feat(settings): the listener's knobs — settings.json + /settings pane [spec 12]

specs/DESIGN.md

@@ -343,6 +343,7 @@ v1 ships as **a sequence of sub-specs**, ordered so that **every step runs and a
 | **~~09~~** | ~~`claude-code-ingestion`~~ — **retired 2026-07-29 as a standalone spec** (row kept: it records why, so it is not re-litigated) | CC → **profile** bootstrap moved into **spec 06 slice B**. CC → **persona** inference **cut** (the persona is user-seeded and stable, §2.3 amended). CC → **activity signals** for 07 **cut**: local keyboard-idle time is cheaper and more accurate than mining CC logs. | — | — |
 | **10** | `tui` | Front-end refinement: replace the CLI Host's plain print/stdin with a real **TUI** (live now-playing/status region + scrolling program log + a stable input line). The **single richer front-end murmur ever gets** — there is no GUI/menu-bar/web. | front-end polish (off the L0→L1 critical path) | 01 |
 | **11** | `agentic-steer` ([`specs/spec11/11-agentic-steer.md`](spec11/11-agentic-steer.md)) | The reply turn becomes an agent: the steer/talkback call runs the 03-01 harness with `switch_music` / `end_broadcast` / `submit_reply`, so the listener's words can act on the program (skip lands via handover-on-resolve; shutdown is confirm-first). Boundary automation stays local policy (§7 pillar 1 unchanged — this arms the one call the listener already pays for). | companion feel | 01,03-01,03-02,04 |
+| **12** | `settings` ([`specs/spec12/12-settings.md`](spec12/12-settings.md)) | The listener's knobs, persisted: `$MURMUR_HOME/settings.json` merged under env/flags per knob, an engine-owned single-writer store with hot application, two additive wire messages, and the TUI `/settings` pane — exactly seven writable intents (anchors, music, mix gear, gap, mute, pet, memory span) plus read-only home/endpoint status. | companion polish | 01,05,10 |
 
 ### 10.1 Decomposition principles
 - **Interface-first (AI-friendly key)**: spec `01` declares the **VoiceProvider / MusicProvider / Memory contract seams** explicitly; their implementations land in 02 / 03-01 / 05 respectively. Parts stay decoupled and buildable in order, and a coding agent never has to guess an interface.

specs/STATUS.md

@@ -7,9 +7,9 @@ _This file is a **card, not a ledger**: an entry that is done and no longer
 guides the work gets **deleted**, not archived. History lives in git and PR
 bodies; measured facts live in the spec they verify._
 
-_Last updated: 2026-08-07 (spec 07 invites retired: murmur is a radio and does
-not solicit interaction — the turn-to-you/slide-back chain is removed; typed
-talkback, anchors, gating, and the activity sensor stay)_
+_Last updated: 2026-08-07 (spec 12 settings layer built: settings.json + the
+engine-owned store + two additive wire messages + the TUI `/settings` pane;
+seven writable intents, everything hot)_
 
 ## Where we are
 
@@ -43,6 +43,10 @@ how it got there:
 - spec 11 agentic-steer — the reply turn runs the harness with
   `switch_music` (handover-on-resolve) / `end_broadcast` (confirm-first) /
   `submit_reply`; boundary automation stays local policy.
+- spec 12 settings — `$MURMUR_HOME/settings.json` merged under env/flags per
+  knob, the engine-owned single-writer `SettingsStore` with hot application,
+  `settings`/`settingsSet` on the wire, and the TUI `/settings` pane (seven
+  intents + read-only home/endpoint facts).
 
 ## Open
 
@@ -59,6 +63,7 @@ hand: CI fails if this section points at an issue that is already closed.
 - **#83** (watch) Enter during an uncommitted IME composition may submit the line.
 - **#98** (eng) Steer tool-choice eval (Ollama) owed — the smoke is on-demand only; spec 11 §5.
 - **#99** (by-ear) Spec 11 acceptance pass — handover feel, slow-pick cover, two-phase off.
+- **#111** (by-ear) Settings pane acceptance pass — focus handoff, hot knobs by ear; spec 12 §5.7.
 
 ## Pinned — do not relitigate
 

specs/spec10/10-tui.md

@@ -338,18 +338,25 @@ where it lands):
 
 Exact composition, palette, and the pet's look belong to the §6.1 creative
 session; this spec fixes only the four functional regions and that the input
-line owns focus permanently.
+line owns focus permanently. **One sanctioned exception (2026-08-07, spec 12
+§3.6)**: the listener-invoked `/settings` pane routes keys to itself until
+Esc. The permanent-focus rule defends against *radio output* stealing focus
+mid-keystroke; a mode the listener opened is the listener spending their own
+focus, and the broadcast never pauses under it.
 
 **As built (2026-08-06, issue #95): the pet is optional.** `MURMUR_TUI_PET=0`
 (also `off` / `false` / `no`) drops the creature from the alive band, and the
 gutter that separated it from the bars goes with it — the spectrum spans the
 band, and the band keeps the pet's height, so nothing above or below moves and
 no dead hole is left where it sat. **Default is ON**: the §5.11 listening pass
 judged the pet's current form, not its existence, and §6.1 still owns its
-identity. The knob is client-side env, like `MURMUR_TUI_KITTY_KEYBOARD` (§5.1)
-— not a `Config` field, because the engine has no business in what the band
-contains, and a front-end knob that traveled through the engine would be the
-first plank of the theming engine §1 rules out.
+identity. ~~The knob is client-side env, like `MURMUR_TUI_KITTY_KEYBOARD`
+(§5.1) — not a `Config` field, because the engine has no business in what the
+band contains.~~ **Superseded (2026-08-07, spec 12 §3.7)**: the knob is
+`tuiPet` in the settings layer — the engine is the single configuration
+holder, and one boolean riding the existing `settings` snapshot is not the
+theming engine this section feared. `MURMUR_TUI_PET` survives as the
+client-local escape hatch and final override (env beats file, per knob).
 
 ### 3.4 Input & interruption