pi-agent: Implement final TUI hardening

.scratch/tui-redesign/issues/11-accessibility-privacy-render-hardening.md

@@ -4,17 +4,21 @@
 
 **Blocked by:** 03 — Stream progressive startup and refresh; 04 — Unify operation coordination and status feedback; 05 — Add contextual Target actions and Drift Resolution; 06 — Add the searchable Active Profile picker; 07 — Build the dedicated Profile management page; 08 — Deliver the mature Profile editor; 09 — Attach Protocol Probe to the Profile field; 10 — Unify Help, dialogs, and navigation.
 
-**Status:** ready-for-agent
+**Status:** done
 
-- [ ] Fixed-size render coverage includes 120×36, 80×24, and 59×15 across the completed workflows.
-- [ ] Light, dark, and `NO_COLOR` renders retain readable state, focus, progress, warnings, disabled actions, and errors.
-- [ ] Standard Unicode symbols have a safe rendering strategy and no Nerd Font dependency.
-- [ ] Long Target names, Profile names, evidence, details, URLs, Bypass values, errors, and confirmation copy remain bounded and reachable.
-- [ ] Secrets injected through valid and malformed Profile fields, evidence, notices, errors, progress, command output, and confirmations never appear in any rendered frame.
-- [ ] Resize stress preserves valid page, dialog, focus, selection, viewport, in-flight operation, and deferred-exit state.
-- [ ] Alternate-screen process tests verify normal exit and safe deferred exit restore the prior terminal screen.
-- [ ] Startup, refresh, Target action, Active Profile switching, management, editor, Probe, Help, and Drift Resolution each have complete-Model behavioral coverage.
-- [ ] Tests assert semantic behavior rather than private component structure or raw styling calls.
-- [ ] Existing Application and Adapter suites remain green without duplicating Target configuration tests in the TUI.
-- [ ] Documentation describes the redesigned keyboard model, responsive size behavior, Profile switching, contextual Target actions, and privacy boundaries.
-- [ ] Full repository and hermetic verification pass without modifying real Shell, APT, Docker, GNOME, or systemd state.
+- [x] Fixed-size render coverage includes 120×36, 80×24, and 59×15 across the completed workflows.
+- [x] Light, dark, and `NO_COLOR` renders retain readable state, focus, progress, warnings, disabled actions, and errors.
+- [x] Standard Unicode symbols have a safe rendering strategy and no Nerd Font dependency.
+- [x] Long Target names, Profile names, evidence, details, URLs, Bypass values, errors, and confirmation copy remain bounded and reachable.
+- [x] Secrets injected through valid and malformed Profile fields, evidence, notices, errors, progress, command output, and confirmations never appear in any rendered frame.
+- [x] Resize stress preserves valid page, dialog, focus, selection, viewport, in-flight operation, and deferred-exit state.
+- [x] Alternate-screen process tests verify normal exit and safe deferred exit restore the prior terminal screen.
+- [x] Startup, refresh, Target action, Active Profile switching, management, editor, Probe, Help, and Drift Resolution each have complete-Model behavioral coverage.
+- [x] Tests assert semantic behavior rather than private component structure or raw styling calls.
+- [x] Existing Application and Adapter suites remain green without duplicating Target configuration tests in the TUI.
+- [x] Documentation describes the redesigned keyboard model, responsive size behavior, Profile switching, contextual Target actions, and privacy boundaries.
+- [x] Full repository and hermetic verification pass without modifying real Shell, APT, Docker, GNOME, or systemd state.
+
+## Answer
+
+Final hardening now exercises every completed workflow through the production Model at all supported size classes, checks semantic equivalence across light, dark, and `NO_COLOR`, uses cell-width bounds for Unicode content, rejects private-use/Nerd Font glyphs, and preserves complete interaction state through resize stress. The final rendering boundary redacts malformed as well as valid credential-bearing text, long Profile names and confirmation copy wrap into reachable viewports, and process tests prove alternate-screen restoration after normal and safely deferred exit. README documents the final keyboard, responsive, contextual-action, accessibility, lifecycle, and privacy contracts.