@iowarp/clio-coder 0.3.9 → 0.4.1

package/src/interactive/turn-runtime.ts

@@ -52,7 +52,7 @@ import type { TurnMiddleware } from "./turn-middleware.js";
 import type { TurnPersistence } from "./turn-persistence.js";
 import type { AgentRuntime, ChatLoopTarget, ChatTurnState } from "./turn-state.js";
 
-const LOCAL_API_KEY_FALLBACK = "clio-local-target";
+const LOCAL_API_KEY_FALLBACK = "clio-coder-local-target";
 
 /**
  * A turn that never started, with a machine-readable reason attached. The
@@ -85,7 +85,7 @@ export class TurnAdmissionError extends Error {
  * same discovery view the planner budgets against, so a model Clio is planning
  * a loaded window for is never announced as absent.
  */
-export function coldModelNotice(
+function coldModelNotice(
 	status: TargetStatus | null | undefined,
 	targetId: string,
 	wireModelId: string,
@@ -183,13 +183,13 @@ export function createTurnRuntime(deps: TurnRuntimeDeps): TurnRuntime {
 
 	const readTarget = (): ChatLoopTarget | null => {
 		const settings = deps.getSettings();
-		const targetId = settings.orchestrator.target?.trim();
-		const wireModelId = settings.orchestrator.model?.trim();
+		const targetId = settings.chat.target?.trim();
+		const wireModelId = settings.chat.model?.trim();
 		if (!targetId || !wireModelId) return null;
 		const resolved = resolveRuntimeTarget(deps.providers, {
 			targetId,
 			wireModelId,
-			requestedThinkingLevel: settings.orchestrator.thinkingLevel ?? "off",
+			requestedThinkingLevel: settings.chat.thinkingLevel ?? "off",
 			use: "orchestrator",
 			requireTools: false,
 			requireOutputBudget: true,
@@ -243,8 +243,8 @@ export function createTurnRuntime(deps: TurnRuntimeDeps): TurnRuntime {
 	const targetProbesInFlight = new Map<string, Promise<void>>();
 	const ensureLiveCapabilitiesForSelectedModel = async (): Promise<void> => {
 		const settings = deps.getSettings();
-		const targetId = settings.orchestrator.target?.trim();
-		const wireModelId = settings.orchestrator.model?.trim();
+		const targetId = settings.chat.target?.trim();
+		const wireModelId = settings.chat.model?.trim();
 		if (!targetId || !wireModelId) return;
 		const target = deps.providers.getTarget(targetId);
 		if (!target) return;
@@ -316,7 +316,7 @@ export function createTurnRuntime(deps: TurnRuntimeDeps): TurnRuntime {
 					const refreshed = resolveRuntimeTarget(deps.providers, {
 						targetId: target.target.id,
 						wireModelId: target.wireModelId,
-						requestedThinkingLevel: deps.getSettings().orchestrator.thinkingLevel ?? "off",
+						requestedThinkingLevel: deps.getSettings().chat.thinkingLevel ?? "off",
 						use: "orchestrator",
 						requireTools: false,
 						requireOutputBudget: true,

package/src/interactive/turn-state.ts

@@ -43,7 +43,7 @@ export interface ChatLoopRunSnapshot {
 	runtimeId: string;
 	runtimeKind: RuntimeDescriptor["kind"];
 	wireModelId: string;
-	autonomy: ClioSettings["autonomy"];
+	autonomy: ClioSettings["safety"]["autonomy"];
 	compiledPromptHash: string | null;
 	staticCompositionHash: string | null;
 	promptSignature: string | null;

package/src/interactive/view/artifacts.ts

@@ -5,12 +5,14 @@ import type { DispatchContract } from "../../domains/dispatch/contract.js";
 import { isReceiptIntegrity, verifyReceiptIntegrity } from "../../domains/dispatch/receipt-integrity.js";
 import type { RunEnvelope, RunReceipt } from "../../domains/dispatch/types.js";
 import { evidenceDirectory, inspectEvidence, listEvidenceOverviews } from "../../domains/evidence/store.js";
-import { formatTrustSummaryLine } from "../../domains/evidence/trust-projection.js";
+import { formatTrustSummaryLine, trustStateWord } from "../../domains/evidence/trust-projection.js";
 import {
 	inspectRunReceiptTrustStatus,
 	type ReceiptIntegrityOutcome,
 	retiredReceiptIntegrity,
 	retiredReceiptIntegrityReason,
+	TRUST_STATUS_AXES,
+	type TrustStatusAxis,
 } from "../../domains/evidence/trust-status.js";
 import type { EvidenceFinding, EvidenceOverview, EvidenceSource } from "../../domains/evidence/types.js";
 import { type AccountabilitySummary, readAccountabilitySummary } from "../../domains/observability/index.js";
@@ -113,6 +115,20 @@ const JSON_PRETTY_MAX_BYTES = 10 * 1024 * 1024;
 
 export type ReceiptVerifyResult = ReceiptIntegrityOutcome;
 
+export interface ReceiptVerificationCheck {
+	name: string;
+	ok: boolean;
+	evidence: string;
+}
+
+export type ReceiptVerificationReport = ReceiptIntegrityOutcome & {
+	receiptPath: string;
+	sealedDigest: string | null;
+	trustSummary: string | null;
+	compromised: boolean;
+	checks: ReceiptVerificationCheck[];
+};
+
 /**
  * What a verify action reports. `retired` marks a seal this build does not
  * verify because its integrity version was retired: not a pass, and not the
@@ -135,7 +151,6 @@ const RECEIPT_REQUIRED_KEYS = [
 	"costUsd",
 	"compiledPromptHash",
 	"staticCompositionHash",
-	"clioVersion",
 	"piMonoVersion",
 	"platform",
 	"nodeVersion",
@@ -239,7 +254,7 @@ export function receiptFilePath(stateDir: string, runId: string): string {
 	return join(stateDir, "receipts", `${runId}.json`);
 }
 
-export function runLedgerPath(stateDir: string): string {
+function runLedgerPath(stateDir: string): string {
 	return join(stateDir, "runs.json");
 }
 
@@ -301,7 +316,7 @@ type ReadLedgerResult = { ok: true; envelope: RunEnvelope } | { ok: false; reaso
  * the same file and ledger row, projected through the shared boundary so the
  * receipt view spells its verdict exactly as the board and the CLI do.
  */
-export function receiptTrustDetail(stateDir: string, runId: string): string {
+function receiptTrustDetail(stateDir: string, runId: string): string {
 	try {
 		const receipt = JSON.parse(readFileSync(receiptFilePath(stateDir, runId), "utf8")) as RunReceipt;
 		const ledger = readRunEnvelope(stateDir, runId);
@@ -319,7 +334,7 @@ function readRunEnvelope(stateDir: string, runId: string): ReadLedgerResult {
 	return { ok: false, reason: runs.length === 0 ? "run ledger not found" : "run not found in ledger" };
 }
 
-export function verifyReceiptFile(stateDir: string, runId: string): ReceiptVerifyResult {
+function verifyReceiptFile(stateDir: string, runId: string): ReceiptVerifyResult {
 	const target = receiptFilePath(stateDir, runId);
 	let raw: string;
 	try {
@@ -342,6 +357,9 @@ export function verifyReceiptFile(stateDir: string, runId: string): ReceiptVerif
 	for (const key of RECEIPT_REQUIRED_KEYS) {
 		if (!(key in r)) return { ok: false, reason: `missing field: ${key}` };
 	}
+	if (!("clioCoderVersion" in r) && !("clioVersion" in r)) {
+		return { ok: false, reason: "missing field: clioCoderVersion" };
+	}
 	if (!isNonEmptyString(r.runId)) {
 		return { ok: false, reason: `runId invalid: ${String(r.runId)}` };
 	}
@@ -397,8 +415,9 @@ export function verifyReceiptFile(stateDir: string, runId: string): ReceiptVerif
 	if (!isIso8601(r.endedAt)) {
 		return { ok: false, reason: `endedAt not ISO-8601: ${String(r.endedAt)}` };
 	}
-	if (typeof r.clioVersion !== "string" || r.clioVersion.length === 0) {
-		return { ok: false, reason: "clioVersion empty" };
+	const clioCoderVersion = r.clioCoderVersion ?? r.clioVersion;
+	if (typeof clioCoderVersion !== "string" || clioCoderVersion.length === 0) {
+		return { ok: false, reason: "clioCoderVersion empty" };
 	}
 	if (!isNonEmptyString(r.piMonoVersion)) {
 		return { ok: false, reason: `piMonoVersion invalid: ${String(r.piMonoVersion)}` };
@@ -435,6 +454,98 @@ export function verifyReceiptFile(stateDir: string, runId: string): ReceiptVerif
 	return verifyReceiptIntegrity(r as unknown as RunReceipt, ledger.envelope);
 }
 
+const RECEIPT_FILE_FAILURE = /^(?:receipt file not found|read error:)/u;
+const RECEIPT_CONTRACT_FAILURE =
+	/^(?:invalid json:|receipt is not an object|missing field:|runId invalid:|runId mismatch:|agentId invalid:|task invalid:|targetId invalid:|wireModelId invalid:|runtimeId invalid:|runtimeKind invalid:|exitCode out of range:|tokenCount out of range:|inputTokenCount out of range:|outputTokenCount out of range:|cacheReadTokenCount out of range:|cacheWriteTokenCount out of range:|costUsd out of range:|reasoningTokenCount out of range:|startedAt not ISO-8601:|endedAt not ISO-8601:|clioCoderVersion empty|piMonoVersion invalid:|platform invalid:|nodeVersion invalid:|toolCalls out of range:|toolStats\[|compiledPromptHash invalid:|staticCompositionHash invalid:|sessionId invalid:|integrity invalid|execution role invalid|routing intent invalid|route decision invalid)/u;
+const LEDGER_FAILURE = /^(?:run ledger not found|run not found in ledger|ledger mismatch:)/u;
+
+function receiptIntegrityDigest(value: unknown): string | null {
+	if (!isRecord(value) || value.algorithm !== "sha256" || !isNonEmptyString(value.digest)) return null;
+	return `sha256:${value.digest}`;
+}
+
+function trustCheckEvidence(status: ReturnType<typeof inspectRunReceiptTrustStatus>["status"], axis: string): string {
+	const entry = status[axis as keyof typeof status];
+	if (typeof entry !== "object" || entry === null || !("state" in entry)) return "canonical trust projection";
+	if (entry.state === "absent") return `reason=${entry.reason}`;
+	const refs = entry.artifacts.map((artifact) => `${artifact.kind}:${artifact.id}`);
+	return refs.length > 0 ? refs.join(", ") : `${entry.authority.kind}:${entry.authority.id}`;
+}
+
+function compromisedTrustAxes(status: ReturnType<typeof inspectRunReceiptTrustStatus>["status"]): TrustStatusAxis[] {
+	return TRUST_STATUS_AXES.filter((axis) => {
+		const state = status[axis].state;
+		if (axis === "artifactIntegrity") return state === "failed";
+		if (axis === "validationGrounding") return state === "failed" || state === "ungrounded";
+		if (axis === "independentReview") return state === "failed" || state === "not_independent";
+		if (axis === "contextProvenance") return state === "invalid";
+		if (axis === "autonomyEnforcement") return state === "bypassed";
+		return false;
+	});
+}
+
+/** Actionable `/view verify` report without changing the low-level verifier contract. */
+export function verifyReceiptFileReport(stateDir: string, runId: string): ReceiptVerificationReport {
+	const receiptPath = receiptFilePath(stateDir, runId);
+	const result = verifyReceiptFile(stateDir, runId);
+	let receipt: RunReceipt | null = null;
+	try {
+		receipt = JSON.parse(readFileSync(receiptPath, "utf8")) as RunReceipt;
+	} catch {
+		// The verifier's named file or JSON check below retains the actionable error.
+	}
+	const sealedDigest = receiptIntegrityDigest(receipt?.integrity);
+	const ledger = readRunEnvelope(stateDir, runId);
+	const inspection = receipt === null ? null : inspectRunReceiptTrustStatus(receipt, ledger.ok ? ledger.envelope : null);
+	const trustSummary = inspection === null ? null : formatTrustSummaryLine(inspection.status);
+	const compromiseAxes = inspection === null ? [] : compromisedTrustAxes(inspection.status);
+	const checks: ReceiptVerificationCheck[] = [];
+
+	if (!result.ok && RECEIPT_FILE_FAILURE.test(result.reason)) {
+		checks.push({ name: "receipt file", ok: false, evidence: `${receiptPath}: ${result.reason}` });
+	} else {
+		checks.push({ name: "receipt file", ok: true, evidence: receiptPath });
+		if (!result.ok && (RECEIPT_CONTRACT_FAILURE.test(result.reason) || result.retired !== undefined)) {
+			checks.push({ name: "receipt contract", ok: false, evidence: result.reason });
+		} else {
+			checks.push({
+				name: "receipt contract",
+				ok: true,
+				evidence: `current integrity v${receipt?.integrity.version ?? "unknown"}`,
+			});
+			if (!result.ok && LEDGER_FAILURE.test(result.reason)) {
+				checks.push({ name: "run ledger", ok: false, evidence: result.reason });
+			} else {
+				checks.push({ name: "run ledger", ok: true, evidence: `run ${runId} fields match` });
+				checks.push({
+					name: "sealed digest",
+					ok: result.ok,
+					evidence: result.ok ? `${sealedDigest ?? "digest unavailable"} matches receipt and ledger` : result.reason,
+				});
+			}
+		}
+	}
+
+	if (inspection !== null) {
+		for (const axis of compromiseAxes) {
+			checks.push({
+				name: `trust ${axis}`,
+				ok: false,
+				evidence: `${trustStateWord(axis, inspection.status[axis].state)}; ${trustCheckEvidence(inspection.status, axis)}`,
+			});
+		}
+	}
+
+	return {
+		...result,
+		receiptPath,
+		sealedDigest,
+		trustSummary,
+		compromised: compromiseAxes.length > 0,
+		checks,
+	};
+}
+
 function pushCapped(lines: string[], line: string, maxLines: number): boolean {
 	if (lines.length >= maxLines) return false;
 	lines.push(line);
@@ -478,7 +589,7 @@ function splitLinesCapped(text: string, path?: string, maxLines = VIEW_ARTIFACT_
 	return [...lines.slice(0, maxLines), `[truncated, open file directly${path ? `: ${path}` : ""}]`];
 }
 
-export async function loadJsonFileLines(path: string): Promise<ViewArtifactLoadResult> {
+async function loadJsonFileLines(path: string): Promise<ViewArtifactLoadResult> {
 	let canPrettyPrint = false;
 	try {
 		const info = await stat(path);
@@ -1461,7 +1572,7 @@ export function createDefaultArtifactProviders(deps: ArtifactProviderDeps): Arti
 	];
 }
 
-export function sortViewArtifacts(artifacts: ReadonlyArray<ViewArtifact>): ViewArtifact[] {
+function sortViewArtifacts(artifacts: ReadonlyArray<ViewArtifact>): ViewArtifact[] {
 	return [...artifacts].sort((a, b) => {
 		const time = b.timestamp - a.timestamp;
 		if (time !== 0) return time;

package/src/interactive/view/view-overlay.ts

@@ -141,7 +141,7 @@ function isViewArtifactCategory(value: string): value is ViewArtifactCategory {
 	return VIEW_ARTIFACT_CATEGORY_SET.has(value as ViewArtifactCategory);
 }
 
-export function parseViewFilterQuery(query: string): ViewFilterQuery {
+function parseViewFilterQuery(query: string): ViewFilterQuery {
 	const text = query.trim();
 	if (text.length === 0) return { kind: "text", text };
 	const colon = text.indexOf(":");
@@ -215,7 +215,7 @@ function formatLocalTime(timestamp: number): string {
 	return !Number.isFinite(timestamp) || timestamp <= 0 ? "unknown time" : clockLocal(timestamp);
 }
 
-export function filterViewArtifacts(artifacts: ReadonlyArray<ViewArtifact>, query: string): ViewArtifact[] {
+function filterViewArtifacts(artifacts: ReadonlyArray<ViewArtifact>, query: string): ViewArtifact[] {
 	const parsed = parseViewFilterQuery(query);
 	if (parsed.kind === "category") {
 		const categoryArtifacts = artifacts.filter((artifact) => artifact.category === parsed.category);
@@ -226,11 +226,11 @@ export function filterViewArtifacts(artifacts: ReadonlyArray<ViewArtifact>, quer
 	return fuzzyFilter([...artifacts], parsed.text, broadFilterText);
 }
 
-export function artifactsInCategoryOrder(artifacts: ReadonlyArray<ViewArtifact>): ViewArtifact[] {
+function artifactsInCategoryOrder(artifacts: ReadonlyArray<ViewArtifact>): ViewArtifact[] {
 	return VIEW_ARTIFACT_CATEGORIES.flatMap((category) => artifacts.filter((artifact) => artifact.category === category));
 }
 
-export function initialViewSelection(artifacts: ReadonlyArray<ViewArtifact>, initialFilter = ""): number {
+function initialViewSelection(artifacts: ReadonlyArray<ViewArtifact>, initialFilter = ""): number {
 	const filtered = filterViewArtifacts(artifacts, initialFilter);
 	const first = filtered[0];
 	if (!first) return 0;
@@ -252,7 +252,7 @@ export function initialViewSelection(artifacts: ReadonlyArray<ViewArtifact>, ini
 	return Math.max(0, artifactsInCategoryOrder(filtered).indexOf(selected));
 }
 
-export function nextCategorySelection(
+function nextCategorySelection(
 	artifacts: ReadonlyArray<ViewArtifact>,
 	currentIndex: number,
 	direction: -1 | 1,
@@ -271,7 +271,7 @@ export function nextCategorySelection(
 	return safeCurrent;
 }
 
-export function groupedViewRows(artifacts: ReadonlyArray<ViewArtifact>): RenderedViewRow[] {
+function groupedViewRows(artifacts: ReadonlyArray<ViewArtifact>): RenderedViewRow[] {
 	const rows: RenderedViewRow[] = [];
 	for (const category of VIEW_ARTIFACT_CATEGORIES) {
 		const items = artifacts.filter((artifact) => artifact.category === category);
@@ -334,7 +334,7 @@ function verificationText(state: ViewVerificationState | undefined): string {
 	return `${GLYPH.error} verify fail ${state.detail}`;
 }
 
-export function buildArtifactHeader(
+function buildArtifactHeader(
 	artifact: ViewArtifact | undefined,
 	verification: ViewVerificationState | undefined,
 	width: number,
@@ -361,7 +361,7 @@ export function buildArtifactHeader(
 }
 
 /** Put verification on wrapped rows so a canonical receipt verdict is never reduced to a prefix. */
-export function buildArtifactHeaderLines(
+function buildArtifactHeaderLines(
 	artifact: ViewArtifact | undefined,
 	verification: ViewVerificationState | undefined,
 	width: number,
@@ -384,7 +384,7 @@ export function buildArtifactHeaderLines(
 	];
 }
 
-export function viewFooterHint(focus: ViewPaneFocus, canVerify: boolean, innerWidth?: number): string {
+function viewFooterHint(focus: ViewPaneFocus, canVerify: boolean, innerWidth?: number): string {
 	// One pane at a time means Tab is how the other one is reached, so the
 	// narrow footer states it. The generic elider drops middle entries, and Tab
 	// sits in the middle.
@@ -527,6 +527,7 @@ export class ViewOverlayView implements Component {
 	private renderedContentLines(width: number): string[] {
 		const content = this.content;
 		if (!content) return [];
+		if (content.status === "error") return content.lines.flatMap((line) => wrapTextWithAnsi(line, Math.max(1, width)));
 		if (content.format !== "markdown") return content.lines;
 		if (content.renderedLines && content.renderWidth === width) return content.renderedLines;
 		const md = new Markdown(content.lines.join("\n"), 0, 0, markdownTheme(clioTheme()));
@@ -548,7 +549,9 @@ export class ViewOverlayView implements Component {
 			return this.fixedLines(lines, width, height);
 		}
 		if (this.artifactError) {
-			lines.push(padAnsi(theme.fg("error", this.artifactError), width, ELLIPSIS));
+			lines.push(
+				...wrapTextWithAnsi(theme.fg("error", this.artifactError), Math.max(1, width)).map((line) => padAnsi(line, width)),
+			);
 			return this.fixedLines(lines, width, height);
 		}
 
@@ -764,6 +767,7 @@ export function openViewOverlay(
 		width: VIEW_OVERLAY_WIDTH,
 		maxHeight: VIEW_OVERLAY_MAX_HEIGHT,
 		margin: VIEW_OVERLAY_MARGIN,
+		markerId: "view",
 		title: "View",
 		footerHint: (innerWidth) => view.getHint(innerWidth),
 	});

package/src/interactive/watch-pane.ts

@@ -0,0 +1,180 @@
+/**
+ * The workers-view watch pane: one pane, beside Clio's own, rendering whatever
+ * run the operator points at.
+ *
+ * The pane hosts `clio-coder fleet view --watch <selection-file>` (see
+ * src/cli/fleet-view.ts), a durable-state viewer that re-reads the selection
+ * file on every poll. Retargeting is therefore one small atomic file write:
+ * arrow keys in the Alt+W board follow the cursor with zero socket traffic and
+ * zero pane churn, which is what makes the navigation feel like part of the
+ * board rather than like driving a terminal multiplexer.
+ *
+ * Pane creation is deliberately lazy, but reclamation is eager. A surviving
+ * pane is adopted as soon as the controller starts so the relaunched session's
+ * inventory owns it before the next watch command. A new pane still opens only
+ * on the first watch (operator Enter, `/panes show`, or the panes tool), and is
+ * never closed by navigation: leaving the workers view parks it on the last
+ * selection, and it goes away when the operator quits the viewer (`q`), closes
+ * the pane, or runs `/panes close watch`.
+ */
+
+import { mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { type ClioDirs, clioCacheDir, clioConfigDir, clioDataDir, clioStateDir } from "../core/xdg.js";
+import type { MuxContract, MuxPaneRef } from "../domains/mux/index.js";
+import type { PanesWatchController, PanesWatchResult } from "../domains/mux/operations.js";
+import { watchViewerCommand } from "../domains/mux/viewer-command.js";
+
+/**
+ * One selection file per state root, deliberately not per session: every
+ * session over a state root shares one run ledger, so a surviving watch pane
+ * from a crashed session keeps working the moment a new session writes the
+ * same file.
+ */
+function watchSelectionPath(stateDir: string = clioStateDir()): string {
+	return join(stateDir, "watch-selection");
+}
+
+export interface WatchPaneDeps {
+	mux: MuxContract;
+	getCwd: () => string;
+	/**
+	 * Live workers-dock share, read at each open so a `/settings` edit applies
+	 * to the next pane. Absent (tests, minimal wiring) the dock spec's default
+	 * governs.
+	 */
+	getWorkersRatio?: () => number;
+	/** Selection-file override for tests. */
+	selectionPath?: string;
+	/** Resolved-layout override for tests. Production pins this process's four cached roots. */
+	dirs?: Readonly<ClioDirs>;
+	/** Command override for tests; production runs this install's own CLI. */
+	command?: (selectionPath: string, dirs: Readonly<ClioDirs>) => ReadonlyArray<string>;
+	writeFile?: (path: string, content: string) => void;
+}
+
+/** Replace-by-rename so the viewer's poll never reads a torn line. */
+function atomicWrite(path: string, content: string): void {
+	mkdirSync(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, content, "utf8");
+	renameSync(tmp, path);
+}
+
+export function createWatchPaneController(deps: WatchPaneDeps): PanesWatchController {
+	const selectionPath = deps.selectionPath ?? watchSelectionPath();
+	const dirs =
+		deps.dirs ??
+		Object.freeze({
+			config: clioConfigDir(),
+			data: clioDataDir(),
+			state: clioStateDir(),
+			cache: clioCacheDir(),
+		});
+	const command = deps.command ?? ((path, layout) => watchViewerCommand(path, { dirs: layout }));
+	const write = deps.writeFile ?? atomicWrite;
+
+	let paneId: string | null = null;
+	let disposed = false;
+	let adoptionInFlight: Promise<boolean> | null = null;
+	const unsubscribe = deps.mux.onPaneGone((record) => {
+		if (record.ref.paneId === paneId) paneId = null;
+	});
+	const adoptExistingPane = (): Promise<boolean> => {
+		if (disposed || paneId !== null) return Promise.resolve(true);
+		if (adoptionInFlight !== null) return adoptionInFlight;
+		const attempt = Promise.resolve()
+			.then(() => deps.mux.adoptPane({ purpose: "watch", label: "watch", dock: "workers" }))
+			.then((adopted) => {
+				if (!disposed && paneId === null && adopted !== null) paneId = adopted.paneId;
+				return true;
+			})
+			.catch(() => {
+				// Startup reclamation is best effort. An explicit watch retries the
+				// scan before it opens a replacement pane.
+				return false;
+			})
+			.finally(() => {
+				if (adoptionInFlight === attempt) adoptionInFlight = null;
+			});
+		adoptionInFlight = attempt;
+		return attempt;
+	};
+
+	const writeSelection = (runId: string): boolean => {
+		try {
+			write(selectionPath, `${runId}\n`);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+
+	/**
+	 * The one place a watch pane is created: the workers dock slot, split right
+	 * of Clio's pane at the configured share. On a host without the layout tier
+	 * the dock request degrades inside the contract to a plain right split.
+	 */
+	const openPane = (): Promise<MuxPaneRef | null> =>
+		deps.mux.openUtilityPane({
+			argv: command(selectionPath, dirs),
+			cwd: deps.getCwd(),
+			label: "watch",
+			title: "clio-coder watch",
+			purpose: "watch",
+			dock: { slot: "workers", ...(deps.getWorkersRatio ? { share: deps.getWorkersRatio() } : {}) },
+		});
+
+	// Reclaim durable ownership for inventory and navigation immediately. The
+	// scan remains best effort and never opens a replacement pane on its own.
+	void adoptExistingPane();
+
+	return {
+		async ensureOpen(): Promise<boolean> {
+			// Boot composition: the pane exists and parks on the last selection
+			// (the viewer renders "no selection" until one is written). Adoption
+			// first, so a surviving dock is reused rather than doubled.
+			if (disposed) return false;
+			if (paneId !== null) return true;
+			await adoptExistingPane();
+			if (paneId !== null) return true;
+			const opened = await openPane();
+			if (opened === null) return false;
+			paneId = opened.paneId;
+			return true;
+		},
+
+		async watch(runId: string): Promise<PanesWatchResult> {
+			if (!writeSelection(runId)) {
+				return { status: "unavailable", reason: `cannot write the watch selection at ${selectionPath}` };
+			}
+			if (paneId !== null) return { status: "watching", runId, paneId, opened: false };
+			const scanned = await adoptExistingPane();
+			if (!scanned) await adoptExistingPane();
+			if (paneId !== null) return { status: "watching", runId, paneId, opened: false };
+			const opened = await openPane();
+			if (opened === null) {
+				return { status: "unavailable", reason: "the pane host refused to open the watch pane" };
+			}
+			paneId = opened.paneId;
+			return { status: "watching", runId, paneId, opened: true };
+		},
+
+		follow(runId: string): boolean {
+			// Navigation never opens anything; a closed watch pane stays closed
+			// until the operator asks again with Enter.
+			if (paneId === null) return false;
+			return writeSelection(runId);
+		},
+
+		isOpen(): boolean {
+			return paneId !== null;
+		},
+
+		dispose(): void {
+			// The pane parks; only the subscription goes.
+			disposed = true;
+			unsubscribe();
+		},
+	};
+}

package/src/interactive/welcome-dashboard.ts

@@ -103,7 +103,7 @@ function findCurrentStatus(
 	statuses: ReadonlyArray<TargetStatus>,
 	settings: Readonly<ClioSettings> | undefined,
 ): TargetStatus | null {
-	const targetId = settings?.orchestrator?.target ?? null;
+	const targetId = settings?.chat?.target ?? null;
 	if (!targetId) return null;
 	return statuses.find((status) => status.target.id === targetId) ?? null;
 }
@@ -127,7 +127,7 @@ function selectedModelCapabilities(
 	providers: ProvidersContract,
 ): CapabilityFlags | null {
 	if (!status) return null;
-	const wireModelId = settings?.orchestrator?.model ?? status.target.defaultModel ?? null;
+	const wireModelId = settings?.chat?.model ?? status.target.defaultModel ?? null;
 	const detectedReasoning =
 		wireModelId && typeof providers.getDetectedReasoning === "function"
 			? providers.getDetectedReasoning(status.target.id, wireModelId)
@@ -216,7 +216,7 @@ function handoffFacts(cwd: string): { handoffCount: number; handoffFreshness: st
 	}
 }
 
-export function readWelcomeRepositoryFacts(cwd: string): WelcomeRepositoryFacts {
+function readWelcomeRepositoryFacts(cwd: string): WelcomeRepositoryFacts {
 	const codewiki = readCodewiki(cwd);
 	const wiki = codewiki ? wikiFactsFrom(cwd, wikiStaleness(cwd)) : { wikiPageCount: 0, wikiStatus: NO_WIKI_STATUS };
 	return {
@@ -255,7 +255,7 @@ async function readWelcomeRepositoryFactsAsync(cwd: string): Promise<WelcomeRepo
  * guessed, because it decides whether the Wiki row exists at all and the whole
  * point of a placeholder is that the banner never changes height.
  */
-export function placeholderRepositoryFacts(cwd: string): WelcomeRepositoryFacts {
+function placeholderRepositoryFacts(cwd: string): WelcomeRepositoryFacts {
 	return {
 		clioMdStatus: clioMdStatusFor(cwd),
 		hasCodewiki: existsSync(join(cwd, ".clio-coder", "codewiki.json")),
@@ -269,13 +269,13 @@ export function placeholderRepositoryFacts(cwd: string): WelcomeRepositoryFacts
 	};
 }
 
-export function deriveWelcomeDashboardStats(deps: WelcomeDashboardDeps): WelcomeDashboardStats {
+function deriveWelcomeDashboardStats(deps: WelcomeDashboardDeps): WelcomeDashboardStats {
 	const settings = deps.getSettings?.();
 	const statuses = deps.providers.list();
 	const current = findCurrentStatus(statuses, settings);
 	// Left null when unset; formatTargetLabel owns the one spelling for that.
-	const targetLabel = current?.target.id ?? settings?.orchestrator?.target ?? null;
-	const modelLabel = settings?.orchestrator?.model ?? current?.target.defaultModel ?? null;
+	const targetLabel = current?.target.id ?? settings?.chat?.target ?? null;
+	const modelLabel = settings?.chat?.model ?? current?.target.defaultModel ?? null;
 	const workspace = deps.getWorkspaceSnapshot?.() ?? null;
 	const cwd = workspace?.cwd ?? process.cwd();
 	const currentAvailable = current ? activeStatus(current) : false;
@@ -283,16 +283,16 @@ export function deriveWelcomeDashboardStats(deps: WelcomeDashboardDeps): Welcome
 	const thinkingLevel =
 		resolveModelRuntimeCapabilitiesForProviders(
 			deps.providers,
-			settings?.orchestrator?.target,
-			settings?.orchestrator?.model,
-			settings?.orchestrator?.thinkingLevel ?? "off",
+			settings?.chat?.target,
+			settings?.chat?.model,
+			settings?.chat?.thinkingLevel ?? "off",
 		)?.thinking.display ??
-		settings?.orchestrator?.thinkingLevel ??
+		settings?.chat?.thinkingLevel ??
 		"off";
 
-	const autonomy = settings?.autonomy ?? "auto-edit";
-	const toolProfile = settings?.delegation?.defaults?.toolGovernance ?? "clio-policy";
-	const threshold = settings?.compaction?.threshold;
+	const autonomy = settings?.safety.autonomy ?? "auto-edit";
+	const toolProfile = settings?.integrations.externalAgents?.defaults?.toolGovernance ?? "clio-coder-policy";
+	const threshold = settings?.context.compaction?.threshold;
 	const compactionThreshold =
 		typeof threshold === "number" && Number.isFinite(threshold) ? `${Math.round(threshold * 100)}%` : "80%";
 
@@ -376,7 +376,7 @@ function nextValue(stats: WelcomeDashboardStats): string {
  * route answers, and what the context is ready for. Maturity caveats belong
  * in the README, not in a line the operator reads on every turn.
  */
-export function buildWelcomeDashboardLines(
+function buildWelcomeDashboardLines(
 	stats: WelcomeDashboardStats,
 	width: number,
 	mode: WelcomeDashboardMode = "launchpad",