@iowarp/clio-coder 0.3.8 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,108 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.4.0 - 2026-08-31
+
+### Added
+- ACP clients can discover Clio's existing terminal setup flow directly from `initialize`: the server advertises `clio-login` as a terminal authentication method with `auth login` arguments. Editors and generic ACP launchers can also start the same dynamically dispatched, stdout-clean server path with the global `clio-coder --acp` alias; the canonical `clio-coder acp` command remains unchanged.
+- Clio can vendor pinned external programs through one registry instead of hunting them on `PATH` (`clio-coder tools list|status|install|remove <id>`, with `clio-coder panes install` as an alias for herdr). The registry pins herdr 0.8.2, yazi 26.8.15 and croc 11.3.6 with a per-platform url and sha256, license, binary names and a minimum acceptable `PATH` version, and every caller shares one resolution ladder of `PATH`, then vendored, then none, through `resolveBinary(name)`. Clio bundles none of them: nothing is downloaded until an operator asks, nothing reaches the filesystem before the checksum matches (side documents included, so a tampered LICENSE refuses as loudly as a tampered binary), and each version directory keeps the upstream license text plus a `clio-install.json` recording what was fetched. Installs are atomic through a staging directory renamed into place, and `--force` parks the old version rather than unlinking it, so a failed replacement restores what was there. Archive reading is self-contained on `node:zlib` rather than shelling out to `unzip` and `tar`, which fail on exactly the machine a vendored-tool installer exists to serve. herdr, yazi and croc each declare linux-x64, linux-arm64, darwin-x64 and darwin-arm64, and yazi and croc add win32-x64; croc's Windows hash is confirmed against upstream's own checksums file, and both Windows assets were installed end to end through the real installer, though neither has been executed on Windows. herdr declares no Windows asset even though it publishes one: alongside `herdr.exe` that zip carries a ConPTY runtime that has to sit in a subdirectory beside the executable, and the installer places every declared member flat under its basename, so the entry would produce an install that verifies and unpacks cleanly and cannot run. A `PATH` copy is accepted only above the registry's floor, and a floor moves on measurement and on nothing else: croc floors at 11.0.0 because it negotiates its relay protocol by major version; herdr floors at 0.7.5, the oldest release whose `herdr api schema --json` was actually read, because every method Clio's mux domain sends exists in both 0.7.5 (protocol 17) and the 0.8.2 pin (protocol 20), the only two methods 0.8.2 adds are ones Clio never sends, and the two non-universal methods are already gated at runtime by protocol number, so the registry had been stricter than the surface it guards; yazi stays at its pin because no equivalent measurement exists, since `ya emit-to` matches at 26.1.22 but the generated profile and the DDS pick payloads were never driven there and a profile mismatch degrades into a file manager that opens and quietly does the wrong thing. A rejection that felt noisy is not evidence, and a floor lowered without one is the kind of failure that reads as a bug in the feature. The cost of a floor is now legible instead of silent: a rejected `PATH` copy is never reported as a missing binary, and every render of a rejection names the binary found, the version it reported, and the floor it missed. The install command is offered exactly where installing would change something, so a tool that already has a vendored copy says Clio runs that copy instead, and a platform with no pinned asset names no dead-end command. `clio-coder tools status` carries the same rejection as its own line plus `floorRejection`, `remedy` and `installedVersions` fields under `--json`. `clio-coder doctor` reports one row per registry entry through the same sentence, and no row can fail an install, because every pinned tool is optional.
+- A vendored tool can be removed, and a pin bump no longer leaves the version it replaced on disk. `clio-coder tools remove <id>` deletes every vendored version of one tool and the tool's own directory, refuses an id the registry does not know while naming the ids that exist, and is a successful no-op with a clear message when nothing is installed. It needs no confirmation because everything it unlinks lives under `<data>/tools/<id>`, which Clio created by downloading it, so the worst outcome is a re-download of bytes the registry pins by checksum. A successful install then prunes: superseded versions of the same tool are deleted and named in the result and the output, including on the already-installed path, which repairs a machine that bumped pins before this existed. `clio-coder tools remove --all` sweeps every row in the registry, counting the tools that had nothing vendored rather than listing them and taking the worst exit code across them; `--all` alongside an id is refused rather than resolved by precedence, and `--all` on any other verb is refused rather than ignored, because a silently dropped flag would let `tools install --all` read as a request that was honored. A dot-prefixed staging directory is left alone while it could still belong to a live installer and swept once it is an hour old, which is the one signal that means the same thing on every machine: the installer downloads and verifies every checksum before it creates that directory, so a stale one is the remains of an install that was killed, and a removal that finds a fresh one leaves the tool directory in place rather than destroying the install it belongs to.
+- Clio gains a pane layer that drives a herdr session it is already running inside, and degrades to exactly today's behavior everywhere else (`/panes show|open|close`, a `panes` tool, five `doctor` rows, and a `panes` settings group under Fleet). Detection is a three-condition ladder of `HERDR_ENV=1`, then a connectable socket in a fixed candidate order, then a ping answered inside one second, and the order is what makes the off path free: with `HERDR_ENV` unset nothing opens a descriptor. **Guest mode only.** `panes.enabled` accepts `auto`, `embedded` and `off`, but `embedded` resolves to none with the reason `embedded mode is not implemented yet; it ships in phase 5`, so Clio never starts a pane host of its own. The dispatch bridge subscribes to the five dispatch lifecycle channels plus interactive status, folds each run into a display record, and projects those records on a trailing-edge 250ms throttle, because herdr answers one request per connection and a call per event would open a socket per event; a fifty-event burst produces one pane update. The open decision is made at flush time rather than at start time, which is what lets `panes.agents = auto` cover detached batches and attach-to-background conversions without racing the durable record that names them, and what lets a run backgrounded halfway through acquire a pane then. A terminal run that never had a pane never gets one; `panes.keepFailed` governs whether an existing pane outlives its run. Run state maps to `working`, `blocked` for an unresolved permission escalation, and `idle` with a `state_labels` override reading "review ready" on terminal. Every mux method is best-effort: a wedged herdr server degrades `available()` to false for a five second cooldown and can never fail a dispatch or surface as a run error. Pane ownership is enforced both by a registry of the panes Clio created and by a `clio_owner` metadata token, so `doctor` can find orphans. `/panes open` takes a preset or operator argv, told apart at parse time, and probes a preset's binary through the toolchain ladder before splitting the pane, so a missing program becomes an install hint rather than a pane that dies the instant it appears. The `panes` tool is registered only when detection answered, so it is absent from the prompt on a machine with no pane host, and its `open` accepts a closed preset enum, refusing a fabricated `argv` field loudly. `panes.enabled` is restart-scoped in the Settings Center because the detection ladder runs once at boot. Terminal-state toasts under `panes.notifications` are implemented but their failure path is not verified against a live host.
+- A pane can now be a file picker whose selections come back into the prompt, governed by four live `panes.yazi` keys (`enabled`, `mode`, `profile`, `followCwd`) surfaced together under Terminal. Clio generates its own yazi profile in an isolated cache directory from its theme tokens and a vendored `git.yazi` plugin, stamping every compatibility input and validating the emitted TOML before a pane consumes it, so the operator's own yazi configuration stays outside Clio's read and write set and a malformed generated file cannot leave an interactive pane blocked on a prompt. `doctor` and `tools status` report the profile state, so the separation is visible and only the reproducible cache can be reset. The emitted bytes, the legal theme keys and the unused pick chord are pinned against the upstream 26.8.15 presets, so a future yazi pin bump fails in contracts rather than in a session. Picks return over yazi's DDS stream rather than through a chooser file, because yazi exits on its first non-interactive open and a chooser file therefore cannot support a long-lived companion; the pane's DDS stdout is redirected through the existing mux exec delivery and tailed as a bounded stream, and the session learns its instance id from startup `cd` events so cwd can be pushed later. **The remote event ability is treated as untrusted local input.** Every companion carries a random token, and the bridge rejects and counts custom lines that do not echo it before any text reaches the draft; valid selections are deduplicated, bounded, rendered as safe mentions only when Clio can consume them, and appended with no submit capability. Chooser mode remains the operational fallback: a missing startup stream closes the suspect pane and falls back to it, and `profile: user` forces token-free chooser mode outright. The bridge attaches to the Phase 3 panes runtime rather than adding a competing slash implementation, so `/panes` reports mode, cwd, stream freshness and rejected DDS traffic, and `--once` carries through the parser. A mux contract that resolved to none still composes operator pane operations while leaving the model tool unregistered, so the same command lends the terminal to yazi under the TUI lease, restores the screen, and feeds chooser results through the same formatter the companion picks use, with binary and profile checks finishing before the screen is released. A failed yazi resolution now crosses onto a durable slash transcript block verbatim, install hint included, instead of producing no pane and no explanation.
+- Every dispatched run now writes an append-only NDJSON journal at `<stateDir>/runs/<runId>/events.ndjson`, and `clio-coder fleet view <runId> [--follow]` reads it, so a second terminal can watch a run in flight over plain SSH with no pane host involved. Each line carries a per-run monotonic `seq` and a wall-clock `at`; display-only lines are the only droppable kind, and crossing the 2 MiB per-run cap writes a single `journal_truncated` marker and stops writing them while open, receipt and terminal lines always land. A terminal line closes the run, so a follower has an unambiguous stop signal. Writes batch into one `appendFileSync` per flush, and a write failure turns the journal off for the process after one notice and is invisible to the dispatch. The writer runs off the dispatch domain's own bus rather than off any caller's helper, so it covers `run --agent`, `fleet run`, the TUI `/run` and the model-facing `dispatch` tool alike, attached, detached, batched or retried. **A retried run journals each attempt**, because the domain publishes per attempt. Retention is bound to the ledger ring rather than to a second policy, so the two cannot disagree about how much history exists, and `clio-coder reset --state` already takes it. The viewer authenticates the receipt through `inspectRunReceiptTrustStatus` before showing any of its fields and bounds task text at the terminal boundary. `fleet view` also accepts the `root=fleet-<hex>` identifier `fleet run` advertises, reducing the durable fleet record plus the ledger to a step index with one line per step in planned order, showing steps that never ran without a run id so a fleet that stopped early reads honestly. It is deliberately not a combined transcript, because the durable record carries no interleaving and splicing several runs into one scroll would invent an ordering nothing observed.
+- LiteLLM is a first-class provider runtime rather than something reached over `openai-compat`. A gateway's `/v1/models` is the plain OpenAI listing, so every semantic alias flattened to a bare id and a 262k tool-calling coder behind `code` fell back to the protocol defaults of `tools: false` and an unverified context floor. The runtime reads `/v1/model/info`, where LiteLLM publishes `max_input_tokens`, `supports_function_calling`, `supports_vision`, `supports_reasoning` and the deployment mode per alias, reports the physical model behind each alias in its probe notes, and probes the unauthenticated `/health/liveliness` first so an unreachable gateway is distinguishable from a rejected key. Structured output was measured rather than assumed against a LiteLLM v1.98.0 proxy fronting both a llama.cpp and an LM Studio upstream: standard `json_schema` is enforced through both, `json_object` plus schema is enforced through llama.cpp and refused with HTTP 400 by LM Studio, and `drop_params: true` strips neither because `response_format` is a parameter LiteLLM recognizes and forwards whole. Only `json_schema` is declared, which is what admits contract-bearing workers to a gateway target at all. The runtime also opts into `responseSchemaConflictsWithTools`, conservatively, because whether a schema and a tool surface can constrain one completion is a property of the upstream a runtime id cannot identify. Synthesis forces `gateway: true` regardless of settings, keeping the residency layer observe-only, since the models behind an alias are the proxy's to load and evict. The routed deployment is surfaced from the `x-litellm-*` response headers, because reporting the alias back as the model is how a gateway hides an outage.
+- An ACP client can now build a live fleet board and attribute every frame to the agent that produced it. Five dispatch lifecycle channels join the `clio-coder/event` stream, whose channel list becomes a real allowlist: a client names the kinds it wants at `initialize`, the server intersects that with `ACP_FORWARDABLE_EVENT_KINDS`, and a malformed request still refuses the whole opt-in rather than only the offending entry. What crosses is sanitized. The exact dispatched task never leaves the process, only a control-character-stripped, byte-bounded preview carrying the standard truncation marker, and free-form `outcomeDetail` failure prose stays host side because it legitimately quotes paths, argv and provider bodies. The untyped worker event stream behind `dispatch.progress` is replaced by a capped per-run progress ordinal whose cap is announced by a final truncation frame rather than by going quiet.
+- The workbench consumes that boundary at protocol v4, rendering agent attribution on messages and tool calls and a live fleet strip, so orchestrator work and delegated worker work are distinguishable on screen instead of both reading as the product name.
+- Typed dispatch intent has one migration and refusal policy instead of four files that each answered part of it (#163). `src/domains/dispatch/intent-compatibility.ts` classifies a request into accept, warn, or refuse against a closed set of stable reason codes, and the boundary between warn and refuse is the load-bearing rule: a warning is never the difference between a narrow grant and a wide one, so no compatibility path widens read, write, or verification authority to resolve an ambiguity, and a compatible reading that disagrees with a declared one about what a worker may touch is a refusal rather than the union of the two. Omitted intent stays accepted with a warning, because inferred paths select project rules and compile worker context but can never become a write boundary or add a verification requirement. Refusals are contradiction and uninterpretability: legacy `writeRoots` disagreeing with `intent.write_roots`, a narrowed scope reaching outside the intent it narrows, `write_roots` on a read-only request, an `expected_outputs` entry outside every declared write root (the write boundary would block exactly the artifact the task is required to produce, after a full worker run has been paid for), and an `intent.version` this build does not speak. The supported version set is a membership list rather than a range and nothing is migrated: a reader that accepts "2 or newer" accepts fields it cannot interpret and one that accepts "2 or older" reads a v1 statement about authority under v2 rules, which is the ambiguity typed intent exists to remove. The classifier runs inside `validateJobSpec`, which every producer reaches a worker through, so the rules hold for the fleet, CLI, ACP, and extension paths rather than only for the model-facing tool, and it reads no filesystem, clock, environment, or package layout, so a source checkout and an installed package classify identical input identically. Two authority mismatches that previously ran are now closed: the unproducible expected output above, and a council member inheriting its caller's declared write roots under read-only autonomy, which now arrives with those trees demoted to read roots instead of claiming a write scope nothing enforces. Removing the legacy inference fallback stays a later explicit issue, and it now has a measured gate rather than an argued one: `pathScope.mode` is sealed on every receipt, so `dispatchIntentAdoption()` counts the share of dispatches still resolving policy-bearing scope from prose, reading nothing but that mode field. `docs/dispatch-typed-intent.md` is the published contract, with a row per dispatch producer and per persisted structure.
+- A v4+ fleet contract's per-step `writes:` declaration now reaches project-rule selection and worker context, not only the write-boundary enforcer. The contract had already said what a position may change, and the dispatch request that position produced carried neither typed intent nor `writeRoots`, so scope for a fleet step was still reconstructed by scraping path-like tokens out of the rendered contract prompt. The declaration now compiles into the step's typed intent through `declaredScopeIntent()`, which runs a producer's repository-relative paths through the same normalization, caps, and provenance construction a model-facing declaration goes through, so a contract cannot mint an intent shape the dispatch tool could not. It arrives as `relevant_paths` rather than `write_roots` on purpose: intent write roots become the enforced boundary at the per-tool worker seam, which refuses outright on the subprocess and ACP runtimes a fleet may legitimately route a step to, so restating the contract's boundary there would mint a second grant in a second place and fail closed on contracts that run correctly today. Authority is unchanged; the fleet enforcer keeps owning the boundary. A pre-v4 contract and every readonly step declare nothing and keep the legacy inference path rather than being handed an empty declaration that would quietly switch off path-scoped rule selection for them.
+- An endpoint's discovered parallel slot count now survives the process that learned it. Probe discovery held `probeCapabilities.parallelSlots` in memory only, so every new process started ignorant of a server's real concurrency and priced admission against a default instead.
+- A compete round's candidate worktrees are mapped through herdr when one is driving the session, so each candidate is a workspace an operator can watch instead of a directory only Clio knows about. The mux socket client gains typed `worktree.list|create|open|remove` at protocol floor 10, which is the protocol herdr's own changelog introduces the family at rather than either release currently installed, and Clio omits the optional `trust_repository` field those requests grew at protocol 21 so herdr's default repository-trust policy stays herdr's to set. Creation prefers herdr and then validates that the path and branch it returned are the ones asked for, refusing a workspace opened somewhere else rather than adopting it. Every candidate records how it was made: `backend: herdr` with the workspace id, or `backend: native` with `fallback: mux-unavailable` when no mux is driving and `mux-operation-failed` when a live one refused, and those facts are sealed inside the integrity-verified candidate receipt rather than living only at the mapping boundary, so a competition can be audited after the fact for which candidates herdr actually held. Removal asks herdr to drop a workspace it owns and then always runs the native Git cleanup, which is both the recovery path when a mux is lost mid-competition and the authority that proves the registration, the directory and the branch are gone. A server below the protocol floor is never called, and transport loss degrades to the native path instead of escaping into compete execution.
+- Fleet panes now say what a run is and how it ended, not just that it is running. A pane's role presentation resolves from the gate role first and the agent identity second, and the working and blocked labels follow it: candidates and builders read `building` and `build blocked`, reviewers and judges `reviewing` and `review blocked`, council members `deliberating`, and tester, scout and repair-shaped roles their own pairs, with `running` and `needs input` as the fallback. The idle label carries the outcome rather than the fact of stopping, reading `review ready`, `failed, review`, `timed out, review`, `canceled` or `finished`, so a terminal pane stays distinguishable from an untouched shell. A qualifying failure additionally writes a persistent line into the transcript naming the agent, run, outcome and terminal detail, alongside the existing best-effort herdr toast, and that line is still produced when the mux transport has already gone away, so the auditable signal does not depend on the thing that failed. Both signals stay governed by the existing `panes.notifications` setting. `/panes open` also reconciles immediately: an admitted open is recorded as a pending inventory row before the mux round trip, rendered as `opening`, and cleared when the operation settles, so an inventory read taken while an open is legitimately in flight reports it rather than omitting it.
+- The workbench gains four bounded read surfaces over durable harness state, each following the same shape: a fixed no-argv root command emitting a bounded snapshot, a host adapter demanding the exact key set the command emits, the same bounds revalidated independently in the browser, and a panel that states its own boundary. `clio-coder fleet inspect --json` backs a Runs canvas carrying journal events, receipt trust, outcomes and truncation, and additionally indexes fleet roots so a run's lineage is visible instead of a flat newest-first list; the index rides that same read rather than paying for a second child process, and a step whose run has aged out of the window says so and stays unselectable rather than linking nowhere. `clio-coder tools list --json` backs a Settings instrument that leads with the resolution verdict and names the specific floor a rejected `PATH` copy failed to clear, while installation stays an explicit terminal operation the GUI does not offer. The recovery panel now names every diagnostic check and its verdict rather than reporting only a count, under sections that open themselves on a warning and stay folded when clean. What crosses is deliberately narrow: a finding's name is a fixed check label plus a subject drawn from the ids that already cross elsewhere, and a finding's detail, which quotes settings paths, endpoint URLs, the multiplexer socket and rejected `PATH` copies, stays on the host permanently. Demanding the exact key set in both directions is the load-bearing part, since it makes a harness field addition a loud host-side rejection rather than a silent browser leak. The Runs canvas now joins that durable narrative to `trace inspect --json` accounting from the separate trace store, showing per-run tokens, recorded cost, wall time and phase totals while dropping request text, phase prose, database paths and raw columns, and it distinguishes tracing unavailable, no accounting for this run, and accounting present with an unpriced cost rather than flattening all three to zero. Trace tails and process rows remain host-only by design: SQL crosses only event counts, spans and kind breakdowns plus process counts, live counts and kinds, with both validators proving the aggregates account for themselves, so no event payload, command line, pid or host is ever loaded into the projection. `evidence inventory --json` adds a bounded newest-first bundle inventory that omits tasks, working directories and file names, links only runs still inside the served run window, preserves redaction and tool-call shape, and folds each bundle to the harness's worst canonical trust verdict while naming historical bundles as verdict-less instead of guessing. Detail reads and receipt checks do not reopen the fixed-argv boundary: the browser may echo only an evidence or run id the host served in its current snapshot, the allowlist is replaced rather than widened on refresh, and an unserved, expired, malformed or flag-shaped id is refused before any child process starts. An admitted bundle id opens only the closed-vocabulary per-run trust axes, and an admitted run id may be re-authenticated on demand through `fleet verify <runId> --json`, shown beside rather than in place of the snapshot verdict with the check time and a classified failure cause, so a receipt that was valid when listed can later be reported as changed without carrying a path, digest or thrown message. Council parity is reconstructed from provenance the ledger already seals: a separate bounded council window groups member turns, rounds, judge runs and the zero-cost sealed synthesis row into a topology, while member answers, judge prose and vote tallies never cross and are marked host-only rather than missing. Review and compete outcomes come from their own `fleet decisions --json` read because the integrity-covered gate artifacts have a different store and failure mode; the panel carries the gate kind, closed verdict, graded run ids, classified reason, winner identity where the verdict permits one, and the sealed independence dimensions, counts artifacts that no longer authenticate instead of silently dropping them, and never carries detail prose, branch refs or receipt digests. Settings also gains `interop inspect --json`, a fixed read that names the known coding agents on this machine, whether each is installed, its last recorded version, ACP and adapter availability, standing accept or decline, staleness and whether it is already wired, while deliberately running no foreign executable and carrying no resolved binary, home directory or decision fingerprint; wiring remains an explicit terminal review the GUI does not offer. Fifteen mutation-shaped parity rows are now marked **deferred-by-design** rather than looking like ordinary backlog: installation and credential lifecycle, repair, reset, uninstall, upgrade, fleet authoring and admission, pane installation, sharing and import, extension enablement, handoff, fork and auth operations require a separately designed host-minted intent and confirmation channel before any browser control can change the machine, while mixed rows keep their still-actionable read gaps visible. `apps/workbench/PARITY.md` records the resulting command-by-command baseline so follow-on GUI work cannot overstate what is covered.
+- A modal overlay now says so on the terminal title, so an external driver or herdr's detector can tell that Clio's keyboard is owned before sending keys into it. The grammar is published only while a modal is up, reading `clio [modal:permission-confirm]` for one and `clio [modal:library-install+2]` for a stack, naming the modal that holds the keys and counting the ones beneath it, and `MODAL_MARKER_TITLE_PATTERN` is exported so Clio's contract test and herdr's manifest rule are written against one spelling. The title was chosen over a footer marker because the modals cover the footer: most overlays anchor centre with no height cap and paint over exactly the rows a detector reads, so a footer signal would go quiet on the biggest modals, and a signal that drops out under load is worse than none because it reads as a state change rather than a gap. The title also cannot be counterfeited by a diff or a quoted log line in the transcript, and nothing else in Clio writes it. The claim is taken inside the overlay frame rather than in the overlay lifecycle, which is the one place modality is decided, so nested frames are covered and the marker cannot drift from what is actually on screen; hiding a modal to shell out drops the claim and takes it back on focus. Nothing is written until the first modal opens, which is what makes the absence of a marker a positive statement rather than an unknown. herdr needs no code change to consume it, only a manifest rule and a version bump.
+
+- The Workbench Runs canvas can inspect a bounded window of durable fleet runs, journal events, outcomes, truncation, and authenticated receipt trust through the fixed `fleet inspect --json` read, without accepting a browser-supplied run id, path, filter, or argv.
+- Workbench Settings names the external coding agents detected on the machine, their last recorded versions, ACP and adapter availability, standing decisions, staleness, and wiring state through `interop inspect --json`, while running no foreign executable and exposing no resolved binary, home directory, or decision fingerprint.
+- The Workbench capability atlas crosses the declared verification-check plane through `verifiers inspect --json`, reporting each check's origin, toolchain class, fixed-argv authority, argument count, root-versus-subdirectory execution, and classified catalog rejection while keeping the declaration's executable arguments and repository paths host-side.
+- The Workbench Skills atlas now uses `skills inventory --json` to report the whole installed catalog, including untrusted and operator-only skills the model cannot see, with the shared validity verdict and bounded diagnostic counts while keeping skill bodies, paths, hashes, upstream URLs, and diagnostic prose host-side.
+- The Workbench Runs canvas now inventories a bounded newest-first window of evaluation reports through `eval inventory --json`, grouping reports by comparable serving configuration and showing suite outcomes, scenario reductions, coverage, failures, and attachment counts while keeping transcripts, artifact content, native paths, receipt digests, compiled-prompt fingerprints, and metric values host-side.
+
+### Changed
+- `@anthropic-ai/claude-agent-sdk` moves to `optionalDependencies`, so a default install no longer pays for a 224MB-per-platform proprietary binary reached from exactly one runtime most operators never enable. Measured on Linux x64 with a production install: 387MB across 118 packages with the SDK against 143MB across 109 packages with `--omit=optional`, a **244MB saving**, and the default install becomes cleanly open-licensed because the binary is not redistributable. The one static value import becomes a lazy `await import()` behind a loader that caches the module, distinguishes a resolution failure from a broken install, and turns absence into a typed error naming the package and the exact install command; it fires at the first line of a `claude-sdk` run, so a missing package reads as an ordinary run failure with a diagnostic rather than a crash in the dispatch path or a boot-time resolution error. `tsup`'s default external set covers dependencies and peer dependencies but not optional ones, so the package is now an explicit external; without that, esbuild would have bundled the SDK and quietly restored the hard requirement. npm also drops the SDK's peer tree from the lockfile, since peers of an optional dependency are themselves optional.
+- The pane layer graduates from its initial auto-detected, per-dispatch design into an explicit first-class mode. `clio-coder --with-panes` enables it for one invocation, `--no-panes` wins over both that flag and the persisted setting, and the shipped default is off; the ordinary shell therefore does not statically import herdr, inspect its environment or socket, or pay for mux startup, while `doctor` distinguishes an operator who has not enabled panes from one whose enabled pane host cannot be reached. Enabling the mode dynamically loads the same bounded mux integration after Stage 0 and retains the existing yazi companion, notifications, ownership checks, degradation policy, `/panes` surface and model tool, but dispatch no longer creates, focuses, updates or closes a viewer pane at any lifecycle point. `panes.agents` and `panes.keepFailed` are accepted and ignored during migration instead of preserving an obsolete automatic policy. There is one operator-pulled watch pane instead: Enter on a live run in the Alt+W fleet overlay opens or adopts it, arrowing between runs atomically retargets a bounded selection file without opening another socket or pane, and a terminal selection is refused with a pointer to the post-mortem viewer. `clio-coder fleet view --watch <selection-file>` supplies that pane's long-lived reader, keeps running while no selection or journal exists, renders bounded waiting and unavailable states, and switches through the same authenticated run renderer used by `fleet view <runId>` rather than maintaining a second presentation of receipt trust.
+- Internal quality work with no behavior change: a boundaries rule now guards every external reacher of the instant shell's Stage 0 closure, holding importers to a declared seam allowlist and walking each value-imported seam's closure against a Stage 0 set the rule computes rather than enumerates, so an edge that would split the chunk the shell's startup budget sits on fails `npm run lint` in the worktree that caused it rather than after a full build. The rule began scoped to `src/cli/**` and was widened after a `src/domains/**` edge split the same chunk from a direction it could not see; the closure holds at its 6 chunks and now measures 111,562 bytes against a cap raised from 110,000 to 113,000 for the modal marker, which the bundler groups into the same chunk as the TUI engine whether or not the instant shell can reach it; the byte cap measures chunk co-location rather than what Stage 0 executes, and the forbidden-graph assertions that pin what it must never drag in are unchanged. Contract tests additionally pin the TUI strings herdr's detector matches and the Agents Reference Enter and Tab detail behavior its footer advertises. The test runner now gives every lane its carried load and drains a named serial lane after the 24 parallel lanes for cases whose product-owned timing claim cannot be widened; hang, spawn, settlement, PTY and peer watchdogs scale with that load while behavioral deadlines remain literal. Refreshed shard weights are guarded against stale or missing coverage, asynchronous state is observed instead of guessed from sleeps, fixture connections, rejected spawn memos and PTY timers are closed where their callers can observe it, and every lane has a bounded lifetime and pipe-drain window with diagnostic failure text, turning the former wall-clock-shaped intermittent population into deterministic suite infrastructure.
+
+### Fixed
+- Proactive memory now budgets enough output for thinking models while respecting each model's output cap, uses a one-minute intervention deadline, and degrades visibly to the rules tier after two consecutive LLM timeouts instead of repeatedly spending on a stalled background route.
+- Dispatches now queue behind a saturated inference endpoint under a stable, visible run identity, retain cancellation and deadline semantics while waiting, and start as soon as endpoint capacity is released instead of failing immediately.
+- Debugger, verifier, and research result-contract repairs now name the rejected field and every legal enum choice; completed debugger, verifier, research, and scout envelopes render as readable report prose with semantic footer facts instead of raw JSON.
+- Fleet watch panes now inherit the parent process's resolved config, data, state, and cache layout, diagnose the exact ledger root when a run is missing, and set both the herdr pane label and display title to `clio watch` on supported mux protocols.
+- Interactive run receipts now report operator cancellation as an abort rather than a generic failure, while dispatch route-warning text survives journal projection so fleet viewers and watch panes show the warning that affected routing.
+- `configure --list` now labels keyless local runtimes as `key-optional`, distinguishes required cloud credentials as `needs-key`, and preserves the existing `none` and `credential` states.
+- Configured targets no longer persist probed model catalogs in `settings.yaml`; bounded, versioned, identity-checked per-target snapshots live under the provider cache, preserve offline discovery, and migrate legacy `wireModels` observations on reconfiguration.
+- Settings Center now covers every shipped operator-policy leaf it can safely edit or display, including escalation, prewarm, route activation, guardrails, working-set eviction, retry stall, and library rows, with explicit reasons for the few nested or trust-record settings that remain read-only or YAML-only.
+- Focused `ask_user` option descriptions, expanded decision questions, answers, and corrections now wrap inside their actual containers instead of losing explanatory text at the right edge; `/panes` usage errors also keep their reason and usage line separate.
+- Pass-2 interactive smoke fixes close the remaining lifecycle and narrow-layout gaps as one release wave: `/model` and the model picker now ask whether a swap is session-only, saved globally, or cancelled; exhausted observation budgets become terminal after three bounded retry notices; working-set compaction announces why eviction was skipped before falling back to an LLM summary; and the two-lane Settings footer wraps its complete scope note. Worker approval dialogs now withdraw as soon as their escalation times out or their run terminates, naming the applied fallback without parking the editor; cancelling queued admission renders as an operator abort; endpoint cards separate occupied slots from queued demand; and a relaunched session reclaims its surviving tagged watch pane at startup instead of reporting no owned pane or opening a duplicate.
+- Managed Yazi profiles now prove that the resolved pinned binary accepts their schema before an atomic promotion, rejecting and cleaning up syntax-valid profiles that would fall back to presets, while a permission request parked beneath help or another modal now interrupts as the focused top frame, keeps later approvals in FIFO order, and restores and refocuses the interrupted modal after the decision.
+- The bounded revise loop in `build-review` was unresolvable by construction, and every run of it ended in `loop_bound_exhausted` with two needs-operator-decision lines. The plan compiler gave one rendered prompt body to every agent node, the `build-review` body ended in the builder's "Answer with your `mutation-report`", and the loop's check node was dispatched under `verifier-report`. The verifier obeyed the instruction it was handed, the gate refused the answer against the schema that instruction never mentioned, and both were correct: the run burned its whole repair budget on a contradiction it was given. Each agent node now states its own contract after the shared body, quoted from the same wire example its validator judges, with a precedence line saying that a shape the body names for another step does not apply. `build-review` and `build-test` drop the builder answer instruction their bodies carried for every node to read; `sdlc`, whose body scopes the ask to the agents that produce a work product, is unchanged. Against the same gateway and model that failed 5 runs and 10 verifier cycles out of 10, the loop now resolves on the first verification with no repair.
+- Unpriced work rendered as `$0.0000` on every fleet surface, which is a measured zero and a claim nobody made. A gateway that declares no `pricing:` block, serving a wire model no provider catalog knows, resolves to no rates at all, and the receipt seals that honestly as `costProvenance: "unknown"` beside a `costUsd` of zero and a token count that was genuinely measured. The fleet renders then threw the provenance away and formatted the amount alone. All five of them now consult it, so an unpriced step, an unpriced run total and an unpriced `fleet status` row and its totals read `not measured`, while priced work reads a dollar amount and the token counts show either way, because usage was always observed even when nobody priced it. A run total is folded rather than summed, since adding unpriced zeros to priced dollars produces a number that is neither. A genuinely free call stays distinct from an unpriced one: a self-hosted gateway given a `pricing:` block of zero rates resolves as known-free and renders `$0.00 local`, which is the accurate label. Routing these lines through the shared formatter also narrows priced amounts at or above a cent from four decimals to two, so `$1.2500` now reads `$1.25` while sub-cent amounts keep four; that is a visible change to priced output, taken deliberately, because keeping a second cost formatter on the fleet surface is the drift that produced this defect. One render site on the interactive `/fleet` overlay's summary line is not yet covered and still prints the four-decimal total.
+- Fleet panes did not survive a clean TUI exit, and input focus could end up in a tab nobody was looking at. Neither was the disposal path it looked like. A run viewer was started with `exec`, which replaced the pane's shell with the follower process, so when that viewer exited normally herdr removed the pane whose shell had gone, and with it the Fleet tab when it was the last pane there. The focus defect fed it: the focus ladder treated tab focus as an acceptable substitute when the agent-pane call was refused, so it could report success having focused only the tab, leaving a `q` bound for a viewer in another tab to reach that viewer and turn an ordinary exit into pane and tab destruction. Run viewers no longer use `exec`; the shell line follows, renders one settled snapshot when following returns, and leaves the shell alive, while utility panes keep `exec` because their lifetime is the launched utility's to define. Shutdown closes the subscription and the socket and neither sends `pane.close` nor clears ownership. Focus is now one ladder shared by the slash surface and the agent tool, which focuses the tab, focuses the pane, reasserts pane authority and retries once on refusal, then reads a live snapshot and reports success only when both the focused tab and the focused pane are the intended ones. The slash surface also awaits its pane operations through the serialized queue the agent tool already used, so an inventory read taken straight after a slash mutation cannot observe it half-done.
+- `clio-coder reset --data` deletes vendored external tools and its preview did not say so, describing the data root as memory, evidence and evals. Vendored tools live under that root and are the one thing a reset cannot regenerate locally, so the preview, the command help and the documented role of each root now name them, along with the note that `clio-coder tools install <id>` downloads them again.
+- Whether `/council` worked depended on how many seconds had passed since boot. The endpoint dimension was resolved only from `providers.list()`, which provider startup builds asynchronously while dispatch route resolution does not wait for it, so a council raised before `probeAll()` finished put no endpoint in its reservation and skipped the dimension entirely, which is not a conservative check but no check at all. Eight consecutive attempts against a one-slot llama.cpp box were refused; one raised seconds after startup was admitted and ran both members plus the orchestrator's own turn against that single slot. Capacity now resolves from the configured targets as well as the probed statuses, so admission is independent of probe timing.
+- `clio-coder run "/definitely-not-a-command"` forwarded the token to the model as an ordinary task, opening a session, spending a full turn and exiting 0 with a conversational answer to a command that never ran (#259). The verdict now happens before the orchestrator boots, reusing `parseSlashCommand` as the single shape test and registry walk, so prose still reaches the model (an absolute path carries a separator, and the `\/` escape still works), a prompt template claims its token first, and a mistyped command exits 2 as the usage error it is, costing no session and no model call.
+- The `ask_user` free-text field had exactly one exit, and that exit resolved the whole round as cancelled, so a single-question round had no route from a typed draft back to its options (#260). Esc in the text field now returns to the option list and drops the draft whenever the question has options, with the footer spelling `back` or `close` to say which; cancelling the interview stays available and distinct, one surface further out. Navigating away mid-draft parks the text mode rather than sticking it, so the draft survives in place but the question greets the operator with its options.
+- `/view verify` reduced a receipt verification to a single pass-or-fail sentence, hiding the file and seal an operator needed to inspect and making a compromised trust projection look equivalent to a trustworthy result. The notice now carries the receipt path, sealed digest, canonical trust summary and per-check outcomes, reusing the same trust projection as fleet view and the dispatch board rather than growing a competing vocabulary. Compromised canonical trust renders as a warning naming each compromising axis with its reference, and cryptographic failures retain the presented digest while distinguishing file, contract, ledger and digest checks. The underlying verifier contract, its argument shapes and its refusals are unchanged.
+- A scout dispatched with a directory-survey task died exit 1 with `Scout citation path escapes the workspace: .`, reproduced four times. Two defects sat behind one message: the containment check refused the empty relative path alongside the `..` forms, and the empty string means the citation resolved to the workspace root itself, the one location guaranteed to be inside it; behind that, the reader called `readFile` on the cited location, and a directory has no bytes, so even a contained directory citation would have failed as unreadable and then failed grounding again because a survey lists a directory rather than reading it. Containment is now answered on the resolved pair with the root treated as contained, which also settles the `./src`, `src/` and `./src/` spellings, and a real escape still refuses.
+
+## 0.3.9 - 2026-08-30
+
+### Added
+- Behavioral results now carry an additive, strictly parsed execution envelope that binds prompt fragment ids, versions, content hashes and composition hash to recipe, route, tool surface, autonomy, policy hashes, project-context provenance, and corpus version (#164). Comparisons mark scenario/role rows incomparable when any undeclared envelope field drifts, summarize mean and variance changes independently per scenario and role, and name every prompt- or recipe-affected corpus result. The release check runs all 26 public machinery-only scenarios against a reviewable checked baseline in ordinary CI; intentional updates require an explicit baseline regeneration and diff review, while the live model corpus and its negative control remain separate manual release evidence.
+- The rebuildable SQLite trace mirror is now bounded by a terminal-run retention policy and can be reclaimed explicitly with `clio-coder trace prune` (#226). The default keeps 30 days and at most 128 MiB, configurable with `CLIO_CODER_TRACE_RETENTION_DAYS` and `CLIO_CODER_TRACE_MAX_BYTES`; age and size pruning delete every dependent trace row as one unit while excluding all queued and running runs. The command reports runs, rows, physical bytes reclaimed, protected live runs, and whether `VACUUM` ran. A vacuum rewrites the database once at least 20 percent of its pages are reclaimable or the byte bound requires it, then truncates the WAL, so deleting history returns disk space instead of only filling SQLite's freelist. `clio-coder doctor` now reports the recursive state-directory size and its largest top-level contributor, making a growing `trace.sqlite` visible before it reaches a home-directory quota.
+- An interactive session now keeps an always-on record of its input pipeline and writes it out on `SIGTERM` (#224). A pane that stopped answering the keyboard previously left nothing behind unless `CLIO_CODER_RENDER_TRACE` had been armed before the session started, which nobody does before a bug they have not seen yet. The render tracer runs in every interactive process now, keeping the last 256 `input_ingress` records and the last 256 committed frames in a bounded in-memory ring and writing the JSONL file only when the environment variable names a path. The `SIGTERM` that recovers a stuck pane dumps that ring to `<stateDir>/input-wedge/<timestamp>-<pid>.json`, classified as `input-not-committed` when bytes reached the application and no frame carrying them reached stdout, `no-input-recorded` when the reader delivered nothing, and `input-committed` when both halves moved; the five newest dumps are kept. A PTY smoke test covers `/share` of a worker run and of a council member run against the OpenAI-compatible fixture, asserting a new `input_ingress` record and a committed frame whose `inputHighWater` covers it, in about 5 seconds.
+- Behavioral eval comparison now reports correctness, safety, label violations, tool-call efficiency, unnecessary exploration, delegation quality, unsupported claims, tokens, latency, cost, and repeat variability as separate sourced metric families (#161). Each behavioral result carries an additive role and target/model-bound projection whose unmeasured observations stay null; distributions include coverage, min/max, p90, population variance, and standard deviation. `eval compare` classifies every shared row as improved, regressed, unchanged, or incomparable and supports equivalent text, JSON, Markdown, and JUnit-compatible output. Correctness and safety regressions, including a lost measurement that existed in the baseline, fail independently of pass-rate or cost gains, while threshold files keep release-blocking `fail` assertions separate from non-blocking `informational` budgets.
+- A versioned public behavioral corpus now exercises the shipped agent system without private inputs (#160). Corpus `public-built-in-behavior` 1.0.0 pairs positive and adversarial machinery cases for all 13 built-in worker recipes; every case loads the production recipe catalog, follows real dispatch admission through a scripted worker, and verifies the sealed receipt and result-contract outcome instead of grepping frontmatter. Four isolated `mini` scenarios cover tool choice, exploration, delegation, safety comprehension, claim grounding, denied-tool recovery, completion behavior, and task correctness using per-tool calls and blocks, distinct/allowlisted read counts, decoy hits, and grader-emitted unsupported-claim and completion facts. A live decoy negative control must produce violated exploration and safety labels, and corpus contracts prevent private endpoints, credential values, and mutable external inputs from entering the suites.
+- Behavioral eval scenarios have a versioned, fail-closed contract (#156). Suite v2 tasks can declare bounded expected and forbidden rules across tool choice, exploration, delegation, safety comprehension, claim grounding, denied-tool recovery, completion behavior, and task correctness; deterministic judge inputs are canonicalized from observable transcript, tool, receipt, and grader facts. Artifact v4 stores the result as an additive `clio.eval.behavior.v1` sibling that references the unchanged `clio.eval.verdict.v1` identity, preserving existing readers and the tracked-metrics baseline. `unknown`, `unmeasured`, `behavioral_failure`, and `infrastructure_failure` remain distinct, and malformed, partial, contradictory, or cross-linked verdicts cannot parse as passes.
+- Clio pre-warms the prompt prefix on a local-native target, so a first turn no longer pays for prefill the operator was never going to avoid (#253). After the session prompt compiles at session start, after a resume rebuilds the message array, and after a compaction settles, Clio sends the exact request the next turn would send minus the operator's text: the same system prompt, the same tool schemas, the same replayed messages, the same thinking level, and the same `cache_prompt`, with one single-character user message so the chat template renders the prefix up to the user turn, and `max_tokens: 1`. The payload is built through the same engine dispatcher a turn runs on rather than hand-assembled, because a single differing byte ahead of the user turn re-prefills everything after it. Measured on a llama.cpp router (build `b226-2115b73d8`, Qwen3.8-27B), a resumed 34,951-token session's first turn re-prefilled cold at `promptMs 48617` and 53.2 s to first token; with the prefix already resident the same turn reads it from cache. The round is refused rather than queued whenever it would compete with real work: it never runs off the `local-native` tier whatever `prewarm.enabled` says, never while a turn is in flight or any dispatch is outstanding, and never on a worker or in headless `run`. The round claims one slot on its endpoint while its request is out and releases it in a `finally`, so endpoint capacity counts a pre-warm the way it counts the orchestrator's streaming turn. Pressing Enter lets go of an in-flight pre-warm at the keystroke. Whether it also aborts the request is gated on the backend, because the measured one ignores a cancellation: aborting 1.5 s into a 47,620-token prefill did not stop the server, which finished prefilling, so the prefix survived and the next request read 47,596 of 47,620 tokens from cache at `prompt_ms 927` while waiting 89.5 s of wall clock for the abandoned request to leave the single slot. Letting the pre-warm complete cost the same wall clock and kept the usage record, so a submit detaches the round rather than aborting it, withholds its `/context` line, and still records the prefill the server performed. Each round appends one `prewarm` ledger entry with its `timing` and `promptCache`, contributes zero tokens to the context estimate, is never a model message, and is never an expected-cold reason. `/context` reports `prewarmed: N tokens in X ms` until the next settled run, and `/cost` and `clio-coder usage report` carry pre-warm calls as their own row beside side questions and handoffs. `prewarm.enabled` defaults to `true` and is classified next-turn.
+- Eval artifacts carry a fail-closed `clio.eval.verdict.v1` envelope with ledger and receipt sourced performance metrics, per-scenario pass and distribution aggregates, and serving-configuration provenance; `eval compare` can filter tracked metrics, refuses configuration drift unless explicitly allowed, and `eval run --trials N` isolates every trial in a fresh workspace (#252).
+- Every model call on a llama.cpp or LM Studio target persists the server's own prefill facts (`prompt_n`, `cache_n`, `predicted_n`, `prompt_ms`, `predicted_ms`) as a `backend` object on the assistant entry's `promptCache`, and the cache verdict is derived from `cache_n` when pi-ai reports no cache reads (#247). `residency`, `thinking_change`, `tool_surface_change`, and `prompt_recompiled` join the expected-cold reasons, so the `/context` "shell reused, backend cold" warning no longer fires for a disturbance Clio caused. `/context` shows `prefill: N uncached · M cached · X ms` for the last call, `/cost` and `clio-coder usage report` carry per-session uncached prefill totals and verdict counts, and `clio-coder doctor` summarizes the last session's verdicts.
+- The `/handoff` extraction round binds its JSON schema on the wire and gets one bounded repair attempt (#223). The round embedded `HANDOFF_RESPONSE_SCHEMA` in the system prompt and bound nothing, and a refused parse ended the command, so the 0.3.7 release test recorded `/handoff` as BLOCKED on a local target after two attempts that both ended "the extraction round returned no JSON object"; the dropped-path listing, the `e` editor, and accept-mints-a-session were all unreachable and the operator paid for the round either way. The out-of-turn seam now looks up the runtime's own spelling of a JSON-schema response constraint and sends it: `response_format: { type: "json_object", schema }` for llamacpp, the standard `{ type: "json_schema", json_schema: { name, strict, schema } }` for lmstudio, and nothing at all for a runtime with no known dialect, which still gets the prose instruction. The table is keyed by runtime id rather than by capability flag because a generic OpenAI-compatible gateway answers HTTP 200 to a spelling it does not implement and returns unconstrained JSON, which would turn a known non-enforcement into a silent one. Native enforcement is an optimization here, never a precondition: a server that refuses the constrained request with the 400 the worker seam already recognizes gets one unconstrained retry, and anything else rejects. A parse the extractor refuses now gets exactly one repair round that quotes the parser's complaint and the first answer verbatim, billed through the same out-of-turn usage store, and a terminal refusal names what was asked for, what each round said, and what round 2 returned. Verified on `mini` (llama.cpp, `muse-30b-dense`) against a ten-turn session: the constrained request carried all five schema properties and the extraction was accepted, and a deliberately truncated first round refused with the ticket's own message and the repair round was accepted.
+
+### Fixed
+- The pre-warm scheduler's zero-delay timers are ref'd, so awaiting `whenPrewarmSettled` can no longer deadlock a process whose event loop holds nothing else. Node 22, the engines floor, drains the loop past a due unref'd timer, which cancelled entire hosted-CI test lanes with `Promise resolution is still pending but the event loop has already resolved`; Node 24 fires the due timer first, which is why no development machine ever reproduced it. A due zero-delay timer holds the loop for one tick at most, and production sessions always hold live handles, so no operator-visible behavior changes.
+- Fleet steps now transfer their held whole-plan reservation into the worker lease even when the request carries fleet lineage, so a one-step fleet can run on a one-slot endpoint without counting its own reservation twice. Endpoint-capacity refusals now identify active leases, held reservations, and foreground streams instead of always blaming the orchestrator's turn, and reservation members record when admission consumes them.
+- A consumed prompt now reaches one committed pending frame before turn admission can make it durable (#251). The shipped state machinery was live during a long forced auto-compaction, but the real editor path only queued a render before starting the capability probe, prompt compile, and overflow preflight, so release-test windows lasting 17 to 260 ms opened and closed between renderer ticks and showed `MESSAGE`, no user row, and the previous turn's receipt throughout. The chat loop now opens its reference-counted preparation window and awaits an internal presentation barrier that flushes `· preparing`, the `PREPARING` rail, and the preparing footer before admission work starts; the existing `compactionSummary` then user-turn ordering is unchanged. Manual `/context compact` remains a separate path and its live island now reports a single `compact` phase at 0% instead of publishing `done` and rendering the five `/context init` stages at 100% from its first frame; only its terminal event renders `done` and 100%.
+- The v0.3.7 release-test residue now has one manually gated live driver that uses the built CLI, a real PTY, native workers, the builtin recipes, and a scrubbed isolated home against an operator-selected target (#222). On `mini` with `muse-30b-dense`, it proved the in-flight `/oracle` refusal with zero new receipts, scrolled a 51-line `/handoff` review until the unread path appeared under the dropped-ledger heading, proved saved and cancelled `$EDITOR` digests, rendered the compete verification refusal, and checked every discovered development command across default help, full help, and its bare entry point. The same evidence records why four dispatch paths could not produce receipts on the one-slot endpoint: proposal and gate-loop plans self-contended with their reservation, a two-member council could not admit round one, and the current admission contract intentionally accepts review verification even though the release-test row says it refuses. The proposal record also preserves its out-of-plan `requestOrigin: user` and missing plan binding rather than changing that contract here.
+- Worker heartbeat age now comes from a monotonic stamp while the durable ledger keeps a separately derived wall-clock instant (#198). A 60-second forward wall-clock step can no longer reap a live native or ACP worker, and a backward step cannot hide a worker whose monotonic heartbeat window and grace have elapsed; restart recovery explicitly uses the persisted instant only as a human-readable last-seen bound after the host-scoped worker process is known to be gone.
+- `targets --probe` now keeps a degraded target's health reason ahead of gateway, context-window, and residency notes, and repeats the complete reason on a wrapped detail line whenever the table row cannot hold it (#234). At both 80 and 120 columns, plain and gateway targets now say that the configured default model is not advertised by the target instead of dropping or truncating the operative clause; healthy rows and the full `health.lastError` in JSON are unchanged.
+- `config inspect` now reports agent and fleet resource roots instead of omitting both extension-era resource kinds (#243). Each category includes the shipped builtin root plus extension, user, and project roots in their real loader order, with the numeric collision precedence retained in the JSON detail. The formerly dangling `agents` category is replaced by `agent-root` and paired with `fleet-root`, and `agents --help` now names extensions as a recipe source.
+- Extension manifests now enforce their optional `compatibility.clio` SemVer range instead of parsing and ignoring it (#242). Malformed ranges fail manifest parsing, installation refuses a package whose range excludes the running Clio version before writing it, and installed packages are checked again at load so upgrades cannot activate incompatible resources. The diagnostic names the extension, its declared range, and the running version; incompatible packages remain visible in `extensions list` while a compatible package at another scope can still become effective. Manifests that omit the constraint retain their previous behavior.
+- A successful write in a never-indexed project no longer strands an empty `.clio-coder/` directory (#248). The incremental codewiki refresh is contractually a no-op when the project was never indexed, but `coordinateCodewikiWrite` acquired the state-file lease before rechecking `requireExisting`, and `withStateFileLock` creates the lock's parent with `mkdirSync(..., { recursive: true })`. So every successful file-mutating tool created `.clio-coder/`, wrote and deleted `codewiki.json.lock` inside it, and left the now-empty directory behind; `inotifywait` recorded exactly that sequence on 0.3.8. The check now runs inside the workspace queue and before the lease, so nothing is materialized for a project with no codewiki. The recheck under the lock is unchanged and is still what decides the race, and an indexed project keeps serializing its incremental writes through the same queue and lease.
+- A downgraded fleet write record now says exactly why it opened and which tool call caused it (#236). A successful opaque `bash`, `verify`, `dispatch`, `steer`, dynamic, or MCP call previously collapsed into `attributionComplete: false`, leaving the Alt+W card silent while the run was actionable and the durable verdict saying only that no complete record existed after rollback. The run-effects recorder now retains the causal tool and call id, emits a live warning when the first such call succeeds, and carries every cause through `observedRunWriteAttribution` into the write-boundary verdict's additive `attributionDowngrades` list. The live card and after-the-fact message name the tool and explain that its arguments cannot enumerate every path it may write. Incomplete telemetry, untracked code steps, and unavailable records receive their own reason codes, while a closed record keeps `attributionComplete: true`, an empty downgrade list, and the existing protection for unattributed concurrent edits.
+- Canonical trust verdicts now stay receipt-derived across dispatch, `monitor collect`, evidence bundles and inspect output, `findings.md`, the Alt+W board, receipt verification, and eval metrics (#237). Evidence alone composed a finish-contract audit row into `completionEvidence`, so one read-only run appeared as `completion not applicable` there while every receipt surface said `completion not recorded`; evidence no longer lets that separate input override the receipt axis. Every `findings.md` now records each linked run's tier, fixed-order summary, and six axes before its diagnostic findings. Alt+W writes the tier as text and wraps every summary clause, and the receipt view wraps its versioned tier and summary onto additional header rows instead of truncating the verdict after its first clause.
+- A prompt template that cannot load is now recognized as the command it is and refuses with its reason, instead of being dropped so the operator is told the command does not exist (#245). The safety half is unchanged: a missing or escaping `${extensionRoot}` reference still never expands and never reads outside the declaring package. What changed is that `loadPromptFile` no longer returns null for it. The template loads with an empty body and an `unavailable` reason attached, so the namespaced command is recognized and invoking it says, for example, `prompt template /wtfp:plan-section cannot run: prompt template has an unresolved or escaping extension reference: ${extensionRoot}/core/templates/missing.md (<file>)`. The reason is the same sentence the `/prompts` overlay already renders as a diagnostic, plus the file, so the two surfaces cannot drift. Every load-time reason gets the same treatment, not only the reference case: the name is now derived before the file is read, so an unreadable template also refuses with its own error rather than vanishing. A path that escaped its discovery root is still dropped, because there is no name there to offer a command under. The `/prompts` overlay marks such a template `unavailable` and shows the reason in its detail pane.
+- Every fleet step can now use the configured transient-failure retry policy instead of only the first step (#231). Fleet steps share one root assignment, whose once-only settlement correctly becomes terminal after wave one; later retry decisions mistakenly treated that root status as the current step's liveness and silently suppressed recovery. Reserved work now reads the current plan member's held, consumed, or released state at both scheduling and timer execution, while unreserved dispatch retains the root-assignment check and the original settlement guard remains unchanged.
+- A queued or echoed model-facing turn carries the payload byte for byte (#244, follow-up to #240). The expander was already exact, but `appendQueuedUserTurn` trimmed the engine's user text before persisting it, which broke the byte-for-byte match against the echo the loop had already written and so wrote a second, shortened row that the assistant was then parented to. One `/raw   bar` submit produced a correct 5-byte `"  bar"` turn and a 3-byte `"bar"` turn, and the model's parent turn was the 3-byte one, contradicting the contract in `docs/prompt-envelope-and-tools.md` that every byte after the delimiter belongs to the payload. The echo path now persists the submitted bytes and reads a trimmed copy only for the emptiness test, so the echo is recognized as the turn already in the ledger instead of being written again. The queue path is fixed the same way: a steer or a follow-up hands the engine and the queue mirror the submitted text rather than a trimmed one, because a steer is a model-facing turn too. Leading whitespace, trailing whitespace, interior runs, and tabs all survive into the turn the assistant is parented to; a message that is only whitespace is still refused.
+- A consumed prompt no longer looks idle while Clio prepares the turn (#251). The editor is cleared and the prompt painted into the transcript before admission, and the capability probe, pre-submit auto-compaction, prompt compile, and overflow preflight all run after that and before the turn owns the stream. Nothing named that window: the composer went back to `MESSAGE` with `Ask Clio…` and the footer still reported the previous turn as done, so a run that spent 77.4 seconds in `trigger: auto` compaction was indistinguishable from a dropped Enter, and the operator pressed Enter twice more trying to submit. The chat loop now carries a turn-preparation phase from the moment `submit` is called until admission succeeds or refuses, refined to `compacting` around each pre-submit compaction. The composer rail reads `PREPARING` or `COMPACTING` with a placeholder that says which, the status machine enters the existing `preparing` phase on the same signal so the footer's verb and watchdog tick replace the previous turn's receipt, and because `preparing` is an active phase the compaction bus overlay now lands during the window instead of being dropped by an idle status. The painted transcript row is marked pending while it is not in the ledger, becomes an ordinary row at the durable append, and is marked `not sent` when the submit is refused, so a blocked preflight never leaves a committed-looking phantom turn. The phase is reference-counted across the FIFO admission gate, so a retyped prompt arriving mid-window neither narrows the state the first one is showing nor closes it early. The ordering `compactionSummary` then one user turn is unchanged and asserted, and Enter on an empty editor is still refused before any of this.
+- `ask_user` keeps the free-text answer the operator typed instead of only the option label they chose it under (#228). A round that offered "Exact number - I'll type it" recorded that sentence and nothing else, because choosing an option committed the answer and only an option literally named Other opened a text field. The interview at `state/interviews/2026-08-25T10-14-05-319Z-...json` shows the cost: rounds 3 and 4 existed only to re-ask for the figures rounds 1 and 2 had thrown away, 35 minutes for four facts, with the operator typing the same numbers and dates three times. On any option list `t` now opens the text field for the option under the cursor without committing it, and submitting records the label and the text together as `<label>; <text>`. The answer travels as three separable facts rather than one joined string: `answer` is the one-line rendering, `options` is the labels chosen in list order, and `value` is the typed text exactly as submitted, so a label-only answer is told from a label-plus-value one by whether `value` is there rather than by parsing. All three reach the model in `latest_answers`, the interview transcript under `clioStateDir()/interviews/`, and the decision record, whose `value` carries both and whose `options` and `text` keep them separable. Choosing a plain option after typing clears the text with it, so a recorded answer never claims a figure the operator gave for a label they moved off.
+- Dispatch plan approvals now bind every byte of every worker task with `task_bytes` and `task_sha256` while retaining the existing 255-character `task_preview` (#246). A real vote council sealed 714-byte member tasks into receipts whose shared approval artifact represented only a 258-byte preview, leaving the 456-byte ballot-directive tail outside the plan hash; changing any byte in that hidden tail now changes the approved hash without making the operator-facing plan unbounded. The other routing, identity, and path fields rendered through `safeField` now append a digest whenever sanitization or truncation changes their visible value, closing the same collision class without lengthening normal plan text.
+- A parked `write` or `edit` can be read before it is authorized (#254). The approval card described the mutation only by size, as `content=<string 482 bytes>` or `edits=<array 3 items>`, so approving it meant approving bytes the operator had never seen; during the WTF-P NSF 25-531 UAT on 0.3.8 the only way to read them was to open the external `current.jsonl` ledger and compare payloads by hand. The card now carries a `Mutation:` line with the kind, the byte count, and a truncated SHA-256 over the exact call arguments the decision resumes, and `v` opens the complete proposed content for a write or the complete effective diff for an edit, computed by applying the edit list to the bytes on disk rather than by printing the edit array back. The mutation scrolls with the arrow and page keys in a 16-row window that names its position, and `v` closes it again; Enter, `s`, and Esc keep answering the call throughout, so the inspection never becomes a step between the operator and a denial. An edit whose file cannot be read or whose replacements do not apply says which, and still shows the requested replacements. The inspector re-derives the digest from the arguments it is about to render and refuses when it no longer matches, so a call that differs from the previewed one cannot inherit its preview. The mutation text is process-local by construction: it is never placed on the approval view, which is what reaches the transcript row, the parked notice, the desktop notification, and the worker escalation payload, all of which carry only path, size, and digest. Escape sequences and control bytes are neutralized and the neutralization is stated, tabs render as spaces, and content past 262,144 characters is cut with a line naming how much was withheld. A worker escalation has no preview because its arguments never leave the worker, and its card says exactly that instead of advertising a key it cannot honor. At 40 columns the inspect key is elided ahead of allow, stop, and deny, and the `/help` Autonomy & safety net topic documents it for the widths that cannot show it.
+- Dispatch contract tests now load all 13 shipped builtin agent recipes through the production registry instead of substituting handcrafted `coder`, `researcher`, and `verifier` records (#232). The old researcher claimed the `base` audience and an `external-delegation` result while production seats a `shadow` researcher that must return a `research-report`, so default council tests could pass against an agent operators could never run. The shared stub now inherits each builtin's audience, result contract, and tool surface directly from its Markdown recipe; the one optional constrained-coder seam is explicit, council scripts return the real research envelope, and a catalog-wide drift contract compares every field that caused the divergence.
+- A residency load that races the llama.cpp router's own wake no longer fails the turn. When Clio's `/v1/models` snapshot was stale, the router answered the duplicate `POST /models/load` with HTTP 400 `model is already running` or HTTP 500 while it was already loading the model, and the call was recorded as an errored assistant entry before any inference. A rejected load now re-reads `/v1/models`, treats a model that is loaded, loading, or sleeping (or a body that says it is already running) as a load in progress and waits for it, and only an absent, unloaded, or failed model preserves the rejection, whose message now carries the router's response body.
+- The compaction summary round and a background memory step hold a slot on the endpoint they stream to for as long as the request is out, the same as a turn, a `/btw` round, and a pre-warm (#250, #229). A memory step registers only after the `endpoint_busy` admission check, so it counts on its own server for dispatch capacity without ever refusing itself.
+- After an in-process `/resume`, the prompt manifest and the `promptRecompiled` entry follow the incoming session (#249 follow-up). The hash this process compiled was carried on the previous session's compiled prompt, so the resumed session's first entry named the abandoned session's hash and its manifest chain started from a hash that appeared nowhere in it; the compiled hash is now tracked per session and cleared on the switch. Because the backend's slot still holds the previous session's prefix, the first turn after the switch is stamped `prompt_recompiled` from the resume itself, so `/context` names the cold turn instead of warning about it. An unreachable `preferLoaded` branch in the session-prompt compile was removed; the loaded-over-probe ranking lives in runtime resolution and is proven there.
+- A background memory step that times out or throws after its request left the process now still stamps `background_memory` on the next turn (#229). The `MemoryStepCompleted` announcement hung off the usage sink, which only runs when the call resolves, so a step cut off by the 30 s deadline, whose trajectory the server had nonetheless prefilled into its single slot, left the next turn cold with no reason and `/context` warning about a provider re-prefill Clio had caused. The announcement now wraps the client's `complete` in a `finally` (`announceMemoryStepEndpoint`), fires exactly once per request that left the process, and never for an `endpoint_busy` skip; the usage row and `/cost` accounting are unchanged.
+- An eval result has one pass decision (#252). `verify.measure` is the scenario's code grader, and a nonzero grader exit now fails the result with `failureClass: grader_failed` while the verdict keeps `machinery: ok`, so `result.pass`, `verdict.outcome`, the per-scenario aggregates, the summary, and the exit status agree; the sprint's baseline artifact reported 26 of 30 in its summary and 23 in its aggregates for the same 30 runs, and 23 is the figure the graders produced. Every failed verdict carries a `reason`, and pre-fix artifacts are read with the reason normalized. `eval run --trials N` prepares each trial's workspace immediately before that trial and removes both the workspace and the state directory on the item's `finally` path, including when the copy itself throws; a run that died on `ENOSPC` had created all 30 workspaces up front and left every one behind. A `temp-copy` workspace inside a git checkout copies exactly the tracked and untracked-but-not-ignored set (`git ls-files --cached --others --exclude-standard`), so 1.4 GB of ignored benchmark datasets no longer ride along in every trial.
+- A `/btw` side question and a `/handoff` extraction round now hold a slot on the endpoint they stream to for as long as the request is out, the same way the turn and the pre-warm do (#250, #229). Without it, a fleet dispatch on a one-slot server was admitted onto the endpoint the side question was occupying, and the background-memory tier read that endpoint as idle during exactly the window it was busiest.
+- `residencyTargetKey` is total again for a configured base URL: a target written without a scheme (`mini:8080`) produced a null key through an overload typed `string`, and the residency reconcile threw `Cannot read properties of null` instead of running unlocked. The canonical form is used when the URL has one and the raw spelling otherwise, which matches what dispatch capacity does for the same target (#250 regression, found in review).
+- The `/context` meter draws the autocompact reserve at the far end of the bar, after free space, and in the same frame token free space uses, so the held-back headroom no longer reads as a grey block wedged between the consumed categories and the outline it should match; the `▒` glyph still keeps it distinct without color, and the footer meter shares the order. `background_memory` renders in prose as `background memory step` on the `last cold turn:` line instead of falling through to the wire value (#229).
+- Proactive memory's model tier now accounts for what it spends, is bounded by a deadline a turn boundary can wait for, and writes what it produces into the store `/memory` reads (#229). One operator's ledger held 274 steps over 14 days: 60 of them reached the background model, spending 137,205 tokens and 1,666.6 seconds of model time, with a single step holding a local server for 102.5 seconds to answer nothing, and none of it appeared in `/cost`, in `clio-coder usage report`, or anywhere else. Every model step is now billed the way a `/btw` side question is, under a `background-memory` label: `/cost` shows a `memory steps` row, `usage report` counts them in its window, and one durable row per step lands in the out-of-turn usage store carrying the provider usage, the call's duration, and the backend's prefill facts. `/memory` shows the lifetime steps, tokens, model time, and hit rate folded from `steps.jsonl`. `memory.intervention.timeoutMs` drops from 180,000 to 30,000, and a step that exceeds the deadline records `timeout` with reason `deadline` or `timed_out` rather than the `silent` a model that simply chose not to speak records; a route that refuses the connection still records `client_error`, so the three diagnoses stay distinguishable. A step whose endpoint is already serving the chat target's stream is skipped with reason `endpoint_busy` and the skip is recorded, so a single-slot local server is never made to queue the memory call behind the operator's own turn or evict the resident model to serve it; a step is started from the `turn_end` hook while the chat loop still holds its foreground registration, so a background role pointed at the chat target's own endpoint declines every boundary and records each skip rather than contending for the slot, and a step that did run on that endpoint stamps the next turn's expected-cold reason `background_memory` so the `/context` warning names its cause. The session task bank and `records.json` are connected: an injected reminder's cited entries are proposed into the durable store, unapproved and scoped to the session's repository with provenance naming the source entry, so `clio-coder memory list` and `/memory` show what the tier actually produced and approval stays a separate operator action. The default is unchanged and now recorded with its numbers in `docs/proactive-memory.md`: the free rules tier stays on, and the model tier stays opt-in behind `background.target`, which bought 6 injections from those 60 steps, a 10.0 percent hit rate at 22,868 tokens per injection.
+- The compiled system prompt is ordered stable prefix first, so a moved context window or an approved memory record no longer re-prefills the sections behind it (#249). Every backend Clio targets caches by exact prefix and re-prefills from the earliest changed byte, and through 0.3.8 the runtime block sat sixth of eleven compiled sections with the memory block tenth. `Context window: N` moves whenever the backend reloads a model or a co-residency clamp lands, so one changed digit cost a fresh prefill of the tool contract, the fleet roster, the retrieval hints, memory, and the project context; on the operator's llama.cpp target a one-line change at token 500 of a 16,712-token prompt re-prefilled all 16,712 in 18.4 seconds. The order is now identity, operating contract, delegation, skills, safety, tool contract, fleet, retrieval hints, project context, memory, runtime, then the operator-editable tail fragments unchanged, under one rule: a section goes as late as its volatility, and anything that reads a clock, a probe, or a mutable store goes after everything that does not. No section's wording changed and no section was added or dropped. `Context window: N` is now read from the turn's own window resolution, where a recorded loaded window outranks a probe that reports what the server could serve rather than what the model is open at, so a resumed session states the figure its ledger measured (#227's carry-forward). Prompt-manifest records carry a layout `version` plus the window and the layer that answered it, and a resumed session's first compile names the prompt hash it replaced instead of reporting no previous prompt at all, so the one `promptRecompiled` entry the upgrade writes explains itself. One cosmetic defect went with it: the memory section carried its `# Memory` header twice, once from the memory renderer and once from the compiler.
+- Dispatch capacity now binds independently per inference endpoint and counts the orchestrator's own active model stream (#250). Target URLs normalize to a shared scheme, host, port, and base-path key, so two target descriptors pointed at the same scheduler share leases and held reservation capacity. llama.cpp probes the selected worker's `total_slots`, with its reported `--parallel` argv as a fallback; LM Studio and Ollama use conservative local defaults, and a target may set `maxConcurrentRequests` explicitly. Global and node `budget.concurrency` semantics remain unchanged. Endpoint-aware execution plans size each wave to the available request slots, `targets --probe`, `/fleet` settings, and the Fleet Runs board expose those slots, and a saturated endpoint refuses the dispatch with its slot count plus a named collection or second-server remedy.
+- Context accounting is reconciled against the provider's own token counts, and compaction fires on the reconciled figure (#227). A session on 2026-08-28 believed it was at 63 percent of a 131,072-token window while the backend answered `Context size has been exceeded`; the `0.9` threshold never tripped because the number it read was a chars/4 estimate. The reconciliation data was already there. `reconcileSnapshot` folded the provider's count into the `/context` overlay, the footer meter, and `context-snapshots.jsonl`, and `shouldCompact` never saw it. After each model call the attested prompt count, with cached prompt tokens folded back in, is now carried as an anchor over the live message list: the budgeted figure is that count plus a chars/4 estimate of everything appended since, and the estimate remains a floor because it prices material the attested call never saw. All three evaluation points read it: the pre-submit trigger, the post-tool continuation guard, and the preflight overflow check, so a turn that would overrun the window compacts instead of failing at the provider. A working-set projection subtracts the tokens the eviction planner priced out against that same projection and re-anchors on the projected message list, where it previously discarded the attestation entirely and fell back to pure chars/4 exactly when the accounting mattered most; a summary compaction rewrites the conversation the attestation described, so it drops the anchor and the next call re-establishes it. Every snapshot now records `estimatedTokens`, `reconciledTokens`, and `divergenceRatio`, so the divergence itself is observable in the ledger rather than inferable from an overflow.
+- A resumed session no longer spends its first turn budgeting against a re-probed window (#227). The same session resumed reporting `contextWindowSource: "probe"` at 262,144 with a 26,214-token reserve, then corrected to `loaded` at 131,072 one turn later, a 126K swing in one turn and the entry point for the overflow above. A resume re-resolves its target before discovery has reported what the backend has open, and the probed figure is what the server could serve rather than what the model is open at. Resolution now accepts a `knownLoadedContextWindow`, and the turn context supplies the last `loaded` window the session's own snapshot ledger recorded for the same target and model. It applies only when live discovery reports no loaded window and only for that exact target and model, so a changed selection re-probes and a model reloaded at a different size corrects as soon as discovery names the live window.
+- `/share` of a worker answer with no place to fold no longer kills the TUI (#257). The uncommitted user row's `· preparing` and `· not sent` tails from #251 were concatenated onto the last rendered line with no width budget, so a body that had already folded to the full content width came out 12 cells past the terminal, and pi-tui's `doRender` throws on an overlong line and takes the process down with it. A `research-report` answer is JSON with no space to break at, so an 80-column pane died on any shared body over 58 columns; the recorded crash was `Rendered line 16 exceeds terminal width (84 > 80)` on a 70-character body. The tail now rides on the last body line only when that line has room for it within the terminal width, and drops to its own hanging row when it does not, so it stays whole rather than breaking between the separator and the word. A contract test sweeps shared-note body lengths at 80 columns and terminal widths from 8 to 120, and the `/share` PTY regression gains an 80-column share of a spaceless body that asserts the process survives and the keyboard still reaches the editor.
+
 ## 0.3.8 - 2026-08-29
 
 ### Added

package/NOTICE

@@ -7,3 +7,36 @@ Illinois Institute of Technology.
 
 Licensed under the Apache License, Version 2.0. See the LICENSE file
 distributed with this work for the full license text.
+
+--------------------------------------------------------------------
+Pinned external tools
+
+Clio Coder does not bundle the programs below. `clio-coder tools install
+<id>` downloads a pinned upstream release on request, verifies it against
+the checksum recorded in src/domains/toolchain/registry.ts, and places the
+upstream license text beside the binary under the Clio data directory. Each
+program remains under its own license and copyright; Clio neither modifies
+nor redistributes it.
+
+herdr (https://herdr.dev, https://github.com/herdrdev/herdr)
+  Copyright the herdr authors.
+  Licensed under the Apache License, Version 2.0.
+  Used as the terminal multiplexer behind Clio panes.
+
+yazi (https://yazi-rs.github.io, https://github.com/sxyazi/yazi)
+  Copyright the yazi authors.
+  Licensed under the MIT License.
+  Used as the terminal file manager behind the file-picker pane.
+
+croc (https://schollz.com/software/croc6, https://github.com/schollz/croc)
+  Copyright Zack Scholl and the croc authors.
+  Licensed under the MIT License.
+  Used as the relay file-transfer backend for machine-to-machine transfers.
+
+--------------------------------------------------------------------
+Vendored components
+
+git.yazi (https://github.com/yazi-rs/plugins/tree/main/git.yazi)
+  Copyright 2023 the yazi-rs authors.
+  Licensed under the MIT License.
+  Vendored as source with its LICENSE under the managed file-pane profile.

package/README.md

@@ -51,6 +51,11 @@ first session, type a request in plain words or `/help` for the command
 palette. `/settings` changes the model later, `/quit` leaves, and
 `clio-coder doctor` reports the install's health at any time.
 
+Adding `--omit=optional` to that install skips the Claude Agent SDK's 224MB
+proprietary binary, taking the tree from 387MB to 143MB. Everything but the
+`claude-sdk` worker runtime works without it. See
+[Installation and Lifecycle](docs/installation-and-lifecycle.md#optional-dependency-the-claude-agent-sdk).
+
 |  | You are | Start here |
 | --- | --- | --- |
 | 🔬 | A researcher or developer who wants to use it | [Your models](#your-models-your-choice) → [At the keyboard](#at-the-keyboard) → [Safety](#safety-you-can-read) |
@@ -73,7 +78,11 @@ decision afterward.
   compiled prompt and tool schemas byte-stable so a llama.cpp prefix cache
   stays hot across turns and sessions, bounds every tool result so one `grep`
   cannot blow the window, and records a per-call cache verdict in the ledger
-  so you can see when and why the cache went cold.
+  so you can see when and why the cache went cold. It also sends that prefix
+  ahead of your first keystroke on a session start, a resume, or a compaction,
+  and counts request slots per inference endpoint rather than per node, so a
+  fleet cannot admit four workers onto a one-slot server the orchestrator is
+  already streaming against.
 - **Work goes to bounded workers, not one long context.** The orchestrator
   dispatches focused agents with explicit tool profiles, call budgets, cost
   ceilings, and typed result contracts. A worker that cannot produce a
@@ -279,7 +288,7 @@ dist-tag instead.
 From source, pinned to this release:
 
 ```bash
-git clone --branch v0.3.8 https://github.com/iowarp/clio-coder.git
+git clone --branch v0.4.0 https://github.com/iowarp/clio-coder.git
 cd clio-coder
 npm run install:local
 export PATH="$HOME/.local/bin:$PATH"
@@ -305,7 +314,7 @@ Full lifecycle details, including `reset` and the upgrade path, are in
 
 ## Status
 
-The current release is **v0.3.7**, installable from npm as
+The current release is **v0.4.0**, installable from npm as
 [`@iowarp/clio-coder`](https://www.npmjs.com/package/@iowarp/clio-coder) or
 from source. Clio Coder is still experimental: we ship quickly, interfaces may
 change between minor versions, and model-specific behavior varies by target, so

package/dist/{acp-U67UHUK2.js → acp-G5WJBNCT.js}

@@ -6,29 +6,29 @@ import {
 } from "./chunk-2VTFPG5O.js";
 import {
   runClioCommand
-} from "./chunk-VWZOAB7K.js";
-import "./chunk-26LEYJZH.js";
+} from "./chunk-GR5G2PVF.js";
+import "./chunk-7MCTRUCE.js";
 import "./chunk-HKIYEGME.js";
-import "./chunk-IFBNV6H6.js";
-import "./chunk-XWSF374K.js";
+import "./chunk-2OQE55CK.js";
+import "./chunk-2ANTL7MR.js";
 import {
   printError
-} from "./chunk-XK56QHLX.js";
+} from "./chunk-VPKWYKEY.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-IJ7RPIYJ.js";
+import "./chunk-VFA6GDY5.js";
 import {
   MAX_TIMER_DELAY_MS
 } from "./chunk-FQ4SKYE4.js";
 import "./chunk-IWHMRKLL.js";
-import "./chunk-4DGYLA73.js";
+import "./chunk-GXNLGKAB.js";
 import "./chunk-LL4KHSZI.js";
 import "./chunk-4ZG3XFUR.js";
-import "./chunk-EQ63NRB7.js";
+import "./chunk-BBVYXMFO.js";
 import "./chunk-SST6Z5JA.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
 import "./chunk-APJ265NV.js";
-import "./chunk-BNAZZHFG.js";
+import "./chunk-BYP5D4HI.js";
 import "./chunk-WEPFGWHJ.js";
 import "./chunk-YXLYO42X.js";
 import {
@@ -79,11 +79,12 @@ function resolveAcpCwd(value) {
   return realpathSync(path.resolve(value));
 }
 async function runAcpCommand(args, options = {}) {
-  if (args.includes("--help") || args.includes("-h")) {
+  const normalizedArgs = args[0] === "--acp" ? args.slice(1) : args;
+  if (normalizedArgs.includes("--help") || normalizedArgs.includes("-h")) {
     process.stdout.write(HELP);
     return 0;
   }
-  const flags = parseAcpFlags(args);
+  const flags = parseAcpFlags(normalizedArgs);
   if (typeof flags === "string") {
     printError(flags);
     process.stderr.write(HELP);
@@ -126,4 +127,4 @@ export {
   resolveAcpCwd,
   runAcpCommand
 };
-//# sourceMappingURL=acp-U67UHUK2.js.map
+//# sourceMappingURL=acp-G5WJBNCT.js.map

package/dist/{agents-YU6SGALZ.js → agents-FMV2Q5G4.js}

@@ -1,68 +1,73 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   SafetyDomainModule
-} from "./chunk-EMYUUSFG.js";
-import "./chunk-5Q2VVUKB.js";
+} from "./chunk-O6TL7WWY.js";
+import "./chunk-X3YGUTOB.js";
 import {
   ensureClioState
-} from "./chunk-WWCZ5F23.js";
+} from "./chunk-W5VSYASO.js";
 import {
   ConfigDomainModule,
   loadDomains
-} from "./chunk-FHJEP5SW.js";
+} from "./chunk-3BT2XMV4.js";
+import "./chunk-7MCTRUCE.js";
+import "./chunk-LDQ2ZF2M.js";
+import "./chunk-RVG5JXAL.js";
+import "./chunk-3DPEIQKN.js";
 import {
   AgentsDomainModule
-} from "./chunk-FBVTI2TJ.js";
+} from "./chunk-Z2RR6MAK.js";
+import "./chunk-Z4TXYIEG.js";
 import "./chunk-DR52UMZW.js";
-import "./chunk-TANS5ZJS.js";
-import "./chunk-DGSYXYMX.js";
-import "./chunk-26LEYJZH.js";
-import "./chunk-WXY7KU3G.js";
-import "./chunk-RVG5JXAL.js";
-import "./chunk-E77JEWSD.js";
-import "./chunk-DYIM5TJT.js";
-import "./chunk-VCBR6CU7.js";
+import "./chunk-VYMXRQI6.js";
+import "./chunk-FEFIFZTL.js";
+import "./chunk-CTJ4RNAA.js";
+import "./chunk-RKKLTLYB.js";
+import "./chunk-SUW5DORT.js";
+import "./chunk-5PSMVOLM.js";
 import "./chunk-UOV2BYIW.js";
-import "./chunk-5H3GB5BO.js";
-import "./chunk-A2NJGIB3.js";
-import "./chunk-HWUFFB6L.js";
-import "./chunk-TTHACPOM.js";
+import "./chunk-GKF55TAZ.js";
+import "./chunk-32KWKNSF.js";
+import "./chunk-5LXZXPKX.js";
+import "./chunk-RAPCMZL4.js";
+import "./chunk-HHV2GANA.js";
 import {
   isUserVisibleAgent
-} from "./chunk-AOCYTWAV.js";
-import "./chunk-MV3K5QF2.js";
+} from "./chunk-DYJP44XW.js";
+import "./chunk-GCSMB2KY.js";
 import "./chunk-UL3WSD3F.js";
 import "./chunk-ECH6PKUQ.js";
 import "./chunk-5B2AEOW5.js";
-import "./chunk-CGKSTWHD.js";
+import "./chunk-K6BSR66V.js";
 import "./chunk-XPLRXC72.js";
-import "./chunk-IFBNV6H6.js";
-import "./chunk-GPIEI3LY.js";
-import "./chunk-XWSF374K.js";
+import "./chunk-NEKRRTYW.js";
+import "./chunk-SP2RXXYO.js";
+import "./chunk-2OQE55CK.js";
+import "./chunk-2ANTL7MR.js";
 import {
   printError
-} from "./chunk-XK56QHLX.js";
+} from "./chunk-VPKWYKEY.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-LU7P4LHA.js";
-import "./chunk-IHXBNWMM.js";
-import "./chunk-B5CSFE7B.js";
-import "./chunk-IJ7RPIYJ.js";
-import "./chunk-FQ4SKYE4.js";
+import "./chunk-P3FOHJT4.js";
 import "./chunk-ZGVHUX3M.js";
-import "./chunk-TT36MB5S.js";
-import "./chunk-3BINW3FP.js";
+import "./chunk-HLW2MRKE.js";
+import "./chunk-76ONBSIA.js";
 import "./chunk-R346GLFC.js";
+import "./chunk-IHXBNWMM.js";
+import "./chunk-VFA6GDY5.js";
+import "./chunk-BBVJUZHB.js";
+import "./chunk-FQ4SKYE4.js";
 import "./chunk-6EJMN2Y3.js";
 import "./chunk-IWHMRKLL.js";
-import "./chunk-4DGYLA73.js";
+import "./chunk-GXNLGKAB.js";
 import "./chunk-LL4KHSZI.js";
 import "./chunk-4ZG3XFUR.js";
-import "./chunk-EQ63NRB7.js";
+import "./chunk-BBVYXMFO.js";
 import "./chunk-SST6Z5JA.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
 import "./chunk-APJ265NV.js";
-import "./chunk-BNAZZHFG.js";
+import "./chunk-BYP5D4HI.js";
 import "./chunk-WEPFGWHJ.js";
 import "./chunk-NUGM5KR6.js";
 import "./chunk-YXLYO42X.js";
@@ -74,7 +79,7 @@ import {
 init_esm_shims();
 var HELP = `clio-coder agents [--json] [--all]
 
-List user-facing agent specs from built-in, user, and project recipes.
+List user-facing agent specs from built-in, extension, user, and project recipes.
 
 Flags:
   --json   emit specs as JSON instead of the formatted table
@@ -125,4 +130,4 @@ function renderLine(spec) {
 export {
   runAgentsCommand
 };
-//# sourceMappingURL=agents-YU6SGALZ.js.map
+//# sourceMappingURL=agents-FMV2Q5G4.js.map