@iowarp/clio-coder 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -2,6 +2,86 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.3.9 - 2026-08-30
+
+### Added
+- Behavioral results now carry an additive, strictly parsed execution envelope that binds prompt fragment ids, versions, content hashes and composition hash to recipe, route, tool surface, autonomy, policy hashes, project-context provenance, and corpus version (#164). Comparisons mark scenario/role rows incomparable when any undeclared envelope field drifts, summarize mean and variance changes independently per scenario and role, and name every prompt- or recipe-affected corpus result. The release check runs all 26 public machinery-only scenarios against a reviewable checked baseline in ordinary CI; intentional updates require an explicit baseline regeneration and diff review, while the live model corpus and its negative control remain separate manual release evidence.
+- The rebuildable SQLite trace mirror is now bounded by a terminal-run retention policy and can be reclaimed explicitly with `clio-coder trace prune` (#226). The default keeps 30 days and at most 128 MiB, configurable with `CLIO_CODER_TRACE_RETENTION_DAYS` and `CLIO_CODER_TRACE_MAX_BYTES`; age and size pruning delete every dependent trace row as one unit while excluding all queued and running runs. The command reports runs, rows, physical bytes reclaimed, protected live runs, and whether `VACUUM` ran. A vacuum rewrites the database once at least 20 percent of its pages are reclaimable or the byte bound requires it, then truncates the WAL, so deleting history returns disk space instead of only filling SQLite's freelist. `clio-coder doctor` now reports the recursive state-directory size and its largest top-level contributor, making a growing `trace.sqlite` visible before it reaches a home-directory quota.
+- An interactive session now keeps an always-on record of its input pipeline and writes it out on `SIGTERM` (#224). A pane that stopped answering the keyboard previously left nothing behind unless `CLIO_CODER_RENDER_TRACE` had been armed before the session started, which nobody does before a bug they have not seen yet. The render tracer runs in every interactive process now, keeping the last 256 `input_ingress` records and the last 256 committed frames in a bounded in-memory ring and writing the JSONL file only when the environment variable names a path. The `SIGTERM` that recovers a stuck pane dumps that ring to `<stateDir>/input-wedge/<timestamp>-<pid>.json`, classified as `input-not-committed` when bytes reached the application and no frame carrying them reached stdout, `no-input-recorded` when the reader delivered nothing, and `input-committed` when both halves moved; the five newest dumps are kept. A PTY smoke test covers `/share` of a worker run and of a council member run against the OpenAI-compatible fixture, asserting a new `input_ingress` record and a committed frame whose `inputHighWater` covers it, in about 5 seconds.
+- Behavioral eval comparison now reports correctness, safety, label violations, tool-call efficiency, unnecessary exploration, delegation quality, unsupported claims, tokens, latency, cost, and repeat variability as separate sourced metric families (#161). Each behavioral result carries an additive role and target/model-bound projection whose unmeasured observations stay null; distributions include coverage, min/max, p90, population variance, and standard deviation. `eval compare` classifies every shared row as improved, regressed, unchanged, or incomparable and supports equivalent text, JSON, Markdown, and JUnit-compatible output. Correctness and safety regressions, including a lost measurement that existed in the baseline, fail independently of pass-rate or cost gains, while threshold files keep release-blocking `fail` assertions separate from non-blocking `informational` budgets.
+- A versioned public behavioral corpus now exercises the shipped agent system without private inputs (#160). Corpus `public-built-in-behavior` 1.0.0 pairs positive and adversarial machinery cases for all 13 built-in worker recipes; every case loads the production recipe catalog, follows real dispatch admission through a scripted worker, and verifies the sealed receipt and result-contract outcome instead of grepping frontmatter. Four isolated `mini` scenarios cover tool choice, exploration, delegation, safety comprehension, claim grounding, denied-tool recovery, completion behavior, and task correctness using per-tool calls and blocks, distinct/allowlisted read counts, decoy hits, and grader-emitted unsupported-claim and completion facts. A live decoy negative control must produce violated exploration and safety labels, and corpus contracts prevent private endpoints, credential values, and mutable external inputs from entering the suites.
+- Behavioral eval scenarios have a versioned, fail-closed contract (#156). Suite v2 tasks can declare bounded expected and forbidden rules across tool choice, exploration, delegation, safety comprehension, claim grounding, denied-tool recovery, completion behavior, and task correctness; deterministic judge inputs are canonicalized from observable transcript, tool, receipt, and grader facts. Artifact v4 stores the result as an additive `clio.eval.behavior.v1` sibling that references the unchanged `clio.eval.verdict.v1` identity, preserving existing readers and the tracked-metrics baseline. `unknown`, `unmeasured`, `behavioral_failure`, and `infrastructure_failure` remain distinct, and malformed, partial, contradictory, or cross-linked verdicts cannot parse as passes.
+- Clio pre-warms the prompt prefix on a local-native target, so a first turn no longer pays for prefill the operator was never going to avoid (#253). After the session prompt compiles at session start, after a resume rebuilds the message array, and after a compaction settles, Clio sends the exact request the next turn would send minus the operator's text: the same system prompt, the same tool schemas, the same replayed messages, the same thinking level, and the same `cache_prompt`, with one single-character user message so the chat template renders the prefix up to the user turn, and `max_tokens: 1`. The payload is built through the same engine dispatcher a turn runs on rather than hand-assembled, because a single differing byte ahead of the user turn re-prefills everything after it. Measured on a llama.cpp router (build `b226-2115b73d8`, Qwen3.8-27B), a resumed 34,951-token session's first turn re-prefilled cold at `promptMs 48617` and 53.2 s to first token; with the prefix already resident the same turn reads it from cache. The round is refused rather than queued whenever it would compete with real work: it never runs off the `local-native` tier whatever `prewarm.enabled` says, never while a turn is in flight or any dispatch is outstanding, and never on a worker or in headless `run`. The round claims one slot on its endpoint while its request is out and releases it in a `finally`, so endpoint capacity counts a pre-warm the way it counts the orchestrator's streaming turn. Pressing Enter lets go of an in-flight pre-warm at the keystroke. Whether it also aborts the request is gated on the backend, because the measured one ignores a cancellation: aborting 1.5 s into a 47,620-token prefill did not stop the server, which finished prefilling, so the prefix survived and the next request read 47,596 of 47,620 tokens from cache at `prompt_ms 927` while waiting 89.5 s of wall clock for the abandoned request to leave the single slot. Letting the pre-warm complete cost the same wall clock and kept the usage record, so a submit detaches the round rather than aborting it, withholds its `/context` line, and still records the prefill the server performed. Each round appends one `prewarm` ledger entry with its `timing` and `promptCache`, contributes zero tokens to the context estimate, is never a model message, and is never an expected-cold reason. `/context` reports `prewarmed: N tokens in X ms` until the next settled run, and `/cost` and `clio-coder usage report` carry pre-warm calls as their own row beside side questions and handoffs. `prewarm.enabled` defaults to `true` and is classified next-turn.
+- Eval artifacts carry a fail-closed `clio.eval.verdict.v1` envelope with ledger and receipt sourced performance metrics, per-scenario pass and distribution aggregates, and serving-configuration provenance; `eval compare` can filter tracked metrics, refuses configuration drift unless explicitly allowed, and `eval run --trials N` isolates every trial in a fresh workspace (#252).
+- Every model call on a llama.cpp or LM Studio target persists the server's own prefill facts (`prompt_n`, `cache_n`, `predicted_n`, `prompt_ms`, `predicted_ms`) as a `backend` object on the assistant entry's `promptCache`, and the cache verdict is derived from `cache_n` when pi-ai reports no cache reads (#247). `residency`, `thinking_change`, `tool_surface_change`, and `prompt_recompiled` join the expected-cold reasons, so the `/context` "shell reused, backend cold" warning no longer fires for a disturbance Clio caused. `/context` shows `prefill: N uncached · M cached · X ms` for the last call, `/cost` and `clio-coder usage report` carry per-session uncached prefill totals and verdict counts, and `clio-coder doctor` summarizes the last session's verdicts.
+- The `/handoff` extraction round binds its JSON schema on the wire and gets one bounded repair attempt (#223). The round embedded `HANDOFF_RESPONSE_SCHEMA` in the system prompt and bound nothing, and a refused parse ended the command, so the 0.3.7 release test recorded `/handoff` as BLOCKED on a local target after two attempts that both ended "the extraction round returned no JSON object"; the dropped-path listing, the `e` editor, and accept-mints-a-session were all unreachable and the operator paid for the round either way. The out-of-turn seam now looks up the runtime's own spelling of a JSON-schema response constraint and sends it: `response_format: { type: "json_object", schema }` for llamacpp, the standard `{ type: "json_schema", json_schema: { name, strict, schema } }` for lmstudio, and nothing at all for a runtime with no known dialect, which still gets the prose instruction. The table is keyed by runtime id rather than by capability flag because a generic OpenAI-compatible gateway answers HTTP 200 to a spelling it does not implement and returns unconstrained JSON, which would turn a known non-enforcement into a silent one. Native enforcement is an optimization here, never a precondition: a server that refuses the constrained request with the 400 the worker seam already recognizes gets one unconstrained retry, and anything else rejects. A parse the extractor refuses now gets exactly one repair round that quotes the parser's complaint and the first answer verbatim, billed through the same out-of-turn usage store, and a terminal refusal names what was asked for, what each round said, and what round 2 returned. Verified on `mini` (llama.cpp, `muse-30b-dense`) against a ten-turn session: the constrained request carried all five schema properties and the extraction was accepted, and a deliberately truncated first round refused with the ticket's own message and the repair round was accepted.
+
+### Fixed
+- The pre-warm scheduler's zero-delay timers are ref'd, so awaiting `whenPrewarmSettled` can no longer deadlock a process whose event loop holds nothing else. Node 22, the engines floor, drains the loop past a due unref'd timer, which cancelled entire hosted-CI test lanes with `Promise resolution is still pending but the event loop has already resolved`; Node 24 fires the due timer first, which is why no development machine ever reproduced it. A due zero-delay timer holds the loop for one tick at most, and production sessions always hold live handles, so no operator-visible behavior changes.
+- Fleet steps now transfer their held whole-plan reservation into the worker lease even when the request carries fleet lineage, so a one-step fleet can run on a one-slot endpoint without counting its own reservation twice. Endpoint-capacity refusals now identify active leases, held reservations, and foreground streams instead of always blaming the orchestrator's turn, and reservation members record when admission consumes them.
+- A consumed prompt now reaches one committed pending frame before turn admission can make it durable (#251). The shipped state machinery was live during a long forced auto-compaction, but the real editor path only queued a render before starting the capability probe, prompt compile, and overflow preflight, so release-test windows lasting 17 to 260 ms opened and closed between renderer ticks and showed `MESSAGE`, no user row, and the previous turn's receipt throughout. The chat loop now opens its reference-counted preparation window and awaits an internal presentation barrier that flushes `· preparing`, the `PREPARING` rail, and the preparing footer before admission work starts; the existing `compactionSummary` then user-turn ordering is unchanged. Manual `/context compact` remains a separate path and its live island now reports a single `compact` phase at 0% instead of publishing `done` and rendering the five `/context init` stages at 100% from its first frame; only its terminal event renders `done` and 100%.
+- The v0.3.7 release-test residue now has one manually gated live driver that uses the built CLI, a real PTY, native workers, the builtin recipes, and a scrubbed isolated home against an operator-selected target (#222). On `mini` with `muse-30b-dense`, it proved the in-flight `/oracle` refusal with zero new receipts, scrolled a 51-line `/handoff` review until the unread path appeared under the dropped-ledger heading, proved saved and cancelled `$EDITOR` digests, rendered the compete verification refusal, and checked every discovered development command across default help, full help, and its bare entry point. The same evidence records why four dispatch paths could not produce receipts on the one-slot endpoint: proposal and gate-loop plans self-contended with their reservation, a two-member council could not admit round one, and the current admission contract intentionally accepts review verification even though the release-test row says it refuses. The proposal record also preserves its out-of-plan `requestOrigin: user` and missing plan binding rather than changing that contract here.
+- Worker heartbeat age now comes from a monotonic stamp while the durable ledger keeps a separately derived wall-clock instant (#198). A 60-second forward wall-clock step can no longer reap a live native or ACP worker, and a backward step cannot hide a worker whose monotonic heartbeat window and grace have elapsed; restart recovery explicitly uses the persisted instant only as a human-readable last-seen bound after the host-scoped worker process is known to be gone.
+- `targets --probe` now keeps a degraded target's health reason ahead of gateway, context-window, and residency notes, and repeats the complete reason on a wrapped detail line whenever the table row cannot hold it (#234). At both 80 and 120 columns, plain and gateway targets now say that the configured default model is not advertised by the target instead of dropping or truncating the operative clause; healthy rows and the full `health.lastError` in JSON are unchanged.
+- `config inspect` now reports agent and fleet resource roots instead of omitting both extension-era resource kinds (#243). Each category includes the shipped builtin root plus extension, user, and project roots in their real loader order, with the numeric collision precedence retained in the JSON detail. The formerly dangling `agents` category is replaced by `agent-root` and paired with `fleet-root`, and `agents --help` now names extensions as a recipe source.
+- Extension manifests now enforce their optional `compatibility.clio` SemVer range instead of parsing and ignoring it (#242). Malformed ranges fail manifest parsing, installation refuses a package whose range excludes the running Clio version before writing it, and installed packages are checked again at load so upgrades cannot activate incompatible resources. The diagnostic names the extension, its declared range, and the running version; incompatible packages remain visible in `extensions list` while a compatible package at another scope can still become effective. Manifests that omit the constraint retain their previous behavior.
+- A successful write in a never-indexed project no longer strands an empty `.clio-coder/` directory (#248). The incremental codewiki refresh is contractually a no-op when the project was never indexed, but `coordinateCodewikiWrite` acquired the state-file lease before rechecking `requireExisting`, and `withStateFileLock` creates the lock's parent with `mkdirSync(..., { recursive: true })`. So every successful file-mutating tool created `.clio-coder/`, wrote and deleted `codewiki.json.lock` inside it, and left the now-empty directory behind; `inotifywait` recorded exactly that sequence on 0.3.8. The check now runs inside the workspace queue and before the lease, so nothing is materialized for a project with no codewiki. The recheck under the lock is unchanged and is still what decides the race, and an indexed project keeps serializing its incremental writes through the same queue and lease.
+- A downgraded fleet write record now says exactly why it opened and which tool call caused it (#236). A successful opaque `bash`, `verify`, `dispatch`, `steer`, dynamic, or MCP call previously collapsed into `attributionComplete: false`, leaving the Alt+W card silent while the run was actionable and the durable verdict saying only that no complete record existed after rollback. The run-effects recorder now retains the causal tool and call id, emits a live warning when the first such call succeeds, and carries every cause through `observedRunWriteAttribution` into the write-boundary verdict's additive `attributionDowngrades` list. The live card and after-the-fact message name the tool and explain that its arguments cannot enumerate every path it may write. Incomplete telemetry, untracked code steps, and unavailable records receive their own reason codes, while a closed record keeps `attributionComplete: true`, an empty downgrade list, and the existing protection for unattributed concurrent edits.
+- Canonical trust verdicts now stay receipt-derived across dispatch, `monitor collect`, evidence bundles and inspect output, `findings.md`, the Alt+W board, receipt verification, and eval metrics (#237). Evidence alone composed a finish-contract audit row into `completionEvidence`, so one read-only run appeared as `completion not applicable` there while every receipt surface said `completion not recorded`; evidence no longer lets that separate input override the receipt axis. Every `findings.md` now records each linked run's tier, fixed-order summary, and six axes before its diagnostic findings. Alt+W writes the tier as text and wraps every summary clause, and the receipt view wraps its versioned tier and summary onto additional header rows instead of truncating the verdict after its first clause.
+- A prompt template that cannot load is now recognized as the command it is and refuses with its reason, instead of being dropped so the operator is told the command does not exist (#245). The safety half is unchanged: a missing or escaping `${extensionRoot}` reference still never expands and never reads outside the declaring package. What changed is that `loadPromptFile` no longer returns null for it. The template loads with an empty body and an `unavailable` reason attached, so the namespaced command is recognized and invoking it says, for example, `prompt template /wtfp:plan-section cannot run: prompt template has an unresolved or escaping extension reference: ${extensionRoot}/core/templates/missing.md (<file>)`. The reason is the same sentence the `/prompts` overlay already renders as a diagnostic, plus the file, so the two surfaces cannot drift. Every load-time reason gets the same treatment, not only the reference case: the name is now derived before the file is read, so an unreadable template also refuses with its own error rather than vanishing. A path that escaped its discovery root is still dropped, because there is no name there to offer a command under. The `/prompts` overlay marks such a template `unavailable` and shows the reason in its detail pane.
+- Every fleet step can now use the configured transient-failure retry policy instead of only the first step (#231). Fleet steps share one root assignment, whose once-only settlement correctly becomes terminal after wave one; later retry decisions mistakenly treated that root status as the current step's liveness and silently suppressed recovery. Reserved work now reads the current plan member's held, consumed, or released state at both scheduling and timer execution, while unreserved dispatch retains the root-assignment check and the original settlement guard remains unchanged.
+- A queued or echoed model-facing turn carries the payload byte for byte (#244, follow-up to #240). The expander was already exact, but `appendQueuedUserTurn` trimmed the engine's user text before persisting it, which broke the byte-for-byte match against the echo the loop had already written and so wrote a second, shortened row that the assistant was then parented to. One `/raw   bar` submit produced a correct 5-byte `"  bar"` turn and a 3-byte `"bar"` turn, and the model's parent turn was the 3-byte one, contradicting the contract in `docs/prompt-envelope-and-tools.md` that every byte after the delimiter belongs to the payload. The echo path now persists the submitted bytes and reads a trimmed copy only for the emptiness test, so the echo is recognized as the turn already in the ledger instead of being written again. The queue path is fixed the same way: a steer or a follow-up hands the engine and the queue mirror the submitted text rather than a trimmed one, because a steer is a model-facing turn too. Leading whitespace, trailing whitespace, interior runs, and tabs all survive into the turn the assistant is parented to; a message that is only whitespace is still refused.
+- A consumed prompt no longer looks idle while Clio prepares the turn (#251). The editor is cleared and the prompt painted into the transcript before admission, and the capability probe, pre-submit auto-compaction, prompt compile, and overflow preflight all run after that and before the turn owns the stream. Nothing named that window: the composer went back to `MESSAGE` with `Ask Clio…` and the footer still reported the previous turn as done, so a run that spent 77.4 seconds in `trigger: auto` compaction was indistinguishable from a dropped Enter, and the operator pressed Enter twice more trying to submit. The chat loop now carries a turn-preparation phase from the moment `submit` is called until admission succeeds or refuses, refined to `compacting` around each pre-submit compaction. The composer rail reads `PREPARING` or `COMPACTING` with a placeholder that says which, the status machine enters the existing `preparing` phase on the same signal so the footer's verb and watchdog tick replace the previous turn's receipt, and because `preparing` is an active phase the compaction bus overlay now lands during the window instead of being dropped by an idle status. The painted transcript row is marked pending while it is not in the ledger, becomes an ordinary row at the durable append, and is marked `not sent` when the submit is refused, so a blocked preflight never leaves a committed-looking phantom turn. The phase is reference-counted across the FIFO admission gate, so a retyped prompt arriving mid-window neither narrows the state the first one is showing nor closes it early. The ordering `compactionSummary` then one user turn is unchanged and asserted, and Enter on an empty editor is still refused before any of this.
+- `ask_user` keeps the free-text answer the operator typed instead of only the option label they chose it under (#228). A round that offered "Exact number - I'll type it" recorded that sentence and nothing else, because choosing an option committed the answer and only an option literally named Other opened a text field. The interview at `state/interviews/2026-08-25T10-14-05-319Z-...json` shows the cost: rounds 3 and 4 existed only to re-ask for the figures rounds 1 and 2 had thrown away, 35 minutes for four facts, with the operator typing the same numbers and dates three times. On any option list `t` now opens the text field for the option under the cursor without committing it, and submitting records the label and the text together as `<label>; <text>`. The answer travels as three separable facts rather than one joined string: `answer` is the one-line rendering, `options` is the labels chosen in list order, and `value` is the typed text exactly as submitted, so a label-only answer is told from a label-plus-value one by whether `value` is there rather than by parsing. All three reach the model in `latest_answers`, the interview transcript under `clioStateDir()/interviews/`, and the decision record, whose `value` carries both and whose `options` and `text` keep them separable. Choosing a plain option after typing clears the text with it, so a recorded answer never claims a figure the operator gave for a label they moved off.
+- Dispatch plan approvals now bind every byte of every worker task with `task_bytes` and `task_sha256` while retaining the existing 255-character `task_preview` (#246). A real vote council sealed 714-byte member tasks into receipts whose shared approval artifact represented only a 258-byte preview, leaving the 456-byte ballot-directive tail outside the plan hash; changing any byte in that hidden tail now changes the approved hash without making the operator-facing plan unbounded. The other routing, identity, and path fields rendered through `safeField` now append a digest whenever sanitization or truncation changes their visible value, closing the same collision class without lengthening normal plan text.
+- A parked `write` or `edit` can be read before it is authorized (#254). The approval card described the mutation only by size, as `content=<string 482 bytes>` or `edits=<array 3 items>`, so approving it meant approving bytes the operator had never seen; during the WTF-P NSF 25-531 UAT on 0.3.8 the only way to read them was to open the external `current.jsonl` ledger and compare payloads by hand. The card now carries a `Mutation:` line with the kind, the byte count, and a truncated SHA-256 over the exact call arguments the decision resumes, and `v` opens the complete proposed content for a write or the complete effective diff for an edit, computed by applying the edit list to the bytes on disk rather than by printing the edit array back. The mutation scrolls with the arrow and page keys in a 16-row window that names its position, and `v` closes it again; Enter, `s`, and Esc keep answering the call throughout, so the inspection never becomes a step between the operator and a denial. An edit whose file cannot be read or whose replacements do not apply says which, and still shows the requested replacements. The inspector re-derives the digest from the arguments it is about to render and refuses when it no longer matches, so a call that differs from the previewed one cannot inherit its preview. The mutation text is process-local by construction: it is never placed on the approval view, which is what reaches the transcript row, the parked notice, the desktop notification, and the worker escalation payload, all of which carry only path, size, and digest. Escape sequences and control bytes are neutralized and the neutralization is stated, tabs render as spaces, and content past 262,144 characters is cut with a line naming how much was withheld. A worker escalation has no preview because its arguments never leave the worker, and its card says exactly that instead of advertising a key it cannot honor. At 40 columns the inspect key is elided ahead of allow, stop, and deny, and the `/help` Autonomy & safety net topic documents it for the widths that cannot show it.
+- Dispatch contract tests now load all 13 shipped builtin agent recipes through the production registry instead of substituting handcrafted `coder`, `researcher`, and `verifier` records (#232). The old researcher claimed the `base` audience and an `external-delegation` result while production seats a `shadow` researcher that must return a `research-report`, so default council tests could pass against an agent operators could never run. The shared stub now inherits each builtin's audience, result contract, and tool surface directly from its Markdown recipe; the one optional constrained-coder seam is explicit, council scripts return the real research envelope, and a catalog-wide drift contract compares every field that caused the divergence.
+- A residency load that races the llama.cpp router's own wake no longer fails the turn. When Clio's `/v1/models` snapshot was stale, the router answered the duplicate `POST /models/load` with HTTP 400 `model is already running` or HTTP 500 while it was already loading the model, and the call was recorded as an errored assistant entry before any inference. A rejected load now re-reads `/v1/models`, treats a model that is loaded, loading, or sleeping (or a body that says it is already running) as a load in progress and waits for it, and only an absent, unloaded, or failed model preserves the rejection, whose message now carries the router's response body.
+- The compaction summary round and a background memory step hold a slot on the endpoint they stream to for as long as the request is out, the same as a turn, a `/btw` round, and a pre-warm (#250, #229). A memory step registers only after the `endpoint_busy` admission check, so it counts on its own server for dispatch capacity without ever refusing itself.
+- After an in-process `/resume`, the prompt manifest and the `promptRecompiled` entry follow the incoming session (#249 follow-up). The hash this process compiled was carried on the previous session's compiled prompt, so the resumed session's first entry named the abandoned session's hash and its manifest chain started from a hash that appeared nowhere in it; the compiled hash is now tracked per session and cleared on the switch. Because the backend's slot still holds the previous session's prefix, the first turn after the switch is stamped `prompt_recompiled` from the resume itself, so `/context` names the cold turn instead of warning about it. An unreachable `preferLoaded` branch in the session-prompt compile was removed; the loaded-over-probe ranking lives in runtime resolution and is proven there.
+- A background memory step that times out or throws after its request left the process now still stamps `background_memory` on the next turn (#229). The `MemoryStepCompleted` announcement hung off the usage sink, which only runs when the call resolves, so a step cut off by the 30 s deadline, whose trajectory the server had nonetheless prefilled into its single slot, left the next turn cold with no reason and `/context` warning about a provider re-prefill Clio had caused. The announcement now wraps the client's `complete` in a `finally` (`announceMemoryStepEndpoint`), fires exactly once per request that left the process, and never for an `endpoint_busy` skip; the usage row and `/cost` accounting are unchanged.
+- An eval result has one pass decision (#252). `verify.measure` is the scenario's code grader, and a nonzero grader exit now fails the result with `failureClass: grader_failed` while the verdict keeps `machinery: ok`, so `result.pass`, `verdict.outcome`, the per-scenario aggregates, the summary, and the exit status agree; the sprint's baseline artifact reported 26 of 30 in its summary and 23 in its aggregates for the same 30 runs, and 23 is the figure the graders produced. Every failed verdict carries a `reason`, and pre-fix artifacts are read with the reason normalized. `eval run --trials N` prepares each trial's workspace immediately before that trial and removes both the workspace and the state directory on the item's `finally` path, including when the copy itself throws; a run that died on `ENOSPC` had created all 30 workspaces up front and left every one behind. A `temp-copy` workspace inside a git checkout copies exactly the tracked and untracked-but-not-ignored set (`git ls-files --cached --others --exclude-standard`), so 1.4 GB of ignored benchmark datasets no longer ride along in every trial.
+- A `/btw` side question and a `/handoff` extraction round now hold a slot on the endpoint they stream to for as long as the request is out, the same way the turn and the pre-warm do (#250, #229). Without it, a fleet dispatch on a one-slot server was admitted onto the endpoint the side question was occupying, and the background-memory tier read that endpoint as idle during exactly the window it was busiest.
+- `residencyTargetKey` is total again for a configured base URL: a target written without a scheme (`mini:8080`) produced a null key through an overload typed `string`, and the residency reconcile threw `Cannot read properties of null` instead of running unlocked. The canonical form is used when the URL has one and the raw spelling otherwise, which matches what dispatch capacity does for the same target (#250 regression, found in review).
+- The `/context` meter draws the autocompact reserve at the far end of the bar, after free space, and in the same frame token free space uses, so the held-back headroom no longer reads as a grey block wedged between the consumed categories and the outline it should match; the `▒` glyph still keeps it distinct without color, and the footer meter shares the order. `background_memory` renders in prose as `background memory step` on the `last cold turn:` line instead of falling through to the wire value (#229).
+- Proactive memory's model tier now accounts for what it spends, is bounded by a deadline a turn boundary can wait for, and writes what it produces into the store `/memory` reads (#229). One operator's ledger held 274 steps over 14 days: 60 of them reached the background model, spending 137,205 tokens and 1,666.6 seconds of model time, with a single step holding a local server for 102.5 seconds to answer nothing, and none of it appeared in `/cost`, in `clio-coder usage report`, or anywhere else. Every model step is now billed the way a `/btw` side question is, under a `background-memory` label: `/cost` shows a `memory steps` row, `usage report` counts them in its window, and one durable row per step lands in the out-of-turn usage store carrying the provider usage, the call's duration, and the backend's prefill facts. `/memory` shows the lifetime steps, tokens, model time, and hit rate folded from `steps.jsonl`. `memory.intervention.timeoutMs` drops from 180,000 to 30,000, and a step that exceeds the deadline records `timeout` with reason `deadline` or `timed_out` rather than the `silent` a model that simply chose not to speak records; a route that refuses the connection still records `client_error`, so the three diagnoses stay distinguishable. A step whose endpoint is already serving the chat target's stream is skipped with reason `endpoint_busy` and the skip is recorded, so a single-slot local server is never made to queue the memory call behind the operator's own turn or evict the resident model to serve it; a step is started from the `turn_end` hook while the chat loop still holds its foreground registration, so a background role pointed at the chat target's own endpoint declines every boundary and records each skip rather than contending for the slot, and a step that did run on that endpoint stamps the next turn's expected-cold reason `background_memory` so the `/context` warning names its cause. The session task bank and `records.json` are connected: an injected reminder's cited entries are proposed into the durable store, unapproved and scoped to the session's repository with provenance naming the source entry, so `clio-coder memory list` and `/memory` show what the tier actually produced and approval stays a separate operator action. The default is unchanged and now recorded with its numbers in `docs/proactive-memory.md`: the free rules tier stays on, and the model tier stays opt-in behind `background.target`, which bought 6 injections from those 60 steps, a 10.0 percent hit rate at 22,868 tokens per injection.
+- The compiled system prompt is ordered stable prefix first, so a moved context window or an approved memory record no longer re-prefills the sections behind it (#249). Every backend Clio targets caches by exact prefix and re-prefills from the earliest changed byte, and through 0.3.8 the runtime block sat sixth of eleven compiled sections with the memory block tenth. `Context window: N` moves whenever the backend reloads a model or a co-residency clamp lands, so one changed digit cost a fresh prefill of the tool contract, the fleet roster, the retrieval hints, memory, and the project context; on the operator's llama.cpp target a one-line change at token 500 of a 16,712-token prompt re-prefilled all 16,712 in 18.4 seconds. The order is now identity, operating contract, delegation, skills, safety, tool contract, fleet, retrieval hints, project context, memory, runtime, then the operator-editable tail fragments unchanged, under one rule: a section goes as late as its volatility, and anything that reads a clock, a probe, or a mutable store goes after everything that does not. No section's wording changed and no section was added or dropped. `Context window: N` is now read from the turn's own window resolution, where a recorded loaded window outranks a probe that reports what the server could serve rather than what the model is open at, so a resumed session states the figure its ledger measured (#227's carry-forward). Prompt-manifest records carry a layout `version` plus the window and the layer that answered it, and a resumed session's first compile names the prompt hash it replaced instead of reporting no previous prompt at all, so the one `promptRecompiled` entry the upgrade writes explains itself. One cosmetic defect went with it: the memory section carried its `# Memory` header twice, once from the memory renderer and once from the compiler.
+- Dispatch capacity now binds independently per inference endpoint and counts the orchestrator's own active model stream (#250). Target URLs normalize to a shared scheme, host, port, and base-path key, so two target descriptors pointed at the same scheduler share leases and held reservation capacity. llama.cpp probes the selected worker's `total_slots`, with its reported `--parallel` argv as a fallback; LM Studio and Ollama use conservative local defaults, and a target may set `maxConcurrentRequests` explicitly. Global and node `budget.concurrency` semantics remain unchanged. Endpoint-aware execution plans size each wave to the available request slots, `targets --probe`, `/fleet` settings, and the Fleet Runs board expose those slots, and a saturated endpoint refuses the dispatch with its slot count plus a named collection or second-server remedy.
+- Context accounting is reconciled against the provider's own token counts, and compaction fires on the reconciled figure (#227). A session on 2026-08-28 believed it was at 63 percent of a 131,072-token window while the backend answered `Context size has been exceeded`; the `0.9` threshold never tripped because the number it read was a chars/4 estimate. The reconciliation data was already there. `reconcileSnapshot` folded the provider's count into the `/context` overlay, the footer meter, and `context-snapshots.jsonl`, and `shouldCompact` never saw it. After each model call the attested prompt count, with cached prompt tokens folded back in, is now carried as an anchor over the live message list: the budgeted figure is that count plus a chars/4 estimate of everything appended since, and the estimate remains a floor because it prices material the attested call never saw. All three evaluation points read it: the pre-submit trigger, the post-tool continuation guard, and the preflight overflow check, so a turn that would overrun the window compacts instead of failing at the provider. A working-set projection subtracts the tokens the eviction planner priced out against that same projection and re-anchors on the projected message list, where it previously discarded the attestation entirely and fell back to pure chars/4 exactly when the accounting mattered most; a summary compaction rewrites the conversation the attestation described, so it drops the anchor and the next call re-establishes it. Every snapshot now records `estimatedTokens`, `reconciledTokens`, and `divergenceRatio`, so the divergence itself is observable in the ledger rather than inferable from an overflow.
+- A resumed session no longer spends its first turn budgeting against a re-probed window (#227). The same session resumed reporting `contextWindowSource: "probe"` at 262,144 with a 26,214-token reserve, then corrected to `loaded` at 131,072 one turn later, a 126K swing in one turn and the entry point for the overflow above. A resume re-resolves its target before discovery has reported what the backend has open, and the probed figure is what the server could serve rather than what the model is open at. Resolution now accepts a `knownLoadedContextWindow`, and the turn context supplies the last `loaded` window the session's own snapshot ledger recorded for the same target and model. It applies only when live discovery reports no loaded window and only for that exact target and model, so a changed selection re-probes and a model reloaded at a different size corrects as soon as discovery names the live window.
+- `/share` of a worker answer with no place to fold no longer kills the TUI (#257). The uncommitted user row's `· preparing` and `· not sent` tails from #251 were concatenated onto the last rendered line with no width budget, so a body that had already folded to the full content width came out 12 cells past the terminal, and pi-tui's `doRender` throws on an overlong line and takes the process down with it. A `research-report` answer is JSON with no space to break at, so an 80-column pane died on any shared body over 58 columns; the recorded crash was `Rendered line 16 exceeds terminal width (84 > 80)` on a 70-character body. The tail now rides on the last body line only when that line has room for it within the terminal width, and drops to its own hanging row when it does not, so it stays whole rather than breaking between the separator and the word. A contract test sweeps shared-note body lengths at 80 columns and terminal widths from 8 to 120, and the `/share` PTY regression gains an 80-column share of a spaceless body that asserts the process survives and the keyboard still reaches the editor.
+
+## 0.3.8 - 2026-08-29
+
+### Added
+- An extension may ship agents, fleets, and namespaced prompts alongside the skills it already provided. `clio-coder-extension.yaml` accepts `resources.agents` and `resources.fleets` beside `resources.skills`, `resources.prompts`, and `resources.themes`, and every declared root is validated when the manifest loads rather than when a resource is first read: a root must be relative, must resolve inside the extension package, must not be the package root itself, must be a directory, and must not reach outside the package through a symbolic link. The whole resource tree is walked for escaping or unresolvable links, and any failure refuses the install with a named diagnostic instead of installing a package whose resources cannot be trusted. Extension agents merge between the builtin recipes and the operator's own, ordered by extension source, so an extension can add an agent but never shadow a shipped one; an attempt is dropped with `ignore override id=<id> by=extension reason=reserved-builtin`. An extension agent's `skills:` bindings resolve only against that same extension's declared skills root with discovery disabled, so a recipe cannot bind a skill from the operator's roots or from another extension, and a binding that escapes the root is refused by name. An extension that binds skills without declaring a skills root is refused rather than silently resolving nothing. Extension fleets take the same position between builtin and user, and a project or user fleet of the same name still wins. Prompts load under the extension's namespace, so `/wtfp:new-paper` addresses the `wtfp` extension's `new-paper` template with no collision against a same-named project prompt, and a `${extensionRoot}` reference in a prompt body resolves to the installed package so a template can cite files it ships. Only an existing path contained by the declaring package resolves; a reference that is missing or escapes is refused with a diagnostic rather than expanding to a path the operator never granted.
+- Nested state resources survive an extension install. The installer excludes `state.json` because that name is the extension manager's own bookkeeping file, but it now excludes only the one at the package root. An extension that ships, say, `core/templates/state.json` as a project-state template keeps it, where every file of that name was previously dropped.
+
+### Changed
+- Receipt integrity moves from v19 to v20, covering the new `pathProvenance` field on dispatch intent (#159). Receipts sealed by 0.3.7 fail verification under 0.3.8 and are never read as evidence; they are not migrated, on the same terms as every prior integrity bump.
+- Legacy path inference is retained with explicit provenance and confidence, and inferred scope is visible before a supervised dispatch runs (#159). #158 made declared intent authoritative and left the inference path unlabelled, so a receipt recorded which project rules applied but never the path set that selected them: the effect was sealed and the cause was discarded. Dispatch intent moves to version 2 and gains `pathProvenance`, one integrity-sealed entry per policy-bearing path carrying its source, whether the value was declared, derived, or inferred, and a confidence with a deterministic ordering. Receipt integrity moves to v20 to cover it. A receipt records that a path was inferred and from which field, never the sentence it was inferred from, so briefing prose stays out of durable evidence. Declared values always outrank inferred ones and inference never widens a scope a declaration closed; an ambiguous or contradictory inference returns a typed refusal rather than passing as though it had been declared. The approval artifact renders inferred policy-bearing scope in full beside the verification argv it already showed, instead of the bare `intent_sha256` hash, and that artifact plus the sealed `pathProvenance` are the two places it appears. A dispatch that declared no intent gets no transcript notice: it is the ordinary case rather than an anomaly, one receipt in ninety-nine carries an intent key today, and warning on it fired on nearly every dispatch, printed twenty entries carrying identical provenance inline, and buried the one scope notice that does mean something.
+- Typed dispatch intent is authoritative for policy-bearing scope, and one path grammar governs every containment check (#158). `readRoots`, `relevantPaths`, and `expectedOutputs` shipped in 0.3.7 with no consumer at all: they were normalized, hashed, and sealed into the receipt, and nothing read them back. Worker rule selection ran on a regular expression over the task and briefing prose, authority admission never saw declared write scope so every writer was admitted against the whole working directory, and five separate containment predicates used three incompatible grammars, under which the entry `src/` meant a subtree to the fleet write boundary and an opaque literal to intent normalization. One owner now defines the grammar, repository-relative POSIX paths where a trailing slash means a subtree and its absence means an exact file, and admission, project-rule selection, worker enforcement, delegation-plan validation, and boundary verification all ask it. The grammar is the fleet write boundary's existing one, so a contract valid before this release means exactly what it meant before. When a request carries `intent`, the declared set replaces prose inference for rule selection and authority rather than joining it, and a path the inference would have contributed that the declaration does not carry is reported to the operator as a transcript notice naming the omitted paths and stating that they selected no project rules and expanded no worker authority. A request without `intent` keeps prose inference unchanged. Batch intent now merges field by field, and a `tasks[]` entry that would widen the top-level declaration is refused rather than silently replacing it.
+- The fleet write boundary stays post-run by design, and the two request constructors say so (#158). Wiring a fleet step's declared `writes` into `spec.writeRoots` would reach the policy engine's blanket refusal of `bash`, `verify`, and `dispatch` under an active write root, which every fleet step running a command depends on. That refusal is honest because the target check can only prove containment when it is handed a concrete write path; narrowing it to admit a fleet-declared command would claim confinement with no mechanism able to enforce it. Pre-emptive fleet confinement needs a command sandbox and is tracked separately.
+
+### Fixed
+- Extension fleets now resolve their own extension-provided agents during `fleet validate` and `fleet graph`. Those read-only commands rebuilt an agent catalog from built-in, user, and project recipes and omitted the extension slot, even though `agents`, `fleet run`, and dispatch used the domain catalog that contained it; a valid installed fleet therefore listed correctly but failed inspection with `unknown agent`. Discovery is now shared with the run and dispatch surface, preserving the existing built-in-before-extension-before-user-before-project precedence, built-in shadow protection, same-extension skill binding, quarantine behavior, and unknown-agent refusal.
+- `$ARGUMENTS` carries the operator's own text byte-for-byte instead of a shell-tokenized reconstruction of it (#240). Every slash prompt template passed its post-command payload through `parseCommandArgs`, whose tokenizer strips both quote characters and splits on spaces and tabs, and then rebuilt the aggregate placeholder with `args.join(" ")`. The round trip silently destroyed every literal quote, every tab, and every run of more than one space, indentation included, from prose the operator had typed. The defect predates this release and reached every slash command, but 0.3.8 is the release that ships namespaced extension prompts and the first real consumer of that surface hit it immediately: a 1,906-character invocation arrived as 1,904, the two missing bytes being the quote characters around a title. `$ARGUMENTS` now carries the exact payload and is substituted after the parsed placeholders, so placeholder-like operator text such as a literal `$1` stays literal rather than expanding a second time. `$1` through `$9`, `$@`, `${@:N}` and `${@:N:L}` keep the shell-tokenized semantics their names describe: quotes still group, and `$@` still joins parsed arguments with single spaces. The first whitespace character after the command name is the delimiter, counting a CRLF pair as one, and every byte after it belongs to the payload.
+- A live fleet is no longer marked failed by an unrelated Clio process starting up (#235). `assignments.json` is machine-wide, so a row still marked `running` does not prove its opener crashed; it usually means another process holds it. Startup reconciliation read `status === "running"` as proof of an orphan and settled every claimed row `failed`, so a second `clio-coder` anywhere on the machine — a CLI command beside an open TUI, a second fleet, an ACP client — declared every fleet in flight a failure while it kept running. The release test caught it on a four-step fleet whose row went terminal 83 seconds early and named a step whose own result was `succeeded: true`; it reproduces in under thirty seconds with two code-only contracts and no model call. This was a regression against #225, which closed the case where the same row lied optimistically. Every live row now persists the orchestrator pid, a process birth token, and an acquisition time, and reconciliation applies the liveness check the checkout writer lease already uses rather than trusting status alone; the owner is cleared only on a true terminal transition. Legacy ownerless rows and genuinely dead owners still reconcile, so `wait` and `collect` can never hang on a real orphan, and an abandoned claimed fleet now settles against its own fleet root instead of filing a successful child attempt as the failed terminal run.
+- The `vote` ballot directive reaches each council member once (#239). `renderCouncilVoteMemberTask` appends the directive to whatever task it is handed, and both plan admission and the runner called it in sequence with the runner receiving admission's output, so every member's integrity-sealed task carried two verbatim copies of the whole block. The vote still tallied correctly, but the directive is specified as bounded and one of its lines is the precedence instruction that stops a small local model answering in its recipe's shape instead of the ballot's — the exact conflict #230 was resolving — and stating a precedence rule twice works against it. The runner now reuses the per-position task admission already pinned into the resolved plan, composing only for a contract with no resolved artifact, so the task the approval artifact binds and the task the receipt seals are byte-identical. Composition is reused rather than made idempotent on purpose: the plan artifact is authoritative, and detecting an already-present suffix could mistake operator-authored text for system composition. The seat, persona, `shadow` audience, read-only autonomy, `council-read-only` profile, ballot contract, and tally are unchanged.
+- A receipt sealed under a retired integrity version is reported as retired, not as corrupt (#238). Receipt integrity moved from v19 to v20 in this release and 0.3.7 receipts are deliberately not migrated, but an intact, correctly sealed 0.3.7 receipt reported `verify fail … integrity invalid` in the TUI and `error: … receipt integrity: integrity invalid` from `evidence build`, which is exactly what a tampered receipt reports; on the release-test machine 99 of 107 receipts were at a retired version, so the release's first impression for anyone with history was an evidence store full of corruption. The verifier's shape check collapsed a wrong version into the same "invalid" as a malformed block, and nothing named either version. There is now a version-mismatch outcome distinct from a digest mismatch, diagnosed ahead of the verifier and carrying both versions: `receipt integrity v19 is retired; this build verifies v20; the receipt is not read as evidence`. The canonical projection distinguishes the two as well, so a retired-format run does not read like a tampered one anywhere: artifact integrity is `unknown` through a compatibility source that names the retired version, the trust line reads `seal v19 retired (this build verifies v20)` where a tampered receipt reads `seal broken`, the receipt-owned axes are absent as `historical_format` rather than `not_observed`, and the verdict is `unknown` rather than `compromised`. `evidence build` records a `receipt-retired` info finding, prints it as a note, and exits 0, since the receipt is set aside unread exactly as a missing one is; `/view verify` and the receipt view report `verify retired` with both versions in the warning color. The receipt is still not migrated and still not read as evidence; the file's digest is unchanged by every one of these reads. Only the reporting changed.
+- The canonical trust projection is the only renderer of a trust axis, on `evidence inspect` and on dispatch (#233). #162 set out to make one trust verdict render the same way everywhere and named this symptom in its own problem statement, and it was still there: `evidence inspect` printed the projection and then unconditionally appended the legacy provenance transcript, which read the receipt directly and never consulted the projection. On a current receipt one axis rendered three times in two vocabularies, `mediated`, `enforced`, and `autonomy enforcement: mediated autonomy=full-auto`; on a receipt whose seal failed, the projection correctly reported `autonomy not recorded` and the block two lines below published `autonomy enforcement: mediated autonomy=read-only` read from that same unverified receipt. Dispatch output carried the same third rendering as an `enforcement=mediated:auto-edit` suffix that `monitor` on the same run did not print. The provenance renderers now take the canonical status and print only what it admits: pipeline, persona-override, and escalation detail behind a verified seal, and the autonomy detail (`autonomy: full-auto mode=… dangerousBypass=…`) only when the projection reports that axis in a recorded state, without the axis word, which the trust summary alone prints. A bundle whose seal was rejected or retired prints no provenance block, `transcript.md` adds no provenance sentence, and `trace.cleaned.jsonl` carries no provenance fields, for the same reason. Without a projection at hand no axis detail is admitted at all, so the dispatch line stops rendering the axis a third time and agrees with `monitor`. A regression test builds a bundle from a receipt at the previous integrity version, and another from a tampered one, and pins that neither rendered output contains an autonomy value.
+- One trust verdict, worded the same way on every surface (#162). #154 defined the algebra and #157 derived receipts and bundles from it, but nothing projected either: two hand-rolled formatters dumped the same six raw axis states with different separators and different completeness, and neither answered who claims this, what was observed, what was independently checked, and what remains unknown without reading receipt internals. A single `evidence inspect` printed the same autonomy fact twice in two vocabularies two lines apart, and it shipped in four spellings across the codebase. Dispatch and monitor collapsed `failed`, `ungrounded` and `absent` validation grounding into one string while the bundle for the same run distinguished them. Evidence findings read two of the six axes, so twelve local runs finished with incomplete completion evidence and nothing said so. The Alt+W board rendered no canonical trust at all, only `host_verification`, which reads as independently verified beside a run whose canonical `independentReview` is `absent`. There are now one compact human projection and one bounded, versioned machine projection carrying references to the detailed artifacts, and dispatch, monitor, the evidence CLI and its reports, findings, the TUI board, the receipt view, and the eval metrics all render the same verdict for the same input. A trust-status glossary is in the docs.
+- The canonical trust status stops reporting valid context provenance as invalid (#162). A `none`-tier run that received the workspace root records real characters, a content hash, and a section, and the adapter refused exactly that shape, so 58 of 91 local receipts and every evidence bundle on this machine read `contextProvenance: invalid`. The axis was invisible on every surface, so nothing surfaced it until the projection above was built. The adapter's rule was written eight days after the producer's behavior shipped and encoded a docblock that was already stale rather than a deliberate stricter model, so the adapter is widened, the docblock is corrected, and the shape a real workspace-root run produces is pinned by a test taken from an actual receipt.
+- The five standing npm audit advisories are cleared, and the release gate now refuses a shipped high (#199). All five reached the published tarball through `@anthropic-ai/claude-agent-sdk` and its MCP dependency chain rather than stopping at the development surface, contrary to the assumption that had let them stand: `package-lock.json` marked every one `"dev": false`. The remaining high was self-inflicted, since this repository's own `overrides` pinned `ip-address` at exactly `10.2.0`, which sat inside an advisory range that had moved past it while the pin held. Dropping that pin and updating four packages within their already-declared semver ranges takes `npm audit` to zero, and the lockfile diff adds and removes nothing: `ip-address` 10.2.0 to 10.5.0, `fast-uri` 3.1.2 to 3.1.6, `hono` 4.12.25 to 4.13.5, `@hono/node-server` 1.19.14 to 1.19.17. Nothing had ever run `npm audit`: CI installs with `--no-audit`, and `scripts/check-release.mjs` audited package contents without asking whether those contents were vulnerable. It now runs `npm audit --omit=dev`, fails the release on a high or critical in a shipped dependency, and prints moderate and low without blocking. There is no environment-variable escape, so shipping a known high takes a reviewable edit.
+- `/council --synthesis vote` asks its members for the verdict it tallies, and produces a real tally (#230). The vote is a strict majority over the final round's structured `verdict` fields, and nothing ever asked a member for one. A council that names no agent seats the builtin `researcher`, whose `research-report` contract accepts `source` and `findings` and nothing else, so a member that emitted a verdict failed its own postcondition and a member that obeyed it emitted no verdict. Every unnamed council's vote resolved to `no_verdict_field` with an empty tally, on every input; the 0.3.7 release test observed exactly this and read it as the specified deterministic behaviour. A vote council now carries a bounded ballot directive on each member's task and seals a new `council-ballot` postcondition, `{"verdict":"...","text":"..."}`, as a per-request override in place of the seated recipe's contract, the same way `reviewer`, the compete `judge`, and the council synthesis already answer the gate that dispatched them rather than their recipe. The seat, the persona, the `shadow` audience, the read-only autonomy, and the `council-read-only` tool profile are all unchanged, and no agent recipe may declare the kind, so a council still runs the agent the operator seated and any recipe can now be voted with. The verdict is bounded to a single line of 64 bytes and lower-cased at the one place a verdict is read, because a tally groups by the exact string and a verdict that is a sentence can only ever tie with itself. A member that seals no conforming ballot spends its ordinary repair rounds and then fails its own run, so a missing verdict is reported as a failed member instead of vanishing from the count. Plan admission composes the same task suffix as the runner, so the approval artifact the plan hash binds shows the ask the member receives. Two things on the override path had to be corrected for it to work at all. A `resultContractOverride` now reaches the worker whether or not the seated recipe declares a contract of its own, matching the resolution the seal has always used; previously the override was sealed but never sent, so the worker spent no repair round on a shape it was never told about. And the worker re-parses its own `WorkerSpec.resultContract` before its first model call through what was the agent-recipe frontmatter parser, which refuses any kind a recipe may not declare, so the first live vote council died with `[worker] fatal: agent recipe: WorkerSpec.resultContract: resultContract.kind is unsupported`; the wire parser is now its own entry point that admits the recipe kinds plus the ones the coordinator authors, and the frontmatter parser stays exactly as strict as it was.
+- A fleet's `assignments.json` row reports the fleet's own verdict instead of whichever step settled last (#225). Every step of a fleet dispatches under the same `lineage.rootRunId`, so all of them share one durable assignment row, and `settleStoredAssignment` had no once-only guard where the in-memory registry has one. Each agent step overwrote the status in turn, so a run that aborted at step 2 of 7 and a run whose final code step exited 1 were both recorded `succeeded`. The receipt was not lying: a write-boundary verdict is applied by the scheduler after the receipt seals, so the assignment path never saw it. A fleet run now claims its row at open, files every settled step as an attempt including code steps, and settles the row once from its own whole-run verdict on both the normal and the throwing path; an attempt-path settle against a claimed row records its attempt and cannot write the status. Orphan reconciliation no longer resolves a claimed record to `succeeded` on the strength of one green attempt, which would have turned a crashed fleet into a successful one on the next startup.
+- The test harness refuses a `.git` at the system temp root and names whoever tried to make one (#205). A stray empty `/tmp/.git` makes `isInsideGitRepo` report every `mkdtemp` scratch as sitting inside a git repository, which drops `--no-require-git` and fails the ignore-policy contracts from whichever lane happens to run them. The creating test was not identified across 28 full suite runs, live `node:fs` and `node:child_process` instrumentation, and a static sweep, so the guard is the fix instead: an in-process write to `<systemTmp>/.git` or `<runRoot>/.git` throws before the entry exists with the test file and line in the stack, a synchronous spawn that creates one throws with its argv and cwd, an asynchronous one is reported at process exit, and `scripts/shard-tests.mjs` backstops the whole run for a creator outside every lane. The guard never deletes, because a `.git` under the system temp root can belong to somebody else. The run root is guarded alongside the system temp root because the same parent walk passes through it.
+- `/council --synthesis judge` runs, seals, and shares as a council (#221). Three defects sat on the default path. Admission refused the whole council before its first member ran, because the persona-override guard counted any non-empty system prompt and the judge carries the coordinator's own `COUNCIL_JUDGE_PROMPT`, while every unnamed council seats the builtin `researcher`, a `shadow` recipe; the ACP delegation path already exempted a bounded gate-role prompt and the two ordinary paths had drifted from it, so all three now share one predicate that stays pinned to one exact prompt text under one gate role and read-only autonomy. The synthesis slot then kept the seated recipe's result contract, so a correct judge answer of `{verdict, text}` sealed a contract failure against `research-report` and burned the configured retries reproducing it; `synthesis` now joins `reviewer` and `judge` as a gate role that answers the coordinator rather than its recipe. And the whole-council-report seal was guarded to vote and none, so `/share <judge synthesis runId>` rendered the bare judge payload with no member answers or roster labels, the exact state the 0.3.7 release test called unusable; judge now seals on the same terms, and the shared block carries every final member's labelled answer plus `[synthesis judge] verdict … · judge run …`.
+- The write boundary no longer rolls back a file the step never wrote, and no longer certifies a window it could not observe (#219). Enforcement derived violations from the working-tree diff over a step's window alone, so a file an operator edited in their own editor while a fleet ran was attributed to the step and restored from the baseline commit. A change is now blamed on a window only when it intersects what that window's runs recorded writing, drawn from the same tool-call fold that grounds a sealed mutation report; anything else is reported as an unattributed concurrent change and left exactly as it is. The record is treated as closed only when it can be: a run that made a successful call to a tool whose arguments cannot name what it writes (`bash`, `verify`, `dispatch`, `steer`, or any unregistered or MCP name, derived from the action classifier rather than a hand-written list) files no usable record, and its window keeps the previous behavior of blaming the whole diff. A blocked or failed call leaves the record closed, because it never reached the filesystem. The verdict gains `unattributed` and `attributionComplete` so it says which of the two it did. Separately, a declared write path that git ignores is now refused at `fleet validate`, at `fleet run` preflight, in the `/fleet run` preview, and when a delegation plan splices a step in, naming the path and the ignoring rule: `git status` cannot report an ignored path, so such a boundary could only ever certify an unobserved window as clean. The existing refusal to touch a path that was already dirty when the window opened is unchanged.
+- `configure` refuses a model the target does not advertise, and health distinguishes reachable from serving (#220). The command already fetched the server's model list to populate `wireModels`, but validated `--model` against the static provider catalog, which is empty for `lmstudio` and every runtime like it, so `src/cli/validate-model.ts` passed any string and the target saved as `ok`. It now checks the live list where there is one, refuses an unadvertised id while naming the ids the server does list, and takes `--force` to save one anyway. A runtime with neither a catalog nor a live list warns that the id could not be verified rather than implying it was. A loaded LM Studio model is accepted under either its instance id or its model key, since the request path resolves both. `targets --probe` gains a `degraded` health state for a target that answers but cannot serve its own `defaultModel`, judged only from a live list on a runtime with no static catalog so a cloud target can never be misread, and the row prints the reason beside the model. `doctor` reports a configured `defaultModel`, `orchestrator.model`, or `workers.default.model` that the target does not advertise. ACP treats `degraded` as reachable, because a client naming its own model can still use the target. The `README.md` quickstart and the two docs copies stop instructing readers to pass `your-model-id`, which produced a target that saved cleanly and failed on its first turn.
+- A version 5 `kind: gate` step that also declares `writes` is refused by name (#217). The gate derives its whole write boundary from `path`, and the refusal now reads `gate step '<id>' must not declare 'writes'; its write boundary is derived from 'path'` instead of `/steps/0: must have required properties scope`, which named a property the author never touched. The check runs before schema validation, alongside the existing version-gate assertions, so `fleet validate`, `fleet run`, and the `/fleet run` approval preview all print it.
+- Settings Center number editors report a refused value instead of dropping it (#218). Every number row now resolves its bound from one shared rule table (`budget.sessionCeilingUsd`, `watchdog.cadenceToolCalls`, and the three `delegation.defaults.*Ms` rows), and the editor and the apply path read the same rule, so a value the editor forwards is never dropped later. A refused submission keeps the editor open and prints the reason under the input in the words the config validator would use for the same key (`Not applied: expected an integer >= 1, got 0.`); Esc still leaves without applying, and a corrected value clears the reason and continues to the scope prompt. Three previously silent drops on that path become named refusals: a blank on the three timeout rows used to parse as zero and be discarded, a blank on `budget.sessionCeilingUsd` used to set the ceiling to zero, and a fractional `watchdog.cadenceToolCalls` used to be floored. A contract test pins the row set, so a sixth number row added without a rule fails it.
+
 ## 0.3.7 - 2026-08-24
 
 ### Added

package/README.md

@@ -73,7 +73,11 @@ decision afterward.
   compiled prompt and tool schemas byte-stable so a llama.cpp prefix cache
   stays hot across turns and sessions, bounds every tool result so one `grep`
   cannot blow the window, and records a per-call cache verdict in the ledger
-  so you can see when and why the cache went cold.
+  so you can see when and why the cache went cold. It also sends that prefix
+  ahead of your first keystroke on a session start, a resume, or a compaction,
+  and counts request slots per inference endpoint rather than per node, so a
+  fleet cannot admit four workers onto a one-slot server the orchestrator is
+  already streaming against.
 - **Work goes to bounded workers, not one long context.** The orchestrator
   dispatches focused agents with explicit tool profiles, call budgets, cost
   ceilings, and typed result contracts. A worker that cannot produce a
@@ -127,7 +131,7 @@ Scripting the same setup the wizard performs:
 
 ```bash
 clio-coder configure --id local-lmstudio --runtime lmstudio \
-  --url http://localhost:1234 --model your-model-id \
+  --url http://localhost:1234 --model qwen3.8-27b \
   --set-orchestrator --set-fleet-default
 clio-coder targets --probe
 
@@ -135,6 +139,11 @@ clio-coder auth login anthropic-max     # or: openai-codex
 clio-coder configure --id claude-sub --runtime anthropic-max --model claude-sonnet-5 --set-orchestrator
 ```
 
+`--model` must name an id the server advertises; `configure` asks the server
+and refuses one it does not list, naming the ids it does. `qwen3.8-27b` is the
+id LM Studio gives the recommended model above; substitute whatever `lms ls`
+shows for yours.
+
 > [!NOTE]
 > Connecting a Claude Pro/Max subscription over OAuth uses the same path as
 > Claude Code. Using subscription credentials outside a vendor's first-party
@@ -274,7 +283,7 @@ dist-tag instead.
 From source, pinned to this release:
 
 ```bash
-git clone --branch v0.3.7 https://github.com/iowarp/clio-coder.git
+git clone --branch v0.3.9 https://github.com/iowarp/clio-coder.git
 cd clio-coder
 npm run install:local
 export PATH="$HOME/.local/bin:$PATH"
@@ -300,7 +309,7 @@ Full lifecycle details, including `reset` and the upgrade path, are in
 
 ## Status
 
-The current release is **v0.3.7**, installable from npm as
+The current release is **v0.3.9**, installable from npm as
 [`@iowarp/clio-coder`](https://www.npmjs.com/package/@iowarp/clio-coder) or
 from source. Clio Coder is still experimental: we ship quickly, interfaces may
 change between minor versions, and model-specific behavior varies by target, so

package/dist/{acp-SK4MD6MM.js → acp-7LOELQFP.js}

@@ -6,31 +6,31 @@ import {
 } from "./chunk-2VTFPG5O.js";
 import {
   runClioCommand
-} from "./chunk-MXI6J5JF.js";
-import "./chunk-YD734TPH.js";
+} from "./chunk-B5XRQOLB.js";
+import "./chunk-FALJGAWU.js";
 import "./chunk-HKIYEGME.js";
-import "./chunk-DOOEX22V.js";
-import "./chunk-465YSENW.js";
+import "./chunk-IFBNV6H6.js";
+import "./chunk-56KB5IJP.js";
 import {
   printError
-} from "./chunk-PPAMZ32Z.js";
+} from "./chunk-XK56QHLX.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-JRIO5UD2.js";
-import "./chunk-UHXRNZ2J.js";
-import "./chunk-4DGYLA73.js";
-import "./chunk-LL4KHSZI.js";
-import "./chunk-SST6Z5JA.js";
+import "./chunk-PNY46YEY.js";
 import {
   MAX_TIMER_DELAY_MS
 } from "./chunk-FQ4SKYE4.js";
+import "./chunk-IWHMRKLL.js";
+import "./chunk-XDOQXGFO.js";
+import "./chunk-LL4KHSZI.js";
 import "./chunk-4ZG3XFUR.js";
+import "./chunk-EQ63NRB7.js";
+import "./chunk-SST6Z5JA.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
 import "./chunk-APJ265NV.js";
-import "./chunk-YXLYO42X.js";
 import "./chunk-BNAZZHFG.js";
 import "./chunk-WEPFGWHJ.js";
-import "./chunk-IWHMRKLL.js";
+import "./chunk-YXLYO42X.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -126,4 +126,4 @@ export {
   resolveAcpCwd,
   runAcpCommand
 };
-//# sourceMappingURL=acp-SK4MD6MM.js.map
+//# sourceMappingURL=acp-7LOELQFP.js.map

package/dist/{agents-2FN2K6ME.js → agents-FIBG2SHA.js}

@@ -1,69 +1,73 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   SafetyDomainModule
-} from "./chunk-J7PIKKWC.js";
-import "./chunk-JTSEDYVQ.js";
+} from "./chunk-WXCJ7VME.js";
+import "./chunk-DG4M6ZUE.js";
 import {
   ensureClioState
-} from "./chunk-3HAPLH5M.js";
+} from "./chunk-T3Z6VAAF.js";
 import {
   ConfigDomainModule,
   loadDomains
-} from "./chunk-BMWK7ZIZ.js";
-import "./chunk-YD734TPH.js";
-import "./chunk-RVG5JXAL.js";
+} from "./chunk-465CC7FK.js";
 import {
   AgentsDomainModule
-} from "./chunk-UVDSQ6LW.js";
+} from "./chunk-YSEHGPCT.js";
+import "./chunk-HCBCAYZU.js";
 import "./chunk-DR52UMZW.js";
-import "./chunk-C4JBQ5SR.js";
-import "./chunk-2SFS6XQE.js";
-import "./chunk-ZWLZP4ZT.js";
-import "./chunk-KCMKRQX4.js";
-import "./chunk-IR4CFBFN.js";
+import "./chunk-AD7Y7STJ.js";
+import "./chunk-AMKHQW3C.js";
+import "./chunk-FALJGAWU.js";
+import "./chunk-BVDVID7E.js";
+import "./chunk-RVG5JXAL.js";
+import "./chunk-3DPEIQKN.js";
+import "./chunk-HPCTNZM2.js";
+import "./chunk-RKKLTLYB.js";
+import "./chunk-5QKCQQ3E.js";
+import "./chunk-HAY4ZE2P.js";
 import "./chunk-UOV2BYIW.js";
-import "./chunk-OBMAI2DP.js";
-import "./chunk-GH5622CP.js";
-import "./chunk-HWUFFB6L.js";
-import "./chunk-DJNLUABN.js";
+import "./chunk-7C6RYZGQ.js";
+import "./chunk-N3PBVRTZ.js";
+import "./chunk-A2NJGIB3.js";
 import {
   isUserVisibleAgent
-} from "./chunk-AOCYTWAV.js";
+} from "./chunk-S4COXYBG.js";
 import "./chunk-MV3K5QF2.js";
+import "./chunk-RAPCMZL4.js";
 import "./chunk-UL3WSD3F.js";
 import "./chunk-ECH6PKUQ.js";
 import "./chunk-5B2AEOW5.js";
 import "./chunk-CGKSTWHD.js";
 import "./chunk-XPLRXC72.js";
-import "./chunk-SROCI7ZU.js";
-import "./chunk-DOOEX22V.js";
-import "./chunk-465YSENW.js";
+import "./chunk-IFBNV6H6.js";
+import "./chunk-QQ7EKM72.js";
+import "./chunk-56KB5IJP.js";
 import {
   printError
-} from "./chunk-PPAMZ32Z.js";
+} from "./chunk-XK56QHLX.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-JRIO5UD2.js";
+import "./chunk-LU7P4LHA.js";
 import "./chunk-IHXBNWMM.js";
-import "./chunk-UHXRNZ2J.js";
-import "./chunk-4DGYLA73.js";
-import "./chunk-LL4KHSZI.js";
-import "./chunk-SST6Z5JA.js";
-import "./chunk-FO5ZOVUY.js";
-import "./chunk-R346GLFC.js";
-import "./chunk-D4MDIG46.js";
+import "./chunk-B5CSFE7B.js";
+import "./chunk-PNY46YEY.js";
 import "./chunk-FQ4SKYE4.js";
+import "./chunk-ZGVHUX3M.js";
+import "./chunk-RKRLDWD3.js";
+import "./chunk-KV2AOLDF.js";
+import "./chunk-6EJMN2Y3.js";
+import "./chunk-IWHMRKLL.js";
+import "./chunk-XDOQXGFO.js";
+import "./chunk-LL4KHSZI.js";
 import "./chunk-4ZG3XFUR.js";
+import "./chunk-EQ63NRB7.js";
+import "./chunk-SST6Z5JA.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
 import "./chunk-APJ265NV.js";
-import "./chunk-YXLYO42X.js";
 import "./chunk-BNAZZHFG.js";
-import "./chunk-6EJMN2Y3.js";
 import "./chunk-WEPFGWHJ.js";
-import "./chunk-X2KV5FXT.js";
-import "./chunk-ZGVHUX3M.js";
-import "./chunk-OB5HIGJY.js";
-import "./chunk-IWHMRKLL.js";
+import "./chunk-NUGM5KR6.js";
+import "./chunk-YXLYO42X.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -72,7 +76,7 @@ import {
 init_esm_shims();
 var HELP = `clio-coder agents [--json] [--all]
 
-List user-facing agent specs from built-in, user, and project recipes.
+List user-facing agent specs from built-in, extension, user, and project recipes.
 
 Flags:
   --json   emit specs as JSON instead of the formatted table
@@ -123,4 +127,4 @@ function renderLine(spec) {
 export {
   runAgentsCommand
 };
-//# sourceMappingURL=agents-2FN2K6ME.js.map
+//# sourceMappingURL=agents-FIBG2SHA.js.map