@iowarp/clio-coder 0.3.9 → 0.4.1

package/CHANGELOG.md

@@ -2,6 +2,98 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.4.1 - 2026-09-01
+
+This grew beyond the bug-fix-only patch originally planned. v0.4.1 is a full release led by the version-2 `settings.yaml` contract, its automatic migration, and a smaller grammar-driven slash-command surface. It adds editor and marketplace workflows; fixes the release-blocking configuration, CLI, TUI, and Workbench failures found in final testing; replaces the oversized test and CI machinery with one fast deterministic gate; consolidates evaluation around the shipping eval domain and `evals/` reference suites; and moves machine-facing names into the `clio-coder` namespace without changing the product persona.
+
+### Changed
+- `settings.yaml` is now a strict version-2 document organized around `chat`, `fleet`, `targets`, `context`, `safety`, `interface`, and `integrations`. `clio-coder upgrade` automatically runs the one-time v1 transformation before the strict config domain loads, validates the complete result in memory, refuses source/destination collisions without touching the original, writes atomically, preserves a sibling `settings.yaml.v1.bak`, and records the moved and retired paths in a migration report. Version-2 files execute only canonical paths; old spellings are non-executing tombstones with replacement guidance rather than permanent aliases.
+- Panes, docks, and Yazi integration are experimental and opt-in: fresh homes keep pane mode, layout, and files off, diagnostics stay neutral while they are off, and migration preserves explicit v1 choices.
+- The slash registry now has an explicit `Work`, `Inspect`, `Configure`, and `Session` order and seven canonical Settings deep links: `/settings chat|fleet|targets|context|safety|interface|integrations`. Resource browsing is consolidated under `/resources skills|prompts|library|extensions`; `/library`, `/prompts`, and `/extensions` now stop with targeted `/resources` guidance, while `/targets` points to `/settings targets` and `/scoped-models` to `/settings chat model-picker`. Other split or renamed surfaces follow the same non-executing-tombstone rule, including `/agents connect`, `/archive import|export`, and `/context compact` replacing their retired spellings.
+
+### Added
+- Grammar-aware slash autocomplete now follows the same command specifications used for parsing. It completes commands, subcommands, flags, closed values, and Settings areas; replaces the token under the cursor without discarding suffix text; respects quotes and explicit command order; exposes structured submenus; suppresses submit-ready exact matches; and generation-checks asynchronous results so stale suggestions cannot overwrite a newer prefix.
+- Typing `@` in ordinary editor text opens a workspace-aware file picker with relative paths, metadata, and previews, then inserts the selected `@path` reference into the draft. File-reference spellings are kept distinct from steer targets, and explicit path completion shares the same cursor-aware replacement behavior.
+- The editor's existing bang operators now have an enforceable public/private boundary. `!command` remains part of later model context, while `!!command` runs visibly but its command and output are excluded from replay, token accounting, and compaction summaries and are marked model-private in evidence. Multiline bracketed pastes beginning with `!` or `!!` remain literal user text through Enter, alternate-send keys, interrupts, and subsequent edits instead of arming shell execution.
+- Marketplace self-promotion can locally match an operator request to an uninstalled catalog skill using the shipped catalog's new `triggers` metadata plus a conservative description-token fallback; request text never leaves the process. The coordinator can offer project or user installation, remember “Not now” for the session, or persist “Never offer” by skill name and version. Full-auto may install at project scope, but every consented or autonomous promotion install passes a hard runtime gate that accepts only Clio's shipped catalog or the `iowarp/clio-coder` repository tree; public registries and foreign GitHub sources are refused before installation. Offers are coordinator-only, source and content hash remain visible on autonomous installs, and installation never activates the skill for the model.
+
+### Fixed
+- Fleet CLI help and missing-journal diagnostics name the version-2 `fleet.history.journal` setting instead of its retired `panes.journal` spelling.
+- Marketplace-offer middleware caches installed and catalog skill inventory per session, revalidating only before a real offer, so ordinary `turn_start` evaluation no longer reparses every skill on every turn.
+- Model-picker `[Enter] use` now leaves the session/global confirmation open and applies the selected target/model binding after the operator chooses a scope.
+- The two settings-v2 release blockers found by black-box testing are closed. A migrated v1 home no longer crashes while reading `target`, and a fresh v2 home no longer crashes while reading `agents` or `target`; both reach diagnostics and the interactive editor. The real built-binary matrix passed once at `616b10a2` and was repeated at `9959652c`, including v1 upgrade, empty-home onboarding, all seven Settings deep links, retired-command tombstones, autocomplete, file references, bang context exclusion, paste inertness, and marketplace flows.
+- The SOL-01 through SOL-03 smoke failures are fixed: plain `clio-coder doctor` is read-only unless `--fix` is supplied; absent trace storage preserves JSON contracts for `trace runs --json` and `trace prune --json`; and command, argument, and read-only SQL validation now runs before trace storage opens.
+- The SOL-04 through SOL-07 smoke failures are fixed: Ctrl+C during `clio-coder configure` reports cancellation and exits 130; cancelled first-run onboarding stops instead of entering an unconfigured TUI; `fleet view --help` prints view-specific usage; and non-follow fleet snapshots contain no stray ANSI reset bytes under `NO_COLOR`.
+- Operator-facing TUI prose now wraps to the available width instead of silently losing remedy text across interviews, context and cwd choices, task/evidence reasons, notifications, model diagnostics, decisions, artifacts, dispatch cards, and fleet snapshots. Retry errors preserve normal provider remedies while bounding runaway bodies at 2,000 Unicode characters with an explicit truncation marker.
+- The Settings Center now owns narrow screens without transcript bleed-through, expands help into otherwise unused rows, and hides parent controls while a submenu owns input. Narrow prompt-template columns have a real gap and no duplicated argument synopsis, while long skill-suggestion descriptions end with an explicit truncation marker.
+- Workbench permission handling now uses one host-clock domain for expiry and escalation, honors the earlier of ACP and Workbench deadlines, escalates immediately when the remaining window is shorter than the delay, cancels already-expired requests without publishing an invalid card, and serializes `resolvePermission`, `cancelTurn`, and `abandon` with turn closure.
+- The interactive Fleet settled notice now uses the shared provenance-aware cost formatter, reporting an entirely unpriced run as `not measured` and preserving estimated or partly priced provenance instead of presenting an invented measured `$0.0000`.
+
+### Test-suite diet
+- The automated suite was rebuilt from 557 files and 183,969 physical lines into 35 behavior-focused files and 5,179 lines at the diet landing: 30 contract suites cover the boundaries, lifecycles, migrations, and integrity properties that can break the product, while five smoke suites exercise the CLI, ACP, process lifecycle, installed package, and real binary. The custom 24-lane shard runner, its timing weights and serial lane, repeat/shuffle machinery, test-only seams, and most harness scaffolding are gone; `npm test` is now a plain `node --test` invocation and the warm suite measures about 21.3 seconds. The weekly `flake-hunt` workflow retired with the timing- and order-flake machinery it existed to exercise.
+
+### CI modernization
+- Push and pull-request CI is one Node 22 job that installs once and runs `npm run ci:release`; the tag-only release workflow independently reruns that same gate before packaging. The rebuilt workflow was verified green on GitHub Actions in 1m48s, down from 7m32s for the preceding successful main-branch run. There is no shard matrix, repeat lane, weekly flake hunt, or eval baseline in either CI or the release gate.
+
+### Eval consolidation
+- Clio Coder now ships one evaluation system: the product engine under `src/domains/eval/` owns suites, execution, verdicts, artifacts, comparison, and reporting, and the maintained runnable reference suites ship under `evals/`. The parallel `benchmarks/` tree and its internal campaign harness are retired to `archive/v041-pre-diet`; future external-benchmark adapters enter through the eval engine rather than creating another stack. Evals remain explicit operator-run measurements and do not run in ordinary CI or release gates.
+
+### Clio Coder naming migration
+- Machine-facing identifiers now follow one syntax-aware Clio Coder namespace: `clio-coder` for paths, package and manifest names, schema and event identifiers, tags, and Git refs; `clio_coder` where underscores are required; and `CLIO_CODER` for environment variables. Existing homes receive one idempotent `2026-09-01-clio-coder-naming` migration recorded in `migrations.json`, with an atomic settings backup and a detailed migration report. Canonical writers use the new names immediately, while readers accept released legacy names through the two-minor v0.5/v0.6 compatibility window and preserve longer read support where sealed artifacts, exported archives, host panes, or published Git refs require it. The Clio product persona and its operator-facing identity text are unchanged.
+
+## 0.4.0 - 2026-08-31
+
+### Added
+- ACP clients can discover Clio's existing terminal setup flow directly from `initialize`: the server advertises `clio-login` as a terminal authentication method with `auth login` arguments. Editors and generic ACP launchers can also start the same dynamically dispatched, stdout-clean server path with the global `clio-coder --acp` alias; the canonical `clio-coder acp` command remains unchanged.
+- Clio can vendor pinned external programs through one registry instead of hunting them on `PATH` (`clio-coder tools list|status|install|remove <id>`, with `clio-coder panes install` as an alias for herdr). The registry pins herdr 0.8.2, yazi 26.8.15 and croc 11.3.6 with a per-platform url and sha256, license, binary names and a minimum acceptable `PATH` version, and every caller shares one resolution ladder of `PATH`, then vendored, then none, through `resolveBinary(name)`. Clio bundles none of them: nothing is downloaded until an operator asks, nothing reaches the filesystem before the checksum matches (side documents included, so a tampered LICENSE refuses as loudly as a tampered binary), and each version directory keeps the upstream license text plus a `clio-install.json` recording what was fetched. Installs are atomic through a staging directory renamed into place, and `--force` parks the old version rather than unlinking it, so a failed replacement restores what was there. Archive reading is self-contained on `node:zlib` rather than shelling out to `unzip` and `tar`, which fail on exactly the machine a vendored-tool installer exists to serve. herdr, yazi and croc each declare linux-x64, linux-arm64, darwin-x64 and darwin-arm64, and yazi and croc add win32-x64; croc's Windows hash is confirmed against upstream's own checksums file, and both Windows assets were installed end to end through the real installer, though neither has been executed on Windows. herdr declares no Windows asset even though it publishes one: alongside `herdr.exe` that zip carries a ConPTY runtime that has to sit in a subdirectory beside the executable, and the installer places every declared member flat under its basename, so the entry would produce an install that verifies and unpacks cleanly and cannot run. A `PATH` copy is accepted only above the registry's floor, and a floor moves on measurement and on nothing else: croc floors at 11.0.0 because it negotiates its relay protocol by major version; herdr floors at 0.7.5, the oldest release whose `herdr api schema --json` was actually read, because every method Clio's mux domain sends exists in both 0.7.5 (protocol 17) and the 0.8.2 pin (protocol 20), the only two methods 0.8.2 adds are ones Clio never sends, and the two non-universal methods are already gated at runtime by protocol number, so the registry had been stricter than the surface it guards; yazi stays at its pin because no equivalent measurement exists, since `ya emit-to` matches at 26.1.22 but the generated profile and the DDS pick payloads were never driven there and a profile mismatch degrades into a file manager that opens and quietly does the wrong thing. A rejection that felt noisy is not evidence, and a floor lowered without one is the kind of failure that reads as a bug in the feature. The cost of a floor is now legible instead of silent: a rejected `PATH` copy is never reported as a missing binary, and every render of a rejection names the binary found, the version it reported, and the floor it missed. The install command is offered exactly where installing would change something, so a tool that already has a vendored copy says Clio runs that copy instead, and a platform with no pinned asset names no dead-end command. `clio-coder tools status` carries the same rejection as its own line plus `floorRejection`, `remedy` and `installedVersions` fields under `--json`. `clio-coder doctor` reports one row per registry entry through the same sentence, and no row can fail an install, because every pinned tool is optional.
+- A vendored tool can be removed, and a pin bump no longer leaves the version it replaced on disk. `clio-coder tools remove <id>` deletes every vendored version of one tool and the tool's own directory, refuses an id the registry does not know while naming the ids that exist, and is a successful no-op with a clear message when nothing is installed. It needs no confirmation because everything it unlinks lives under `<data>/tools/<id>`, which Clio created by downloading it, so the worst outcome is a re-download of bytes the registry pins by checksum. A successful install then prunes: superseded versions of the same tool are deleted and named in the result and the output, including on the already-installed path, which repairs a machine that bumped pins before this existed. `clio-coder tools remove --all` sweeps every row in the registry, counting the tools that had nothing vendored rather than listing them and taking the worst exit code across them; `--all` alongside an id is refused rather than resolved by precedence, and `--all` on any other verb is refused rather than ignored, because a silently dropped flag would let `tools install --all` read as a request that was honored. A dot-prefixed staging directory is left alone while it could still belong to a live installer and swept once it is an hour old, which is the one signal that means the same thing on every machine: the installer downloads and verifies every checksum before it creates that directory, so a stale one is the remains of an install that was killed, and a removal that finds a fresh one leaves the tool directory in place rather than destroying the install it belongs to.
+- Clio gains a pane layer that drives a herdr session it is already running inside, and degrades to exactly today's behavior everywhere else (`/panes show|open|close`, a `panes` tool, five `doctor` rows, and a `panes` settings group under Fleet). Detection is a three-condition ladder of `HERDR_ENV=1`, then a connectable socket in a fixed candidate order, then a ping answered inside one second, and the order is what makes the off path free: with `HERDR_ENV` unset nothing opens a descriptor. **Guest mode only.** `panes.enabled` accepts `auto`, `embedded` and `off`, but `embedded` resolves to none with the reason `embedded mode is not implemented yet; it ships in phase 5`, so Clio never starts a pane host of its own. The dispatch bridge subscribes to the five dispatch lifecycle channels plus interactive status, folds each run into a display record, and projects those records on a trailing-edge 250ms throttle, because herdr answers one request per connection and a call per event would open a socket per event; a fifty-event burst produces one pane update. The open decision is made at flush time rather than at start time, which is what lets `panes.agents = auto` cover detached batches and attach-to-background conversions without racing the durable record that names them, and what lets a run backgrounded halfway through acquire a pane then. A terminal run that never had a pane never gets one; `panes.keepFailed` governs whether an existing pane outlives its run. Run state maps to `working`, `blocked` for an unresolved permission escalation, and `idle` with a `state_labels` override reading "review ready" on terminal. Every mux method is best-effort: a wedged herdr server degrades `available()` to false for a five second cooldown and can never fail a dispatch or surface as a run error. Pane ownership is enforced both by a registry of the panes Clio created and by a `clio_owner` metadata token, so `doctor` can find orphans. `/panes open` takes a preset or operator argv, told apart at parse time, and probes a preset's binary through the toolchain ladder before splitting the pane, so a missing program becomes an install hint rather than a pane that dies the instant it appears. The `panes` tool is registered only when detection answered, so it is absent from the prompt on a machine with no pane host, and its `open` accepts a closed preset enum, refusing a fabricated `argv` field loudly. `panes.enabled` is restart-scoped in the Settings Center because the detection ladder runs once at boot. Terminal-state toasts under `panes.notifications` are implemented but their failure path is not verified against a live host.
+- A pane can now be a file picker whose selections come back into the prompt, governed by four live `panes.yazi` keys (`enabled`, `mode`, `profile`, `followCwd`) surfaced together under Terminal. Clio generates its own yazi profile in an isolated cache directory from its theme tokens and a vendored `git.yazi` plugin, stamping every compatibility input and validating the emitted TOML before a pane consumes it, so the operator's own yazi configuration stays outside Clio's read and write set and a malformed generated file cannot leave an interactive pane blocked on a prompt. `doctor` and `tools status` report the profile state, so the separation is visible and only the reproducible cache can be reset. The emitted bytes, the legal theme keys and the unused pick chord are pinned against the upstream 26.8.15 presets, so a future yazi pin bump fails in contracts rather than in a session. Picks return over yazi's DDS stream rather than through a chooser file, because yazi exits on its first non-interactive open and a chooser file therefore cannot support a long-lived companion; the pane's DDS stdout is redirected through the existing mux exec delivery and tailed as a bounded stream, and the session learns its instance id from startup `cd` events so cwd can be pushed later. **The remote event ability is treated as untrusted local input.** Every companion carries a random token, and the bridge rejects and counts custom lines that do not echo it before any text reaches the draft; valid selections are deduplicated, bounded, rendered as safe mentions only when Clio can consume them, and appended with no submit capability. Chooser mode remains the operational fallback: a missing startup stream closes the suspect pane and falls back to it, and `profile: user` forces token-free chooser mode outright. The bridge attaches to the Phase 3 panes runtime rather than adding a competing slash implementation, so `/panes` reports mode, cwd, stream freshness and rejected DDS traffic, and `--once` carries through the parser. A mux contract that resolved to none still composes operator pane operations while leaving the model tool unregistered, so the same command lends the terminal to yazi under the TUI lease, restores the screen, and feeds chooser results through the same formatter the companion picks use, with binary and profile checks finishing before the screen is released. A failed yazi resolution now crosses onto a durable slash transcript block verbatim, install hint included, instead of producing no pane and no explanation.
+- Every dispatched run now writes an append-only NDJSON journal at `<stateDir>/runs/<runId>/events.ndjson`, and `clio-coder fleet view <runId> [--follow]` reads it, so a second terminal can watch a run in flight over plain SSH with no pane host involved. Each line carries a per-run monotonic `seq` and a wall-clock `at`; display-only lines are the only droppable kind, and crossing the 2 MiB per-run cap writes a single `journal_truncated` marker and stops writing them while open, receipt and terminal lines always land. A terminal line closes the run, so a follower has an unambiguous stop signal. Writes batch into one `appendFileSync` per flush, and a write failure turns the journal off for the process after one notice and is invisible to the dispatch. The writer runs off the dispatch domain's own bus rather than off any caller's helper, so it covers `run --agent`, `fleet run`, the TUI `/run` and the model-facing `dispatch` tool alike, attached, detached, batched or retried. **A retried run journals each attempt**, because the domain publishes per attempt. Retention is bound to the ledger ring rather than to a second policy, so the two cannot disagree about how much history exists, and `clio-coder reset --state` already takes it. The viewer authenticates the receipt through `inspectRunReceiptTrustStatus` before showing any of its fields and bounds task text at the terminal boundary. `fleet view` also accepts the `root=fleet-<hex>` identifier `fleet run` advertises, reducing the durable fleet record plus the ledger to a step index with one line per step in planned order, showing steps that never ran without a run id so a fleet that stopped early reads honestly. It is deliberately not a combined transcript, because the durable record carries no interleaving and splicing several runs into one scroll would invent an ordering nothing observed.
+- LiteLLM is a first-class provider runtime rather than something reached over `openai-compat`. A gateway's `/v1/models` is the plain OpenAI listing, so every semantic alias flattened to a bare id and a 262k tool-calling coder behind `code` fell back to the protocol defaults of `tools: false` and an unverified context floor. The runtime reads `/v1/model/info`, where LiteLLM publishes `max_input_tokens`, `supports_function_calling`, `supports_vision`, `supports_reasoning` and the deployment mode per alias, reports the physical model behind each alias in its probe notes, and probes the unauthenticated `/health/liveliness` first so an unreachable gateway is distinguishable from a rejected key. Structured output was measured rather than assumed against a LiteLLM v1.98.0 proxy fronting both a llama.cpp and an LM Studio upstream: standard `json_schema` is enforced through both, `json_object` plus schema is enforced through llama.cpp and refused with HTTP 400 by LM Studio, and `drop_params: true` strips neither because `response_format` is a parameter LiteLLM recognizes and forwards whole. Only `json_schema` is declared, which is what admits contract-bearing workers to a gateway target at all. The runtime also opts into `responseSchemaConflictsWithTools`, conservatively, because whether a schema and a tool surface can constrain one completion is a property of the upstream a runtime id cannot identify. Synthesis forces `gateway: true` regardless of settings, keeping the residency layer observe-only, since the models behind an alias are the proxy's to load and evict. The routed deployment is surfaced from the `x-litellm-*` response headers, because reporting the alias back as the model is how a gateway hides an outage.
+- An ACP client can now build a live fleet board and attribute every frame to the agent that produced it. Five dispatch lifecycle channels join the `clio-coder/event` stream, whose channel list becomes a real allowlist: a client names the kinds it wants at `initialize`, the server intersects that with `ACP_FORWARDABLE_EVENT_KINDS`, and a malformed request still refuses the whole opt-in rather than only the offending entry. What crosses is sanitized. The exact dispatched task never leaves the process, only a control-character-stripped, byte-bounded preview carrying the standard truncation marker, and free-form `outcomeDetail` failure prose stays host side because it legitimately quotes paths, argv and provider bodies. The untyped worker event stream behind `dispatch.progress` is replaced by a capped per-run progress ordinal whose cap is announced by a final truncation frame rather than by going quiet.
+- The workbench consumes that boundary at protocol v4, rendering agent attribution on messages and tool calls and a live fleet strip, so orchestrator work and delegated worker work are distinguishable on screen instead of both reading as the product name.
+- Typed dispatch intent has one migration and refusal policy instead of four files that each answered part of it (#163). `src/domains/dispatch/intent-compatibility.ts` classifies a request into accept, warn, or refuse against a closed set of stable reason codes, and the boundary between warn and refuse is the load-bearing rule: a warning is never the difference between a narrow grant and a wide one, so no compatibility path widens read, write, or verification authority to resolve an ambiguity, and a compatible reading that disagrees with a declared one about what a worker may touch is a refusal rather than the union of the two. Omitted intent stays accepted with a warning, because inferred paths select project rules and compile worker context but can never become a write boundary or add a verification requirement. Refusals are contradiction and uninterpretability: legacy `writeRoots` disagreeing with `intent.write_roots`, a narrowed scope reaching outside the intent it narrows, `write_roots` on a read-only request, an `expected_outputs` entry outside every declared write root (the write boundary would block exactly the artifact the task is required to produce, after a full worker run has been paid for), and an `intent.version` this build does not speak. The supported version set is a membership list rather than a range and nothing is migrated: a reader that accepts "2 or newer" accepts fields it cannot interpret and one that accepts "2 or older" reads a v1 statement about authority under v2 rules, which is the ambiguity typed intent exists to remove. The classifier runs inside `validateJobSpec`, which every producer reaches a worker through, so the rules hold for the fleet, CLI, ACP, and extension paths rather than only for the model-facing tool, and it reads no filesystem, clock, environment, or package layout, so a source checkout and an installed package classify identical input identically. Two authority mismatches that previously ran are now closed: the unproducible expected output above, and a council member inheriting its caller's declared write roots under read-only autonomy, which now arrives with those trees demoted to read roots instead of claiming a write scope nothing enforces. Removing the legacy inference fallback stays a later explicit issue, and it now has a measured gate rather than an argued one: `pathScope.mode` is sealed on every receipt, so `dispatchIntentAdoption()` counts the share of dispatches still resolving policy-bearing scope from prose, reading nothing but that mode field. `docs/dispatch-typed-intent.md` is the published contract, with a row per dispatch producer and per persisted structure.
+- A v4+ fleet contract's per-step `writes:` declaration now reaches project-rule selection and worker context, not only the write-boundary enforcer. The contract had already said what a position may change, and the dispatch request that position produced carried neither typed intent nor `writeRoots`, so scope for a fleet step was still reconstructed by scraping path-like tokens out of the rendered contract prompt. The declaration now compiles into the step's typed intent through `declaredScopeIntent()`, which runs a producer's repository-relative paths through the same normalization, caps, and provenance construction a model-facing declaration goes through, so a contract cannot mint an intent shape the dispatch tool could not. It arrives as `relevant_paths` rather than `write_roots` on purpose: intent write roots become the enforced boundary at the per-tool worker seam, which refuses outright on the subprocess and ACP runtimes a fleet may legitimately route a step to, so restating the contract's boundary there would mint a second grant in a second place and fail closed on contracts that run correctly today. Authority is unchanged; the fleet enforcer keeps owning the boundary. A pre-v4 contract and every readonly step declare nothing and keep the legacy inference path rather than being handed an empty declaration that would quietly switch off path-scoped rule selection for them.
+- An endpoint's discovered parallel slot count now survives the process that learned it. Probe discovery held `probeCapabilities.parallelSlots` in memory only, so every new process started ignorant of a server's real concurrency and priced admission against a default instead.
+- A compete round's candidate worktrees are mapped through herdr when one is driving the session, so each candidate is a workspace an operator can watch instead of a directory only Clio knows about. The mux socket client gains typed `worktree.list|create|open|remove` at protocol floor 10, which is the protocol herdr's own changelog introduces the family at rather than either release currently installed, and Clio omits the optional `trust_repository` field those requests grew at protocol 21 so herdr's default repository-trust policy stays herdr's to set. Creation prefers herdr and then validates that the path and branch it returned are the ones asked for, refusing a workspace opened somewhere else rather than adopting it. Every candidate records how it was made: `backend: herdr` with the workspace id, or `backend: native` with `fallback: mux-unavailable` when no mux is driving and `mux-operation-failed` when a live one refused, and those facts are sealed inside the integrity-verified candidate receipt rather than living only at the mapping boundary, so a competition can be audited after the fact for which candidates herdr actually held. Removal asks herdr to drop a workspace it owns and then always runs the native Git cleanup, which is both the recovery path when a mux is lost mid-competition and the authority that proves the registration, the directory and the branch are gone. A server below the protocol floor is never called, and transport loss degrades to the native path instead of escaping into compete execution.
+- Fleet panes now say what a run is and how it ended, not just that it is running. A pane's role presentation resolves from the gate role first and the agent identity second, and the working and blocked labels follow it: candidates and builders read `building` and `build blocked`, reviewers and judges `reviewing` and `review blocked`, council members `deliberating`, and tester, scout and repair-shaped roles their own pairs, with `running` and `needs input` as the fallback. The idle label carries the outcome rather than the fact of stopping, reading `review ready`, `failed, review`, `timed out, review`, `canceled` or `finished`, so a terminal pane stays distinguishable from an untouched shell. A qualifying failure additionally writes a persistent line into the transcript naming the agent, run, outcome and terminal detail, alongside the existing best-effort herdr toast, and that line is still produced when the mux transport has already gone away, so the auditable signal does not depend on the thing that failed. Both signals stay governed by the existing `panes.notifications` setting. `/panes open` also reconciles immediately: an admitted open is recorded as a pending inventory row before the mux round trip, rendered as `opening`, and cleared when the operation settles, so an inventory read taken while an open is legitimately in flight reports it rather than omitting it.
+- The workbench gains four bounded read surfaces over durable harness state, each following the same shape: a fixed no-argv root command emitting a bounded snapshot, a host adapter demanding the exact key set the command emits, the same bounds revalidated independently in the browser, and a panel that states its own boundary. `clio-coder fleet inspect --json` backs a Runs canvas carrying journal events, receipt trust, outcomes and truncation, and additionally indexes fleet roots so a run's lineage is visible instead of a flat newest-first list; the index rides that same read rather than paying for a second child process, and a step whose run has aged out of the window says so and stays unselectable rather than linking nowhere. `clio-coder tools list --json` backs a Settings instrument that leads with the resolution verdict and names the specific floor a rejected `PATH` copy failed to clear, while installation stays an explicit terminal operation the GUI does not offer. The recovery panel now names every diagnostic check and its verdict rather than reporting only a count, under sections that open themselves on a warning and stay folded when clean. What crosses is deliberately narrow: a finding's name is a fixed check label plus a subject drawn from the ids that already cross elsewhere, and a finding's detail, which quotes settings paths, endpoint URLs, the multiplexer socket and rejected `PATH` copies, stays on the host permanently. Demanding the exact key set in both directions is the load-bearing part, since it makes a harness field addition a loud host-side rejection rather than a silent browser leak. The Runs canvas now joins that durable narrative to `trace inspect --json` accounting from the separate trace store, showing per-run tokens, recorded cost, wall time and phase totals while dropping request text, phase prose, database paths and raw columns, and it distinguishes tracing unavailable, no accounting for this run, and accounting present with an unpriced cost rather than flattening all three to zero. Trace tails and process rows remain host-only by design: SQL crosses only event counts, spans and kind breakdowns plus process counts, live counts and kinds, with both validators proving the aggregates account for themselves, so no event payload, command line, pid or host is ever loaded into the projection. `evidence inventory --json` adds a bounded newest-first bundle inventory that omits tasks, working directories and file names, links only runs still inside the served run window, preserves redaction and tool-call shape, and folds each bundle to the harness's worst canonical trust verdict while naming historical bundles as verdict-less instead of guessing. Detail reads and receipt checks do not reopen the fixed-argv boundary: the browser may echo only an evidence or run id the host served in its current snapshot, the allowlist is replaced rather than widened on refresh, and an unserved, expired, malformed or flag-shaped id is refused before any child process starts. An admitted bundle id opens only the closed-vocabulary per-run trust axes, and an admitted run id may be re-authenticated on demand through `fleet verify <runId> --json`, shown beside rather than in place of the snapshot verdict with the check time and a classified failure cause, so a receipt that was valid when listed can later be reported as changed without carrying a path, digest or thrown message. Council parity is reconstructed from provenance the ledger already seals: a separate bounded council window groups member turns, rounds, judge runs and the zero-cost sealed synthesis row into a topology, while member answers, judge prose and vote tallies never cross and are marked host-only rather than missing. Review and compete outcomes come from their own `fleet decisions --json` read because the integrity-covered gate artifacts have a different store and failure mode; the panel carries the gate kind, closed verdict, graded run ids, classified reason, winner identity where the verdict permits one, and the sealed independence dimensions, counts artifacts that no longer authenticate instead of silently dropping them, and never carries detail prose, branch refs or receipt digests. Settings also gains `interop inspect --json`, a fixed read that names the known coding agents on this machine, whether each is installed, its last recorded version, ACP and adapter availability, standing accept or decline, staleness and whether it is already wired, while deliberately running no foreign executable and carrying no resolved binary, home directory or decision fingerprint; wiring remains an explicit terminal review the GUI does not offer. Fifteen mutation-shaped parity rows are now marked **deferred-by-design** rather than looking like ordinary backlog: installation and credential lifecycle, repair, reset, uninstall, upgrade, fleet authoring and admission, pane installation, sharing and import, extension enablement, handoff, fork and auth operations require a separately designed host-minted intent and confirmation channel before any browser control can change the machine, while mixed rows keep their still-actionable read gaps visible. `apps/workbench/PARITY.md` records the resulting command-by-command baseline so follow-on GUI work cannot overstate what is covered.
+- A modal overlay now says so on the terminal title, so an external driver or herdr's detector can tell that Clio's keyboard is owned before sending keys into it. The grammar is published only while a modal is up, reading `clio [modal:permission-confirm]` for one and `clio [modal:library-install+2]` for a stack, naming the modal that holds the keys and counting the ones beneath it, and `MODAL_MARKER_TITLE_PATTERN` is exported so Clio's contract test and herdr's manifest rule are written against one spelling. The title was chosen over a footer marker because the modals cover the footer: most overlays anchor centre with no height cap and paint over exactly the rows a detector reads, so a footer signal would go quiet on the biggest modals, and a signal that drops out under load is worse than none because it reads as a state change rather than a gap. The title also cannot be counterfeited by a diff or a quoted log line in the transcript, and nothing else in Clio writes it. The claim is taken inside the overlay frame rather than in the overlay lifecycle, which is the one place modality is decided, so nested frames are covered and the marker cannot drift from what is actually on screen; hiding a modal to shell out drops the claim and takes it back on focus. Nothing is written until the first modal opens, which is what makes the absence of a marker a positive statement rather than an unknown. herdr needs no code change to consume it, only a manifest rule and a version bump.
+
+- The Workbench Runs canvas can inspect a bounded window of durable fleet runs, journal events, outcomes, truncation, and authenticated receipt trust through the fixed `fleet inspect --json` read, without accepting a browser-supplied run id, path, filter, or argv.
+- Workbench Settings names the external coding agents detected on the machine, their last recorded versions, ACP and adapter availability, standing decisions, staleness, and wiring state through `interop inspect --json`, while running no foreign executable and exposing no resolved binary, home directory, or decision fingerprint.
+- The Workbench capability atlas crosses the declared verification-check plane through `verifiers inspect --json`, reporting each check's origin, toolchain class, fixed-argv authority, argument count, root-versus-subdirectory execution, and classified catalog rejection while keeping the declaration's executable arguments and repository paths host-side.
+- The Workbench Skills atlas now uses `skills inventory --json` to report the whole installed catalog, including untrusted and operator-only skills the model cannot see, with the shared validity verdict and bounded diagnostic counts while keeping skill bodies, paths, hashes, upstream URLs, and diagnostic prose host-side.
+- The Workbench Runs canvas now inventories a bounded newest-first window of evaluation reports through `eval inventory --json`, grouping reports by comparable serving configuration and showing suite outcomes, scenario reductions, coverage, failures, and attachment counts while keeping transcripts, artifact content, native paths, receipt digests, compiled-prompt fingerprints, and metric values host-side.
+
+### Changed
+- `@anthropic-ai/claude-agent-sdk` moves to `optionalDependencies`, so a default install no longer pays for a 224MB-per-platform proprietary binary reached from exactly one runtime most operators never enable. Measured on Linux x64 with a production install: 387MB across 118 packages with the SDK against 143MB across 109 packages with `--omit=optional`, a **244MB saving**, and the default install becomes cleanly open-licensed because the binary is not redistributable. The one static value import becomes a lazy `await import()` behind a loader that caches the module, distinguishes a resolution failure from a broken install, and turns absence into a typed error naming the package and the exact install command; it fires at the first line of a `claude-sdk` run, so a missing package reads as an ordinary run failure with a diagnostic rather than a crash in the dispatch path or a boot-time resolution error. `tsup`'s default external set covers dependencies and peer dependencies but not optional ones, so the package is now an explicit external; without that, esbuild would have bundled the SDK and quietly restored the hard requirement. npm also drops the SDK's peer tree from the lockfile, since peers of an optional dependency are themselves optional.
+- The pane layer graduates from its initial auto-detected, per-dispatch design into an explicit first-class mode. `clio-coder --with-panes` enables it for one invocation, `--no-panes` wins over both that flag and the persisted setting, and the shipped default is off; the ordinary shell therefore does not statically import herdr, inspect its environment or socket, or pay for mux startup, while `doctor` distinguishes an operator who has not enabled panes from one whose enabled pane host cannot be reached. Enabling the mode dynamically loads the same bounded mux integration after Stage 0 and retains the existing yazi companion, notifications, ownership checks, degradation policy, `/panes` surface and model tool, but dispatch no longer creates, focuses, updates or closes a viewer pane at any lifecycle point. `panes.agents` and `panes.keepFailed` are accepted and ignored during migration instead of preserving an obsolete automatic policy. There is one operator-pulled watch pane instead: Enter on a live run in the Alt+W fleet overlay opens or adopts it, arrowing between runs atomically retargets a bounded selection file without opening another socket or pane, and a terminal selection is refused with a pointer to the post-mortem viewer. `clio-coder fleet view --watch <selection-file>` supplies that pane's long-lived reader, keeps running while no selection or journal exists, renders bounded waiting and unavailable states, and switches through the same authenticated run renderer used by `fleet view <runId>` rather than maintaining a second presentation of receipt trust.
+- Internal quality work with no behavior change: a boundaries rule now guards every external reacher of the instant shell's Stage 0 closure, holding importers to a declared seam allowlist and walking each value-imported seam's closure against a Stage 0 set the rule computes rather than enumerates, so an edge that would split the chunk the shell's startup budget sits on fails `npm run lint` in the worktree that caused it rather than after a full build. The rule began scoped to `src/cli/**` and was widened after a `src/domains/**` edge split the same chunk from a direction it could not see; the closure holds at its 6 chunks and now measures 111,562 bytes against a cap raised from 110,000 to 113,000 for the modal marker, which the bundler groups into the same chunk as the TUI engine whether or not the instant shell can reach it; the byte cap measures chunk co-location rather than what Stage 0 executes, and the forbidden-graph assertions that pin what it must never drag in are unchanged. Contract tests additionally pin the TUI strings herdr's detector matches and the Agents Reference Enter and Tab detail behavior its footer advertises. The test runner now gives every lane its carried load and drains a named serial lane after the 24 parallel lanes for cases whose product-owned timing claim cannot be widened; hang, spawn, settlement, PTY and peer watchdogs scale with that load while behavioral deadlines remain literal. Refreshed shard weights are guarded against stale or missing coverage, asynchronous state is observed instead of guessed from sleeps, fixture connections, rejected spawn memos and PTY timers are closed where their callers can observe it, and every lane has a bounded lifetime and pipe-drain window with diagnostic failure text, turning the former wall-clock-shaped intermittent population into deterministic suite infrastructure.
+
+### Fixed
+- Proactive memory now budgets enough output for thinking models while respecting each model's output cap, uses a one-minute intervention deadline, and degrades visibly to the rules tier after two consecutive LLM timeouts instead of repeatedly spending on a stalled background route.
+- Dispatches now queue behind a saturated inference endpoint under a stable, visible run identity, retain cancellation and deadline semantics while waiting, and start as soon as endpoint capacity is released instead of failing immediately.
+- Debugger, verifier, and research result-contract repairs now name the rejected field and every legal enum choice; completed debugger, verifier, research, and scout envelopes render as readable report prose with semantic footer facts instead of raw JSON.
+- Fleet watch panes now inherit the parent process's resolved config, data, state, and cache layout, diagnose the exact ledger root when a run is missing, and set both the herdr pane label and display title to `clio watch` on supported mux protocols.
+- Interactive run receipts now report operator cancellation as an abort rather than a generic failure, while dispatch route-warning text survives journal projection so fleet viewers and watch panes show the warning that affected routing.
+- `configure --list` now labels keyless local runtimes as `key-optional`, distinguishes required cloud credentials as `needs-key`, and preserves the existing `none` and `credential` states.
+- Configured targets no longer persist probed model catalogs in `settings.yaml`; bounded, versioned, identity-checked per-target snapshots live under the provider cache, preserve offline discovery, and migrate legacy `wireModels` observations on reconfiguration.
+- Settings Center now covers every shipped operator-policy leaf it can safely edit or display, including escalation, prewarm, route activation, guardrails, working-set eviction, retry stall, and library rows, with explicit reasons for the few nested or trust-record settings that remain read-only or YAML-only.
+- Focused `ask_user` option descriptions, expanded decision questions, answers, and corrections now wrap inside their actual containers instead of losing explanatory text at the right edge; `/panes` usage errors also keep their reason and usage line separate.
+- Pass-2 interactive smoke fixes close the remaining lifecycle and narrow-layout gaps as one release wave: `/model` and the model picker now ask whether a swap is session-only, saved globally, or cancelled; exhausted observation budgets become terminal after three bounded retry notices; working-set compaction announces why eviction was skipped before falling back to an LLM summary; and the two-lane Settings footer wraps its complete scope note. Worker approval dialogs now withdraw as soon as their escalation times out or their run terminates, naming the applied fallback without parking the editor; cancelling queued admission renders as an operator abort; endpoint cards separate occupied slots from queued demand; and a relaunched session reclaims its surviving tagged watch pane at startup instead of reporting no owned pane or opening a duplicate.
+- Managed Yazi profiles now prove that the resolved pinned binary accepts their schema before an atomic promotion, rejecting and cleaning up syntax-valid profiles that would fall back to presets, while a permission request parked beneath help or another modal now interrupts as the focused top frame, keeps later approvals in FIFO order, and restores and refocuses the interrupted modal after the decision.
+- The bounded revise loop in `build-review` was unresolvable by construction, and every run of it ended in `loop_bound_exhausted` with two needs-operator-decision lines. The plan compiler gave one rendered prompt body to every agent node, the `build-review` body ended in the builder's "Answer with your `mutation-report`", and the loop's check node was dispatched under `verifier-report`. The verifier obeyed the instruction it was handed, the gate refused the answer against the schema that instruction never mentioned, and both were correct: the run burned its whole repair budget on a contradiction it was given. Each agent node now states its own contract after the shared body, quoted from the same wire example its validator judges, with a precedence line saying that a shape the body names for another step does not apply. `build-review` and `build-test` drop the builder answer instruction their bodies carried for every node to read; `sdlc`, whose body scopes the ask to the agents that produce a work product, is unchanged. Against the same gateway and model that failed 5 runs and 10 verifier cycles out of 10, the loop now resolves on the first verification with no repair.
+- Unpriced work rendered as `$0.0000` on every fleet surface, which is a measured zero and a claim nobody made. A gateway that declares no `pricing:` block, serving a wire model no provider catalog knows, resolves to no rates at all, and the receipt seals that honestly as `costProvenance: "unknown"` beside a `costUsd` of zero and a token count that was genuinely measured. The fleet renders then threw the provenance away and formatted the amount alone. All five of them now consult it, so an unpriced step, an unpriced run total and an unpriced `fleet status` row and its totals read `not measured`, while priced work reads a dollar amount and the token counts show either way, because usage was always observed even when nobody priced it. A run total is folded rather than summed, since adding unpriced zeros to priced dollars produces a number that is neither. A genuinely free call stays distinct from an unpriced one: a self-hosted gateway given a `pricing:` block of zero rates resolves as known-free and renders `$0.00 local`, which is the accurate label. Routing these lines through the shared formatter also narrows priced amounts at or above a cent from four decimals to two, so `$1.2500` now reads `$1.25` while sub-cent amounts keep four; that is a visible change to priced output, taken deliberately, because keeping a second cost formatter on the fleet surface is the drift that produced this defect. One render site on the interactive `/fleet` overlay's summary line is not yet covered and still prints the four-decimal total.
+- Fleet panes did not survive a clean TUI exit, and input focus could end up in a tab nobody was looking at. Neither was the disposal path it looked like. A run viewer was started with `exec`, which replaced the pane's shell with the follower process, so when that viewer exited normally herdr removed the pane whose shell had gone, and with it the Fleet tab when it was the last pane there. The focus defect fed it: the focus ladder treated tab focus as an acceptable substitute when the agent-pane call was refused, so it could report success having focused only the tab, leaving a `q` bound for a viewer in another tab to reach that viewer and turn an ordinary exit into pane and tab destruction. Run viewers no longer use `exec`; the shell line follows, renders one settled snapshot when following returns, and leaves the shell alive, while utility panes keep `exec` because their lifetime is the launched utility's to define. Shutdown closes the subscription and the socket and neither sends `pane.close` nor clears ownership. Focus is now one ladder shared by the slash surface and the agent tool, which focuses the tab, focuses the pane, reasserts pane authority and retries once on refusal, then reads a live snapshot and reports success only when both the focused tab and the focused pane are the intended ones. The slash surface also awaits its pane operations through the serialized queue the agent tool already used, so an inventory read taken straight after a slash mutation cannot observe it half-done.
+- `clio-coder reset --data` deletes vendored external tools and its preview did not say so, describing the data root as memory, evidence and evals. Vendored tools live under that root and are the one thing a reset cannot regenerate locally, so the preview, the command help and the documented role of each root now name them, along with the note that `clio-coder tools install <id>` downloads them again.
+- Whether `/council` worked depended on how many seconds had passed since boot. The endpoint dimension was resolved only from `providers.list()`, which provider startup builds asynchronously while dispatch route resolution does not wait for it, so a council raised before `probeAll()` finished put no endpoint in its reservation and skipped the dimension entirely, which is not a conservative check but no check at all. Eight consecutive attempts against a one-slot llama.cpp box were refused; one raised seconds after startup was admitted and ran both members plus the orchestrator's own turn against that single slot. Capacity now resolves from the configured targets as well as the probed statuses, so admission is independent of probe timing.
+- `clio-coder run "/definitely-not-a-command"` forwarded the token to the model as an ordinary task, opening a session, spending a full turn and exiting 0 with a conversational answer to a command that never ran (#259). The verdict now happens before the orchestrator boots, reusing `parseSlashCommand` as the single shape test and registry walk, so prose still reaches the model (an absolute path carries a separator, and the `\/` escape still works), a prompt template claims its token first, and a mistyped command exits 2 as the usage error it is, costing no session and no model call.
+- The `ask_user` free-text field had exactly one exit, and that exit resolved the whole round as cancelled, so a single-question round had no route from a typed draft back to its options (#260). Esc in the text field now returns to the option list and drops the draft whenever the question has options, with the footer spelling `back` or `close` to say which; cancelling the interview stays available and distinct, one surface further out. Navigating away mid-draft parks the text mode rather than sticking it, so the draft survives in place but the question greets the operator with its options.
+- `/view verify` reduced a receipt verification to a single pass-or-fail sentence, hiding the file and seal an operator needed to inspect and making a compromised trust projection look equivalent to a trustworthy result. The notice now carries the receipt path, sealed digest, canonical trust summary and per-check outcomes, reusing the same trust projection as fleet view and the dispatch board rather than growing a competing vocabulary. Compromised canonical trust renders as a warning naming each compromising axis with its reference, and cryptographic failures retain the presented digest while distinguishing file, contract, ledger and digest checks. The underlying verifier contract, its argument shapes and its refusals are unchanged.
+- A scout dispatched with a directory-survey task died exit 1 with `Scout citation path escapes the workspace: .`, reproduced four times. Two defects sat behind one message: the containment check refused the empty relative path alongside the `..` forms, and the empty string means the citation resolved to the workspace root itself, the one location guaranteed to be inside it; behind that, the reader called `readFile` on the cited location, and a directory has no bytes, so even a contained directory citation would have failed as unreadable and then failed grounding again because a survey lists a directory rather than reading it. Containment is now answered on the resolved pair with the root treated as contained, which also settles the `./src`, `src/` and `./src/` spellings, and a real escape still refuses.
+
 ## 0.3.9 - 2026-08-30
 
 ### Added

package/NOTICE

@@ -7,3 +7,36 @@ Illinois Institute of Technology.
 
 Licensed under the Apache License, Version 2.0. See the LICENSE file
 distributed with this work for the full license text.
+
+--------------------------------------------------------------------
+Pinned external tools
+
+Clio Coder does not bundle the programs below. `clio-coder tools install
+<id>` downloads a pinned upstream release on request, verifies it against
+the checksum recorded in src/domains/toolchain/registry.ts, and places the
+upstream license text beside the binary under the Clio data directory. Each
+program remains under its own license and copyright; Clio neither modifies
+nor redistributes it.
+
+herdr (https://herdr.dev, https://github.com/herdrdev/herdr)
+  Copyright the herdr authors.
+  Licensed under the Apache License, Version 2.0.
+  Used as the terminal multiplexer behind Clio panes.
+
+yazi (https://yazi-rs.github.io, https://github.com/sxyazi/yazi)
+  Copyright the yazi authors.
+  Licensed under the MIT License.
+  Used as the terminal file manager behind the file-picker pane.
+
+croc (https://schollz.com/software/croc6, https://github.com/schollz/croc)
+  Copyright Zack Scholl and the croc authors.
+  Licensed under the MIT License.
+  Used as the relay file-transfer backend for machine-to-machine transfers.
+
+--------------------------------------------------------------------
+Vendored components
+
+git.yazi (https://github.com/yazi-rs/plugins/tree/main/git.yazi)
+  Copyright 2023 the yazi-rs authors.
+  Licensed under the MIT License.
+  Vendored as source with its LICENSE under the managed file-pane profile.

package/README.md

@@ -45,12 +45,54 @@ clio-coder                # start the interactive session in any project directo
 ```
 
 Requires Node.js `>=22.19.0`. `configure` lists the runtimes, asks for the
-endpoint and model, probes it, and saves it as the chat and worker target; bare
+endpoint and model, probes it, and saves it as the chat and fleet default; bare
 `clio-coder` opens the same wizard when nothing usable is configured yet. In the
 first session, type a request in plain words or `/help` for the command
 palette. `/settings` changes the model later, `/quit` leaves, and
 `clio-coder doctor` reports the install's health at any time.
 
+Adding `--omit=optional` to that install skips the Claude Agent SDK's 224MB
+proprietary binary, taking the tree from 387MB to 143MB. Everything but the
+`claude-sdk` worker runtime works without it. See
+[Installation and Lifecycle](docs/installation-and-lifecycle.md#optional-dependency-the-claude-agent-sdk).
+
+## What changed in v0.4.1
+
+- **`settings.yaml` v2** replaces the accumulated legacy layout with seven
+  durable areas: `chat`, `fleet`, `targets`, `context`, `safety`, `interface`,
+  and `integrations`. `clio-coder upgrade` automatically migrates a v1 (or
+  unversioned pre-v2) file once, writes it atomically, and keeps the original as
+  `settings.yaml.v1.bak`.
+- **The interactive command surface is smaller and explicit.** `/settings`
+  accepts the same seven area names, resources meet under `/resources`, and
+  retired slash commands stop at targeted tombstones instead of falling
+  through to the model.
+- **The editor operator family is honest about context.** `@` opens a
+  workspace-aware file picker, `!` runs a public shell command whose result can
+  enter model context, and `!!` runs a context-excluded shell command that
+  remains visible to you but is never sent to a model.
+- **The local skills marketplace can meet a request in flight.** Clio may offer
+  a matching uninstalled skill, but every install initiated by that promotion
+  flow is hard-gated to Clio's own shipped catalog or the
+  `iowarp/clio-coder` repository. A public registry or foreign GitHub source is
+  refused before the installer runs.
+- **Evaluation and release validation each have one path.** The product eval
+  engine remains under `src/domains/eval/`, runnable reference suites ship
+  under `evals/`, and evals stay outside CI and release gates. The automated
+  gate is now 35 focused test files driven directly by `node --test` through a
+  single fast CI job.
+- **Machine-facing names use the Clio Coder namespace.** New paths, schemas,
+  tags, environment variables, Git refs, and manifests use syntax-appropriate
+  `clio-coder`, `clio_coder`, or `CLIO_CODER` forms. Upgrade records one naming
+  migration, and readers retain the released legacy spellings through v0.5 and
+  v0.6. The Clio persona and operator-facing identity text are unchanged.
+
+The release also hardens the surfaces that tend to fail outside unit tests:
+plain `doctor` is read-only again, configure cancellation exits correctly,
+trace empty states preserve their JSON contracts, fleet views wrap and honor
+`NO_COLOR`, Settings and other interactive prose stop losing remedy text, and
+the Workbench lifecycle closes its timing and recovery gaps.
+
 |  | You are | Start here |
 | --- | --- | --- |
 | 🔬 | A researcher or developer who wants to use it | [Your models](#your-models-your-choice) → [At the keyboard](#at-the-keyboard) → [Safety](#safety-you-can-read) |
@@ -110,6 +152,7 @@ or the reverse.
 | `lmstudio` | LM Studio |
 | `ollama-native` | Ollama |
 | `vllm`, `sglang` | vLLM and SGLang |
+| `litellm` | LiteLLM gateways with per-alias capability discovery and routed-model attribution |
 | `lemonade`, `lemonade-anthropic` | Lemonade |
 | `openai-compat`, `anthropic-compat` | Any OpenAI- or Anthropic-shaped endpoint |
 | `openai`, `anthropic`, `google`, `groq`, `mistral`, `deepseek`, `openrouter`, `bedrock` | Cloud APIs |
@@ -160,11 +203,12 @@ Run `clio-coder` from the repository you want to work on. The session opens on a
 one-line header that names where Clio is working, which route answers, and
 whether project context is ready, and then the transcript owns the screen.
 Tool calls render as live rows with their verdicts, successful edits render as
-numbered diffs, and `!` runs a shell command in the same transcript.
+numbered diffs, and editor operators put files and local shell output in the
+same transcript.
 
 | You want to | Type |
 | --- | --- |
-| Change model, target, thinking level, autonomy, or terminal options | `/settings`, `/model`, `/thinking` |
+| Change model, target, thinking level, autonomy, or terminal options | `/settings [chat\|fleet\|targets\|context\|safety\|interface\|integrations]`, `/model`, `/thinking` |
 | See what is in the context window and what it costs | `/context`, `/cost` |
 | Branch, revisit, or pick up a session | `/tree`, `/fork`, `/resume`, `/new` |
 | Delegate to a fleet agent and watch it work | `/run coder "..."`, `/tasks`, `Alt+W` |
@@ -172,16 +216,63 @@ numbered diffs, and `!` runs a shell command in the same transcript.
 | Ask a side question without touching the session, or get a read-only second opinion | `/btw <question>`, `/oracle <question>` |
 | Put the same question to several models at once and read one synthesis | `/council --synthesis vote "..."` |
 | Preview and run a multi-step fleet contract, resumable from the CLI | `/fleet run <name>` |
-| Install agents, prompts, fleets, and skills from a catalog | `/library`, `/library agents` |
+| Browse or install agents, prompts, fleets, extensions, and skills | `/resources`, `/resources library agent` |
 | Carry the working state into a fresh session | `/handoff <goal>` |
 | Save a self-contained HTML transcript | `/export` (an explicit `.md` path keeps Markdown) |
 | Everything else | `/help` |
 
 Enter while Clio is running steers the current turn; `Alt+Enter` queues a
-follow-up; `Esc` cancels. Settings → Terminal offers an opt-in fullscreen mode
-with a sticky composer beneath an independently scrollable transcript; regular
-terminal scrollback is the default. The complete command and keybinding
-reference is [docs/commands-and-modes.md](docs/commands-and-modes.md).
+follow-up; `Esc` cancels. `/settings interface` opens the Terminal options,
+including an opt-in fullscreen mode with a sticky composer beneath an
+independently scrollable transcript; regular terminal scrollback is the
+default. The complete command and keybinding reference is
+[docs/commands-and-modes.md](docs/commands-and-modes.md).
+
+### Settings v2 and the seven areas
+
+The user config is a strict `version: 2` YAML document. Its seven top-level
+areas match the seven arguments accepted by `/settings`. Those arguments are
+stable deep links into the current Settings Center; the overlay still divides
+the detailed editor into its existing subsections, while the durable paths on
+disk use the seven-area vocabulary below.
+
+| Area | What it owns |
+| --- | --- |
+| `chat` | Active target and model, thinking, model-picker state, output limits, prewarm, and interactive retry |
+| `fleet` | Worker defaults and profiles, rosters, agent bindings, routing, nodes, permissions, limits, retry, and run history |
+| `targets` | Provider/runtime connections, advertised models, capabilities, and routing roles |
+| `context` | Working-set eviction, compaction, and proactive task memory |
+| `safety` | Autonomy, cost/tool/read ceilings, and the review watchdog |
+| `interface` | Output detail, terminal mode, streaming, notifications, and keybindings |
+| `integrations` | Project resource trust, external agents, runtime plugins, resource libraries, and Git attribution |
+
+When upgrading an existing install, run `clio-coder upgrade`. The v1-to-v2
+migration runs before strict v2 consumers load, records its migration id so it
+does not run twice, writes through an atomic rename, and leaves the byte-exact
+v1 file beside the result as `settings.yaml.v1.bak`. If old and new paths
+collide, it refuses the migration and leaves the original untouched instead of
+guessing which value should win.
+
+The removed slash spellings are non-executing tombstones with exact remedies:
+`/targets` points to `/settings targets`, `/scoped-models` points to
+`/settings chat model-picker`, and `/library`, `/prompts`, and `/extensions`
+point to their `/resources` equivalents. The `clio-coder targets`,
+`clio-coder skills`, and other CLI command families remain available; this
+cleanup applies to slash commands inside the interactive session.
+
+### The operator family today
+
+| Operator | Behavior |
+| --- | --- |
+| `@` | Opens the workspace-aware picker. A bare `@` starts at the workspace root, a name fuzzily searches visible paths, and directory prefixes drill into the tree. Selecting a file inserts a reference that is expanded into the request when submitted. |
+| `! command` | Runs one shell command in the interactive working directory. The durable transcript entry, command, and output are available to model replay and compaction. |
+| `!! command` | Runs the same shell path and keeps the result visible and durable, but marks both command and output `not sent to model`; replay, compaction, and context accounting all exclude it. |
+
+Bang operators arm only for a non-empty, typed, single-line draft. A
+bracketed-pasted `!` or `!!` line, or any multiline draft beginning with one,
+is treated as literal prompt text rather than executed.
+
+Panes, docks, and Yazi integration are experimental and opt-in in v0.4.1; enable them explicitly under `interface.panes` in `settings.yaml`.
 
 Outside the TUI, the same engine runs headless and speaks to editors:
 
@@ -264,6 +355,19 @@ an installed copy verifies against its audited source, and
 `clio-coder skills eval <name>` runs a skill's executable evals instead of
 trusting the prose.
 
+The catalog is also a local marketplace. On a request that matches an
+uninstalled skill and is not already covered by an installed one, the
+coordinator can offer project install, user install, not now, or never for that
+skill version, then continue the task in the same turn. Matching is local and
+lexical; request text does not leave the machine. Full-auto may skip the
+question, but it cannot skip the source gate: consented and autonomous
+promotion installs both accept only the shipped local catalog or this
+repository's own tree, and they install without activating. Dispatch workers
+never receive offers, and only the operator activates a skill with `/skill`.
+Manual `clio-coder skills install <path|github-url>` remains available for a
+source you deliberately choose; the own-marketplace guarantee governs what
+Clio installs on its own initiative.
+
 **Task memory** keeps long runs from drifting: a rules-only tier with no model
 calls watches tool and lifecycle hooks and surfaces advisory reminders at the
 right boundaries, `/memory` inspects it, and durable lessons are reviewed with
@@ -283,7 +387,7 @@ dist-tag instead.
 From source, pinned to this release:
 
 ```bash
-git clone --branch v0.3.9 https://github.com/iowarp/clio-coder.git
+git clone --branch v0.4.1 https://github.com/iowarp/clio-coder.git
 cd clio-coder
 npm run install:local
 export PATH="$HOME/.local/bin:$PATH"
@@ -309,7 +413,7 @@ Full lifecycle details, including `reset` and the upgrade path, are in
 
 ## Status
 
-The current release is **v0.3.9**, installable from npm as
+The current release is **v0.4.1**, installable from npm as
 [`@iowarp/clio-coder`](https://www.npmjs.com/package/@iowarp/clio-coder) or
 from source. Clio Coder is still experimental: we ship quickly, interfaces may
 change between minor versions, and model-specific behavior varies by target, so
@@ -341,8 +445,8 @@ If you are an AI agent operating inside this repository or driving Clio as a
 tool, start here.
 
 **Orient from the index, not from a wide read.** `clio-coder context index`
-builds a codewiki over the roughly 1,200 source and test files; use `code_nav`
-in `entries`, `path`, or `symbol` mode first. The indexed entry points are
+builds a codewiki over the source and test tree; use `code_nav` in `entries`,
+`path`, or `symbol` mode first. The indexed entry points are
 `src/cli/index.ts`, `src/domains/agents/index.ts`,
 `src/domains/components/index.ts`, `src/domains/config/index.ts`,
 `src/domains/context/bootstrap.ts`, `src/domains/context/index.ts`,
@@ -422,10 +526,11 @@ Conventions worth knowing before your first PR: local imports end in `.js`,
 tests use `node:test`, `any` needs a tracking issue, and compile-time
 boundaries between domains are enforced by the hygiene lint rather than by
 convention. Read [docs/architecture.md](docs/architecture.md) before adding a
-cross-domain import. Live model validation (`npm run live:smoke -- --target <id>`) and the
-SWE-bench, SciCode, and Terminal-Bench harnesses under `benchmarks/` are
-separate and opt-in, because no deterministic suite can promise that every
-local model behaves identically.
+cross-domain import. Live model validation
+(`npm run live:smoke -- --target <id>`) and the runnable reference suites under
+`evals/` are explicit, opt-in measurements. Neither runs in CI or the release
+gate, because no deterministic suite can promise that every local model
+behaves identically.
 
 ## Documentation
 

package/dist/{acp-7LOELQFP.js → acp-ZILU3AUO.js}

@@ -6,29 +6,30 @@ import {
 } from "./chunk-2VTFPG5O.js";
 import {
   runClioCommand
-} from "./chunk-B5XRQOLB.js";
-import "./chunk-FALJGAWU.js";
-import "./chunk-HKIYEGME.js";
-import "./chunk-IFBNV6H6.js";
-import "./chunk-56KB5IJP.js";
+} from "./chunk-GVQJ5CCZ.js";
+import "./chunk-VKRH2TCS.js";
+import "./chunk-ZTJUVLTU.js";
+import "./chunk-7PWAODYW.js";
+import "./chunk-ZW55JB7N.js";
 import {
   printError
-} from "./chunk-XK56QHLX.js";
+} from "./chunk-VPKWYKEY.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-PNY46YEY.js";
+import "./chunk-EIMVLWB3.js";
+import "./chunk-D7E7WCDF.js";
 import {
   MAX_TIMER_DELAY_MS
-} from "./chunk-FQ4SKYE4.js";
+} from "./chunk-EBY63B7G.js";
 import "./chunk-IWHMRKLL.js";
-import "./chunk-XDOQXGFO.js";
+import "./chunk-BWW4HLO4.js";
 import "./chunk-LL4KHSZI.js";
-import "./chunk-4ZG3XFUR.js";
-import "./chunk-EQ63NRB7.js";
-import "./chunk-SST6Z5JA.js";
+import "./chunk-NLFAQR7Z.js";
+import "./chunk-WNP7O5WZ.js";
+import "./chunk-336NSSKI.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
 import "./chunk-APJ265NV.js";
-import "./chunk-BNAZZHFG.js";
+import "./chunk-BYP5D4HI.js";
 import "./chunk-WEPFGWHJ.js";
 import "./chunk-YXLYO42X.js";
 import {
@@ -79,11 +80,12 @@ function resolveAcpCwd(value) {
   return realpathSync(path.resolve(value));
 }
 async function runAcpCommand(args, options = {}) {
-  if (args.includes("--help") || args.includes("-h")) {
+  const normalizedArgs = args[0] === "--acp" ? args.slice(1) : args;
+  if (normalizedArgs.includes("--help") || normalizedArgs.includes("-h")) {
     process.stdout.write(HELP);
     return 0;
   }
-  const flags = parseAcpFlags(args);
+  const flags = parseAcpFlags(normalizedArgs);
   if (typeof flags === "string") {
     printError(flags);
     process.stderr.write(HELP);
@@ -111,7 +113,7 @@ async function runAcpCommand(args, options = {}) {
         transportOptions: {
           write: writeRawStdout,
           diagnostics: (line) => {
-            process.stderr.write(`[clio:acp] ${line}
+            process.stderr.write(`[clio-coder:acp] ${line}
 `);
           }
         },
@@ -123,7 +125,6 @@ async function runAcpCommand(args, options = {}) {
   }
 }
 export {
-  resolveAcpCwd,
   runAcpCommand
 };
-//# sourceMappingURL=acp-7LOELQFP.js.map
+//# sourceMappingURL=acp-ZILU3AUO.js.map