proxy/.scratch/tui-redesign/issues/11-accessibility-privacy-render-hardening.md

11 — Harden accessibility, privacy, and rendering

What to build: Verify and finish the redesigned TUI across supported terminal sizes, color modes, hostile text, and process lifecycle so that visual polish does not compromise meaning, privacy, or reliability.

Blocked by: 03 — Stream progressive startup and refresh; 04 — Unify operation coordination and status feedback; 05 — Add contextual Target actions and Drift Resolution; 06 — Add the searchable Active Profile picker; 07 — Build the dedicated Profile management page; 08 — Deliver the mature Profile editor; 09 — Attach Protocol Probe to the Profile field; 10 — Unify Help, dialogs, and navigation.

Status: done

• Fixed-size render coverage includes 120×36, 80×24, and 59×15 across the completed workflows.
• Light, dark, and NO_COLOR renders retain readable state, focus, progress, warnings, disabled actions, and errors.
• Standard Unicode symbols have a safe rendering strategy and no Nerd Font dependency.
• Long Target names, Profile names, evidence, details, URLs, Bypass values, errors, and confirmation copy remain bounded and reachable.
• Secrets injected through valid and malformed Profile fields, evidence, notices, errors, progress, command output, and confirmations never appear in any rendered frame.
• Resize stress preserves valid page, dialog, focus, selection, viewport, in-flight operation, and deferred-exit state.
• Alternate-screen process tests verify normal exit and safe deferred exit restore the prior terminal screen.
• Startup, refresh, Target action, Active Profile switching, management, editor, Probe, Help, and Drift Resolution each have complete-Model behavioral coverage.
• Tests assert semantic behavior rather than private component structure or raw styling calls.
• Existing Application and Adapter suites remain green without duplicating Target configuration tests in the TUI.
• Documentation describes the redesigned keyboard model, responsive size behavior, Profile switching, contextual Target actions, and privacy boundaries.
• Full repository and hermetic verification pass without modifying real Shell, APT, Docker, GNOME, or systemd state.

Answer

Final hardening now exercises every completed workflow through the production Model at all supported size classes, checks semantic equivalence across light, dark, and NO_COLOR, uses cell-width bounds for Unicode content, rejects private-use/Nerd Font glyphs, and preserves complete interaction state through resize stress. Every untrusted ingress is credential-redacted and stripped of terminal controls before semantic styling; the final frame pass only validates controls and does not reparse clipped prose. Long fields, Bypass previews, errors, and arbitrary confirmation copy remain scrollable through resize at nonterminal offsets. Real subprocess tests under a PTY prove alternate-screen restoration after normal exit and after exit is deferred for an already-blocked Target mutation. Unprivileged hermetic verification hashes all readable host paths and compares stable metadata plus explicit markers for protected paths without sudo. README documents the final keyboard, responsive, contextual-action, accessibility, lifecycle, and privacy contracts.