Overhaul command palette UX

Six-phase sweep: section headers (Focused / Open / Spawn / Quit) with header-skip cursor; chip strip mirroring sw/sp/k macros, driven by Tab; unified Spawn verbs across agent / process / terminal / custom; dropped duplicate global Close list in favor of Ctrl-X inline close on a Switch row plus the [Close] chip; scored matching (prefix > word-boundary > substring > fuzzy) with matched-char highlighting; title bar surfaces focus subject; rename forms split long subject onto its own row; new Alt-1..9 quick-pick, Home/End, ? help overlay, and Ctrl-R relaunch toggle inside the spawn-process form. Scroll indicator and cursor/total counter round out the footer.
Clarify sub-agent reply routing in MCP tool descriptions
2026-05-15 16:41:44 +01:00 · 2026-05-15 16:08:07 +01:00 · 2026-05-15 16:07:58 +01:00
9 changed files with 1397 additions and 381 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,46 @@ loosely follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

 ## [Unreleased]

+### Changed
+- Command palette UX overhaul. The single flat list grew section
+  bands (`── Focused ──`, `── Open ──`, `── Spawn ──`, `── Quit ──`)
+  so the rows are scannable at a glance; cursor navigation skips
+  the dim header rows transparently. A chip strip — `[All] Open
+  Spawn Close` — sits below the query line and tracks the active
+  macro filter; `Tab` / `Shift-Tab` cycle through the chips, and
+  the typed-prefix macros (`sw `, `sp `, `k `) still work and now
+  collapse the whole prefix on a single backspace instead of
+  leaving a stray `sw` behind. The title bar surfaces the current
+  focus subject (`on: <child>` / `pad: <name>`) so the user knows
+  which Focused row is targeting what. The duplicate global Close
+  list is gone — close is reachable via the Focused-section action,
+  the `k ` macro / `[Close]` chip, or the new `Ctrl-X` inline close
+  on a Switch row. The "(current)" marker on the focused Switch row
+  became a leading `▶`. The empty-state hint now reads `no matches
+  · ⌫ to widen` instead of bare `no matches`. The middle divider
+  shows a `▼ N more` / `▲ N above` scroll indicator when the list
+  overflows, and the footer carries a `cursor/total` counter.
+- Spawn verbs are unified on **Spawn**: `Run process: …` →
+  `Spawn process: …`, `New Terminal` → `Spawn terminal`, and the
+  freeform-form row is now `Spawn process… (custom)` so the
+  trailing ellipsis still signals it opens a form.
+- Filtering switched from binary fuzzy-include to scored ranking.
+  Prefix matches beat word-boundary matches beat substring matches
+  beat scattered-fuzzy matches; ties fall back to section order so
+  a Focused-section hit always outranks an equally tight Spawn
+  hit. The matched characters in the rendered label render in
+  accent+bold so the user can see why a row matched.
+- Rename forms split the long subject (`scratchpad:
+  some-really-long-name.md`) onto its own dim row above the input
+  so the title bar no longer truncates with an ellipsis when the
+  subject name is wide.
+- New palette accelerators: `Alt-1` … `Alt-9` quick-pick the Nth
+  visible row, `Home` / `End` jump to first / last selectable row,
+  `?` (with empty query) opens an inline keybinding cheat-sheet
+  which any further keystroke dismisses, and `Ctrl-R` inside the
+  Spawn-process form toggles "Relaunch on exit" without leaving
+  the command field.
+
 ### Fixed
 - Typing into a focused child while its emulator viewport is
  scrolled up into scrollback history now auto-snaps the viewport
@@ -20,6 +60,19 @@ loosely follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
  child agent, even though you were still within that thread.

 ### Changed
+- MCP tool descriptions and `help('coordination')` /
+  `help('readiness')` now spell out that a sub-agent's reply to
+  `send_message` lands in the caller's own pane (tagged
+  `[sub-agent:<name>]`), not in the sub-agent's output. The canonical
+  wait-for-reply pattern — `send_message` → `timer_fire_when_idle_any`
+  on the sub-agent → read your own pane — is now called out on
+  `send_message`, `wait_for_pattern`, both `timer_fire_when_idle_*`,
+  the help topics, and the server-instructions preamble every agent
+  reads at startup. Previously `wait_for_pattern` was the obvious
+  blocking primitive in the catalog, and agents routinely called it
+  against the sub-agent for a reply that had already arrived in their
+  own pane, deadlocking until the wait timed out. No behaviour
+  changes; descriptions only.
 - Agent-initiated `spawn_agent` and `spawn_process` MCP calls no
  longer steal viewport focus from the currently active tab. The
  new child still appears in the sidebar and tab bar; switch to it
--- a/TODO.md
+++ b/TODO.md
@@ -1,6 +1,7 @@
-# Perf Audit (auto-generated 2026-05-15)
-Findings from a codebase sweep — not user-reported, needs review before
-action. Each item names the anchor and a sketched fix.
+# Perf Audit (reviewed 2026-05-15)
+Findings that survived the 2026-05-15 review pass. Low and marginal
+items from the original sweep were removed; remaining items have enough
+measured or workflow evidence to justify action.

 Baseline benchmark numbers (`go test -bench=. ./internal/app/`, AMD
 Ryzen 7 7800X3D, libghostty-vt **ReleaseFast** after the Makefile
@@ -27,145 +28,75 @@ Emulator_Write_Stream_8Color_120fps    257 µs/frame  3890 fps_ceiling
 Emulator_Write_Stream_TrueColor_120fps 488 µs/frame  2051 fps_ceiling
 ```

-Result of the fix below: 27-32× pipeline speedup, 60× emulator
-speedup. Pipeline hits 930-2030 fps end-to-end — 7-16× headroom
-over the 120 fps target on the heaviest workload (truecolor
-full-screen redraws).
+The current pipeline still has large 120 fps headroom. The remaining
+renderer concern is multi-MiB styled replay latency and allocation
+churn, not normal steady-state frame budget.


- [ ] **viewport renderer allocates ~1 alloc per 4 input bytes on SGR/CSI-heavy chunks.** [MEDIUM]
-  - `internal/app/viewport_renderer.go` — the styled-lines and
-    ratatui benchmarks show 4-17k allocs per chunk. The hot
-    contributors are likely (a) `string(vr.buf)` / `string(params)`
-    conversions in `emitCSI` for every escape sequence, (b) the
-    `pending strings.Builder` resizing as fragments arrive, and (c)
-    `vr.shifter.Shift(vr.buf)` returning a fresh slice per CSI.
-  - Fix direction: switch CSI param parsing to byte-slice
-    comparison (no string conversion); reuse `vr.buf` and
-    `vr.pending` backing arrays across `Render` calls by
-    pre-growing in `newViewportRenderer`; have `cursorShifter.Shift`
-    return into a caller-owned buffer instead of allocating.
-    Profile-guided: run the styled-lines bench, point pprof at the
-    allocs profile, fix the top three call sites.
+- [ ] **viewport renderer allocates heavily on SGR/CSI-heavy chunks.** [MEDIUM]
+  - Review evidence: five benchmark reps confirmed
+    `ViewportRenderer_StyledLines` at about 4,325 allocs per 16 KiB
+    chunk (~91.5 KB/op, roughly 1 alloc per 3.8 input bytes), and
+    `ViewportRenderer_RatatuiBurst` at about 17,306 allocs per chunk
+    (~365 KB/op). A 5 MiB styled resume benchmark allocated about
+    31 MB across 1.38M objects.
+  - Likely hot paths: generic CSI/SGR output in
+    `internal/app/viewport_renderer.go` sends many sequences through
+    `vr.shifter.Shift(vr.buf)`, while `internal/app/cursorshift.go`
+    returns a fresh `[]byte` via `pending.String()` on every
+    `Shift` call and parses CSI params through `string(raw)` /
+    `strings.Split`. The mode-helper `string(params)` conversions
+    are real, but probably not the main SGR-heavy cost.
+  - Fix direction: make `cursorShifter` write into caller-owned
+    scratch output or directly into the viewport renderer's pending
+    builder; parse CSI params from byte slices; pre-grow/reuse
+    renderer and shifter buffers. Re-run styled-lines, ratatui, and
+    5 MiB resume benchmarks; use pprof when available to confirm the
+    top allocation sites.

- [ ] **viewport renderer throughput (~90 MB/s styled) limits codex steady-state.** [MEDIUM]
-  - The styled-lines and ratatui benchmarks come in at 89 MB/s and
-    40 MB/s respectively. A 100 KB/s codex burst is far under that
-    limit, but a session-resume dump of a 5 MiB chat history takes
-    50-130 ms of pure renderer time at those rates — enough to be
-    user-visible at the start of a long resume.
-  - Fix direction: same as the alloc fix above; once the per-call
-    allocation cost drops, the throughput ceiling rises with it.
-    Worth re-running the benches after fixing the allocs and only
-    investing further if the styled-lines bench is still under
-    ~300 MB/s.
+- [ ] **large styled resume/replay dumps spend visible time in viewport rendering.** [MEDIUM]
+  - Review evidence: `BenchmarkSessionResume_5MiBStyled` measured
+    about 58 ms median and 63 ms p95 over five reps. The plain 5 MiB
+    benchmark was about 23-24 ms with only 21 allocs. The live path
+    renders focused PTY chunks through `renderer.Render`, then still
+    pays emulator writes, ring writes, event dispatch, stdout writes,
+    and real terminal paint.
+  - Scope: this is not a Codex steady-state throughput limit. A
+    100 KB/s stream is far below the styled renderer's ~80-90 MB/s
+    ceiling. It matters for multi-MiB burst replay, resume/startup
+    dumps, and dense full-screen churn.
+  - Fix direction: do the allocation fix first, since it should also
+    improve throughput. After that, invest further only if styled
+    resume traces remain user-visible or the styled-lines benchmark
+    is still under roughly 300 MB/s.

- [ ] **Session.Children() allocates a fresh slice on every call.** [MEDIUM]
-  - `internal/app/session.go:530-541` walks `s.order` under `s.mu` and
-    builds a new `[]*Child` slice every time. Callers on hot paths:
-    `drawSidebar` calls it twice per frame
-    (`internal/app/sidebar.go:139` and `:171`); `drawTabBar` calls it
-    once per frame (`internal/app/tabbar.go:37`); the classifier
-    iterates it every 250 ms (`internal/app/classifier.go:38`); and
-    palette/navigation hit it on every Ctrl-A/D/W/S keystroke.
-  - Fix direction: store the snapshot in an `atomic.Pointer[[]*Child]`
-    on `Session`, refresh it under `s.mu` only when `Spawn` / `delete`
-    mutates the map. Readers get O(1) `Load()` with zero allocation —
-    same pattern already used for `listeners` (session.go:118-123).
+- [ ] **wait_for_pattern re-scans the entire stream/grid while waiting.** [MEDIUM]
+  - `internal/app/host.go:476-493` (the `check` closure). On
+    `scope="scrollback"` it calls `c.StreamRead(0)` followed by
+    `stripANSIBytes(nil, b)`, so each check can copy, strip, and
+    search the full 1 MiB ring. On `scope="grid"` it calls
+    `PlainText()` and runs the regex against the full grid string.
+  - Caveat from review: the current chunk notifier coalesces bursts
+    with a buffered channel and has a 500 ms fallback, so this is not
+    necessarily one full scan per PTY chunk. It is still meaningful
+    for active waits on chatty panes.
+  - Fix direction: for `scrollback`, track the last checked stream
+    offset and search only new output plus a bounded overlap/scratch
+    buffer so matches spanning chunks are not missed. For `grid`,
+    dedupe on `ScreenVersion()` and skip work when the version has
+    not changed.

- [ ] **wait_for_pattern re-scans the entire stream/grid every iteration.** [MEDIUM]
-  - `internal/app/host.go:476-493` (the `check` closure). On `scope =
-    "scrollback"` it calls `c.StreamRead(0)` followed by
-    `stripANSIBytes(nil, b)` over the entire ring on every wake — a
-    full O(ring size) walk per chunk arrival. On `grid` it goes
-    through PlainText (one CGO call) plus a regex match against the
-    full grid string. For an agent waiting on a marker in a chatty
-    pane, every PTY chunk fires `check()`.
-  - Fix direction: for `scrollback`, track the offset of the last
-    check and run the regex only over the new tail, reusing a
-    per-call scratch buffer for ANSI stripping. For `grid`, dedupe
-    on `ScreenVersion()` — skip when version hasn't changed.
-
- [ ] **search_output compiles regex + strips ANSI on every call.** [MEDIUM]
-  - `internal/app/host.go:428` compiles a fresh `regexp.Regexp` per
-    invocation; `:434` strips ANSI over the entire ring buffer when
-    `kind="rendered"`. Agents that poll `search_output` with the same
-    pattern (the typical "watch for marker" loop) repay both costs on
-    every call.
-  - Fix direction: small LRU of compiled regexes keyed by pattern
-    string (cap maybe 32) on `toolHost`. Cache the stripped-ANSI
-    buffer keyed by `c.ScreenVersion()` so consecutive searches over
-    an unchanged ring reuse the strip.
-
- [ ] **GetProcessOutput grid mode acquires the emulator twice.** [MEDIUM]
-  - `internal/app/host.go:375-391` does `em := c.Emulator()` for
-    ActiveScreen / Cursor / Size, then at line 387 re-fetches
-    `em := c.Emulator()` for PlainText. Each `Emulator()` call goes
-    through `ptyMu` and inspects the live PTY pointer. Under a
-    chatty agent polling `get_process_output` every 100 ms this is
-    a redundant lock and pointer chase per call.
-  - Fix direction: hold the emulator reference from the first
-    lookup; reuse it for PlainText. The check `if em == nil` still
-    runs cleanly because the variable is captured.
-
- [ ] **FindChildByIdentity is O(N) under the session lock.** [LOW]
-  - `internal/app/session.go:553-565` scans the children map looking
-    for a matching `Identity` token on every new mcp-stdio
-    connection. Not a steady-state hot path — only fires once per
-    child spawn — but with many short-lived sub-agents it adds up
-    and contends with everyone else taking `s.mu`.
-  - Fix direction: maintain an `identityIndex map[string]string`
-    (identity → child id) updated alongside spawn / exit, give the
-    lookup an O(1) read.
-
- [ ] **Per-promoter regex matches in the idle classifier.** [LOW]
-  - `internal/app/idle.go:175-182` (`matchAny`) walks each compiled
-    pattern and runs the DFA over the same 4 KiB tail. A preset with
-    five permission patterns + five error patterns is ten DFA
-    invocations per child per 250 ms tick.
-  - Fix direction: at preset load time, compile each `_patterns`
-    list into a single alternation regex (`(?:p1)|(?:p2)|…`). The
-    classifier then makes one Match call per category per tick.
-
- [ ] **Port-detection dedup is O(N²) over c.ports.** [LOW]
-  - `internal/app/child.go:461-467`: for each fresh URL match the
-    code linearly scans the existing port list. The list rarely
-    grows past a handful, but a dev server that lists "all open
-    ports" in one log line interacts badly: M new matches × N
-    existing entries.
-  - Fix direction: keep a `seenPorts map[int]struct{}` next to
-    `c.ports`, rebuilt on prune (none today). O(1) per match.
-
- [ ] **Port-sighting string allocations happen before the dedup check.** [LOW]
-  - `internal/app/child.go:455-456` allocates `urlForm` and `portStr`
-    before line 461's `seen` walk. Both strings are wasted when the
-    port is already in `c.ports`. Inside `c.portsMu` for the whole
-    loop body too, blocking the `Ports()` reader path.
-  - Fix direction: bind the port int first (cheap parse from
-    `m[1]`), do the seen check, only then allocate the URL string
-    for the surviving sighting.
-
- [ ] **classifier `time.Now()` syscall per child per tick.** [LOW]
-  - `internal/app/classifier.go:54` (and the `IdleMS` /
-    `TitleIdleMS` helpers it transitively calls in
-    `internal/app/child.go:343-374`) each call `time.Now()`.
-    Reading time on Linux is fast (vDSO) but with N children × 4
-    `time.Now()` per tick × 4 ticks/sec it's wasted work that can
-    be batched.
-  - Fix direction: capture `now := time.Now().UnixNano()` once at
-    the top of `classifyAll` and thread it into `classifyOne` and
-    the helpers as a parameter.
-
- [ ] **wait_for_pattern subscribes a listener for every call.** [LOW]
-  - `internal/app/host.go:472-474`: each invocation calls
-    `Session.Subscribe(wake)` which clones the listener slice and
-    swaps the atomic pointer; the `defer Unsubscribe` does the same
-    on exit. Two allocations per `wait_for_pattern`. The agent
-    pattern of looping on `wait_for_pattern` after every tool call
-    pays this churn on the steady-state path.
-  - Fix direction: a per-child `chunkBroadcaster` registered once
-    at child spawn that hands out lightweight subscriber tokens,
-    rather than going through the full session listener machinery.
+- [ ] **search_output rebuilds and searches whole scrollback on every call.** [MEDIUM]
+  - `internal/app/host.go:428-437` compiles a fresh regex, reads the
+    stream from offset 0, strips ANSI for `kind="rendered"`, converts
+    the full buffer to a string, and splits it into lines before
+    applying `limit`. This is meaningful when agents poll the same
+    pattern; it is low impact for ad hoc searches.
+  - Fix direction: cache compiled regexes by pattern; cache stripped
+    rendered output by child id and stream end offset; avoid
+    `strings.Split` over the whole ring when only the first `limit`
+    matches are needed. Prefer an incremental search shape if this
+    becomes the standard "watch for marker" path.

 # On Hold
 - [ ] There's a unicode <?> being displayed in opencode [ON HOLD]
--- a/internal/app/host.go
+++ b/internal/app/host.go
@@ -1134,9 +1134,10 @@ func helpFor(topic string) mcp.HelpResponse {
 		}
 	case "coordination":
 		return mcp.HelpResponse{
-			Topic:        "coordination",
-			Content:      "send_message tags the message with the caller's role (parent → [orchestrator], child → [sub-agent:<name>]). Siblings must route through their parent. request_human_attention raises a UI notification when you can't safely decide.",
-			RelatedTools: []string{"send_message", "request_human_attention"},
+			Topic: "coordination",
+			Content: "send_message tags the message with the caller's role (parent → [orchestrator], child → [sub-agent:<name>]). Siblings must route through their parent. request_human_attention raises a UI notification when you can't safely decide.\n\n" +
+				"Reply routing: a sub-agent's reply to your send_message lands in YOUR pane tagged `[sub-agent:<name>]`, not in the sub-agent's output. Anti-pattern: `wait_for_pattern(sub_agent, …)` to wait for a reply — the sub-agent is already idle, its output won't change, and the call spins to timeout. Pattern: send_message → timer_fire_when_idle_any([sub_agent_id], body=\"[system] sub-agent finished\") → when the timer fires, the reply is already queued as your next user turn (or visible via get_process_output on your own pane).",
+			RelatedTools: []string{"send_message", "request_human_attention", "timer_fire_when_idle_any", "timer_fire_when_idle_all"},
 		}
 	case "scratchpads":
 		return mcp.HelpResponse{
@@ -1161,9 +1162,14 @@ func helpFor(topic string) mcp.HelpResponse {
 		}
 	case "readiness":
 		return mcp.HelpResponse{
-			Topic:        "readiness",
-			Content:      "A pane is 'idle' once nothing has been written to its PTY for ~1s (SPEC §11). Treat idle as a signal to read, not a guarantee of completion. wait_for_pattern lets you wait on a known terminal marker for stronger evidence.",
-			RelatedTools: []string{"wait_for_pattern", "get_process_status"},
+			Topic: "readiness",
+			Content: "A pane is 'idle' once nothing has been written to its PTY for ~1s (SPEC §11). Treat idle as a signal to read, not a guarantee of completion.\n\n" +
+				"Waiting for a sub-agent's reply (canonical pattern):\n" +
+				"  1. send_message(sub_agent_id, request)\n" +
+				"  2. timer_fire_when_idle_any(watched=[sub_agent_id], body=\"[system] sub-agent done\")\n" +
+				"  3. When the timer fires you re-enter as a fresh user turn; the sub-agent's reply is already in your own pane tagged `[sub-agent:<name>]` (read via get_process_output on yourself if you need it explicitly).\n\n" +
+				"wait_for_pattern is for waiting on text a process emits in its OWN output (a shell prompt, a build's \"tests passed\" line). It does NOT see send_message replies, because those land in the caller's pane, not the target's — calling wait_for_pattern on a sub-agent to wait for its reply deadlocks until timeout.",
+			RelatedTools: []string{"wait_for_pattern", "get_process_status", "timer_fire_when_idle_any", "send_message"},
 		}
 	case "permissions":
 		return mcp.HelpResponse{
--- a/internal/app/palette.go
+++ b/internal/app/palette.go
--- a/internal/app/palette_context_test.go
+++ b/internal/app/palette_context_test.go
@@ -31,8 +31,10 @@ func findItem(p *paletteState, want string) (int, *paletteItem) {

 func TestContextItemsScratchpad(t *testing.T) {
 	p := newPalette(nil, "", "notes.md", preset.Set{})
-	if i, _ := findItem(p, "pad-delete"); i != 0 {
-		t.Fatalf("pad-delete at %d; want top", i)
+	// pad-delete is the first selectable row; the Focused section header
+	// (a non-selectable row) sits above it.
+	if i, _ := findItem(p, "pad-delete"); i != 1 {
+		t.Fatalf("pad-delete at %d; want 1 (after Focused header)", i)
 	}
 	if _, it := findItem(p, "pad-rename-form"); it == nil || it.action.padName != "notes.md" {
 		t.Fatalf("pad-rename-form missing or wrong padName: %+v", it)
--- a/internal/app/palette_input_test.go
+++ b/internal/app/palette_input_test.go
@@ -47,36 +47,50 @@ func TestPaletteBareEscCancels(t *testing.T) {
 	}
 }

+// firstSelectable returns the lowest item index whose action is
+// selectable (not a section header), or -1 if the palette has no
+// selectable rows.
+func firstSelectable(p *paletteState) int {
+	for i, it := range p.items {
+		if it.action.kind != "header" {
+			return i
+		}
+	}
+	return -1
+}
+
 func TestPaletteKittyArrowsNavigate(t *testing.T) {
 	pr := []*preset.Preset{{Name: "a"}, {Name: "b"}, {Name: "c"}}
 	p := newPalette(nil, "", "", preset.Set{Agents: pr})
-	if p.cursor != 0 {
-		t.Fatalf("initial cursor %d", p.cursor)
+	first := firstSelectable(p)
+	if first < 0 || p.cursor != first {
+		t.Fatalf("initial cursor %d, want first selectable %d", p.cursor, first)
 	}
 	// Kitty functional Down arrow.
 	_, _, adv := p.handleInput([]byte("\x1b[57353u"), 0)
 	if adv != 8 {
 		t.Fatalf("advance %d", adv)
 	}
-	if p.cursor != 1 {
-		t.Fatalf("cursor %d after Down, want 1", p.cursor)
+	if p.cursor != first+1 {
+		t.Fatalf("cursor %d after Down, want %d", p.cursor, first+1)
 	}
 	// Kitty functional Up arrow.
 	_, _, _ = p.handleInput([]byte("\x1b[57352u"), 0)
-	if p.cursor != 0 {
-		t.Fatalf("cursor %d after Up, want 0", p.cursor)
+	if p.cursor != first {
+		t.Fatalf("cursor %d after Up, want %d", p.cursor, first)
 	}
 }

 func TestPaletteLegacyArrowsStillWork(t *testing.T) {
 	pr := []*preset.Preset{{Name: "a"}, {Name: "b"}}
 	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	first := firstSelectable(p)
 	_, _, adv := p.handleInput([]byte("\x1b[B"), 0)
 	if adv != 3 {
 		t.Fatalf("advance %d", adv)
 	}
-	if p.cursor != 1 {
-		t.Fatalf("cursor %d, want 1", p.cursor)
+	if p.cursor != first+1 {
+		t.Fatalf("cursor %d, want %d", p.cursor, first+1)
 	}
 }

--- a/internal/app/palette_ux_test.go
+++ b/internal/app/palette_ux_test.go
@@ -0,0 +1,359 @@
+package app
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/hjbdev/patterm/internal/preset"
+)
+
+// -- Phase 1: naming & dropped global Close list ---------------------
+
+func TestPaletteVerbsAreUnified(t *testing.T) {
+	procs := []*preset.Preset{{Name: "dev"}}
+	agents := []*preset.Preset{{Name: "claude"}}
+	p := newPalette(nil, "", "", preset.Set{Agents: agents, Processes: procs})
+	gotLabels := make([]string, 0, len(p.items))
+	for _, it := range p.items {
+		if it.action.kind == "header" {
+			continue
+		}
+		gotLabels = append(gotLabels, it.label)
+	}
+	joined := strings.Join(gotLabels, "\n")
+
+	mustContain := []string{
+		"Spawn agent: claude",
+		"Spawn process: dev",
+		"Spawn terminal",
+		"Spawn process… (custom)",
+	}
+	for _, want := range mustContain {
+		if !strings.Contains(joined, want) {
+			t.Errorf("missing unified-verb label %q in:\n%s", want, joined)
+		}
+	}
+	// The pre-overhaul verb forms must not appear anywhere.
+	mustNotContain := []string{"Run process:", "New Terminal", "Spawn process… (custom)"}
+	for _, bad := range mustNotContain {
+		if strings.Contains(joined, bad) {
+			t.Errorf("leftover legacy verb %q present in:\n%s", bad, joined)
+		}
+	}
+}
+
+func TestPaletteDropsGlobalCloseList(t *testing.T) {
+	c1 := makeFakeChild("a", "claude", KindAgent)
+	c2 := makeFakeChild("b", "dev", KindCommand)
+	p := newPalette([]*Child{c1, c2}, "", "", preset.Set{})
+	// No focus → no Focused context, so no "kill" / "agent-close" /
+	// "proc-stop" rows should exist at all.
+	for _, kind := range []string{"kill", "agent-close", "proc-stop", "proc-delete"} {
+		if i, _ := findItem(p, kind); i != -1 {
+			t.Fatalf("kind %q present at %d; global Close list should be gone", kind, i)
+		}
+	}
+}
+
+// -- Phase 2: section headers and cursor skip ------------------------
+
+func TestPaletteSectionHeadersPresent(t *testing.T) {
+	c := makeFakeChild("a", "claude", KindAgent)
+	p := newPalette([]*Child{c}, "a", "", preset.Set{Agents: []*preset.Preset{{Name: "codex"}}})
+	wantSections := []string{"Focused", "Open", "Spawn", "Quit"}
+	for _, w := range wantSections {
+		found := false
+		for _, it := range p.items {
+			if it.action.kind == "header" && strings.Contains(it.label, w) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("section header %q missing from items", w)
+		}
+	}
+}
+
+func TestPaletteCursorSkipsHeaders(t *testing.T) {
+	pr := []*preset.Preset{{Name: "a"}, {Name: "b"}}
+	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	// Initial cursor must land on a selectable row, never a header.
+	if p.items[p.cursor].action.kind == "header" {
+		t.Fatalf("initial cursor sits on a header: %+v", p.items[p.cursor])
+	}
+	// Walk to the end with cursorDown; every stop must be selectable.
+	for i := 0; i < len(p.items)*2; i++ {
+		p.cursorDown()
+		if p.items[p.cursor].action.kind == "header" {
+			t.Fatalf("cursorDown landed on a header at index %d", p.cursor)
+		}
+	}
+	// Walk back to top.
+	for i := 0; i < len(p.items)*2; i++ {
+		p.cursorUp()
+		if p.items[p.cursor].action.kind == "header" {
+			t.Fatalf("cursorUp landed on a header at index %d", p.cursor)
+		}
+	}
+}
+
+func TestPaletteEnterOnHeaderIsNoOp(t *testing.T) {
+	pr := []*preset.Preset{{Name: "a"}}
+	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	// Force the cursor onto a header.
+	for i, it := range p.items {
+		if it.action.kind == "header" {
+			p.cursor = i
+			break
+		}
+	}
+	_, done, _ := p.handleInput([]byte("\r"), 0)
+	if done {
+		t.Fatalf("Enter on header closed palette; expected no-op")
+	}
+}
+
+// -- Phase 3: filter chips & macro coexistence -----------------------
+
+func TestPaletteTabCyclesChip(t *testing.T) {
+	p := newTestPalette()
+	// All → Open
+	_, _, _ = p.handleInput([]byte{'\t'}, 0)
+	if string(p.query) != "sw " {
+		t.Fatalf("Tab #1: query %q, want %q", string(p.query), "sw ")
+	}
+	// Open → Spawn
+	_, _, _ = p.handleInput([]byte{'\t'}, 0)
+	if string(p.query) != "sp " {
+		t.Fatalf("Tab #2: query %q, want %q", string(p.query), "sp ")
+	}
+	// Spawn → Close
+	_, _, _ = p.handleInput([]byte{'\t'}, 0)
+	if string(p.query) != "k " {
+		t.Fatalf("Tab #3: query %q, want %q", string(p.query), "k ")
+	}
+	// Close → All (wraps)
+	_, _, _ = p.handleInput([]byte{'\t'}, 0)
+	if string(p.query) != "" {
+		t.Fatalf("Tab #4 wrap: query %q, want empty", string(p.query))
+	}
+}
+
+func TestPaletteShiftTabCyclesBackwards(t *testing.T) {
+	p := newTestPalette()
+	// Shift-Tab via legacy CSI Z: All → Close
+	_, _, _ = p.handleInput([]byte("\x1b[Z"), 0)
+	if string(p.query) != "k " {
+		t.Fatalf("Shift-Tab: query %q, want %q", string(p.query), "k ")
+	}
+}
+
+func TestPaletteBackspaceThroughTrailingMacro(t *testing.T) {
+	p := newTestPalette()
+	p.query = []rune("sw ")
+	p.rebuild()
+	p.backspace()
+	if string(p.query) != "" {
+		t.Fatalf("backspace through 'sw ' left %q; want empty", string(p.query))
+	}
+}
+
+func TestPaletteMacroPreservesQueryCase(t *testing.T) {
+	// Tab cycling shouldn't downcase the user-typed search text.
+	p := newTestPalette()
+	p.query = []rune("Foo")
+	p.rebuild()
+	_, _, _ = p.handleInput([]byte{'\t'}, 0)
+	if string(p.query) != "sw Foo" {
+		t.Fatalf("query after Tab over 'Foo' = %q; want 'sw Foo'", string(p.query))
+	}
+}
+
+// -- Phase 4: scored matching ----------------------------------------
+
+func TestFuzzyScorePrefixBeatsBoundaryBeatsSubstring(t *testing.T) {
+	prefix, _ := fuzzyScore("spawn agent: foo", "", "spa")
+	boundary, _ := fuzzyScore("hello spam", "", "spa")
+	substring, _ := fuzzyScore("escapade", "", "spa")
+	if !(prefix > boundary && boundary > substring) {
+		t.Fatalf("score ordering wrong: prefix=%d boundary=%d substring=%d", prefix, boundary, substring)
+	}
+}
+
+func TestFuzzyScoreReturnsMatchPositions(t *testing.T) {
+	_, pos := fuzzyScore("spawn process: dev", "", "dev")
+	want := []int{15, 16, 17}
+	if len(pos) != len(want) {
+		t.Fatalf("positions = %v, want %v", pos, want)
+	}
+	for i, p := range pos {
+		if p != want[i] {
+			t.Fatalf("pos[%d] = %d, want %d (full %v)", i, p, want[i], pos)
+		}
+	}
+}
+
+func TestPaletteScoredResultsDropHeaders(t *testing.T) {
+	pr := []*preset.Preset{{Name: "claude"}, {Name: "codex"}}
+	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	// Type a needle that matches both.
+	p.query = []rune("c")
+	p.rebuild()
+	for _, it := range p.items {
+		if it.action.kind == "header" {
+			t.Fatalf("scored mode should not emit header rows; got %+v", it)
+		}
+	}
+}
+
+func TestPaletteScoringFloatsPrefixMatchToTop(t *testing.T) {
+	// "x" is a prefix of "xtest" preset; it's a scattered-fuzzy match
+	// against many other rows. Scoring should land the prefix match at
+	// the top regardless of group order.
+	pr := []*preset.Preset{
+		{Name: "alpha"},
+		{Name: "xtest"},
+		{Name: "beta"},
+	}
+	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	p.query = []rune("xt")
+	p.rebuild()
+	if len(p.items) == 0 {
+		t.Fatalf("no scored items for needle 'xt'")
+	}
+	if !strings.Contains(p.items[0].label, "xtest") {
+		t.Fatalf("expected xtest at top of scored list, got %q", p.items[0].label)
+	}
+}
+
+// -- Phase 5: power-user accelerators --------------------------------
+
+func TestPaletteCtrlXOnSwitchKills(t *testing.T) {
+	c := makeFakeChild("a", "claude", KindAgent)
+	p := newPalette([]*Child{c}, "", "", preset.Set{})
+	// Cursor should already be on the switch row (it's the first
+	// selectable item with no Focused section).
+	idx, _ := findItem(p, "switch")
+	if idx < 0 {
+		t.Fatalf("no switch item in palette")
+	}
+	p.cursor = idx
+	action, done, _ := p.handleInput([]byte{0x18}, 0)
+	if !done {
+		t.Fatalf("Ctrl-X on switch row didn't close palette: action=%+v", action)
+	}
+	if action.kind != "kill" || action.childID != "a" {
+		t.Fatalf("Ctrl-X action = %+v, want kill of 'a'", action)
+	}
+}
+
+func TestPaletteCtrlXOnNonSwitchIsNoOp(t *testing.T) {
+	p := newPalette(nil, "", "", preset.Set{})
+	// Cursor parks on Quit or Spawn entries — neither is a switch row.
+	_, done, _ := p.handleInput([]byte{0x18}, 0)
+	if done {
+		t.Fatalf("Ctrl-X on non-switch closed palette")
+	}
+}
+
+func TestPaletteHelpToggle(t *testing.T) {
+	p := newTestPalette()
+	// `?` with empty query opens help.
+	_, done, _ := p.handleInput([]byte("?"), 0)
+	if done {
+		t.Fatalf("? closed palette")
+	}
+	if !p.showHelp {
+		t.Fatalf("? didn't open help")
+	}
+	// Next keystroke dismisses.
+	_, _, _ = p.handleInput([]byte("a"), 0)
+	if p.showHelp {
+		t.Fatalf("help still showing after dismissing keystroke")
+	}
+}
+
+func TestPaletteHelpDoesNotInterceptInQuery(t *testing.T) {
+	p := newTestPalette()
+	p.query = []rune("dev")
+	p.rebuild()
+	_, _, _ = p.handleInput([]byte("?"), 0)
+	if p.showHelp {
+		t.Fatalf("? with non-empty query incorrectly opened help")
+	}
+	if string(p.query) != "dev?" {
+		t.Fatalf("? with non-empty query failed to append: %q", string(p.query))
+	}
+}
+
+func TestPaletteHomeEndJumpsOverHeaders(t *testing.T) {
+	pr := []*preset.Preset{{Name: "a"}, {Name: "b"}}
+	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	// End jumps to last selectable.
+	p.cursorEnd()
+	if p.items[p.cursor].action.kind == "header" {
+		t.Fatalf("End landed on header: %+v", p.items[p.cursor])
+	}
+	if p.items[p.cursor].action.kind != "quit" {
+		t.Fatalf("End on simple palette should park on Quit; got %+v", p.items[p.cursor])
+	}
+	// Home returns to first selectable.
+	p.cursorHome()
+	if p.items[p.cursor].action.kind == "header" {
+		t.Fatalf("Home landed on header: %+v", p.items[p.cursor])
+	}
+}
+
+func TestPaletteAltDigitQuickPick(t *testing.T) {
+	pr := []*preset.Preset{{Name: "first"}, {Name: "second"}}
+	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	// Alt-1 picks the first selectable item (Spawn agent: first).
+	action, done, adv := p.handleInput([]byte("\x1b1"), 0)
+	if adv != 2 {
+		t.Fatalf("Alt-1 advance %d, want 2", adv)
+	}
+	if !done {
+		t.Fatalf("Alt-1 didn't close palette")
+	}
+	if action.kind != "spawn-agent" || action.preset == nil || action.preset.Name != "first" {
+		t.Fatalf("Alt-1 action = %+v, want spawn-agent first", action)
+	}
+}
+
+func TestPaletteFormCtrlRTogglesRelaunchFromCommandField(t *testing.T) {
+	p := newPalette(nil, "", "", preset.Set{})
+	p.mode = paletteModeSpawnForm
+	p.form = &spawnProcessForm{}
+	// Type without leaving the command field, then Ctrl-R.
+	for _, b := range []byte("xyz") {
+		_, _, _ = p.handleInput([]byte{b}, 0)
+	}
+	if p.form.field != 0 {
+		t.Fatalf("field jumped to %d", p.form.field)
+	}
+	_, _, _ = p.handleInput([]byte{0x12}, 0)
+	if !p.form.relaunch {
+		t.Fatalf("Ctrl-R didn't toggle relaunch from command field")
+	}
+	// Second press toggles back.
+	_, _, _ = p.handleInput([]byte{0x12}, 0)
+	if p.form.relaunch {
+		t.Fatalf("second Ctrl-R didn't toggle off")
+	}
+}
+
+// -- Phase 6: counter / scroll indicator -----------------------------
+
+func TestPaletteFooterCounter(t *testing.T) {
+	pr := []*preset.Preset{{Name: "a"}, {Name: "b"}, {Name: "c"}}
+	p := newPalette(nil, "", "", preset.Set{Agents: pr})
+	total := p.visibleSelectableCount()
+	if total < 4 { // 3 spawn-agents + terminal + custom + quit
+		t.Fatalf("expected ≥4 selectables; got %d", total)
+	}
+	idx := p.selectableIndex()
+	if idx <= 0 {
+		t.Fatalf("selectable index = %d on freshly-built palette; want ≥1", idx)
+	}
+}
--- a/internal/harness/scenarios/rename_process_via_palette.json
+++ b/internal/harness/scenarios/rename_process_via_palette.json
@@ -16,7 +16,7 @@
    { "type": "send_chord", "chord": "ctrl-k" },
    { "type": "send_text", "text": "Rename process" },
    { "type": "send_chord", "chord": "enter" },
-    { "type": "wait_text", "contains": "Rename process", "timeout_ms": 3000 },
+    { "type": "wait_text", "contains": "process: original", "timeout_ms": 3000 },
    { "type": "send_chord", "chord": "ctrl-u" },
    { "type": "send_text", "text": "renamed-pane" },
    { "type": "send_chord", "chord": "enter" },
--- a/internal/mcp/protocol.go
+++ b/internal/mcp/protocol.go
@@ -43,7 +43,7 @@ var serverInfo = map[string]any{
 //     up as sub-agents and won't be tied into the patterm lifecycle.
 //
 // Keep this short — clients vary in how much they surface to the LLM.
-const serverInstructions = "You are already running INSIDE patterm; the `patterm` MCP server is connected over the same stdio MCP transport you use for any other MCP server. Use the MCP tools you see in tools/list — do NOT (a) try to launch `patterm` or `patterm mcp-stdio` yourself, (b) poke the Unix socket through perl / nc / socat / curl, or (c) shell out to `claude` / `codex` / `opencode` to start a peer. Any of those bypasses caller-identity and the new agent will land as a stray top-level tab instead of a child under you. Start with `whoami` for your role and the full tool list, then `help('topics')` for orientation. `spawn_agent` is the only correct way to start a sub-agent; `spawn_process` is for non-LLM commands; `list_processes` / `get_process_output` inspect them; `send_input` / `send_message` drive them. Whatever you spawn is yours to `close_process` when done."
+const serverInstructions = "You are already running INSIDE patterm; the `patterm` MCP server is connected over the same stdio MCP transport you use for any other MCP server. Use the MCP tools you see in tools/list — do NOT (a) try to launch `patterm` or `patterm mcp-stdio` yourself, (b) poke the Unix socket through perl / nc / socat / curl, or (c) shell out to `claude` / `codex` / `opencode` to start a peer. Any of those bypasses caller-identity and the new agent will land as a stray top-level tab instead of a child under you. Start with `whoami` for your role and the full tool list, then `help('topics')` for orientation. `spawn_agent` is the only correct way to start a sub-agent; `spawn_process` is for non-LLM commands; `list_processes` / `get_process_output` inspect them; `send_input` / `send_message` drive them. Whatever you spawn is yours to `close_process` when done. When you `send_message` a sub-agent, its reply comes back into YOUR pane as `[sub-agent:<name>] …`, not into the sub-agent's output — to wait for it, use `timer_fire_when_idle_any([sub_agent])` and then read your own pane; do NOT `wait_for_pattern` on the sub-agent, that will deadlock until timeout."

 // toolDescriptor is the shape returned by `tools/list`. inputSchema is
 // a JSON Schema object — we provide a minimal `{type: "object"}` schema
@@ -219,7 +219,7 @@ func toolCatalog() []toolDescriptor {
 		},
 		{
 			Name:        "wait_for_pattern",
-			Description: "Block until pattern appears in process output or timeout elapses.",
+			Description: "Block until pattern appears in the TARGET process's own output, or timeout elapses. Use this for waiting on text the target itself will emit (a shell prompt, a build's \"tests passed\" line, etc.). Anti-pattern: do NOT use this to wait for a sub-agent's reply to send_message — replies are routed into the CALLER's pane tagged `[sub-agent:<name>]`, not into the sub-agent's output, so this call will spin to timeout. For sub-agent coordination use `timer_fire_when_idle_any` and then read your own pane.",
 			InputSchema: objectSchema(map[string]any{
 				"process_id":      stringProp("Target process id."),
 				"pattern":         stringProp("Regex pattern."),
@@ -249,7 +249,7 @@ func toolCatalog() []toolDescriptor {
 		},
 		{
 			Name:        "send_message",
-			Description: "Deliver a text message to another process as orchestrator-owned input.",
+			Description: "Deliver a text message to another process as orchestrator-owned input. Fire-and-forget: returns immediately, without waiting for the recipient to read or act. If the recipient replies via send_message, that reply arrives in YOUR pane tagged `[sub-agent:<name>]` (child→parent) or `[orchestrator]` (parent→child) — NOT in the recipient's output. To wait for a sub-agent's reply, schedule `timer_fire_when_idle_any([sub_agent_id], body=…)` and then read your own pane when the timer fires. Do not `wait_for_pattern` on the recipient for a reply; it will deadlock.",
 			InputSchema: objectSchema(map[string]any{
 				"target_process_id": stringProp("Recipient process id."),
 				"message":           stringProp("Message body."),
@@ -283,7 +283,7 @@ func toolCatalog() []toolDescriptor {
 		},
 		{
 			Name:        "timer_fire_when_idle_any",
-			Description: "Schedule a timer that fires when any watched process enters idle (already-idle entries excluded), or when max_wait_seconds elapses.",
+			Description: "Canonical way to wait for a sub-agent to finish working: send_message the sub-agent, then schedule this with watched=[sub_agent_id]; when it fires, the reply is already sitting in your own pane tagged `[sub-agent:<name>]`. Schedules a timer that fires when any watched process enters idle (already-idle entries excluded), or when max_wait_seconds elapses.",
 			InputSchema: objectSchema(map[string]any{
 				"watched":          arrayOfStringsProp("Process ids to watch."),
 				"body":             stringProp("Message delivered verbatim to the owning agent when the timer fires."),
@@ -294,7 +294,7 @@ func toolCatalog() []toolDescriptor {
 		},
 		{
 			Name:        "timer_fire_when_idle_all",
-			Description: "Schedule a timer that fires when all watched processes are idle (already-idle entries count as satisfied), or when max_wait_seconds elapses.",
+			Description: "Canonical way to wait for several sub-agents to finish working in parallel: send_message each one, then schedule this with watched=[…ids]; when it fires, each reply is in your own pane tagged `[sub-agent:<name>]`. Schedules a timer that fires when all watched processes are idle (already-idle entries count as satisfied), or when max_wait_seconds elapses.",
 			InputSchema: objectSchema(map[string]any{
 				"watched":          arrayOfStringsProp("Process ids to watch."),
 				"body":             stringProp("Message delivered verbatim to the owning agent when the timer fires."),