@iowarp/clio-coder 0.3.9 → 0.4.1

package/src/entry/orchestrator.ts

@@ -11,7 +11,7 @@ import { loadDomains } from "../core/domain-loader.js";
 import type { SafeEventBus } from "../core/event-bus.js";
 import { expandInlineFileReferencesAsync } from "../core/file-references.js";
 import { setGitCommitAttributionEnabled } from "../core/git-commit-attribution.js";
-import { configureGuardrails } from "../core/guardrails.js";
+import { configureGuardrails, guardrailValuesFromSettings } from "../core/guardrails.js";
 import { HEADLESS_PERMISSION_DENIED_REASON } from "../core/headless-permission.js";
 import { rememberRecentModel } from "../core/recent-models.js";
 import { protectedResidencyModels } from "../core/residency-protection.js";
@@ -49,6 +49,7 @@ import { createDispatchDedupRegistration } from "../domains/dispatch/dedup.js";
 import { agentRoleFactsResolver } from "../domains/dispatch/execution-role.js";
 import { readGateDecisionArtifacts, readPendingGateDecisions } from "../domains/dispatch/gate-decisions.js";
 import { createDispatchDomainModule } from "../domains/dispatch/index.js";
+import { configureRunEventJournal } from "../domains/dispatch/run-event-journal.js";
 import { type ExtensionsContract, ExtensionsDomainModule } from "../domains/extensions/index.js";
 import { type InteropContract, InteropDomainModule } from "../domains/interop/index.js";
 import {
@@ -84,6 +85,7 @@ import {
 } from "../domains/middleware/dispatch-nudge.js";
 import {
 	createHookReceiptLog,
+	createMarketplaceOfferRegistration,
 	createMiddlewareToolChoiceControl,
 	createSkillsReminderRegistration,
 	type ExtensionHookRoot,
@@ -97,6 +99,7 @@ import { announceMemoryStepEndpoint } from "../domains/middleware/memory-step-en
 import { createTaskBoardReminderRegistration } from "../domains/middleware/task-board-reminder.js";
 import { createTaskNudgeRegistration } from "../domains/middleware/task-nudge.js";
 import { createWatchdogRegistration } from "../domains/middleware/watchdog.js";
+import type { MuxContract } from "../domains/mux/index.js";
 import type { ObservabilityContract } from "../domains/observability/index.js";
 import { ObservabilityDomainModule, recordBackgroundMemoryStep } from "../domains/observability/index.js";
 import type { PromptsContract } from "../domains/prompts/contract.js";
@@ -120,11 +123,13 @@ import {
 	targetRequiresAuth,
 	VALID_THINKING_LEVELS,
 } from "../domains/providers/index.js";
+import { memoryInterventionModelMaxTokens } from "../domains/providers/model-runtime-capabilities.js";
 import { getRuntimeRegistry } from "../domains/providers/registry.js";
 import { registerBuiltinRuntimes } from "../domains/providers/runtimes/builtins.js";
 import {
 	createResourcesDomainModule,
 	discoverMarketplaceSkills,
+	installSkill,
 	modelVisibleSkills,
 	type ResourcesContract,
 } from "../domains/resources/index.js";
@@ -159,6 +164,7 @@ import {
 import { createTaskBoardStore } from "../domains/session/task-board.js";
 import { filterEntriesToActivePath } from "../domains/session/tree/active-path.js";
 import { type ShareContract, ShareDomainModule } from "../domains/share/index.js";
+import { ToolchainDomainModule } from "../domains/toolchain/index.js";
 import { createUserTasksStore } from "../domains/user-tasks/store.js";
 import { type AcpSafeSettingsPatch, type AcpSafeSettingsSnapshot, serveClioAcpAgent } from "../engine/acp/server.js";
 import { createStdioServerTransport } from "../engine/acp/transport.js";
@@ -175,6 +181,7 @@ import { createChatLoop } from "../interactive/chat-loop.js";
 import { type RunIo, startInteractive } from "../interactive/index.js";
 import { buildModelReplayAgentMessagesFromTurns } from "../interactive/model-session-replay.js";
 import type { BootOptions } from "./boot-options.js";
+import { resolvePanesEnablement } from "./panes-activation.js";
 
 export type { BootOptions, HeadlessSamplingOverrides } from "./boot-options.js";
 
@@ -224,11 +231,11 @@ function bannerConfigurationLine(): string {
 	}
 	// A dangling chat target normalizes to null in the schema, so a deleted
 	// target arrives here as no target at all rather than as a name to report.
-	const targetId = settings.orchestrator?.target;
+	const targetId = settings.chat?.target;
 	if (!targetId) {
 		return chalk.yellow("no model target configured. Run `clio-coder configure` to add one.");
 	}
-	const model = settings.orchestrator?.model;
+	const model = settings.chat?.model;
 	return chalk.dim(`target ${targetId}${model ? ` · model ${model}` : " · no default model"}`);
 }
 
@@ -251,7 +258,7 @@ function printJsonSessionHeader(meta: SessionMeta | null): Record<string, unknow
 		cwd: meta.cwd,
 		target: meta.target,
 		model: meta.model,
-		clioVersion: meta.clioVersion,
+		clioCoderVersion: meta.clioCoderVersion,
 	};
 }
 
@@ -261,17 +268,17 @@ function applyHeadlessSettingsOverlay(
 ): ClioSettings {
 	const next = structuredClone(settings);
 	if (!overrides) return next;
-	const previousTarget = next.orchestrator.target;
+	const previousTarget = next.chat.target;
 	if (overrides.target !== undefined) {
-		next.orchestrator.target = overrides.target;
-		if (overrides.model === undefined && (previousTarget !== overrides.target || !next.orchestrator.model)) {
+		next.chat.target = overrides.target;
+		if (overrides.model === undefined && (previousTarget !== overrides.target || !next.chat.model)) {
 			const target = next.targets.find((entry) => entry.id === overrides.target);
-			if (target) next.orchestrator.model = target.defaultModel ?? null;
+			if (target) next.chat.model = target.defaultModel ?? null;
 		}
 	}
-	if (overrides.model !== undefined) next.orchestrator.model = overrides.model;
-	if (overrides.thinking !== undefined) next.orchestrator.thinkingLevel = overrides.thinking;
-	if (overrides.autonomy !== undefined) next.autonomy = overrides.autonomy;
+	if (overrides.model !== undefined) next.chat.model = overrides.model;
+	if (overrides.thinking !== undefined) next.chat.thinkingLevel = overrides.thinking;
+	if (overrides.autonomy !== undefined) next.safety.autonomy = overrides.autonomy;
 	return next;
 }
 
@@ -302,9 +309,9 @@ function advanceThinkingLevel(current: ThinkingLevel, available: ReadonlyArray<T
  * model all send this placeholder so a local llama.cpp or LM Studio endpoint
  * works without the user inventing a credential.
  */
-const LOCAL_API_KEY_FALLBACK = "clio-local-target";
+const LOCAL_API_KEY_FALLBACK = "clio-coder-local-target";
 
-export async function resolveApiKeyForTarget(
+async function resolveApiKeyForTarget(
 	target: TargetDescriptor,
 	providers: ProvidersContract,
 	signal?: AbortSignal,
@@ -333,6 +340,7 @@ interface BackgroundMemoryRoute {
 	targetId: string;
 	wireModelId: string;
 	endpointKey: string | null;
+	modelMaxTokens(configuredMaxTokens: number): number;
 }
 
 function createBackgroundMemoryModelClient(
@@ -341,8 +349,8 @@ function createBackgroundMemoryModelClient(
 	timeoutMs: number,
 	bus: Pick<SafeEventBus, "emit"> | null,
 ): BackgroundMemoryRoute | null {
-	const targetId = settings.background.target?.trim();
-	const wireModelId = settings.background.model?.trim();
+	const targetId = settings.context.memory.target?.trim();
+	const wireModelId = settings.context.memory.model?.trim();
 	if (!targetId || !wireModelId) return null;
 	// One model cannot both drive the action agent and think its way through a
 	// memory step: the memory call would contend with the agent's own decoding on
@@ -375,6 +383,12 @@ function createBackgroundMemoryModelClient(
 		targetId,
 		wireModelId: refined.wireModelId,
 		endpointKey,
+		modelMaxTokens: (configuredMaxTokens) =>
+			memoryInterventionModelMaxTokens({
+				configuredMaxTokens,
+				thinkingMechanism: refined.modelRuntime.thinking.mechanism,
+				modelMaxTokens: refined.capabilityDecisions.maxTokens,
+			}),
 		client: {
 			// Wrapped at the layer that knows a request left the process: the step
 			// holds endpoint capacity while it is out and publishes the cache
@@ -433,8 +447,8 @@ function createBackgroundMemoryModelClient(
  */
 function agentRoleToolWarnings(providers: ProvidersContract, settings: Readonly<ClioSettings>): string[] {
 	const roles: ReadonlyArray<{ label: string; target: string | null; model: string | null }> = [
-		{ label: "orchestrator", target: settings.orchestrator.target, model: settings.orchestrator.model },
-		{ label: "workers.default", target: settings.workers.default.target, model: settings.workers.default.model },
+		{ label: "orchestrator", target: settings.chat.target, model: settings.chat.model },
+		{ label: "workers.default", target: settings.fleet.default.target, model: settings.fleet.default.model },
 	];
 	const warnings: string[] = [];
 	for (const role of roles) {
@@ -466,12 +480,12 @@ function backgroundSharesReasoningModelWithOrchestrator(
 	providers: ProvidersContract,
 	settings: Readonly<ClioSettings>,
 ): boolean {
-	const backgroundModel = settings.background.model?.trim();
-	const orchestratorModel = settings.orchestrator.model?.trim();
+	const backgroundModel = settings.context.memory.model?.trim();
+	const orchestratorModel = settings.chat.model?.trim();
 	if (!backgroundModel || backgroundModel !== orchestratorModel) return false;
-	if (settings.background.target?.trim() !== settings.orchestrator.target?.trim()) return false;
+	if (settings.context.memory.target?.trim() !== settings.chat.target?.trim()) return false;
 	try {
-		const status = providers.list().find((entry) => entry.target.id === settings.background.target?.trim());
+		const status = providers.list().find((entry) => entry.target.id === settings.context.memory.target?.trim());
 		if (!status) return false;
 		return resolveModelCapabilities(status, backgroundModel, providers.knowledgeBase).reasoning === true;
 	} catch {
@@ -481,7 +495,7 @@ function backgroundSharesReasoningModelWithOrchestrator(
 	}
 }
 
-export function synthesizeOrchestratorModel(
+function synthesizeOrchestratorModel(
 	providers: ProvidersContract,
 	target: TargetDescriptor,
 	wireModelId: string,
@@ -514,8 +528,8 @@ async function resolveCompactionModel(
 	settings: ClioSettings,
 	providers: ProvidersContract,
 ): Promise<CompactionResolution | null> {
-	const targetId = settings.orchestrator?.target ?? null;
-	const wireModelId = settings.orchestrator?.model ?? null;
+	const targetId = settings.chat?.target ?? null;
+	const wireModelId = settings.chat?.model ?? null;
 	if (!targetId || !wireModelId) return null;
 	const target = resolveTarget(providers, targetId);
 	if (!target) return null;
@@ -595,7 +609,7 @@ function appendProtectedArtifactRegistryEvent(
  * subprocess, which makes this the only recording path there is. Returns how
  * many were folded.
  */
-export function foldDispatchSkillActivations(
+function foldDispatchSkillActivations(
 	session: SessionContract | undefined,
 	payload: { runId?: unknown; skillActivations?: ReadonlyArray<unknown> } | undefined,
 ): number {
@@ -636,7 +650,7 @@ async function runCompactionFlow(
 	}
 	const resolved = await resolveCompactionModel(settings, providers);
 	if (!resolved) {
-		throw new Error("no model configured; set orchestrator.target + orchestrator.model");
+		throw new Error("no model configured; set chat.target + chat.model");
 	}
 	// Summarize only the active branch: after a /tree switch the raw file
 	// still holds abandoned sibling turns, and a summary that folds them in
@@ -692,7 +706,7 @@ async function runCompactionFlow(
  * a thrown read/model/persistence failure from the legitimate null no-op that
  * `runCompactionFlow` returns for an empty session or an unavailable cut.
  */
-export function createProductionAutoCompact(
+function createProductionAutoCompact(
 	session: SessionContract,
 	getSettings: () => ClioSettings,
 	providers: ProvidersContract,
@@ -739,11 +753,11 @@ function estimateTokensAfterCompaction(entries: ReadonlyArray<SessionEntry>, res
  * ids or target/model refs. Absent scope is a no-op so unconfigured users
  * feel nothing.
  */
-export function advanceScopedTarget(
+function advanceScopedTarget(
 	settings: Readonly<ClioSettings>,
 	direction: "forward" | "backward",
 ): { target: string; model: string | null } | null {
-	const scope = settings.scope ?? [];
+	const scope = settings.chat.modelPicker.cycleSet ?? [];
 	if (scope.length === 0) return null;
 	const registry = getRuntimeRegistry();
 	if (registry.list().length === 0) registerBuiltinRuntimes(registry);
@@ -755,8 +769,8 @@ export function advanceScopedTarget(
 		return runtime !== null && isOrchestratorEligibleRuntime(runtime);
 	});
 	if (filteredScope.length === 0) return null;
-	const activeTarget = settings.orchestrator.target ?? "";
-	const activeModel = settings.orchestrator.model ?? "";
+	const activeTarget = settings.chat.target ?? "";
+	const activeModel = settings.chat.model ?? "";
 	const activeCombinedRef = activeTarget.length > 0 && activeModel.length > 0 ? `${activeTarget}/${activeModel}` : "";
 	const idx = filteredScope.findIndex((entry) => entry === activeCombinedRef || entry === activeTarget);
 	const base = idx === -1 ? 0 : idx + (direction === "forward" ? 1 : filteredScope.length - 1);
@@ -844,6 +858,19 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	let effectiveSettingsForDispatch: (() => Readonly<ClioSettings>) | null = null;
 	let protectedArtifactStateForDispatch: (() => ProtectedArtifactState) | null = null;
 
+	// Panes are an interactive-surface projection. Headless, ACP, and worker boots
+	// gate detection off so they never resolve a socket path or open a descriptor.
+	// This mirrors the `interactive` predicate computed after the domains load.
+	const muxInteractive = !options.headless && options.acp === undefined && process.env.CLIO_CODER_INTERACTIVE === "1";
+	// The rung is settled before the config contract loads, off the settings the
+	// interactive entry point already read strictly (`src/cli/clio.ts:31`) and
+	// the `--with-panes` / `--no-panes` flag, which wins in both directions. This
+	// is why `panes.enabled` is a restart-scoped row: the decision runs once,
+	// here. An inactive rung loads nothing: the whole extension, mux domain
+	// included, lives behind the dynamic import below.
+	const muxEnablement = resolvePanesEnablement(options.panes, options.startupSettings?.interface.panes.enabled);
+	const withPanes = muxInteractive && muxEnablement !== "off" ? await import("./with-panes.js") : null;
+
 	const result = await loadDomains(
 		[
 			options.startupSettings ? createConfigDomainModule(options.startupSettings) : ConfigDomainModule,
@@ -863,6 +890,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			ShareDomainModule,
 			createContextDomainModule({ noContextFiles: options.noContextFiles === true }),
 			ProvidersDomainModule,
+			ToolchainDomainModule,
 			SafetyDomainModule,
 			createPromptsDomainModule({
 				noContextFiles: options.noContextFiles === true,
@@ -872,6 +900,16 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			SessionDomainModule,
 			ObservabilityDomainModule,
 			SchedulingDomainModule,
+			...(withPanes
+				? [
+						withPanes.createMuxDomainModule({
+							enabled: muxEnablement,
+							log: (level, message) => {
+								if (level === "warning") bootStderr(`[mux] ${message}\n`);
+							},
+						}),
+					]
+				: []),
 			// Dispatch resolves worker targets through the session's effective
 			// settings view once it exists (assigned below, after the config
 			// contract loads); until then it falls back to the shared snapshot.
@@ -879,6 +917,11 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				getSettings: () => effectiveSettingsForDispatch?.(),
 				getProtectedArtifactState: () => protectedArtifactStateForDispatch?.() ?? { artifacts: [] },
 				autonomyOverride: options.headless?.autonomy !== undefined,
+				// The domain owns the durable journal here, not the dispatch
+				// tool's event registry: `/run`, a watchdog run, and a model
+				// dispatch all have to leave the same transcript behind, and only
+				// the last of the three ever reaches that registry.
+				journalRunEvents: true,
 			}),
 			LifecycleDomainModule,
 		],
@@ -915,7 +958,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			bootStderr("Clio Coder: --api-key supplied but providers domain unavailable; ignoring.\n");
 		} else {
 			const settingsNow = applyHeadlessSettingsOverlay(config?.get() ?? readSettings(), options.headless);
-			const activeTargetId = settingsNow.orchestrator?.target;
+			const activeTargetId = settingsNow.chat?.target;
 			const target = resolveTarget(providers, activeTargetId);
 			const runtime = target ? providers.getRuntime(target.runtime) : null;
 			if (target && runtime) {
@@ -941,6 +984,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	const resources = result.getContract<ResourcesContract>("resources");
 	const extensions = result.getContract<ExtensionsContract>("extensions");
 	const share = result.getContract<ShareContract>("share");
+	const mux = result.getContract<MuxContract>("mux");
 	const contextDomain = result.getContract<ContextContract>("context");
 	const interop = result.getContract<InteropContract>("interop");
 	// Boot detection resolves paths only: no `--version` subprocess and no skill
@@ -1034,14 +1078,20 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		bus.on(BusChannels.RuntimeNotice, (payload: unknown) => {
 			const notice = payload as { level?: string; message?: string } | undefined;
 			if (typeof notice?.message !== "string") return;
-			process.stderr.write(`[clio:runtime] ${notice.level ?? "info"}: ${notice.message}\n`);
+			process.stderr.write(`[clio-coder:runtime] ${notice.level ?? "info"}: ${notice.message}\n`);
 		});
 	}
 
 	// Guardrail policy (tool-call budgets, tool byte caps, dispatch ledger cap)
 	// resolves settings-first with env as emergency override; install the
 	// settings section before any guard registration or tool reads it.
-	configureGuardrails((config?.get() ?? readSettings()).guardrails);
+	const resolvedSettings = config?.get() ?? readSettings();
+	configureGuardrails(guardrailValuesFromSettings(resolvedSettings));
+
+	// The run event journal resolves the same way for the same reason: the sink
+	// sits on the dispatch event path, where reading settings.yaml would be both
+	// a cost and a throw site, so the composition root installs the value once.
+	configureRunEventJournal(resolvedSettings.fleet.history.journal);
 
 	// Guard registrations on the middleware contract, in order: loop guard,
 	// protected artifacts (last among guards so it absorbs protect_path effects
@@ -1135,7 +1185,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		taskMemoryBank.clear();
 		taskMemorySessionId = currentSessionId;
 	};
-	const memorySettings = (config?.get() ?? readSettings()).memory.intervention;
+	const memorySettings = (config?.get() ?? readSettings()).context.memory;
 	// Bound late: the registration is built here, but the buffer a deferred
 	// reminder lands in belongs to the chat loop that has not been composed yet.
 	let deferredMemoryReminderSink: ((message: string) => void) | null = null;
@@ -1185,12 +1235,12 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		})
 			.then((result) => {
 				for (const error of result.errors) {
-					process.stderr.write(`[clio:memory] proposed record not written for ${error}\n`);
+					process.stderr.write(`[clio-coder:memory] proposed record not written for ${error}\n`);
 				}
 			})
 			.catch((error: unknown) => {
 				process.stderr.write(
-					`[clio:memory] proposed records not written: ${error instanceof Error ? error.message : String(error)}\n`,
+					`[clio-coder:memory] proposed records not written: ${error instanceof Error ? error.message : String(error)}\n`,
 				);
 			});
 	};
@@ -1204,16 +1254,25 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		onDeferredReminder: (message) => deferredMemoryReminderSink?.(message),
 		getSettings: () => {
 			ensureTaskMemorySession();
-			return effectiveSettingsForDispatch?.().memory.intervention ?? memorySettings;
+			const memory = effectiveSettingsForDispatch?.().context.memory ?? memorySettings;
+			return {
+				enabled: memory.enabled,
+				everyNTools: memory.cadenceToolCalls,
+				windowSteps: memory.trajectorySteps,
+				maxTokens: memory.maxOutputTokens,
+				timeoutMs: memory.timeoutMs,
+			};
 		},
 		getModelClient: () => {
 			const settings = effectiveSettingsForDispatch?.();
 			backgroundMemoryRoute =
 				settings === undefined
 					? null
-					: createBackgroundMemoryModelClient(providers, settings, settings.memory.intervention.timeoutMs, bus);
+					: createBackgroundMemoryModelClient(providers, settings, settings.context.memory.timeoutMs, bus);
 			return backgroundMemoryRoute?.client ?? null;
 		},
+		getModelMaxTokens: (configuredMaxTokens) =>
+			backgroundMemoryRoute?.modelMaxTokens(configuredMaxTokens) ?? configuredMaxTokens,
 		// A single-slot local server serves one request at a time, so a memory step
 		// started while the operator's turn is streaming either waits behind it or
 		// makes the server swap the resident model out to answer. The chat loop
@@ -1252,10 +1311,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	});
 	if (!interactive) {
 		for (const issue of userHooks.fileIssues) {
-			process.stderr.write(`[clio:hooks] ${issue.message}\n`);
+			process.stderr.write(`[clio-coder:hooks] ${issue.message}\n`);
 		}
 		for (const issue of userHooks.issues) {
-			process.stderr.write(`[clio:hooks] ${issue.source.sourcePath}#${issue.index}: ${issue.issues.join("; ")}\n`);
+			process.stderr.write(`[clio-coder:hooks] ${issue.source.sourcePath}#${issue.index}: ${issue.issues.join("; ")}\n`);
 		}
 	}
 	termination.onDrain(() => hookReceiptLog.flush());
@@ -1267,11 +1326,29 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// through these two functions so a fallback added to one surface cannot
 	// silently skip another.
 	const resolveBaselineAutonomy = (): AutonomyLevel =>
-		effectiveSettingsForDispatch?.().autonomy ??
+		effectiveSettingsForDispatch?.().safety.autonomy ??
 		options.headless?.autonomy ??
-		(config?.get() ?? readSettings()).autonomy ??
+		(config?.get() ?? readSettings()).safety.autonomy ??
 		"auto-edit";
 	const resolveEffectiveAutonomy = (): AutonomyLevel => activeAcpSessionAutonomy ?? resolveBaselineAutonomy();
+	// Marketplace self-promotion: coordinator-only by this wiring (never a
+	// dispatch worker), local matcher, consented installs and full-auto
+	// autonomous installs both pass the own-marketplace source gate inside the
+	// registration. Registered here because it needs the effective-autonomy
+	// resolution defined one line up.
+	if (resources) {
+		middleware.registerHook(
+			createMarketplaceOfferRegistration({
+				listInstalledSkillNames: () => resources.skills(process.cwd()).items.map((skill) => skill.name),
+				listMarketplaceEntries: () => discoverMarketplaceSkills({ cwd: process.cwd() }).skills,
+				getAutonomy: resolveEffectiveAutonomy,
+				installEntry: (entry, scope) => {
+					const installed = installSkill({ source: entry.sourceUrl, scope, name: entry.name, cwd: process.cwd() });
+					return { path: installed.path, sourceUrl: installed.sourceUrl, installedHash: installed.installedHash };
+				},
+			}),
+		);
+	}
 	const middlewareToolChoice = createMiddlewareToolChoiceControl();
 	const toolRegistry = createRegistry({
 		safety,
@@ -1374,6 +1451,19 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// Operator-initiated backgrounding is a TUI affordance: the registry is the
 	// one object the dispatch tool and the keypress both hold.
 	const dispatchBackground = createDispatchBackgroundRegistry();
+	// One `PanesOperations` instance drives both the `panes` tool and the
+	// `/panes` slash command, so the model and the operator cannot be told
+	// different things about the same pane. It also owns the no-mux Yazi chooser,
+	// while model tool registration below remains gated on a live pane host.
+	const panes =
+		withPanes && mux
+			? withPanes.createPanesRuntime({
+					mux,
+					getSettings: () => getCurrentSettings(),
+					getDispatchSnapshot: () => dispatch.snapshot(),
+					getCwd: () => process.cwd(),
+				})
+			: null;
 	registerAllTools(toolRegistry, {
 		...(session
 			? {
@@ -1397,10 +1487,15 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		// provenance and compete winner handling agree with the approval surface.
 		getAutonomy: resolveEffectiveAutonomy,
 		...(interactive ? { dispatchBackground } : {}),
+		...(mux ? { competeMuxWorktrees: mux } : {}),
+		// Registered only when a pane host answered detection, so the tool is
+		// absent from the prompt on a machine with none rather than present and
+		// always refusing.
+		...(panes && mux?.mode !== "none" ? { panes } : {}),
 		getCostCeilingUsd: () => result.getContract<SchedulingContract>("scheduling")?.ceilingUsd() ?? 0,
-		...(config ? { getWorkerRosters: () => config.get().workers.rosters } : {}),
+		...(config ? { getWorkerRosters: () => config.get().fleet.rosters } : {}),
 		getSkillLoaderOptions: () => ({
-			trustProjectCompatRoots: config?.get().skills.trustProjectCompatRoots === true,
+			trustProjectCompatRoots: config?.get().integrations.projectResources.trustProjectImports === true,
 			disableDiscovery: options.noSkills === true || options.headless?.noSkills === true,
 			...(options.skillPaths && options.skillPaths.length > 0
 				? { explicitSkillPaths: options.skillPaths }
@@ -1441,7 +1536,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		sessionStateGeneration += 1;
 		// Child-process seams read the effective setting from the environment,
 		// and the session view may override the saved value.
-		setGitCommitAttributionEnabled(getCurrentSettings().attribution.gitCommits);
+		setGitCommitAttributionEnabled(getCurrentSettings().integrations.git.commitAttribution);
 	};
 	const getCurrentSettings = (): ClioSettings => {
 		// Recents live in the data dir (core/recent-models.ts), never in
@@ -1472,15 +1567,11 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	const unsubscribeCommitAttributionSync = bus.on(BusChannels.ConfigHotReload, () => bumpSessionState());
 	termination.onDrain(() => unsubscribeCommitAttributionSync());
 	const getTaskMemorySeedOffer = (): { source: string; count: number } | null => {
-		return taskMemoryHandoffSeedOffer(process.cwd(), getCurrentSettings().memory.intervention.enabled);
+		return taskMemoryHandoffSeedOffer(process.cwd(), getCurrentSettings().context.memory.enabled);
 	};
 	const seedCurrentTaskMemoryFromHandoff = () => {
 		ensureTaskMemorySession();
-		return seedTaskMemoryFromNewestHandoff(
-			taskMemoryBank,
-			process.cwd(),
-			getCurrentSettings().memory.intervention.enabled,
-		);
+		return seedTaskMemoryFromNewestHandoff(taskMemoryBank, process.cwd(), getCurrentSettings().context.memory.enabled);
 	};
 	if (resumedSessionAtBoot) {
 		const offer = getTaskMemorySeedOffer();
@@ -1500,7 +1591,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// routing change updates the set on the next read.
 	setProtectedModelsProvider(() => protectedResidencyModels(getCurrentSettings()));
 
-	const validatedKeybindings = validateKeybindings((config?.get() ?? readSettings()).keybindings ?? {});
+	const validatedKeybindings = validateKeybindings((config?.get() ?? readSettings()).interface.keybindings ?? {});
 	const invalidBindings = validatedKeybindings.invalid;
 	if (invalidBindings.length > 0) {
 		const notice = formatInvalidKeybindingNotice(invalidBindings);
@@ -1542,13 +1633,27 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			mutateSaved?.(saved);
 		});
 	};
+	/**
+	 * A routing change at the scope the operator chose. "session" moves the live
+	 * route and leaves settings.yaml alone, so a swap that points at a dead
+	 * endpoint dies with the session that made it; "global" is the historical
+	 * write-through. Nothing on this path writes durably without a scope.
+	 */
+	const applyRoutingAtScope = (patch: RoutingPatch, scope: "session" | "global"): void => {
+		if (scope === "global") {
+			updateSessionRouting(patch);
+			return;
+		}
+		applyRoutingPatch(sessionRouting, patch);
+		bumpSessionState();
+	};
 	const readAcpSafeSettings = (): AcpSafeSettingsSnapshot => {
 		const settings = getCurrentSettings();
 		return {
-			target: settings.orchestrator.target,
-			model: settings.orchestrator.model,
-			thinkingLevel: settings.orchestrator.thinkingLevel ?? "off",
-			autonomy: settings.autonomy,
+			target: settings.chat.target,
+			model: settings.chat.model,
+			thinkingLevel: settings.chat.thinkingLevel ?? "off",
+			autonomy: settings.safety.autonomy,
 		};
 	};
 	/**
@@ -1558,15 +1663,15 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	 */
 	const commitAcpSafeSettings = (patch: AcpSafeSettingsPatch): AcpSafeSettingsSnapshot => {
 		const orchestrator: NonNullable<RoutingPatch["orchestrator"]> = {};
-		if (patch["orchestrator.target"] !== undefined) orchestrator.target = patch["orchestrator.target"];
-		if (patch["orchestrator.model"] !== undefined) orchestrator.model = patch["orchestrator.model"];
-		if (patch["orchestrator.thinkingLevel"] !== undefined) {
-			orchestrator.thinkingLevel = patch["orchestrator.thinkingLevel"];
+		if (patch["chat.target"] !== undefined) orchestrator.target = patch["chat.target"];
+		if (patch["chat.model"] !== undefined) orchestrator.model = patch["chat.model"];
+		if (patch["chat.thinkingLevel"] !== undefined) {
+			orchestrator.thinkingLevel = patch["chat.thinkingLevel"];
 		}
 		const routingPatch: RoutingPatch | null = Object.keys(orchestrator).length > 0 ? { orchestrator } : null;
 		persistSavedMutation((saved) => {
 			if (routingPatch !== null) mergeRoutingPatchIntoSettings(saved, routingPatch);
-			if (patch.autonomy !== undefined) saved.autonomy = patch.autonomy;
+			if (patch["safety.autonomy"] !== undefined) saved.safety.autonomy = patch["safety.autonomy"];
 		});
 		if (routingPatch !== null) {
 			applyRoutingPatch(sessionRouting, routingPatch);
@@ -1665,7 +1770,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	middleware.registerHook(
 		createWatchdogRegistration({
 			firesOnThisSurface: interactive,
-			getSettings: () => (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).watchdog,
+			getSettings: () => (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).safety.review,
 			getScope: () => {
 				const board = taskBoard.snapshot();
 				if (board === null) return null;
@@ -1677,7 +1782,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 					dispatch,
 					bus,
 					...(agents ? { getAgentRoleFacts: agentRoleFactsResolver((id: string) => agents.getSpec(id)) } : {}),
-					target: (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).watchdog.target,
+					target: (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).safety.review.target,
 					...(deferredWatchdogNoticeSink ? { emitNotice: deferredWatchdogNoticeSink } : {}),
 				}),
 		}),
@@ -1723,7 +1828,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			try {
 				const records = loadMemoryRecordsSync(clioDataDir());
 				const settings = getCurrentSettings();
-				const targetId = session?.current()?.target ?? settings.orchestrator?.target;
+				const targetId = session?.current()?.target ?? settings.chat?.target;
 				const runtimeId = targetId ? providers.getTarget(targetId)?.runtime : undefined;
 				return buildMemoryPromptSection(records, {
 					scopes: ["global", "repo", "runtime"],
@@ -1739,7 +1844,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			const meta = session?.current();
 			if (!meta) throw new Error("task memory handoff requires an active session");
 			const settings = getCurrentSettings();
-			const targetId = meta.target ?? settings.orchestrator?.target;
+			const targetId = meta.target ?? settings.chat?.target;
 			const runtimeId = targetId ? providers.getTarget(targetId)?.runtime : undefined;
 			return renderTaskMemoryHandoffSource(taskMemoryBank.snapshot(), {
 				sessionId: meta.id,
@@ -1848,7 +1953,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				try {
 					session.appendEntry({
 						kind: "custom",
-						customType: "clio.routing-notice",
+						customType: "clio-coder.routing-notice",
 						parentTurnId: null,
 						data: { kind: notice.kind, level: notice.level, text: notice.text },
 					});
@@ -1882,8 +1987,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				routing: () => {
 					const settings = getCurrentSettings();
 					return {
-						target: settings.orchestrator.target,
-						model: settings.orchestrator.model,
+						target: settings.chat.target,
+						model: settings.chat.model,
 					};
 				},
 				onActiveSessionAutonomyChange: (level) => {
@@ -1895,11 +2000,11 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				// as a provider's failure body, is kept off the wire and written to
 				// the unstructured stderr tail instead.
 				diagnostics: (line) => {
-					process.stderr.write(`[clio:acp] ${line}\n`);
+					process.stderr.write(`[clio-coder:acp] ${line}\n`);
 				},
 				permissionTimeoutMs:
 					options.acp.permissionTimeoutMs ??
-					config?.get().delegation.defaults.permissionTimeoutMs ??
+					config?.get().integrations.externalAgents.defaults.permissionTimeoutMs ??
 					DEFAULT_DELEGATION_PERMISSION_TIMEOUT_MS,
 			});
 			// Same ordering the termination drain hook relies on: an aborted turn's
@@ -2014,6 +2119,20 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		...(extensions ? { extensions } : {}),
 		...(interop ? { interop } : {}),
 		...(share ? { share } : {}),
+		...(mux ? { mux } : {}),
+		...(panes ? { panes } : {}),
+		...(panes ? { attachYaziBridge: (bridge) => panes.attachYazi(bridge) } : {}),
+		// The interactive surface never imports the panes glue itself; the
+		// factories arrive only on an active boot, through the same dynamic
+		// import that loaded the mux domain.
+		...(withPanes
+			? {
+					createMuxBridge: withPanes.createMuxBridge,
+					createYaziBridge: withPanes.createYaziBridge,
+					createWatchPane: withPanes.createWatchPaneController,
+				}
+			: {}),
+		...(panes ? { attachWatchPane: (controller) => panes.attachWatch(controller) } : {}),
 		toolRegistry,
 		...(session ? { session } : {}),
 		...(session ? { readSessionEntries: readCurrentSessionEntries } : {}),
@@ -2026,8 +2145,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			const settings = getCurrentSettings();
 			const bank = taskMemoryBank.snapshot();
 			return {
-				enabled: settings.memory.intervention.enabled,
-				tier: settings.background.target && settings.background.model ? "llm" : "rules",
+				enabled: settings.context.memory.enabled,
+				tier: settings.context.memory.target && settings.context.memory.model ? "llm" : "rules",
 				size: taskMemoryBankSize(bank),
 				lastDecision: memoryIntervention.lastDecision(),
 				bank,
@@ -2126,33 +2245,29 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 					},
 				}
 			: {}),
-		onSetThinkingLevel: (level) => {
+		onSetThinkingLevel: (level, scope) => {
 			const current = getCurrentSettings();
 			const nextLevel =
-				resolveModelRuntimeCapabilitiesForProviders(
-					providers,
-					current.orchestrator.target,
-					current.orchestrator.model,
-					level,
-				)?.thinking.effectiveLevel ?? "off";
-			updateSessionRouting({ orchestrator: { thinkingLevel: nextLevel } });
+				resolveModelRuntimeCapabilitiesForProviders(providers, current.chat.target, current.chat.model, level)?.thinking
+					.effectiveLevel ?? "off";
+			applyRoutingAtScope({ orchestrator: { thinkingLevel: nextLevel } }, scope ?? "global");
 		},
 		onCycleThinking: () => {
 			const current = getCurrentSettings();
 			const thinking = resolveModelRuntimeCapabilitiesForProviders(
 				providers,
-				current.orchestrator.target,
-				current.orchestrator.model,
-				current.orchestrator.thinkingLevel ?? "off",
+				current.chat.target,
+				current.chat.model,
+				current.chat.thinkingLevel ?? "off",
 			)?.thinking;
 			const effectiveAvailable = thinking?.supportedLevels ?? (["off"] as ThinkingLevel[]);
 			const nextLevel = advanceThinkingLevel(
-				thinking?.effectiveLevel ?? current.orchestrator.thinkingLevel ?? "off",
+				thinking?.effectiveLevel ?? current.chat.thinkingLevel ?? "off",
 				effectiveAvailable,
 			);
 			updateSessionRouting({ orchestrator: { thinkingLevel: nextLevel } });
 		},
-		onSelectModel: ({ target, model }) => {
+		onSelectModel: ({ target, model }, scope) => {
 			const registry = getRuntimeRegistry();
 			const settings = getCurrentSettings();
 			const descriptor = settings.targets.find((e) => e.id === target);
@@ -2169,8 +2284,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 					);
 				}
 			}
-			updateSessionRouting({ orchestrator: { target, model } });
-			rememberRecentModel(`${target}/${model}`, getCurrentSettings().modelSelector.recentLimit);
+			applyRoutingAtScope({ orchestrator: { target, model } }, scope);
+			// Recents live in the state dir, not settings.yaml, and are how a swap
+			// stays reachable in the picker. A session-scoped swap still earns one.
+			rememberRecentModel(`${target}/${model}`, getCurrentSettings().chat.modelPicker.recentLimit);
 		},
 		writeSettings: (next) => applySettingsBlob(next),
 		commitSetting: (id, next, scope) => commitSetting(id, next, scope),
@@ -2191,8 +2308,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 					onNewSession: () => {
 						const settings = getCurrentSettings();
 						const input: { cwd: string; target?: string; model?: string } = { cwd: process.cwd() };
-						if (settings.orchestrator.target) input.target = settings.orchestrator.target;
-						if (settings.orchestrator.model) input.model = settings.orchestrator.model;
+						if (settings.chat.target) input.target = settings.chat.target;
+						if (settings.chat.model) input.model = settings.chat.model;
 						session.create(input);
 						taskBoard.snapshot();
 						ensureTaskMemorySession();