docs: implementation plan for human CLI grammar redesign

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/superpowers/specs/2026-06-27-human-cli-grammar-redesign-design.md

@@ -131,8 +131,11 @@ booleans, default `false`, read fresh on every command via `Deps.setup` (which r
 only consult them at evaluation time. Nothing in account creation, `init`, or the policy engine
 needs them set at creation time, and toggling them later takes effect on the next command.
 
-Therefore: remove `--whitelist-in` / `--whitelist-out` from `account add` and from `init`'s flow
-entirely. Accounts are created with whitelists off; the user sets them up afterward:
+Therefore: remove `--whitelist-in` / `--whitelist-out` from `account add`, from `init`'s flow, and
+from the interactive TUI account form (the `Whitelist inbound`/`Whitelist outbound` toggles in
+`internal/tui/account.go`) entirely — leaving them in the form would contradict the decoupling and
+re-expose the empty-enabled-whitelist footgun. Accounts are created with whitelists off; the user
+sets them up afterward:
 
 ```
 emcli whitelist add bobby alice@example.com bob@example.com --in
@@ -168,6 +171,9 @@ it. (Addresses are still lowercased on store as today.)
   leftover-positional and empty-operand guards; wire `normalizeVerb`.
 - `internal/cli/run.go` — `doctor` accepts positional + `--account`; routing unchanged otherwise.
 - `internal/cli/interactive.go` (`runInit`) — drop whitelist references.
+- `internal/tui/account.go` — remove the `WhitelistIn`/`WhitelistOut` form fields, their rows,
+  and their render/parse/`ToAccount`/`FieldsFromAccount` handling (new accounts are created with
+  whitelists off; managed via the `whitelist` group thereafter).
 - `internal/cli/help.go` — rewrite admin synopses to the new grammar; document the
   agent-vs-human positional/flag split; list aliases.
 - New: settings registry (small map + validators) — location `internal/cli` (e.g.