — the bare Esc fires at once (its immediacy is
+                    // exactly what a hold would spend)."
+                    //
+                    // The work order asked for the split pair to be JOINED
+                    // through #pending. Built that way first, and it broke six
+                    // gates across four files — `dc7-osc-swallow`'s case is
+                    // titled "a chunk boundary between ESC and ] is known to
+                    // leak — Esc stays immediate", which is the same ruling
+                    // stated from the other side. Parking a lone ESC is what
+                    // joining requires, and esc immediacy is what parking
+                    // spends: esc interrupts a run. The conflict is reported
+                    // rather than resolved here.
+                    //
+                    // Inside a paste these bytes are CONTENT — `\x1bb` in
+                    // someone's text is an escape and a letter, not a motion.
+                    const op = ALT_WORD.get(rest[0]);
+                    if (op === "left" || op === "right")
+                        this.#moveWord(op === "left" ? -1 : 1);
+                    else if (op === "killBack")
+                        this.#killWord();
+                    else
+                        this.#killWordForward();
+                    this.#onRender();
+                    i += 2;
+                }
                 else if (rest.startsWith("\x0d") && this.#composerIdle()) {
                     // KC2 §2 — Alt+Enter. A terminal sends Alt+X as ESC and X in
                     // ONE write, so SAME-CHUNK is the whole test: no timer, no
@@ -1269,13 +1046,13 @@ export class Editor {
                     this.#refreshMenu();
                     i += 1;
                 }
-                else if (this.#pickUp()) {
+                else if (this.#pickInput.up()) {
                     // TUI2-R2 ②: esc leaves the picker with nothing picked.
                     // The caller reads null and exits 0 — declining to resume
                     // is a normal thing to do, not a failure, so it must not
                     // fall through to the escapeCbs (which mean "abort the
                     // run" and there is no run yet).
-                    this.#pickClose(null);
+                    this.#pickInput.close(null);
                     i += 1;
                 }
                 else if (this.#atUp()) {
@@ -1432,6 +1209,21 @@ export class Editor {
                     cb();
                 i += 1;
             }
+            else if (c === "\x18" && this.#composerIdle()) {
+                // E1 §3 — ctrl+x copies the last answer. `\x18` was unbound
+                // across the whole tree (checked before the round started),
+                // so nothing is displaced.
+                //
+                // Composer-idle only, like `?` and ctrl+r: a panel, picker,
+                // menu or question owns its keys first. The buffer is NOT
+                // required to be empty — ctrl+x copies the ANSWER, not the
+                // composer, so a half-written follow-up is no reason to
+                // refuse. (ctrl+r requires an empty buffer because it opens
+                // a surface OVER the composer; this prints one status row.)
+                for (const cb of [...this.#copyCbs])
+                    cb();
+                i += 1;
+            }
             else if (c === "\x12" && this.#composerIdle() && this.#chars.length === 0) {
                 // R5 — the transcript viewer, on ctrl+r since DC-41. The
                 // reference binds ctrl+r to renaming a session, which kiso
@@ -1454,12 +1246,48 @@ export class Editor {
                 this.#onRender();
                 i += 1;
             }
+            else if (c === "\t" && this.#pasting) {
+                // DC-55 — a TAB is content, and the branch below would have
+                // eaten it.
+                //
+                // `c < " "` discards every unclaimed control byte, and a
+                // paste has no other way into the buffer, so pasting
+                // indented code silently lost its indentation: `alpha\tbeta`
+                // arrived as `alphabeta`.
+                //
+                // `#pasting` IS TESTED, and the first build left it out on the
+                // reasoning that a typed Tab is claimed further up anyway.
+                // It is claimed CONDITIONALLY: `\t && #menuOpen` completes a
+                // command and `\t && #atUp()` completes a path, so with
+                // neither surface open a typed Tab falls through to exactly
+                // here. Without the guard it started inserting a tab — the
+                // completion key silently became an insert key on an idle
+                // composer, which the typed-Tab gate caught.
+                //
+                // A paste is the one context where a tab is CONTENT.
+                this.#insert(0x09);
+                i += 1;
+            }
             else if (c !== undefined && c < " ") {
                 i += 1; // other control — ignored
             }
             else {
-                this.#insert(text.codePointAt(i));
-                i += c.length;
+                // E1 §1 (found by the word-op gate, PRE-EXISTING): advance by
+                // the CODE POINT, not by `text[i]`.
+                //
+                // `c` is one UTF-16 unit, so `c.length` is always 1, while
+                // `codePointAt` returns the whole astral code point. Typing
+                // one emoji therefore inserted the code point AND then the
+                // lone low surrogate left under the cursor — `"😀"` came back
+                // as `"😀\ude00"`, three UTF-16 units for one glyph.
+                //
+                // Verified pre-existing by stashing this round's changes and
+                // re-running: the baseline is identically wrong. It surfaces
+                // now because word motion is the first feature that has to
+                // STEP over a grapheme rather than only append to it.
+                const cp = text.codePointAt(i);
+                this.#insert(cp);
+                i += cp > 0xffff ? 2 : 1;
             }
         }
     }
@@ -1485,18 +1313,7 @@ export class Editor {
         // TUI2-R3v2 ③: a click works on BOTH lists — one interaction model
         // means the safer alternatives are clickable for the same reason the
         // original choices are.
-        if (this.#panel === null || (this.#panel.phase !== "options" && this.#panel.phase !== "safer"))
-            return;
-        const span = this.#panelRows?.();
-        if (span == null || row === undefined || !Number.isFinite(row))
-            return;
-        const offset = row - span.top;
-        if (offset < 0 || offset >= span.count)
-            return; // outside the list — inert
-        if (this.#panel.phase === "safer")
-            this.#saferConfirm(offset);
-        else
-            this.#panelConfirm((span.first ?? 0) + offset);
+        this.#panelInput.click(this.#panelRows?.(), row);
     }
     /** TUI2-R3v2 ②: the compositor reports where it PUT the option rows.
      *  The editor does no row arithmetic of its own — the surface that
@@ -1531,6 +1348,21 @@ export class Editor {
                 return;
             }
         }
+        // E1 §1 — alt+←/→ and ctrl+←/→, the CSI spellings of word motion.
+        //
+        // `1;3` is alt (meta), `1;5` is ctrl. Terminal.app sends the CSI
+        // form for alt+← unless "Use Option as Meta Key" is on, in which
+        // case it sends `\x1bb` — handled in the escape branch. Both are
+        // the same gesture and both route here, because a gesture with
+        // three spellings is a table, not three features.
+        //
+        // Composer-idle only, for the back-tab's reason below: a panel,
+        // picker, menu or question owns its keys first.
+        if ((final === "D" || final === "C") && (params === "1;3" || params === "1;5") && this.#composerIdle()) {
+            this.#moveWord(final === "D" ? -1 : 1);
+            this.#onRender();
+            return;
+        }
         // R3a — Shift+Tab (CSI Z, the universal back-tab encoding) cycles
         // the approval tier. Composer-idle ONLY: a panel, picker, menu,
         // history browse or question owns its keys first (the W21 gate),
@@ -1582,37 +1414,11 @@ export class Editor {
             // the cursor semantics are unchanged (↑↓ do nothing). W21: the
             // panel owns the keys while up (↑↓ do nothing — the panel has no
             // ↑↓ role).
-            if (this.#panel !== null) {
-                // W21: the panel owns the keys. KC3.5: an ask uses ↑↓ for
-                // the option cursor (the approval panel still has no ↑↓ role).
-                if (this.#panel.pick !== null && this.#panel.pick.phase === "options") {
-                    // TUI2-R2 ④: ↑↓ walk the pick's cursor — the same list the
-                    // digits address, the other muscle.
-                    const n = Math.min(this.#panel.view.pick.options.length, PICK_MAX);
-                    const cur = this.#panel.pick.cursor;
-                    this.#panel.pick = { cursor: final === "A" ? Math.max(0, cur - 1) : Math.min(Math.max(0, n - 1), cur + 1), phase: "options" };
-                }
-                else if (this.#panel.ask !== null && this.#panel.ask.phase === "options")
-                    this.#askStep(final === "A" ? "up" : "down");
-                // TUI2-R3v2 ①: the approval/simple panel joins them. It was the
-                // one panel flavour with no ↑↓ role, because it had no cursor to
-                // move; it has one now, and the gesture is the same one the
-                // pick, the ask, the session picker and the @ picker already
-                // answer to. ONE interaction model is the round's acceptance
-                // criterion, and this branch is where it stops being four.
-                else if (this.#panel.phase === "safer")
-                    this.#saferMove(final === "A" ? -1 : 1);
-                else if (this.#panel.phase !== "asking")
-                    this.#panelMove(final === "A" ? -1 : 1);
+            if (this.#panelInput.arrow(final === "A" ? "up" : "down")) {
+                // the panel walked its own list (a phase without one swallows the key)
             }
-            else if (this.#pickUp()) {
-                // TUI2-R2 ②: the session picker owns ↑↓ while up — the
-                // SELECTION, never the composer's line walk and never the
-                // history browse. It sits above both because the picker is
-                // modal: there is no turn to recall and no second line to
-                // walk to while it is open.
-                const view = this.#pickView();
-                this.#pickSel = final === "A" ? Math.max(0, view.selected - 1) : Math.min(Math.max(0, view.matches.length - 1), view.selected + 1);
+            else if (this.#pickInput.arrow(final === "A" ? "up" : "down")) {
+                // the session picker moved its selection
             }
             else if (this.#menuOpen) {
                 if (final === "A")
@@ -1652,9 +1458,7 @@ export class Editor {
         else if (final === "D") {
             // KC3.5: ← walks the ask BACK a question (the ‹ n/m › walk); at
             // question one it stays put — esc is the decline, never ←.
-            if (this.#panel?.ask != null && this.#panel.ask.phase === "options")
-                this.#askStep("left");
-            else
+            if (!this.#panelInput.left())
                 this.#move(-1);
         }
         else if (final === "C") {
@@ -1687,365 +1491,44 @@ export class Editor {
         this.#reflow();
         this.#verticalGoalCol = goal; // the walk re-arms it (the reflow's reset is for every OTHER key)
     }
-    // ---- W21 / TUI2-R3v2 ①: the panel state machine ----
-    /** ↑↓ — the bar walks the list and STOPS at both ends. A list that
-     *  wraps makes the fastest gesture (hold ↓ to reach the bottom) into
-     *  a gamble about where you landed, and the bottom option here is the
-     *  denial. */
-    #panelMove(delta) {
-        const panel = this.#panel;
-        if (panel === null || panel.phase !== "options")
-            return;
-        const n = panelOptions(panel.view).length;
-        panel.cursor = Math.max(0, Math.min(n - 1, panel.cursor + delta));
-        this.#onRender();
-    }
-    /**
-     * Take the option at `index` — the ONE place a panel choice resolves,
-     * whether the human pressed a digit, pressed ⏎ on the bar, typed the
-     * y/n alias, or clicked the row (slice ②). Four gestures, one branch:
-     * a click cannot mean something a digit does not.
-     *
-     * Every kind but `deny` on an approval resolves IMMEDIATELY. That is
-     * the round's whole claim — the durable rule included, because the
-     * rule the machinery supports is exactly "this tool", and asking the
-     * human to confirm a value they cannot change was the old model's
-     * ceremony, not a safeguard.
-     */
-    #panelConfirm(index) {
-        const panel = this.#panel;
-        if (panel === null || panel.phase !== "options")
-            return;
-        const options = panelOptions(panel.view);
-        const option = options[index];
-        if (option === undefined)
-            return; // a digit past the list is inert
-        panel.cursor = index;
-        switch (option.kind) {
-            case "allow":
-                this.#panelClose({ action: "allow", reason: "" });
-                return;
-            case "rule":
-                this.#panelClose({ action: "allow-rule", rule: panel.view.name });
-                return;
-            case "safer":
-                this.#panelSafer();
-                return;
-            case "deny":
-                // the approval flavor's denial is "let me tell it what to do
-                // instead", so it opens the composer; the simple flavors have
-                // nothing to tell anyone and resolve on the spot.
-                if (panel.view.flavor === "approval")
-                    this.#panelAmend();
-                else
-                    this.#panelClose({ action: "deny", reason: "" });
-                return;
-        }
-    }
-    /**
-     * Option 3 — "show me safer ways to do this".
-     *
-     * The round's ONE new model request, and every branch here exists to
-     * keep it honest.
-     *
-     * It fires ONLY from this method, which only this option reaches —
-     * that is the entire mechanism behind the zero-ambient-rent claim,
-     * and it is why the claim is checkable rather than asserted: a
-     * session that never presses 3 never enters this branch, and the
-     * trace shows no side-query line.
-     *
-     * The in-flight phase is VISIBLE because this is a network call: a
-     * button that goes quiet for two seconds reads as broken, and the
-     * human is standing in front of a paused run.
-     *
-     * Every failure — a throw, a null, an empty list, no provider bound
-     * at all — lands on the SAME honest branch and puts back every
-     * original choice. There is deliberately no retry and no partial
-     * state: the alternative to "I could not get them" is either a lie or
-     * a spinner that never ends, and both are worse than the sentence.
-     *
-     * R3v2-F1: one of those failures can now name its cause, and the
-     * sentence says it. That is a widening of the COPY, not of the
-     * branch — there is still exactly one failure path, it still restores
-     * every original choice, and a provider that has nothing to add still
-     * resolves `null` and still gets the line it always got. A cause is
-     * only ever spoken when the caller could prove it; a diagnosis the
-     * product cannot prove would be worse than the unqualified line it
-     * replaced.
-     *
-     * The generation token is the guard against a late answer: a panel
-     * the human escaped (or that a SIGINT cancelled) must not be
-     * resurrected two seconds later by a promise nobody is waiting for.
-     */
-    #panelSafer() {
-        const panel = this.#panel;
-        if (panel === null)
-            return;
-        const ask = panel.safer;
-        panel.phase = "asking";
-        panel.note = null;
-        this.#onRender();
-        const token = ++this.#saferToken;
-        const settle = (answer) => {
-            // the panel that asked must still be the panel on screen
-            if (this.#panel !== panel || token !== this.#saferToken)
-                return;
-            // R3v2-F1: a non-list answer is a failure, and it may name its
-            // cause. Which sentence that earns is decided where the
-            // sentences live; here we only route to the same one branch
-            // every failure has always taken.
-            const options = Array.isArray(answer) ? answer : null;
-            if (options === null || options.length === 0) {
-                panel.phase = "options";
-                panel.note = saferDegradedNote(answer);
-                panel.cursor = 0;
-                this.#onRender();
-                return;
-            }
-            panel.phase = "safer";
-            panel.saferRun = { options, cursor: 0 };
-            this.#onRender();
+    /* DECLARED MOVE (S5, 2026-09-06): the panel state machine — the
+       fourteen handlers from #panelMove to #panelClose — lives in
+       panel-input.ts (PanelInput); the session picker's in pick-input.ts
+       (PickInput). The editor parses bytes and lends them the composer
+       through #bandHost; nothing else of either band remains here. */
+    /** S5 — the composer as the band controllers see it: the whole
+     *  surface a panel or the session picker may touch, in one place. */
+    #bandHost() {
+        return {
+            line: () => this.line(),
+            expandPastes: (line) => this.#expandPastes(line),
+            clear: () => {
+                this.#chars = [];
+                this.#cursor = 0;
+                this.#scroll = 0;
+                this.#verticalGoalCol = null;
+            },
+            insert: (cp) => this.#insert(cp),
+            newline: () => this.#insert(NEWLINE),
+            stash: () => ({ chars: this.#chars, cursor: this.#cursor, scroll: this.#scroll }),
+            restore: (st) => {
+                this.#chars = [...st.chars];
+                this.#cursor = st.cursor;
+                this.#scroll = st.scroll;
+            },
+            reflow: () => this.#reflow(),
+            render: () => this.#onRender(),
+            syncMouse: () => this.#syncMouse(),
+            closeBands: () => {
+                this.#menuOpen = false;
+                this.#menuSel = 0;
+                this.#queuePopMode = false; // W22: the panel owns the keys while up
+                this.#atClose(); // KC3 §3: and the picker closes with everything else
+            },
+            swallowNextEnter: () => {
+                this.#swallowEnter = true;
+            },
         };
-        if (ask === undefined) {
-            settle(null); // no provider bound — the button says so rather than lying
-            return;
-        }
-        void Promise.resolve()
-            .then(ask)
-            .then(settle)
-            .catch(() => settle(null));
-    }
-    /** Take a row of the SAFER list. The alternatives route through the
-     *  EXISTING amend channel — choosing a safer command is a denial with
-     *  instructions, which is a verdict the product already has; the last
-     *  row is the way back and decides nothing. */
-    #saferConfirm(index) {
-        const panel = this.#panel;
-        if (panel === null || panel.saferRun === null)
-            return;
-        const { options } = panel.saferRun;
-        if (index === options.length) {
-            // "back to the original choices"
-            panel.phase = "options";
-            panel.saferRun = null;
-            panel.cursor = 0;
-            this.#onRender();
-            return;
-        }
-        const chosen = options[index];
-        if (chosen === undefined)
-            return; // past the list — inert
-        this.#panelClose({ action: "deny", reason: `run this instead: ${chosen.command}` });
-    }
-    /** ↑↓ inside the safer list — the way back is its last row, so the
-     *  bar reaches it like any other. */
-    #saferMove(delta) {
-        const panel = this.#panel;
-        if (panel === null || panel.saferRun === null)
-            return;
-        const last = panel.saferRun.options.length; // + the way-back row
-        panel.saferRun = { options: panel.saferRun.options, cursor: Math.max(0, Math.min(last, panel.saferRun.cursor + delta)) };
-        this.#onRender();
-    }
-    /** The typed phase — the one place the panel takes prose. The buffer
-     *  starts empty and the cursor stays where the human left it, so esc
-     *  can put the bar back exactly where it was. */
-    #panelAmend() {
-        const panel = this.#panel;
-        if (panel === null)
-            return;
-        panel.phase = "amend";
-        this.#chars = [];
-        this.#cursor = 0;
-        this.#scroll = 0;
-        this.#verticalGoalCol = null;
-        this.#onRender();
-    }
-    /** tab — the amend alias, unchanged as a GESTURE: it opens the same
-     *  typed phase the last option does, from anywhere in the list. The
-     *  simple flavors never had it and still do not. */
-    #panelTab() {
-        const panel = this.#panel;
-        if (panel === null || panel.view.flavor !== "approval")
-            return;
-        panel.cursor = panelOptions(panel.view).length - 1;
-        this.#panelAmend();
-    }
-    /** esc — back out of the typed phase to the list (the buffer clears,
-     *  the bar stays on the option that opened it), or cancel the panel.
-     *  The old model had a third step, the deselect, because a selection
-     *  could be "none"; a list always has a selection, so esc from the
-     *  list means what it means everywhere else in the product. */
-    #panelEsc() {
-        const panel = this.#panel;
-        if (panel === null)
-            return;
-        // TUI2-R3v2 ③: esc out of the safer list — or out of the ask while
-        // it is still in flight — returns to the original choices, exactly
-        // as the way-back row does. The in-flight answer is orphaned by the
-        // generation token; nothing it does can reopen this list.
-        if (panel.phase === "safer" || panel.phase === "asking") {
-            this.#saferToken += 1;
-            panel.phase = "options";
-            panel.saferRun = null;
-            panel.cursor = 0;
-            this.#onRender();
-            return;
-        }
-        if (panel.phase !== "options") {
-            panel.phase = "options";
-            this.#chars = [];
-            this.#cursor = 0;
-            this.#scroll = 0;
-            this.#verticalGoalCol = null;
-            this.#onRender();
-            return;
-        }
-        this.#panelClose({ action: "cancel" });
-    }
-    /**
-     * enter — send the typed note, or TAKE THE HIGHLIGHTED OPTION.
-     *
-     * The second half is the round. The retired model's enter-at-rest did
-     * nothing at all, on the theory that an accidental return must never
-     * approve; what it actually produced was a panel that ignored the key
-     * every human presses first. The safeguard is real but it belongs on
-     * WHERE THE BAR STARTS, not on whether the key works: the bar opens on
-     * the option whose blast radius is one tool call the human is looking
-     * at, and every irreversible-er choice is a deliberate ↑↓ away.
-     *
-     * An empty note in the typed phase is the bare denial — the W21
-     * mapping, untouched: no words means the run aborts, words mean the
-     * model gets them and proposes a new call.
-     */
-    #panelEnter() {
-        const panel = this.#panel;
-        if (panel === null)
-            return;
-        if (panel.phase === "amend") {
-            this.#panelClose({ action: "deny", reason: this.line() });
-            return;
-        }
-        // TUI2-R3v2 ③: in the safer list, enter takes the highlighted
-        // alternative — the same gesture, one surface over.
-        if (panel.phase === "safer" && panel.saferRun !== null) {
-            this.#saferConfirm(panel.saferRun.cursor);
-            return;
-        }
-        if (panel.phase === "asking")
-            return; // nothing to confirm yet
-        this.#panelConfirm(panel.cursor);
-    }
-    /**
-     * KC3.5 — one ask key: the pure reducer decides, this method applies.
-     * The buffer is cleared on every phase change so the type-your-own
-     * line starts empty and its text never leaks back into the options
-     * (the rule-input phase's own discipline). A step that produced a
-     * RESULT closes the panel with it — the stash/restore is the W21
-     * path, identical for an answer and for a decline.
-     */
-    #askStep(key) {
-        const panel = this.#panel;
-        if (panel === null || panel.ask === null)
-            return;
-        const spec = panel.view.ask;
-        const before = panel.ask.phase;
-        // REL-0152-D8: a typed ask answer is a line leaving the editor too —
-        // pasting a stack trace into "type your own answer" must send the
-        // stack trace, not the capsule that stands for it.
-        const step = key === "commit" ? askCommitCustom(spec, panel.ask, this.#expandPastes(this.line())) : askKey(spec, panel.ask, key);
-        panel.ask = step.state;
-        if (step.state.phase !== before) {
-            this.#chars = [];
-            this.#cursor = 0;
-            this.#scroll = 0;
-        }
-        if (step.result !== undefined) {
-            this.#panelClose({ action: "answers", result: step.result });
-            return;
-        }
-        this.#onRender();
-    }
-    /**
-     * TUI2-R2 ④ — the pick panel's three keys.
-     *
-     * A digit MOVES the cursor rather than committing. The list is short
-     * and the digits are adjacent on the keyboard; a picker that acted on
-     * the keypress would make a mistyped 3 a model switch, and the whole
-     * point of a confirm step is that the choice is visible before it is
-     * taken.
-     */
-    #pickPanelDigit(index) {
-        const panel = this.#panel;
-        if (panel === null || panel.pick === null)
-            return;
-        // a digit past the list is INERT — an option nobody has is never
-        // selected, and the cursor stays where the human left it
-        if (index < 0 || index >= Math.min(panel.view.pick.options.length, PICK_MAX))
-            return;
-        panel.pick = { cursor: index, phase: "options" };
-        this.#onRender();
-    }
-    /** enter — the typed line when there is one (an EMPTY line is not a
-     *  choice and commits nothing), else the option under the cursor. */
-    #pickPanelEnter() {
-        const panel = this.#panel;
-        if (panel === null || panel.pick === null)
-            return;
-        if (panel.pick.phase === "custom") {
-            const line = this.line().trim();
-            if (line === "")
-                return;
-            this.#panelClose({ action: "picked", result: { custom: line } });
-            return;
-        }
-        if (panel.view.pick.options.length === 0)
-            return; // nothing to take
-        this.#panelClose({ action: "picked", result: { index: panel.pick.cursor } });
-    }
-    /** esc — back out of the type-it line first, then cancel the panel.
-     *  Two escapes, two meanings, exactly as the approval panel's
-     *  rule/amend phases already work. */
-    #pickPanelEsc() {
-        const panel = this.#panel;
-        if (panel === null || panel.pick === null)
-            return;
-        if (panel.pick.phase === "custom") {
-            panel.pick = { cursor: panel.pick.cursor, phase: "options" };
-            this.#chars = [];
-            this.#cursor = 0;
-            this.#scroll = 0;
-            this.#onRender();
-            return;
-        }
-        this.#panelClose({ action: "cancel" });
-    }
-    #panelClose(verdict) {
-        const panel = this.#panel;
-        if (panel === null)
-            return;
-        this.#panel = null;
-        this.#syncMouse();
-        // TUI2-R3v2 ①: swallow ONE bare enter after the panel goes away.
-        //
-        // This is the hazard the instant confirm creates and it is not
-        // hypothetical: "y⏎" and "1⏎" are what a decade of y/n prompts
-        // taught everyone's fingers, and the panel used to need both bytes.
-        // It needs one now — so the second one lands in a composer that has
-        // just had the user's PRE-PANEL DRAFT restored into it, and submits
-        // it. Answering an approval would send a half-written message.
-        //
-        // The guard is one-shot and expires on any other key, so it can
-        // never eat an enter the user meant: by the time they have typed
-        // anything at all, it is gone.
-        this.#swallowEnter = true;
-        // the pre-panel buffer returns — the panel's amend text never leaks
-        // into the user's next turn (commit AND cancel).
-        this.#chars = [...panel.stash.chars];
-        this.#cursor = panel.stash.cursor;
-        this.#scroll = panel.stash.scroll;
-        this.#onRender();
-        panel.onCommit(verdict);
     }
     // ---- editing ----
     #insert(cp) {
@@ -2171,21 +1654,127 @@ export class Editor {
         if (!this.#pasting)
             this.#onRender();
     }
-    /** Ctrl+W — the word kill. The newline rides as a non-space code
-     *  point (a kill at a line's start joins it to the one above, the
-     *  readline behavior); A3 scopes A/E/U/K, not W. */
+    /**
+     * E1 §1 — WHERE A WORD ENDS. One function, five operations.
+     *
+     * `#killWord` used to answer this inline, and only for `0x20`: no
+     * tab, no punctuation, and a whole Chinese sentence was one word from
+     * its first character to its last. Five operations asking the
+     * question separately is five chances for a motion and a deletion to
+     * disagree about the same text, so they ask here.
+     *
+     * Three classes over the CODE POINT:
+     *
+     *   - SEPARATOR — whitespace, and the newline the flat buffer carries
+     *     as an ordinary code point;
+     *   - CJK — one character IS one word. A sentence is not a unit
+     *     anyone wants to move or delete by, and the owner types Chinese;
+     *   - otherwise WORD vs PUNCT, which split from each other: `foo.bar`
+     *     is three words, the readline behaviour and every editor's.
+     *
+     * Combining marks, ZWJ joins and variation selectors are NOT their
+     * own class — they belong to whatever precedes them (`#glyphStart`),
+     * so a family emoji deletes whole instead of shedding a member and
+     * stranding a joiner.
+     */
+    #classOf(cp) {
+        // U+3000 IS A SPACE, and it sits inside the CJK range below, so it
+        // has to be named before the range test rather than after it. It
+        // classed as "cjk" in the first build — an ideographic space
+        // deleted as though it were a character, which is exactly what the
+        // CJK-per-character rule is NOT about.
+        if (cp === 0x20 || cp === 0x09 || cp === 0x0a || cp === 0x0d || cp === 0x3000)
+            return "sep";
+        // CJK ideographs, kana, Hangul, the fullwidth forms — one per word.
+        if ((cp >= 0x1100 && cp <= 0x11ff) ||
+            (cp >= 0x2e80 && cp <= 0x9fff) ||
+            (cp >= 0xa960 && cp <= 0xa97f) ||
+            (cp >= 0xac00 && cp <= 0xd7ff) ||
+            (cp >= 0xf900 && cp <= 0xfaff) ||
+            (cp >= 0xff00 && cp <= 0xffef) ||
+            (cp >= 0x20000 && cp <= 0x3ffff)) {
+            return "cjk";
+        }
+        const ch = String.fromCodePoint(cp);
+        if (/[\p{L}\p{N}_]/u.test(ch))
+            return "word";
+        return "punct";
+    }
+    /** True when `i` is a continuation of the glyph before it — a
+     *  combining mark, a ZWJ, or a variation selector. Never a boundary. */
+    #joins(cp) {
+        return ((cp >= 0x0300 && cp <= 0x036f) || // combining diacriticals
+            (cp >= 0x1ab0 && cp <= 0x1aff) ||
+            (cp >= 0x20d0 && cp <= 0x20ff) ||
+            (cp >= 0xfe00 && cp <= 0xfe0f) || // variation selectors
+            cp === 0x200d || // ZWJ
+            (cp >= 0xe0100 && cp <= 0xe01ef));
+    }
+    /** The index one WORD away from `from`, in `dir`. Skips a run of
+     *  separators, then crosses one run of a single class. Joiners never
+     *  end a run, so a grapheme is never split. */
+    #wordEdge(from, dir) {
+        const at = (i) => this.#chars[dir < 0 ? i - 1 : i] ?? -1;
+        let i = from;
+        const end = dir < 0 ? 0 : this.#chars.length;
+        const more = () => (dir < 0 ? i > end : i < end);
+        while (more() && this.#classOf(at(i)) === "sep")
+            i += dir;
+        if (!more())
+            return i;
+        // A JOINER NEVER DECIDES THE RUN'S CLASS. Walking backwards, the
+        // first thing seen at the end of `café` is the combining acute —
+        // which is not a letter, so classifying from it made the run
+        // "punct" and the kill stopped after one mark, leaving `e`.
+        // Joiners belong to the character before them; step over them
+        // first and classify from the base.
+        while (more() && this.#joins(at(i)))
+            i += dir;
+        if (!more())
+            return i;
+        // CJK: exactly one character (plus anything joined to it).
+        const cls = this.#classOf(at(i));
+        if (cls === "cjk") {
+            i += dir;
+            while (more() && this.#joins(at(i)))
+                i += dir;
+            return i;
+        }
+        while (more()) {
+            const c = at(i);
+            if (!this.#joins(c) && this.#classOf(c) !== cls)
+                break;
+            i += dir;
+        }
+        return i;
+    }
+    /** Ctrl+W and alt+backspace — the word kill. A3 scopes A/E/U/K, not
+     *  W. UD-1: an archive point only when something is actually removed;
+     *  a no-op kill at the buffer's start must not eat the next ctrl+z. */
     #killWord() {
-        let i = this.#cursor;
-        while (i > 0 && this.#chars[i - 1] === 0x20)
-            i -= 1; // trailing spaces
-        while (i > 0 && this.#chars[i - 1] !== 0x20)
-            i -= 1; // the word
-        if (i < this.#cursor)
-            this.#checkpoint(); // UD-1
+        const i = this.#wordEdge(this.#cursor, -1);
+        if (i >= this.#cursor)
+            return;
+        this.#checkpoint(); // UD-1
         this.#chars.splice(i, this.#cursor - i);
         this.#cursor = i;
         this.#reflow();
     }
+    /** alt+d — the word kill FORWARD. Same boundary, same archive rule. */
+    #killWordForward() {
+        const j = this.#wordEdge(this.#cursor, 1);
+        if (j <= this.#cursor)
+            return;
+        this.#checkpoint(); // UD-1
+        this.#chars.splice(this.#cursor, j - this.#cursor);
+        this.#reflow();
+    }
+    /** alt+←/→ — the cursor one word over. No archive point: nothing is
+     *  destroyed. */
+    #moveWord(dir) {
+        this.#cursor = this.#wordEdge(this.#cursor, dir);
+        this.#reflow();
+    }
     /** KC1/KC2 — the buffer LEAVES: the flat chars, the cursor, the
      *  horizontal scroll, the ↑/↓ goal, the menu and the pop-walk all
      *  reset together (W22: a departing line ends the pop-walk, so the
@@ -2342,10 +1931,10 @@ export class Editor {
      *  one of those states the two bytes fall through to today's
      *  handling — two gestures, unchanged. */
     #composerIdle() {
-        return (this.#panel === null &&
+        return (!this.#panelInput.up() &&
             !this.#menuOpen &&
             !this.#atUp() && // KC3 §3: the @ picker owns the keys while up, exactly like the menu
-            !this.#pickUp() && // TUI2-R2 ②: and so does the session picker — `?` is a query character there
+            !this.#pickInput.up() && // TUI2-R2 ②: and so does the session picker — `?` is a query character there
             this.#historyIdx === null &&
             !this.#queuePopMode &&
             !this.#pasting &&
@@ -2380,8 +1969,8 @@ export class Editor {
     #submit() {
         // TUI2-R2 ②: the session picker takes Enter before anything else —
         // while it is up there is no turn to submit and no line to send.
-        if (this.#pickUp()) {
-            this.#pickAccept();
+        if (this.#pickInput.up()) {
+            this.#pickInput.accept();
             return;
         }
         // KC3 §3: Enter ACCEPTS while the picker is up — the same rule the
@@ -2485,7 +2074,8 @@ export class Editor {
         // W23: the ONE width authority — leadWidth(lead) — the cap follows
         // the lead the editor itself renders (the panel lead when the panel
         // owns the keys, the brick otherwise): maxW = W − walls − lead.
-        const lead = this.#panel !== null ? panelLead(this.#panel.view, this.#panel.phase, this.#panel.cursor, this.#panel.ask ?? undefined) : PROMPT;
+        const ps = this.#panelInput.state();
+        const lead = ps !== null ? panelLead(ps.view, ps.phase, ps.cursor, ps.ask) : PROMPT;
         const leadW = leadWidth(lead);
         // DC-17: ONE column, not four. W6's box took 2+2 and this kept
         // reserving them after law 1.1 retired it — so the horizontal