@iowarp/clio-coder 0.3.1 → 0.3.3

package/src/entry/orchestrator.ts

@@ -2,16 +2,17 @@ import { join } from "node:path";
 import chalk from "chalk";
 import { modelBootstrapGenerate, resolveBootstrapRoute } from "../cli/bootstrap-generate.js";
 import { runHeadlessMainAgent } from "../cli/modes/print.js";
+import { formatBootTrace } from "../core/boot-trace.js";
 import { BusChannels } from "../core/bus-events.js";
 import { installBusTracer } from "../core/bus-trace.js";
 import { type ClioSettings, readSettings, type SettingsMutator, updateSettings } from "../core/config.js";
 import { DEFAULT_DELEGATION_PERMISSION_TIMEOUT_MS } from "../core/defaults.js";
 import { loadDomains } from "../core/domain-loader.js";
 import { expandInlineFileReferencesAsync } from "../core/file-references.js";
+import { setGitCommitAttributionEnabled } from "../core/git-commit-attribution.js";
 import { configureGuardrails } from "../core/guardrails.js";
 import { HEADLESS_PERMISSION_DENIED_REASON } from "../core/headless-permission.js";
 import { rememberRecentModel } from "../core/recent-models.js";
-import { EXPERIMENTAL_RELEASE_WARNING } from "../core/release.js";
 import { protectedResidencyModels } from "../core/residency-protection.js";
 import {
 	applyOverrides,
@@ -38,9 +39,10 @@ import { renderAgentCatalogSectionsFromSpecs } from "../domains/agents/catalog.j
 import type { AgentsContract } from "../domains/agents/contract.js";
 import { AgentsDomainModule } from "../domains/agents/index.js";
 import type { ConfigContract } from "../domains/config/contract.js";
-import { ConfigDomainModule } from "../domains/config/index.js";
-import { type ContextContract, createContextDomainModule } from "../domains/context/index.js";
+import { ConfigDomainModule, createConfigDomainModule } from "../domains/config/index.js";
+import type { ContextContract } from "../domains/context/contract.js";
 import { bootstrapInputFromInitOptions } from "../domains/context/init-options.js";
+import { createContextDomainModule } from "../domains/context/runtime.js";
 import type { DispatchContract } from "../domains/dispatch/contract.js";
 import { createDispatchDedupRegistration } from "../domains/dispatch/dedup.js";
 import { agentRoleFactsResolver } from "../domains/dispatch/execution-role.js";
@@ -109,7 +111,12 @@ import {
 } from "../domains/providers/index.js";
 import { getRuntimeRegistry } from "../domains/providers/registry.js";
 import { registerBuiltinRuntimes } from "../domains/providers/runtimes/builtins.js";
-import { createResourcesDomainModule, modelVisibleSkills, type ResourcesContract } from "../domains/resources/index.js";
+import {
+	createResourcesDomainModule,
+	discoverMarketplaceSkills,
+	modelVisibleSkills,
+	type ResourcesContract,
+} from "../domains/resources/index.js";
 import { DEFAULT_RECENT_ENTRY_LIMIT } from "../domains/safety/finish-contract.js";
 import { createFinishContractRegistration } from "../domains/safety/finish-contract-registration.js";
 import type { AutonomyLevel, SafetyContract } from "../domains/safety/index.js";
@@ -123,8 +130,10 @@ import type { SchedulingContract } from "../domains/scheduling/contract.js";
 import { SchedulingDomainModule } from "../domains/scheduling/index.js";
 import { type CompactResult, compact } from "../domains/session/compaction/compact.js";
 import { collectSessionEntries } from "../domains/session/compaction/session-entries.js";
-import { ceilChars, estimateAgentContextTokens } from "../domains/session/context-accounting.js";
+import { estimateTokens } from "../domains/session/compaction/tokens.js";
+import { ceilChars } from "../domains/session/context-accounting.js";
 import type { SessionContract, SessionMeta } from "../domains/session/contract.js";
+import { createDecisionBoardStore } from "../domains/session/decision-board.js";
 import type { CompactionSummaryEntry, CompactionTrigger, SessionEntry } from "../domains/session/entries.js";
 import { SessionDomainModule } from "../domains/session/index.js";
 import {
@@ -139,12 +148,9 @@ import {
 import { createTaskBoardStore } from "../domains/session/task-board.js";
 import { filterEntriesToActivePath } from "../domains/session/tree/active-path.js";
 import { type ShareContract, ShareDomainModule } from "../domains/share/index.js";
-import { serveClioAcpAgent } from "../engine/acp/server.js";
-import {
-	type AcpJsonRpcPeerTransport,
-	createStdioServerTransport,
-	type StdioServerTransportOptions,
-} from "../engine/acp/transport.js";
+import { createUserTasksStore } from "../domains/user-tasks/store.js";
+import { type AcpSafeSettingsPatch, type AcpSafeSettingsSnapshot, serveClioAcpAgent } from "../engine/acp/server.js";
+import { createStdioServerTransport } from "../engine/acp/transport.js";
 import { completeEngineText } from "../engine/ai.js";
 import { setProtectedModelsProvider } from "../engine/apis/residency.js";
 import {
@@ -153,10 +159,14 @@ import {
 	readOrchTurnToolCallBudget,
 } from "../engine/loop-guard.js";
 import { openSession, readSessionTailTurns, sessionCurrentPath, sessionPaths } from "../engine/session.js";
-import type { EngineModel, ImageContent } from "../engine/types.js";
+import type { EngineModel } from "../engine/types.js";
 import { createChatLoop } from "../interactive/chat-loop.js";
 import { buildReplayAgentMessagesFromTurns } from "../interactive/chat-renderer.js";
 import { type RunIo, startInteractive } from "../interactive/index.js";
+import type { BootOptions } from "./boot-options.js";
+
+export type { BootOptions, HeadlessSamplingOverrides } from "./boot-options.js";
+
 import {
 	detectPlatformKeybindingWarnings,
 	detectTerminalKeySupport,
@@ -165,12 +175,13 @@ import {
 	validateKeybindings,
 } from "../interactive/keybinding-manager.js";
 import { subscribeLoopGuardStop } from "../interactive/loop-guard-interrupt.js";
+import { BUILTIN_SLASH_COMMANDS } from "../interactive/slash-commands.js";
 import { createToolProseRegistration } from "../interactive/tool-prose-registration.js";
 import { type AskUserHandler, cancelledAskUserResult } from "../tools/ask-user.js";
 import { registerAllTools } from "../tools/bootstrap.js";
 import { isGitRepository, recoverCleanupReadyCompeteGroups } from "../tools/compete-worktrees.js";
-import { createDispatchBackgroundRegistry } from "../tools/dispatch.js";
-import { coalescePathSink, createFileMutationObserver, createSkillActivationObserver } from "../tools/observers.js";
+import { createDispatchBackgroundRegistry } from "../tools/dispatch-background.js";
+import { createFileMutationObserver, createSkillActivationObserver } from "../tools/observers.js";
 import { createRegistry } from "../tools/registry.js";
 
 export interface BootResult {
@@ -178,57 +189,6 @@ export interface BootResult {
 	bootTimeMs: number;
 }
 
-export interface HeadlessSamplingOverrides {
-	temperature?: number;
-	topP?: number;
-	topK?: number;
-	minP?: number;
-	presencePenalty?: number;
-	frequencyPenalty?: number;
-	repeatPenalty?: number;
-}
-
-export interface BootOptions {
-	/** Process-lifetime API key override applied to the active orchestrator target. */
-	apiKey?: string;
-	/** Suppress CLIO-CODER.md project-context injection for this run. */
-	noContextFiles?: boolean;
-	noSkills?: boolean;
-	skillPaths?: ReadonlyArray<string>;
-	/** Run one non-interactive main-agent turn. */
-	headless?: {
-		prompt: string;
-		images?: ReadonlyArray<ImageContent>;
-		workingContextPaths?: ReadonlyArray<string>;
-		mode?: "text" | "json";
-		jsonEvents?: "full" | "terminal";
-		target?: string;
-		model?: string;
-		thinking?: ThinkingLevel;
-		autonomy?: AutonomyLevel;
-		sampling?: HeadlessSamplingOverrides;
-		noSkills?: boolean;
-		skillPaths?: ReadonlyArray<string>;
-		steerChannel?: string;
-		/**
-		 * Append this turn to an existing session instead of starting a fresh
-		 * one. `latest` means the most recent session recorded for this
-		 * workspace. A named session that cannot be resumed fails the run
-		 * rather than silently starting a new one, because a caller that asked
-		 * to continue a conversation would otherwise get an answer with no
-		 * history behind it.
-		 */
-		resumeSession?: { kind: "id"; id: string } | { kind: "latest" };
-	};
-	/** Serve Clio as an Agent Client Protocol v1 agent over JSON-RPC stdio. */
-	acp?: {
-		transport?: AcpJsonRpcPeerTransport;
-		transportOptions?: StdioServerTransportOptions;
-		/** Overrides delegation.defaults.permissionTimeoutMs for this server only. */
-		permissionTimeoutMs?: number;
-	};
-}
-
 /**
  * The bannered boot is the whole of what a piped or CI invocation of bare
  * `clio` shows, so it is the entire first impression for a stranger who is not
@@ -264,7 +224,6 @@ function buildBanner(): string {
 	return `
   ${chalk.cyan("Clio Coder")}
   ${chalk.dim(`v${clio} · CLIO: Context Layer for I/O · HPC & scientific software`)}
-  ${chalk.yellow.bold(EXPERIMENTAL_RELEASE_WARNING)}
   ${bannerConfigurationLine()}
 `;
 }
@@ -334,6 +293,7 @@ const LOCAL_API_KEY_FALLBACK = "clio-local-target";
 export async function resolveApiKeyForTarget(
 	target: TargetDescriptor,
 	providers: ProvidersContract,
+	signal?: AbortSignal,
 ): Promise<string | undefined> {
 	const runtime = providers.getRuntime(target.runtime);
 	if (!runtime) return undefined;
@@ -343,7 +303,7 @@ export async function resolveApiKeyForTarget(
 	// failed on exactly the local runtimes Clio is built for, while ordinary
 	// turns against the same target succeeded.
 	if (!targetRequiresAuth(target, runtime)) return LOCAL_API_KEY_FALLBACK;
-	const resolved = await providers.auth.resolveForTarget(target, runtime);
+	const resolved = await providers.auth.resolveForTarget(target, runtime, signal ? { signal } : undefined);
 	return resolved.apiKey;
 }
 
@@ -383,7 +343,7 @@ function createBackgroundMemoryModelClient(
 	return {
 		async complete(request) {
 			const apiKey = targetRequiresAuth(refined.target, refined.runtime)
-				? (await providers.auth.resolveForTarget(refined.target, refined.runtime)).apiKey
+				? (await providers.auth.resolveForTarget(refined.target, refined.runtime, { signal: request.signal })).apiKey
 				: LOCAL_API_KEY_FALLBACK;
 			return completeEngineText({
 				model,
@@ -459,7 +419,7 @@ function backgroundSharesReasoningModelWithOrchestrator(
 	}
 }
 
-function synthesizeOrchestratorModel(
+export function synthesizeOrchestratorModel(
 	providers: ProvidersContract,
 	target: TargetDescriptor,
 	wireModelId: string,
@@ -619,8 +579,11 @@ async function runCompactionFlow(
 	// Summarize only the active branch: after a /tree switch the raw file
 	// still holds abandoned sibling turns, and a summary that folds them in
 	// would persist abandoned content back into the active context. The full
-	// file read stays in place for the task board, protected artifacts, and
-	// the masking rewrite, which are session-global.
+	// file read stays in place for protected artifacts and the masking
+	// rewrite, which are session-global. The task board is not: it used to
+	// read the full file too (last taskLedger entry in file order, with no
+	// branch filter at all), which was a second, independent instance of this
+	// same bug. See the taskBoard wiring below for the fix.
 	const activeLeafTurnId = session.tree(meta.id).leafId ?? undefined;
 	const entries = filterEntriesToActivePath(readSessionEntriesForCompact(meta.id), activeLeafTurnId);
 	if (entries.length === 0) return null;
@@ -674,22 +637,30 @@ function estimateTokensFromSummary(summary: string): number {
 	return Math.max(1, ceilChars(summary.length));
 }
 
+/**
+ * The post-compaction size, on the same scale as `tokensBefore`.
+ *
+ * `tokensBefore` is a whole-prompt figure: `calculateContextTokens` anchors it
+ * on the last assistant call's measured usage, so it carries the system prompt
+ * and tool schemas that compaction never touches. The after figure has to stay
+ * on that scale to be comparable, and the persistence layer has no model handle
+ * to re-measure with, so it is arithmetic on that same scale: drop what stops
+ * being replayed and add the summary that replaces it.
+ *
+ * Estimating it from the rebuilt message list instead reported `tokensBefore`
+ * back unchanged, which is what made /tree render "~16276 -> ~16276 tokens"
+ * beside a footer that said 16276 -> 11008 for the same compaction. That
+ * estimator anchors on the newest assistant usage, and the retained suffix
+ * still holds the assistant message whose usage describes the pre-compaction
+ * prompt. Anchoring on it reports precisely the number compaction removed.
+ */
 function estimateTokensAfterCompaction(entries: ReadonlyArray<SessionEntry>, result: CompactResult): number {
-	const synthetic: CompactionSummaryEntry = {
-		kind: "compactionSummary",
-		turnId: "__pending_compaction__",
-		parentTurnId: result.firstKeptTurnId ?? null,
-		timestamp: new Date(0).toISOString(),
-		summary: result.summary,
-		tokensBefore: result.tokensBefore,
-		firstKeptTurnId: result.firstKeptTurnId ?? "",
-		messagesSummarized: result.messagesSummarized,
-		isSplitTurn: result.isSplitTurn,
-		tokensAfter: estimateTokensFromSummary(result.summary),
-	};
-	const messages = buildReplayAgentMessagesFromTurns([...entries, synthetic]);
-	const tokens = estimateAgentContextTokens({ messages });
-	return tokens > 0 ? tokens : estimateTokensFromSummary(result.summary);
+	let droppedTokens = 0;
+	for (const entry of entries.slice(0, result.firstKeptEntryIndex)) droppedTokens += estimateTokens(entry);
+	const summaryTokens = estimateTokensFromSummary(result.summary);
+	// The summary alone is the floor: a session whose dropped estimate exceeds
+	// the measured anchor must not report a negative or sub-summary context.
+	return Math.max(summaryTokens, result.tokensBefore - droppedTokens + summaryTokens);
 }
 
 /**
@@ -733,7 +704,22 @@ export function advanceScopedTarget(
 }
 
 export async function bootOrchestrator(options: BootOptions = {}): Promise<BootResult> {
-	const timer = new StartupTimer();
+	const bootStdout = (text: string): void => {
+		if (options.terminalLease) options.terminalLease.writeDiagnostic("stdout", text);
+		else process.stdout.write(text);
+	};
+	const bootStderr = (text: string): void => {
+		if (options.terminalLease) options.terminalLease.writeDiagnostic("stderr", text);
+		else process.stderr.write(text);
+	};
+	const timer = new StartupTimer(
+		options.terminalLease
+			? (phase) => {
+					const line = formatBootTrace(phase);
+					if (line) options.terminalLease?.deferDiagnostic("stderr", line);
+				}
+			: undefined,
+	);
 	const bus = getSharedBus();
 	const termination = getTerminationCoordinator();
 	installBusTracer();
@@ -776,54 +762,56 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				preserveAllActive: pendingGate.errors.length > 0,
 			});
 			for (const failure of recovery.failed) {
-				process.stderr.write(`[dispatch] compete recovery preserved ${failure.group}: ${failure.message}\n`);
+				bootStderr(`[dispatch] compete recovery preserved ${failure.group}: ${failure.message}\n`);
 			}
 		} catch (err) {
-			process.stderr.write(
-				`[dispatch] compete recovery failed closed: ${err instanceof Error ? err.message : String(err)}\n`,
-			);
+			bootStderr(`[dispatch] compete recovery failed closed: ${err instanceof Error ? err.message : String(err)}\n`);
 		}
 	}
 
 	let effectiveSettingsForDispatch: (() => Readonly<ClioSettings>) | null = null;
 	let protectedArtifactStateForDispatch: (() => ProtectedArtifactState) | null = null;
 
-	const result = await loadDomains([
-		ConfigDomainModule,
-		ExtensionsDomainModule,
-		InteropDomainModule,
-		createResourcesDomainModule({
-			skills: () => ({
-				disableDiscovery: options.noSkills === true || options.headless?.noSkills === true,
-				...(options.skillPaths && options.skillPaths.length > 0
-					? { explicitSkillPaths: options.skillPaths }
-					: options.headless?.skillPaths && options.headless.skillPaths.length > 0
-						? { explicitSkillPaths: options.headless.skillPaths }
-						: {}),
+	const result = await loadDomains(
+		[
+			options.startupSettings ? createConfigDomainModule(options.startupSettings) : ConfigDomainModule,
+			ExtensionsDomainModule,
+			InteropDomainModule,
+			createResourcesDomainModule({
+				reservedPromptNames: new Set(BUILTIN_SLASH_COMMANDS.map((entry) => entry.name)),
+				skills: () => ({
+					disableDiscovery: options.noSkills === true || options.headless?.noSkills === true,
+					...(options.skillPaths && options.skillPaths.length > 0
+						? { explicitSkillPaths: options.skillPaths }
+						: options.headless?.skillPaths && options.headless.skillPaths.length > 0
+							? { explicitSkillPaths: options.headless.skillPaths }
+							: {}),
+				}),
 			}),
-		}),
-		ShareDomainModule,
-		createContextDomainModule({ noContextFiles: options.noContextFiles === true }),
-		ProvidersDomainModule,
-		SafetyDomainModule,
-		createPromptsDomainModule({
-			noContextFiles: options.noContextFiles === true,
-		}),
-		AgentsDomainModule,
-		MiddlewareDomainModule,
-		SessionDomainModule,
-		ObservabilityDomainModule,
-		SchedulingDomainModule,
-		// Dispatch resolves worker targets through the session's effective
-		// settings view once it exists (assigned below, after the config
-		// contract loads); until then it falls back to the shared snapshot.
-		createDispatchDomainModule({
-			getSettings: () => effectiveSettingsForDispatch?.(),
-			getProtectedArtifactState: () => protectedArtifactStateForDispatch?.() ?? { artifacts: [] },
-			autonomyOverride: options.headless?.autonomy !== undefined,
-		}),
-		LifecycleDomainModule,
-	]);
+			ShareDomainModule,
+			createContextDomainModule({ noContextFiles: options.noContextFiles === true }),
+			ProvidersDomainModule,
+			SafetyDomainModule,
+			createPromptsDomainModule({
+				noContextFiles: options.noContextFiles === true,
+			}),
+			AgentsDomainModule,
+			MiddlewareDomainModule,
+			SessionDomainModule,
+			ObservabilityDomainModule,
+			SchedulingDomainModule,
+			// Dispatch resolves worker targets through the session's effective
+			// settings view once it exists (assigned below, after the config
+			// contract loads); until then it falls back to the shared snapshot.
+			createDispatchDomainModule({
+				getSettings: () => effectiveSettingsForDispatch?.(),
+				getProtectedArtifactState: () => protectedArtifactStateForDispatch?.() ?? { artifacts: [] },
+				autonomyOverride: options.headless?.autonomy !== undefined,
+			}),
+			LifecycleDomainModule,
+		],
+		{ diagnostic: bootStderr },
+	);
 	timer.mark(`domains loaded (${result.loaded.length})`);
 
 	const dispatch = result.getContract<DispatchContract>("dispatch");
@@ -842,8 +830,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	const acpMode = options.acp !== undefined;
 	const interactive = !options.headless && !acpMode && process.env.CLIO_CODER_INTERACTIVE === "1";
 	if (!interactive && !options.headless && !acpMode) {
-		process.stdout.write(buildBanner());
-		if (process.env.CLIO_CODER_TIMING === "1") process.stdout.write(`${timer.report()}\n`);
+		bootStdout(buildBanner());
+		if (process.env.CLIO_CODER_TIMING === "1") bootStdout(`${timer.report()}\n`);
 	}
 
 	const config = result.getContract<ConfigContract>("config");
@@ -852,7 +840,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 
 	if (options.apiKey) {
 		if (!providers) {
-			process.stderr.write("Clio Coder: --api-key supplied but providers domain unavailable; ignoring.\n");
+			bootStderr("Clio Coder: --api-key supplied but providers domain unavailable; ignoring.\n");
 		} else {
 			const settingsNow = applyHeadlessSettingsOverlay(config?.get() ?? readSettings(), options.headless);
 			const activeTargetId = settingsNow.orchestrator?.target;
@@ -861,13 +849,13 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			if (target && runtime) {
 				providers.auth.setRuntimeOverrideForTarget(target, runtime, options.apiKey);
 			} else {
-				process.stderr.write("Clio Coder: --api-key supplied but no active orchestrator target is configured; ignoring.\n");
+				bootStderr("Clio Coder: --api-key supplied but no active orchestrator target is configured; ignoring.\n");
 			}
 		}
 	}
 
 	if (!interactive && !options.headless && !acpMode) {
-		process.stdout.write(`${chalk.dim("  (non-interactive boot. pass CLIO_CODER_INTERACTIVE=1 to launch the TUI.)")}\n`);
+		bootStdout(`${chalk.dim("  (non-interactive boot. pass CLIO_CODER_INTERACTIVE=1 to launch the TUI.)")}\n`);
 		await termination.shutdown(0);
 		return { exitCode: 0, bootTimeMs: timer.snapshot().totalMs };
 	}
@@ -897,7 +885,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		if (interopHint !== null) initialNotices.push(interopHint);
 	}
 	if (!providers || !dispatch || !observability || !safety || !middleware) {
-		process.stderr.write(
+		bootStderr(
 			"Clio Coder: chat mode requires safety + middleware + providers + dispatch + observability contracts; aborting.\n",
 		);
 		await termination.shutdown(1);
@@ -931,12 +919,12 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		} catch (err) {
 			const detail = err instanceof Error ? err.message : String(err);
 			if (requestedResume !== undefined) headlessResumeFailure = `failed to resume session ${resumeId}: ${detail}`;
-			else process.stderr.write(`Clio Coder: failed to resume session ${resumeId}: ${detail}\n`);
+			else bootStderr(`Clio Coder: failed to resume session ${resumeId}: ${detail}\n`);
 		}
 	}
 	Reflect.deleteProperty(process.env, "CLIO_CODER_RESUME_SESSION_ID");
 	if (headlessResumeFailure !== null) {
-		process.stderr.write(`clio-coder run: ${headlessResumeFailure}\n`);
+		bootStderr(`clio-coder run: ${headlessResumeFailure}\n`);
 		await termination.shutdown(2);
 		return { exitCode: 2, bootTimeMs: timer.snapshot().totalMs };
 	}
@@ -1051,6 +1039,14 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		middleware.registerHook(
 			createSkillsReminderRegistration({
 				countModelVisibleSkills: () => modelVisibleSkills(resources.skills(process.cwd()).items).length,
+				// Same lookup context(scope="skills") lists under its Marketplace
+				// heading, minus what is already installed, so the count the
+				// reminder quotes is the count the listing will show.
+				countInstallableSkills: () => {
+					const installed = new Set(resources.skills(process.cwd()).items.map((skill) => skill.name));
+					return discoverMarketplaceSkills({ cwd: process.cwd() }).skills.filter((skill) => !installed.has(skill.name))
+						.length;
+				},
 			}),
 		);
 	}
@@ -1098,9 +1094,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	const unsubscribeMemoryLoop = bus.on(BusChannels.LoopBlocked, () => memoryIntervention.signalLoop());
 	termination.onDrain(() => unsubscribeMemoryLoop());
 	if (contextDomain) {
-		middleware.registerHook(
-			createFileMutationObserver(coalescePathSink((paths) => contextDomain.noteFileChanges(paths))),
-		);
+		middleware.registerHook(createFileMutationObserver(({ paths }) => contextDomain.noteFileChanges(paths)));
 	}
 	// User-defined hooks: extensions and the project (.clio-coder/hooks.yaml,
 	// .clio-coder/hooks.local.yaml) declare a conservative, receipted hook set on the
@@ -1167,19 +1161,58 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// interview fall back to their stated defaults when the tool is absent.
 	const askUserBridge: AskUserHandler = async (questions, invokeOptions) =>
 		askUserHandler ? await askUserHandler(questions, invokeOptions) : cancelledAskUserResult();
+	const userTasks = createUserTasksStore({ cwd: process.cwd() });
 	// One task board per orchestrator: the tasks tool mutates it, the turn-end
 	// open-tasks nudge reads it, and the footer/overlay render it. Keyed on the
 	// current session id so resume/fork/new refolds it from taskLedger entries.
+	// Folding through filterEntriesToActivePath (not the raw file) is what
+	// keeps a /resume from picking up whichever branch happened to write its
+	// taskLedger entry last in file order; readEntries here used to skip that
+	// filter entirely (issue #94).
 	const taskBoard = createTaskBoardStore({
 		getSessionId: () => session?.current()?.id ?? null,
 		readEntries: () => {
 			const meta = session?.current();
-			return meta ? readSessionEntriesForCompact(meta.id) : [];
+			if (!meta) return [];
+			const leafTurnId = session?.tree(meta.id).leafId ?? undefined;
+			return filterEntriesToActivePath(readSessionEntriesForCompact(meta.id), leafTurnId);
 		},
 		appendEntry: (entry) => {
 			session?.appendEntry(entry);
 		},
 	});
+	// Prime the projection once at composition. Interactive repaint paths use
+	// cachedSnapshot() below, so a first paint can never become a ledger read.
+	taskBoard.snapshot();
+	const decisionBoard = createDecisionBoardStore({
+		getSessionId: () => session?.current()?.id ?? null,
+		readEntries: () => {
+			const meta = session?.current();
+			if (!meta) return [];
+			const leafTurnId = session?.tree(meta.id).leafId ?? undefined;
+			return filterEntriesToActivePath(readSessionEntriesForCompact(meta.id), leafTurnId);
+		},
+		getActiveLeafTurnId: () => {
+			const meta = session?.current();
+			return meta ? (session?.tree(meta.id).leafId ?? null) : null;
+		},
+		appendEntry: (entry) => {
+			if (!session) throw new Error("decision board: no session ledger is available");
+			session.appendEntry(entry);
+		},
+	});
+	// getSessionId alone never notices a /tree switch: it moves the active
+	// append point inside the same session, so the id-keyed cache above kept
+	// showing the abandoned branch's board (issue #94). SessionTurnSwitched is
+	// the signal that switch actually happened; invalidate() forces the next
+	// read to refold from the now-current leaf.
+	bus.on(BusChannels.SessionTurnSwitched, () => {
+		taskBoard.invalidate();
+		// The tree switch is the I/O boundary: refold eagerly here so the 250-ms
+		// island ticker remains a cache-only consumer after changing branches.
+		taskBoard.snapshot();
+		decisionBoard.invalidate();
+	});
 	// Link in-flight dispatch runs to the live board via the ledger's
 	// activeRunIds field: a run is tracked from the moment its child process is
 	// live until it finalizes either way. attach/detach are no-ops when no board
@@ -1205,6 +1238,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	registerAllTools(toolRegistry, {
 		...(session ? { session } : {}),
 		taskBoard,
+		userTasks,
 		dispatch,
 		bus,
 		...(interactive ? { askUser: askUserBridge } : {}),
@@ -1256,6 +1290,9 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	let cachedSettingsView: ClioSettings | null = null;
 	const bumpSessionState = (): void => {
 		sessionStateGeneration += 1;
+		// Child-process seams read the effective setting from the environment,
+		// and the session view may override the saved value.
+		setGitCommitAttributionEnabled(getCurrentSettings().attribution.gitCommits);
 	};
 	const getCurrentSettings = (): ClioSettings => {
 		// Recents live in the data dir (core/recent-models.ts), never in
@@ -1280,6 +1317,11 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		return view;
 	};
 	effectiveSettingsForDispatch = getCurrentSettings;
+	bumpSessionState();
+	// The config bundle publishes the saved value on reload; a session-scoped
+	// override must win, so re-derive from the session view after it.
+	const unsubscribeCommitAttributionSync = bus.on(BusChannels.ConfigHotReload, () => bumpSessionState());
+	termination.onDrain(() => unsubscribeCommitAttributionSync());
 	const getTaskMemorySeedOffer = (): { source: string; count: number } | null => {
 		return taskMemoryHandoffSeedOffer(process.cwd(), getCurrentSettings().memory.intervention.enabled);
 	};
@@ -1333,11 +1375,9 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	 * interleave and drop each other's patches.
 	 */
 	const persistSavedMutation = (mutator: SettingsMutator): void => {
-		if (config?.update) {
-			config.update(mutator);
-			return;
-		}
-		updateSettings(mutator);
+		if (config?.update) config.update(mutator);
+		else updateSettings(mutator);
+		bumpSessionState();
 	};
 	/**
 	 * Apply a routing change with one consistent scope: it takes effect in this
@@ -1353,6 +1393,38 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			mutateSaved?.(saved);
 		});
 	};
+	const readAcpSafeSettings = (): AcpSafeSettingsSnapshot => {
+		const settings = getCurrentSettings();
+		return {
+			target: settings.orchestrator.target,
+			model: settings.orchestrator.model,
+			thinkingLevel: settings.orchestrator.thinkingLevel ?? "off",
+			autonomy: settings.autonomy,
+		};
+	};
+	/**
+	 * ACP safe settings are one atomic persisted mutation followed by infallible
+	 * in-process routing assignment. Persisting first avoids reporting a live
+	 * route that failed to become the future-session default.
+	 */
+	const commitAcpSafeSettings = (patch: AcpSafeSettingsPatch): AcpSafeSettingsSnapshot => {
+		const orchestrator: NonNullable<RoutingPatch["orchestrator"]> = {};
+		if (patch["orchestrator.target"] !== undefined) orchestrator.target = patch["orchestrator.target"];
+		if (patch["orchestrator.model"] !== undefined) orchestrator.model = patch["orchestrator.model"];
+		if (patch["orchestrator.thinkingLevel"] !== undefined) {
+			orchestrator.thinkingLevel = patch["orchestrator.thinkingLevel"];
+		}
+		const routingPatch: RoutingPatch | null = Object.keys(orchestrator).length > 0 ? { orchestrator } : null;
+		persistSavedMutation((saved) => {
+			if (routingPatch !== null) mergeRoutingPatchIntoSettings(saved, routingPatch);
+			if (patch.autonomy !== undefined) saved.autonomy = patch.autonomy;
+		});
+		if (routingPatch !== null) {
+			applyRoutingPatch(sessionRouting, routingPatch);
+			bumpSessionState();
+		}
+		return readAcpSafeSettings();
+	};
 	/**
 	 * Persist a whole-settings blob coming from the effective view (the
 	 * /settings overlay, favorites toggles). Routing edits in the blob are
@@ -1383,7 +1455,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	 *     every other id becomes a session override. settings.yaml is untouched.
 	 *   - scope "global": apply live and persist just that leaf as the new
 	 *     default, clearing any prior session override for it.
-	 * Restart-required ids (budget.concurrency, runtimePlugins) cannot apply
+	 * Restart-required ids (budget.concurrency, runtimePlugins,
+	 * terminal.tuiMode, terminal.fullscreenScrollbar) cannot apply
 	 * live, so the overlay only offers "global" for them; the file write is what
 	 * a later restart picks up.
 	 */
@@ -1485,6 +1558,9 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		registerDeferredReminderSink: (sink) => {
 			deferredMemoryReminderSink = sink;
 		},
+		onAskUserFinalized: (policy) => {
+			decisionBoard.recordFinalizedInterview(policy);
+		},
 		...(session
 			? {
 					readSessionEntries: readCurrentSessionEntries,
@@ -1492,6 +1568,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				}
 			: {}),
 		toolRegistry,
+		hasAttachedDispatch: () => dispatchBackground.size() > 0,
 	});
 
 	// Coordinated shutdown (SIGINT/SIGTERM, TUI quit) must abort any in-flight
@@ -1523,15 +1600,23 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			try {
 				leafTurnId = session.tree(resumedMeta.id).leafId;
 			} catch (err) {
-				process.stderr.write(
+				bootStderr(
 					`Clio Coder: failed to read resumed session tree ${resumedMeta.id}: ${err instanceof Error ? err.message : String(err)}\n`,
 				);
 			}
 			try {
-				chat.resetForSession(leafTurnId, buildReplayAgentMessagesFromTurns(readCurrentSessionEntries()));
+				// Scoped to the leaf resume landed on for the same reason the /resume
+				// overlay is (issue #107): with a /tree pin persisted, the file still
+				// holds the abandoned branch after the pinned turn, and replaying it
+				// unfiltered seeds the provider with turns the next append does not
+				// parent onto.
+				chat.resetForSession(
+					leafTurnId,
+					buildReplayAgentMessagesFromTurns(readCurrentSessionEntries(), leafTurnId ? { activeLeafTurnId: leafTurnId } : {}),
+				);
 			} catch (err) {
 				chat.resetForSession(leafTurnId);
-				process.stderr.write(
+				bootStderr(
 					`Clio Coder: failed to replay resumed session context ${resumedMeta.id}: ${err instanceof Error ? err.message : String(err)}\n`,
 				);
 			}
@@ -1575,19 +1660,50 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				transport,
 				chat,
 				...(session ? { session } : {}),
+				...(session
+					? {
+							readSessionEntries: readSessionEntriesForCompact,
+							buildReplayMessages: (entries: ReadonlyArray<SessionEntry>, leafTurnId: string | null) =>
+								buildReplayAgentMessagesFromTurns(entries, leafTurnId === null ? {} : { activeLeafTurnId: leafTurnId }),
+						}
+					: {}),
+				providers,
+				settings: {
+					read: readAcpSafeSettings,
+					commit: commitAcpSafeSettings,
+				},
 				toolRegistry,
 				bus,
 				autonomy: resolveBaselineAutonomy,
+				routing: () => {
+					const settings = getCurrentSettings();
+					return {
+						target: settings.orchestrator.target,
+						model: settings.orchestrator.model,
+					};
+				},
 				onActiveSessionAutonomyChange: (level) => {
 					activeAcpSessionAutonomy = level;
 				},
 				cwd: process.cwd(),
 				version: getVersionInfo().clio,
+				// Stdout belongs to JSON-RPC. Text this process did not author, such
+				// as a provider's failure body, is kept off the wire and written to
+				// the unstructured stderr tail instead.
+				diagnostics: (line) => {
+					process.stderr.write(`[clio:acp] ${line}\n`);
+				},
 				permissionTimeoutMs:
 					options.acp.permissionTimeoutMs ??
 					config?.get().delegation.defaults.permissionTimeoutMs ??
 					DEFAULT_DELEGATION_PERMISSION_TIMEOUT_MS,
 			});
+			// Same ordering the termination drain hook relies on: an aborted turn's
+			// tool results still land and persist through the run's subscribers,
+			// and the session writer stops in result.stop() below. Awaiting
+			// settlement here makes a session append after session stop impossible
+			// by ordering rather than by timing.
+			await chat.whenSettled();
 			chat.dispose();
 			await dispatch.drain();
 			await result.stop();
@@ -1665,7 +1781,13 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		}
 	}
 
-	timer.mark("first TUI paint");
+	if (options.terminalLease) {
+		for (const diagnostic of options.terminalLease.takeDiagnostics()) {
+			const text = diagnostic.text.trimEnd();
+			if (text.length > 0) initialNotices.push(text);
+		}
+	}
+
 	await startInteractive({
 		bus,
 		providers,
@@ -1673,6 +1795,12 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		...(agents ? { agents } : {}),
 		observability,
 		chat,
+		...(options.terminalLease
+			? {
+					terminalLease: options.terminalLease,
+					onHydratedFrameCommit: () => timer.mark("Stage 1 hydration"),
+				}
+			: { onFirstFrameCommit: () => timer.mark("first TUI paint") }),
 		...(initialNotices.length > 0 ? { initialNotices } : {}),
 		...(resources ? { resources } : {}),
 		...(extensions ? { extensions } : {}),
@@ -1681,7 +1809,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		toolRegistry,
 		...(session ? { session } : {}),
 		...(session ? { readSessionEntries: readCurrentSessionEntries } : {}),
-		getTaskBoard: () => taskBoard.snapshot(),
+		getTaskBoard: () => taskBoard.cachedSnapshot(),
+		getDecisionBoard: () => decisionBoard.snapshot(),
+		supersedeDecision: (interviewId, key, correction) => decisionBoard.supersede(interviewId, key, correction),
+		userTasks,
 		getTaskMemoryStatus: () => {
 			ensureTaskMemorySession();
 			const settings = getCurrentSettings();
@@ -1837,6 +1968,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 						try {
 							const previousSessionId = session.current()?.id ?? null;
 							session.resume(sessionId);
+							taskBoard.snapshot();
 							if (previousSessionId !== sessionId) ensureTaskMemorySession();
 						} catch (err) {
 							process.stderr.write(
@@ -1845,12 +1977,18 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 						}
 					},
 					onNewSession: () => {
-						session.create({ cwd: process.cwd() });
+						const settings = getCurrentSettings();
+						const input: { cwd: string; target?: string; model?: string } = { cwd: process.cwd() };
+						if (settings.orchestrator.target) input.target = settings.orchestrator.target;
+						if (settings.orchestrator.model) input.model = settings.orchestrator.model;
+						session.create(input);
+						taskBoard.snapshot();
 						ensureTaskMemorySession();
 					},
 					onForkSession: (parentTurnId) => {
 						try {
 							session.fork(parentTurnId);
+							taskBoard.snapshot();
 							ensureTaskMemorySession();
 						} catch (err) {
 							process.stderr.write(