@iowarp/clio-coder 0.4.7 → 0.4.9

package/docs/architecture/tui-design.md

@@ -1,8 +1,5 @@
 # Clio TUI Design System
 
-> **Visual blueprint:** The source checkout includes the complete
-> [Clio TUI Design System visual reference](https://github.com/iowarp/clio-coder/blob/main/docs/html/tui_design_blueprint.html).
-
 This document is the reference specification for the Clio Coder TUI visual layout, styling, and behavior. It describes color semantics, the glyph vocabulary, structural recipes, and state choreography for all surfaces under [src/interactive/](../../src/interactive/).
 
 The governing principle: **the user reads state from color, structure from frames, and identity from brand marks.** Everything that is not state or structure remains visually quiet.
@@ -27,6 +24,8 @@ The governing principle: **the user reads state from color, structure from frame
 
 Preview budgets count terminal rows **after wrapping**, including the `/view` overflow hint, and shrink on short terminals. Reasoning previews retain the newest text when streaming stops. Detailed remains bounded: a successful `cat` or file read cannot fill the transcript with the entire file.
 
+Detailed worker activity puts `now:` operations before newest-first `last:` calls; settled entries do not advertise stale current work. Pending checkpoint questions remain visible even in Compact.
+
 Use **/view transcript** to select full available reasoning, tool arguments/results, local shell output, or worker details. Search the list, press Enter to inspect, and Escape to return. Offloaded tool and dispatch output remains available in the other `/view` categories; missing or truncated captured content is identified. Inspection applies secret redaction, and `!!` output remains excluded from model context.
 
 Output style changes presentation only. **Shift+Tab** still changes the model's thinking effort. It does not reveal unavailable reasoning; Clio shows only reasoning supplied by the provider. The previous Alt+R, Alt+P, and expand-all rendering shortcuts are retired. `/output` now explains how to reach Alt+O and Settings. Existing `minimal`, `default`, and `verbose` preferences map to `compact`, `standard`, and `detailed` without rewriting other preferences.
@@ -113,7 +112,7 @@ Standardized formatters live in [src/interactive/theme/labels.ts](../../src/inte
 - **Duration**: `formatCompactMs` is the unified duration formatter, yielding compact outputs (`860ms`, `4.2s`, `42s`, `1m36s`).
 - **Token Counts**: `formatFooterTokens` formats footer and chip counts (`842`, `12.4k`, `1.2M`). Full numeric strings via `toLocaleString` are reserved for detailed tables like the context legend.
 - **Cost**: The shared `formatUsd` formatter handles dollar values, printing up to four decimal places when under one cent.
-- **Model IDs**: `abbreviateModelId` keeps whole dash-separated parts of model names up to 18 characters; if the parts still overflow, it clips the ID at 18 characters.
+- **Model IDs**: `abbreviateModelId` fits the model label to 24 terminal cells, allocating space to the model family and suffix before shortening its placement prefix. It preserves complete graphemes and marks omissions with `…`. The hydrated presentation passes raw, structured target/model fields through the editor callback; the composer formats them once at its actual width, retaining the full route when it fits and letting placement yield to target, family and variant when it does not. Raw identity and workspace text is sanitized before width measurement or grapheme splitting, so OSC/CSI payloads and control bytes cannot become visible label fragments. Abbreviations are display labels; full routes remain available in model/settings inspection and Fleet Runs detail.
 
 ---
 
@@ -144,7 +143,7 @@ Overlay frames share the island's top border rules and include keyboard shortcut
 └─ [Tab] mode · [Esc] close ─────────────────┘
 ```
 
-Fleet run cards add two bounded budget rows when native dispatch admission supplies an envelope. The `policy` row shows the recipe default or exact pin, its optional maximum, and the invocation request. The `budget` row shows the effective phase, the operator lifetime cap, and the clamp or retry/revision escalation reason. Historical or external-agent rows without this provenance omit both rows.
+Expanded Fleet run cards show available policy and budget details when native dispatch admission supplies an envelope. These values wrap and may occupy several rows; the default card omits them. The `policy` row shows the recipe default or exact pin, its optional maximum, and the invocation request. The `budget` row shows the effective phase, the operator lifetime cap, and the clamp or retry/revision escalation reason. Historical or external-agent rows without this provenance omit both rows.
 
 ### 4.3 Section Headers
 
@@ -202,7 +201,7 @@ Interactive startup uses one terminal lease across both boot stages. Stage 0 own
 ### 5.1 Welcome Launchpad & Session Header
 
 The header has two shapes and no box. Source: `src/interactive/welcome-dashboard.ts`;
-contracts: `tests/contracts/welcome-boot-header.test.ts`.
+contracts: `tests/extended/welcome-boot-header.test.ts`.
 
 - **Launchpad (before the first prompt): exactly three rows.** A masthead with
   identity flush left and workspace flush right separated by a `frame`-token
@@ -259,10 +258,10 @@ contracts: `tests/contracts/welcome-boot-header.test.ts`.
   any handler appends transcript output, on all three submit paths (ordinary
   submit, admission of a queued boot submission, interrupt-submit). `/new`
   returns to the launchpad. `/resume`, `/tree`, `/fork` and `/handoff` collapse
-  it, so a rebuilt transcript is never shown under fresh-start onboarding, and
-  `clio-coder --continue` / `--session <id>` opens directly in the collapsed
-  header once `session.resume()` has actually succeeded. Transitions are
-  idempotent.
+  it after a successful session transition, so a rebuilt transcript is never
+  shown under fresh-start onboarding. Interactive resume starts inside the app
+  with `/resume`; `--continue` and `--session <id>` belong to the headless
+  `clio-coder run` command. Transitions are idempotent.
 
 - **No filesystem work on the render path**, in any state, including the first
   frame and render-cache hits. Project-context state comes from the context
@@ -299,14 +298,14 @@ Starting Clio · you can type now
   - `FOLLOW-UP` (muted) while Clio is actively processing a run.
   - `STEER` (neon orange) when Enter will actively steer in-flight work.
   - When the draft scrolls, the active mode folds into the scroll indicator row so the orange warning remains visible.
-- **Top Rail Metadata**: The top rail right displays target/model and thinking level with two-step color hierarchy: `off` (dim), `minimal`/`low` (muted), `medium`/`high` (`reason` purple), and `xhigh`/`max`/`on` (bold `reason` purple).
+- **Top Rail Metadata**: The top rail right displays target/model and thinking level. Narrow labels budget target and model separately, for example `blade… · qwopus3.…dense-q6 · low`, so the gateway does not consume the model family or variant. Thinking levels use a two-step color hierarchy: `off` (dim), `minimal`/`low` (muted), `medium`/`high` (`reason` purple), and `xhigh`/`max`/`on` (bold `reason` purple).
 - **Empty-State Placeholder**: Displays dim prompt `Ask Clio…  / for commands`.
 - **Lower Rail Affordance**: On terminals at or above 60 columns, the bottom rail displays `Enter send · Ctrl+J newline` (or resolved keybindings).
 
 ### 5.3 Progressively Disclosed Footer
 
 - **Compact Mode (Quiet Idle)**: Two always-on lines that eliminate idle telemetry noise (suppresses `tools none`, `◌ idle`, and duplicate turn receipts):
-  - **Line 1 (Workspace & Readiness)**: CWD path, git branch/dirty state, and active phase pill only when meaningful.
+  - **Line 1 (Workspace & Readiness)**: CWD path, git branch/dirty state, and active phase pill only when meaningful. Long workspace parents and branch decoration yield before current activity; the workspace suffix and live worker count remain visible at narrow widths, including while the main agent is idle.
   - **Line 2 (Context & Style)**: Context window meter, Output style, and session cost.
 - **Expanded Mode (`Alt+U`)**: Four responsive sections ordered by operational urgency rather than a static telemetry grid:
   1. `Activity`: Live agent phase, active workers, running tool calls.
@@ -363,9 +362,16 @@ The right-hand label shows `model · thinking`. Thinking level colors map as: `o
 ### 6.5 Transcript Notices
 Replay and system tags (e.g. `[retry]`, `[model]`) are wrapped in `dim` brackets with a `muted` message. Retry tags use `warning` amber.
 
+Provider failures use a bounded, sanitized diagnosis in the primary transcript,
+retaining available HTTP status and actionable route advice. Provider retry labels
+identify their layer; running and waiting phases do not repeat the same error body.
+Live and replay previews use the current terminal height and output-style row
+budget. `/view transcript` and export retain the available redacted diagnostic;
+upstream SDK truncation cannot be undone by the presentation layer.
+
 ### 6.6 Output Style Receipts
 
-Compact omits the separate turn receipt. Standard shows a small completion line with available duration. Detailed includes model calls, input/output tokens, cache usage, and supplied reasoning usage with provenance. Reasoning text is an excerpt, not verification. The quiet footer keeps the style and session cost visible; detailed telemetry is available through Detailed or the expanded dashboard.
+Compact omits the separate turn receipt. Standard shows a small completion line with available duration. Replay treats tool-use messages as intermediate; they cannot create a successful receipt on an earlier failed or cancelled turn. Detailed includes model calls, input/output tokens, cache usage, and supplied reasoning usage with provenance. Reasoning text is an excerpt, not verification. The quiet footer keeps the style and session cost visible; detailed telemetry is available through Detailed or the expanded dashboard.
 
 ### 6.7 Code Ink (Syntax Highlighting)
 
@@ -417,12 +423,14 @@ The `/settings` overlay is a full-screen transactional control center:
 
 ### 7.2 Fleet Runs Board
 
-The `Alt+W` board renders one card per run from the observability run projection, which owns lifecycle, worker progress, receipt trust, retries, cancellation, fleet positions, and evidence readiness; the board owns only ordering, selection, and rendering. The default list is compact: run id, route, task, status, telemetry, retry, tool names, and proof. `Enter` opens the selected run's worker detail, which adds two rows to that card and nothing to any other:
+`/fleet` and `Alt+W` open Fleet Runs; `/settings fleet` opens fleet configuration. The board consumes the observability run projection, which owns lifecycle, worker progress, receipt trust, retries, cancellation, fleet positions and evidence readiness. The board owns selection and rendering; council members remain grouped in a council card.
 
-- **`doing`**: the phase (`◐ thinking` in `reason`, `◑ writing` in `accent`, `⚙ tool` in `action`, `◔ waiting` in `info`) followed by the running call as `<tool> <verb> <object>`, or the last finished call as `last <tool> <verb> <object>`. The verb and object come from a descriptor composed at the worker seam; raw arguments never reach the renderer.
-- **`answer`**: the newest rows of the worker's bounded prose on a `│` rail with a hanging indent under the key, then a dim row naming the lines and bytes the bounds refused and the `/view dispatch:<runId>` deep link.
+An ordinary card defaults to run identity, abbreviated route, a task preview, status, trust/evidence, telemetry and one current-operation row when available. A long task keeps two wrapped rows plus an Enter-detail disclosure. Fleet phase appears only when the run has a recorded fleet position. Route abbreviation preserves its distinguishing suffix. Retry, control and evidence warnings remain visible when present. An ordinary completed, sealed and mediated run with no validation or independent review shows `unverified; no validation observed` in its compact trust row. Enter restores every canonical provenance clause. This shortening applies only when context is recorded and completion evidence is absent; exceptional, unknown or failed states keep the full trust summary visible. Execution completion and receipt sealing do not establish scientific validation.
 
-Wrapping happens before the row cap, so the block is at most six rows tall at any width and a streaming answer cannot make the card grow under the operator. Detail follows the cursor rather than pinning to a run, and closing the board closes it. Reasoning text is never rendered; the `thinking` phase word is the whole of what the board says about it.
+- **`doing`** shows `now <tool> <verb> <object>` for the current call. Between calls it can show the worker phase and `last <tool> <verb> <object>` for its most recent completed call. Descriptors come from the worker seam; raw arguments never reach the renderer. A thinking phase exposes no reasoning text.
+- **Enter detail** restores the full wrapped route and task, exposes policy and budget facts, and adds the available answer. The answer uses a `│` rail, retaining up to six wrapped prose rows plus an overflow disclosure for omitted lines/bytes and the `/view dispatch:<runId>` inspection route. This cap applies to the answer preview, not to the complete expanded card. Recognized complete results use the same readable contract presentation as the transcript only when an integrity-verified receipt supplies the declared kind and passing conformance. Partial, malformed, unknown or nonconforming output remains an honest excerpt. Contract conformance does not imply validation; reproduction and other qualification facts remain visible, and inspection retains the available raw output.
+
+Detail follows selection rather than pinning to a run. Empty boards show `Use /run or /delegate to start a run.` and advertise only closing. Narrow active hints prioritize supported steering and cancellation over navigation/detail hints; Enter remains available to expand. HTTP/SDK runs expose steering only in supported live states, ACP and subprocess runs do not, and terminal rows expose neither steering nor cancellation.
 
 ### 7.3 Task and Decision Boards
 
@@ -434,6 +442,18 @@ Wrapping happens before the row cap, so the block is at most six rows tall at an
 - **Grouped Palette**: Typing `/` opens a grouped command palette (ordered by `Run`, `Inspect`, `Configure`, `Sessions`) with compact argument hints and formatted descriptions.
 - **One Canonical Spelling**: Autocomplete, help, and parsing expose the same unique slash-command names; no alias rows compete with canonical commands.
 
+### 7.5 View Artifact Inspection
+
+View uses explicit list/preview focus labels and match/total counts. Search requires every whitespace-separated term to occur literally, case-insensitively, in resource identity or available provenance; paths remain intact terms. Category prefixes such as `dispatch:<runId>` constrain the same search. Left/Right selects among nonempty categories in the current results; it does not remove the filter. Filtering does not change provider scope or discard global evidence. Initial query editing starts at the end, and selection is retained by resource identity across refresh. Filters persist within one overlay lifetime. In list focus, Ctrl+U uses Input's semantic clear operation without synthesized movement keys: it saves one undo snapshot and the complete killed value, so undo restores query and cursor and yank can restore the full query. Clearing an empty filter changes neither history nor the kill ring.
+
+Workspace outputs lead with their basename and workspace-relative path. In preview, `i` toggles scrollable provenance including the full backing path and available session, run and correlation identities; `o` keeps its backing-path notice and `v` retains available verification. Toggling provenance resets that pane's scroll offset. At narrow widths, Enter opens preview and Esc returns to the list before closing; empty results cannot acquire preview focus. Content loading is deferred off the synchronous render stack, and stale loads or refreshes cannot replace newer selection/results.
+
+### 7.6 Library Browsing and Notices
+
+Library status and footer counts distinguish Browse packages, Installed entries and inspected members, with correct singular/plural forms, separately from discovery notices. From browse focus, `n` opens the searchable child notice view and returns from it to resources. While search has edit focus, `n` is filter text; Esc clears a filter or leaves search focus before returning to the parent browser. Returning restores the original browser's selection, filter draft, browse focus and detail position. Notices retain their individual evidence and offer no package mutation or recipe-use action. Count units describe the selected inventory view, not the number of runnable recipes; unavailable Installed entries remain visible.
+
+Agents and Fleets label plugin provider packages as `[plugin]` and show only the selected category's catalog hints. Those hints do not claim a recipe is loaded. `b` switches Browse/Installed; `Actions: User/Project` (or the compact `s:User/Project` label) identifies the destination for package lifecycle actions, not an inventory scope filter. Narrow status lines retain the `n` notice affordance. The selected inspector opens below the split threshold as well as beside the list at wider widths, puts applicable actions before long provenance, and retains Tab and page-scroll navigation. Enter says `members` only when it opens package members, otherwise `detail`. Plain external metadata is sanitized before composition with trusted semantic state colors, so available, unavailable and other states retain their theme styling. All lifecycle actions retain their existing review paths.
+
 ---
 
 ## 8. Shared Vocabulary
@@ -472,7 +492,7 @@ memory ID, and leave approval to the separate reviewed memory lifecycle.
 
 Clio pins pi-tui 0.85.1 with a tracked pnpm patch for one pre-viewport input
 policy, public existing search focus/operations, and semantic Editor/Input
-edits. Production consumes these only through src/engine. The patch adds no
+edits, including atomic Input clear with native undo and kill-ring preservation. Production consumes these only through src/engine. The patch adds no
 renderer, decoder or search implementation. Published dist bundles patched
 JavaScript and the pure JavaScript transitive dependencies; the pinned installed
 Pi package supplies native Darwin/Windows helpers through its package resolver.

package/docs/architecture/worker-context.md

@@ -1,7 +1,5 @@
 # Worker context inheritance
 
-> **Visual blueprint:** [Worker context visual reference](https://github.com/iowarp/clio-coder/blob/main/docs/html/worker_context_blueprint.html).
-
 Clio dispatch separates **what a worker inherits** from **how workers are scheduled**. This implements the isolation, fork, and splice patterns discussed in [Organizing context in a multi-agent harness](https://www.langchain.com/blog/organizing-context-in-a-multi-agent-harness), using Clio's existing Pi agent loop and dispatch admission boundary.
 
 The default remains an isolated conversation. A native worker gets its own Pi Agent, worker system prompt, admitted tools, dynamic project context, task, and run-local accounting. Context inheritance does not grant additional tools, write roots, or autonomy. Conversation isolation is not a filesystem sandbox; use dispatch worktrees when filesystem isolation is required.
@@ -96,7 +94,7 @@ compatibility allowance and not a universal provider contract. A per-response ca
 also caps one response, not a task: it does not bound total task tokens or
 guarantee the task finishes.
 
-`tests/contracts/worker-output-settings.test.ts` covers the eight combinations of
+`tests/extended/worker-output-settings.test.ts` covers the eight combinations of
 trust state and layer (trusted project at low/medium/xhigh effort, trusted local
 override, untrusted, changed-after-trust, malformed, and user settings only).
 

package/docs/architecture/worker-dispatch-mechanics.md

@@ -1,8 +1,5 @@
 # Worker Dispatch Mechanics
 
-> **Visual blueprint:** The source checkout includes the complete
-> [Worker Dispatch Mechanics visual reference](https://github.com/iowarp/clio-coder/blob/main/docs/html/worker_dispatch_blueprint.html).
-
 This document describes the design and lifecycle of Clio Coder dispatched workers, focusing on the spawning sequence, execution isolation, the standard input/output NDJSON communication loop, and permission escalation routing.
 
 Source of truth:
@@ -231,7 +228,7 @@ The current reduced contract suite divides dispatch coverage by ownership:
 | --- | --- |
 | `tests/contracts/dispatch-lifecycle.test.ts` | Attached and detached lifecycle deduplication, durable transitions, terminal finalization, and orphan recovery from durable attempts. |
 | `tests/contracts/dispatch-admission.test.ts` | Typed-scope authority, capability pairing, deterministic capacity admission, conservative slot defaults, and ACP authority boundaries. |
-| `tests/contracts/dispatch-schema.test.ts` | Capability-shaped model schema, referenced `$defs`, and hidden-field compatibility. |
+| `tests/extended/dispatch-schema.test.ts` | Capability-shaped model schema, referenced `$defs`, and hidden-field compatibility. |
 
 Earlier releases carried separate envelope, assignment, detached-assignment,
 and failure-class test files for the detailed retry scenarios. Those files are

package/docs/guide/authoring-plugins.md

@@ -1,7 +1,5 @@
 # Authoring a portable agent plugin
 
-> **Visual blueprint:** See the [visual reference](../html/authoring_plugins_blueprint.html) in the source checkout.
-
 An agent plugin packages a workflow and its supporting resources as one versioned installation. Its canonical identity is the [Agent Plugins 1.0.0 manifest](https://agent-plugins.org/schemas/1.0.0/plugin.schema.json). Clio keeps the complete package together, verifies its full-tree digest, and discovers the resources supported by the current runtime.
 
 The minimal package has a root `plugin.json` and an immediate child skill directory:
@@ -120,7 +118,7 @@ What a peer host does *not* load matters just as much. Claude Code scans a plugi
 
 That leaves a real choice when a package should serve both audiences. Ordinary top-level `agents/` and `prompts/` directories are the recommended Clio layout and stay a valid first-class library package; the repository marketplace simply does not publish such a package, and `pnpm run library:pin` prints the reason. To publish it as well, declare its Clio resource roots at paths no peer host scans, for example `"agents": "native/agents"` in the manifest's `resources` map, and put the recipes there. The bundled `materio` package does this with its own historical directory name.
 
-Keep the skill surface intact when you edit a package: adding a `skills/` directory to a standalone skill silently stops its root `SKILL.md` from loading. `tests/contracts/library-portability.test.ts` asserts all of this for every curated package, and `scripts/verify-portable-hosts.sh` re-measures it against the real host CLIs. See [coding agent interoperability](interop.md) for the exact install commands.
+Keep the skill surface intact when you edit a package: adding a `skills/` directory to a standalone skill silently stops its root `SKILL.md` from loading. `tests/extended/library-portability.test.ts` asserts all of this for every curated package, and `scripts/verify-portable-hosts.sh` re-measures it against the real host CLIs. See [coding agent interoperability](interop.md) for the exact install commands.
 
 Harness extensions register runtime tools through the [harness extension contract](harness-extensions.md). They use a separate extension manifest and installation state, and they cannot declare domain resources: prompts, agents, skills, fleets and reference files ship in a plugin. See [plugin library usage](plugins.md) for catalogs, updates, pins and terminal UI operations.
 

package/docs/guide/built-in-agents.md

@@ -1,8 +1,5 @@
 # Clio Coder Agent Fleet
 
-> **Visual blueprint:** The source checkout includes the complete
-> [Clio Coder Agent Fleet visual reference](https://github.com/iowarp/clio-coder/blob/main/docs/html/agents_blueprint.html).
-
 Clio Coder dispatches focused fleet agents from Markdown recipes. Recipes are data files, not hidden code plugins: YAML frontmatter declares identity, tool requirements, skill bindings, audience, capability and latency classes, budget, and result contract; the Markdown body is the agent instruction text.
 
 The source of truth is `src/domains/agents/**`. Clio's agent dispatch engine and execution boundaries are built upon the [@earendil-works/pi-agent-core](https://www.npmjs.com/package/@earendil-works/pi-agent-core) library.

package/docs/guide/commands-and-modes.md

@@ -1,8 +1,5 @@
 # Commands and Modes
 
-> **Visual blueprint:** The source checkout includes the complete
-> [Commands and Modes visual reference](https://github.com/iowarp/clio-coder/blob/main/docs/html/commands_blueprint.html).
-
 Clio Coder is a terminal-first coding agent. This page is the detailed command
 reference for interactive sessions, headless runs, dispatch, verification, and
 common operator workflows; the README remains an approachable product and
@@ -24,6 +21,9 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `clio-coder --help [--all]` | Print the command list. `--all` appends every command under `clio-coder dev`. |
 | `clio-coder --api-key <key>` | Override the active target API key for one invocation. |
 | `clio-coder --no-context-files` / `clio-coder -nc` | Skip `CLIO-CODER.md` project-context injection for one invocation. |
+| `clio-coder --with-panes` | Activate guest pane integration for this invocation when Clio is inside a reachable herdr session. |
+| `clio-coder --no-panes` | Keep panes off even when settings turn them on. |
+| `clio-coder --autonomy <level>` | Start this interactive session at `read-only`, `suggest`, `auto-edit`, or `full-auto` without modifying `settings.yaml`. Passing `--autonomy` before a subcommand is refused with exit 2 (`clio-coder run --autonomy` remains the headless form). |
 | `clio-coder --no-skills` | Disable skill discovery for one invocation while still honoring explicit `--skill` paths. |
 | `clio-coder --skill <path>` | Load one explicit skill file or directory for one invocation (repeatable). |
 | `clio-coder configure` | Run the configuration wizard. Ctrl+C reports `configuration cancelled`, writes no target, and exits 130; when first-run onboarding is cancelled, startup stops instead of opening the TUI with no usable target. |
@@ -45,16 +45,19 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `clio-coder auth status [target-or-runtime]` | Inspect auth state. |
 | `clio-coder auth login [target-or-runtime] [--api-key <value>]` | Add credentials through the supported flow. |
 | `clio-coder auth logout [target-or-runtime]` | Remove stored credentials. |
-| `clio-coder doctor [--fix] [--json]` | Diagnose state. Plain `doctor` is read-only and leaves even a partially initialized home byte-for-byte untouched. With `--fix`, create missing structure and templates, repair credential permissions, and refresh install metadata. Settings remain strict; lifecycle migrations belong to `upgrade`, not `doctor --fix`. |
+| `clio-coder doctor [--fix] [--json]` | Diagnose state. Plain `doctor` is read-only and leaves even a partially initialized home byte-for-byte untouched. With `--fix`, create missing structure and templates, repair credential permissions, refresh install metadata, and record fleet preflight results. Settings remain strict; lifecycle migrations belong to `upgrade`, not `doctor --fix`. |
+| `clio-coder mcp list\|trust\|untrust` | List configured MCP servers or manage explicit project trust with `trust <id> [--action-class read\|execute\|unknown]` and `untrust <id>`. |
 | `clio-coder tools list [--json]` | List the pinned external tool registry and whether each program resolves from `PATH`, Clio's vendored data directory, or nowhere. |
 | `clio-coder tools status <id> [--json] [--reset-profile]` | Inspect one registered tool. `--reset-profile` applies only to yazi's generated profile. |
 | `clio-coder tools install <id> [--force] [--json]` | Download the platform asset, verify every declared checksum, and atomically vendor it. |
 | `clio-coder tools remove <id>\|--all [--json]` | Remove Clio-vendored copies without touching a program found on `PATH`. |
 | `clio-coder panes install` | Alias for `clio-coder tools install herdr`. |
 | `clio-coder panes theme` | Print Clio's theme tokens as a herdr `[theme.custom]` block to paste into herdr's `config.toml`; Clio never edits that file itself. See [Panes and the Files Pane](panes-and-files.md). |
-| `clio-coder reset [--state\|--data\|--cache\|--auth\|--config\|--all] [--dry-run] [--force]` | Reset selected Clio Coder state. `--state` is the default level. |
-| `clio-coder uninstall [--dry-run] [--remove-binary] [--force]` | Remove Clio Coder state and print uninstall guidance. |
-| `clio-coder upgrade [--dry-run] [--channel=<latest\|beta\|dev>] [--skip-migrations]` | Refresh state metadata, apply migrations, and update npm installs when applicable. |
+| `clio-coder tasks [list\|add\|hand\|done\|drop]` | List, add, hand, finish, or drop project operator tasks. |
+| `clio-coder verifiers discover\|inspect\|author\|validate\|edit\|dry-run` | Discover, inspect, author, validate, edit, or dry-run project checks. |
+| `clio-coder reset [--state\|--data\|--cache\|--auth\|--config\|--all] [--dry-run] [--force] [--json]` | Reset selected Clio Coder state. `--state` is the default level. |
+| `clio-coder uninstall [--dry-run] [--remove-binary] [--keep-config] [--keep-data] [--force] [--json]` | Remove Clio Coder state and print uninstall guidance. |
+| `clio-coder upgrade [--dry-run] [--channel=<latest\|beta\|dev>] [--skip-migrations] [--json]` | Refresh state metadata, apply migrations, and update npm installs when applicable. |
 | `clio-coder agents [--json] [--all]` | List discovered agent specs. |
 | `clio-coder fleet list\|run\|status\|drain\|resume` | List fleet contracts, run one, show dispatch state, or control admission. `drain` denies new execution starts for up to one hour and preserves running work; `resume` reopens admission immediately. `run <name>` takes `[--var k=v ...]` and `[--json]`; `status`, `drain`, and `resume` each take `[--json]`. |
 | `clio-coder fleet view <runId\|fleetRootId> [--follow]` | Read the append-only run journal after verifying receipt trust. A fleet root prints its durable step index. Without `--follow`, the width-bounded snapshot is plain text with no ANSI control bytes. `--follow` requires an interactive terminal and one run id; `fleet view --help` prints this subcommand's own usage, including `--watch`. |
@@ -73,11 +76,10 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `clio-coder trace code-steps <rootId> [--json]` | Show the deterministic code-step records one fleet root wrote (argv, cwd, env names, exit code, duration, output digest, artifact paths). They are files beside the ledger, not rows in the mirror, so `--db` does not apply. |
 | `clio-coder trace prune [--max-age-days N] [--max-bytes N] [--db PATH] [--json]` | Apply the trace-retention policy while protecting queued and running runs; JSON reports the resolved policy, rows, runs and bytes removed, protected runs, and whether vacuum ran. |
 | `clio-coder trace sql <SELECT query> [--db PATH]` | Run one read-only query against the mirror. Only a single `SELECT` or read-only `WITH` statement is accepted; anything else exits 2. |
-| `clio-coder trace ui [--db PATH] [--port N]` | Serve the localhost-only waterfall viewer. The viewer is not part of the published package. |
 | `clio-coder dev evolve manifest init\|validate\|summarize` | Create and check typed harness change manifests. |
 | `clio-coder extensions list\|discover\|install\|enable\|disable\|remove` | Manage installed extension packages and resource roots. `clio-coder ext` is an accepted alias. |
 | `clio-coder library list\|search\|register\|inspect\|validate\|install\|update\|enable\|disable\|drift\|pin\|remove` | Manage packages of kind plugin, skill, agent, prompt or fleet at user/project scope; `install/update --dry-run` preview. `library skills` lists runtime skills; `library inventory --json` is the fixed GUI read. |
-| `clio-coder docs [topic] [--no-open]` | Serve the interactive HTML docs of a source checkout on 127.0.0.1; the npm package ships the Markdown guides only. |
+| `clio-coder docs [topic] [--no-open]` | Open the documentation in the web app, rendered directly from the canonical Markdown. Reuse the configured background app or start a foreground loopback server; `--no-open` prints its launch link. |
 | `clio-coder usage report [--repo <path>] [--days <n>] [--json]` | Cross-session usage facts from session/run ledgers and retained out-of-turn calls, including known failed-compaction spending and missing coverage. The window defaults to 30 days and the JSON schema is marked experimental. |
 | `clio-coder dev share export --out <path> [--project\|--user\|--both] [--context] [--prompts] [--skills] [--settings] [--extensions]` | Export project context, prompts, skills, settings fragments, and extension bundles. |
 | `clio-coder dev share import <path> [--dry-run] [--force] [--project\|--user] [--json]` | Import a share archive with conflict reporting. |
@@ -177,7 +179,8 @@ The registry table below lists the available interactive slash commands. On a ba
 | `/library` | `/library [inspect \| install \| remove <ref>] [import <path-or-url>] [reload]` | Open the full-screen Library with Skills, Agents, Prompts, Fleets and Plugins tabs. A named reference opens the browser on that row; `install`, `remove` and `import` show a reviewed plan first and write nothing until it is accepted. `reload` refreshes installed recipe resources. Alt+L opens the same browser. |
 | `/skills` | `/skills` | Open the Library on Skills. |
 | `/prompts` | `/prompts` | Open the Library on Prompts. |
-| `/extensions` | `/extensions [reload]` | Inspect harness extensions or reload their hooks and operator runtimes. |
+| `/mcp` | `/mcp [list] \| /mcp trust <id> [class] \| /mcp untrust <id>` | List MCP servers or manage explicit trust for project MCP servers with optional action class |
+| `/extensions` | `/extensions [reload]` | Inspect harness extensions or reload their commands, hooks and operator UI |
 | `/interop` | `/interop` | Inspect another local coding agent and review adoption of supported resources. |
 | `/share` | `/share [runId]` | Share a worker result with the main agent |
 | `/archive` | `/archive export <path> \| /archive import [--dry-run] [--force] <path>` | Export or import a full Clio archive |
@@ -189,10 +192,10 @@ The registry table below lists the available interactive slash commands. On a ba
 | `/agents` | `/agents` | Open the Library on Agents. |
 | `/cost` | `/cost` | Show session token and cost totals |
 | `/context` | `/context compact [instructions] \| /context recall <ref> \| /context init \| /context refresh \| /context reset` | Context hub: window overlay plus compact, recall, init, refresh, and reset |
-| `/fleet` | `/fleet run [--var <key=value>] <name>` | Open Settings → Fleet, or run a fleet contract with an approval preview |
+| `/fleet` | `/fleet [run [--var <key=value>] <name>]` | Open Fleet Runs, or run a fleet contract with an approval preview. Configure fleets with `/settings fleet`. |
 | `/decisions` | `/decisions` | Show settled interview decisions and operator revisions |
 | `/tasks` | `/tasks add [--expect <path>] [--verify <checkId>[:timeoutMs]] <text> \| /tasks hand <id> \| /tasks done <id> \| /tasks drop <id>` | Show the session board or manage project operator tasks |
-| `/memory` | `/memory seed` | Inspect, promote, or seed task memory |
+| `/memory` | `/memory [seed]` | Inspect, promote, or seed task memory |
 | `/view` | `/view [filter] \| /view verify <runId>` | Browse session artifacts and verify receipts |
 | `/panes` | `/panes show <run-or-agent> \| /panes open <preset-or-argv> \| /panes zoom [target] \| /panes close [target]` | Inspect the pane layer, watch a live run in a pane, or open a utility pane (`files`, `logs`, `shell`, `files --once`, or a command); a second open focuses the pane already there |
 | `/files` | `/files [open\|close\|pick]` | Toggle the files pane docked below the session; picks land in the composer as `@` mentions. See [Panes and the Files Pane](panes-and-files.md) |
@@ -202,7 +205,7 @@ The registry table below lists the available interactive slash commands. On a ba
 | `/resume` | `/resume` | Resume a past session |
 | `/new` | `/new` | Start a fresh session |
 | `/handoff` | `/handoff <goal>` | Hand this session's working state to a fresh session for a stated goal |
-| `/tree` | `/tree` | Open session tree navigator |
+| `/tree` | `/tree` | Open session tree navigator. Press `p` to filter by current cwd and `s` to cycle tree order or most recent first. |
 | `/fork` | `/fork` | Fork from an assistant turn |
 | `/export` | `/export [path]` | Export a self-contained HTML transcript by default; a `.md` path writes Markdown |
 
@@ -224,6 +227,14 @@ completion note alone does not satisfy acceptance. `clio-coder tasks list`,
 
 Retired commands are rejected before model submission. Old Library browsing forms, including `/resources`, `/library <kind>` and `/agents connect`, explain the canonical route. Browse with `/library`, `/skills`, `/agents` or `/prompts`; use `/interop` for local-agent adoption and `/extensions` for harness extensions.
 
+In `/library`, `b` switches between Browse packages and Installed entries. Agents and Fleets may show `[plugin]` provider packages with category-specific catalog hints; use Installed to find loaded recipes. Status and footer counts distinguish packages, entries and members with correct singular/plural forms, and do not imply every entry is runnable. `s` chooses User or Project as the destination for package actions; it does not filter the inventory by execution scope. Install, import and removal still require their existing review. Narrow layouts open with the selected detail visible, and Tab toggles it.
+
+Library discovery notices have their own searchable `n` view and independent count. From browse focus, `n` opens notices or returns from notices to resources. While search has edit focus, `n` types into the filter. Esc clears a filter or leaves search focus before returning to the parent browser. Your resource selection, filter draft, browse focus and detail position survive the visit. Notices are evidence to inspect and have no package action. Enter opens members only for a package that supports that operation; otherwise it opens detail.
+
+`/view [filter]` searches resource identity and available provenance with case-insensitive literal terms. Every whitespace-separated term must occur; fuzzy abbreviations do not match. A category prefix such as `dispatch:<runId>` limits the search to that category, while an ordinary query searches across the supplied categories. Left/Right moves between categories with matches without clearing the query. Match/total counts describe the current filter without hiding global evidence at the provider level. The filter persists through preview, back and refresh within the open overlay, and an initial query starts with its cursor at the end. While editing the filter, Ctrl+U clears the whole query even with customized movement keys; undo restores its full text and cursor, and clearing an already empty filter does not consume an undo step.
+
+Workspace output rows show their basename before the relative path. In View preview, press `i` for scrollable provenance with the full backing path and available session/run/correlation identities; press `i` again for content. This toggle resets the pane's scroll position. `o` reports the backing path, and `v` verifies resources that support verification. Enter or Tab opens a selected preview; Esc returns to the list, then closes. Empty results keep focus in the list. View's literal search is separate from the shared ListOverlay fuzzy search described below.
+
 `/context` with no arguments opens the context-window ledger overlay, including
 the working-set section (policy, evicted items and tokens, events, recalls, churn).
 The subcommands own the durable project-context noun: `compact` summarizes older
@@ -317,7 +328,7 @@ bank. `/handoff` during an in-flight turn is refused with a notice rather than
 queued, because a document summarizing a session that is still moving would be
 wrong by the time it was read.
 
-The `/resume` picker accepts Page Up and Page Down to move by its 12 visible rows. Arrow keys continue to move one session at a time, and typing continues to filter the list.
+The `/resume` picker accepts Page Up and Page Down to move by its 12 visible rows. Arrow keys continue to move one session at a time, and typing continues to filter the list. Task identity occupies the primary column, with the session name or ID as a fallback; metadata yields as the terminal narrows. Filtering preserves the selected session when it still matches, and undo from an empty result restores that selection. Confirmation resumes the visibly selected session, including with customized list bindings.
 
 Only active commands run. Typing anything command-shaped that the registry does
 not own checks the loaded prompt templates across native and foreign prompt roots.
@@ -355,7 +366,7 @@ Configuration lives in one place: the `/settings` overlay. `/settings <section>`
 
 Settings → Targets presents an operational console table (`HEALTH`, `ID`, `ROLES`, `RUNTIME`, `LATENCY`) with an in-place action/detail drawer for URL, default model, last probe error, and reachability. `Enter` opens actions for `Use` (switches active chat target and rebases model), `Connect` (runs the API-key or OAuth flow then probes), `Probe`, and `Remove` (with preflight analysis of affected routes/profiles). Probing runs live when the overlay opens or when explicitly requested. Target creation is initiated via `clio-coder targets add`.
 
-Settings → Fleet is an entity workbench organized with dim group headers (`Defaults`, `Profiles`, `Agent routes`, `Placement`). Dispatched worker defaults and profile rows render as compact summaries (`fast-local node-a/example-coder-model  high  auto`), drilling into fields (`target`, `model`, `thinkingLevel`, `node`) on `Enter`. Profile removal is a named destructive action with affected-route preflight. Running and retrying dispatches live in the `Alt+W` Fleet Runs board, which also steers and cancels them. `Enter` opens the selected run's worker detail: the phase, the running call with its redacted action descriptor, and the bounded tail of the worker's own prose.
+Settings → Fleet is an entity workbench organized with dim group headers (`Defaults`, `Profiles`, `Agent routes`, `Placement`). Dispatched worker defaults and profile rows render as compact summaries (`fast-local node-a/example-coder-model  high  auto`), drilling into fields (`target`, `model`, `thinkingLevel`, `node`) on `Enter`. Profile removal is a named destructive action with affected-route preflight. Running and retrying dispatches live in the `/fleet` or `Alt+W` Fleet Runs board. Its default cards show task previews, route, status, trust/evidence, telemetry and the current operation when available. `Enter` expands the selected card to show its full task and route, policy and budget, and bounded answer. Long task previews explicitly point to Enter detail. Empty boards offer `/run` or `/delegate` and no selection action. An ordinary sealed completion without validation shows `unverified; no validation observed`; Enter restores the full provenance summary. Unknown or failed trust facts remain visible by default. Completion is not scientific validation.
 
 `/run` and `/delegate` put the worker's answer on screen. Both echo the typed
 line dim above the block, then stream the run into the transcript as an attributed
@@ -364,7 +375,7 @@ or `◇ codex (acp) · run 7hq2ab` for ACP peers), the worker's prose down a rai
 one coalesced line of tool names, and a one-line footer carrying the outcome glyph,
 token count, duration, and contract status (such as `└ ✓ ok · 8.4k tok · 18s · contract unmeasured`),
 with the failure reason printed on the rail above the footer when a run fails.
-Model-launched workers use `◆` and operator-launched workers use `◇`; both follow the same Output style. Standard shows a short reported summary, Detailed adds bounded activity, and Compact keeps identity and outcome. The footer shows the active worker count alongside the main agent's phase. Use `/view transcript` or `/view dispatch:<runId>` for full available details. Memory workers do not appear as transcript blocks. A failover keeps one block with an attempt annotation.
+Model-launched workers use `◆` and operator-launched workers use `◇`; both follow the same Output style. Standard shows a short reported summary, Detailed adds bounded activity labeled `now:` for current work and `last:` for completed calls, and Compact keeps identity and outcome. Pending checkpoint questions remain visible in Compact. The footer shows the active worker count alongside the main agent's phase. Use `/view transcript` or `/view dispatch:<runId>` for full available details. Memory workers do not appear as transcript blocks. A failover keeps one block with an attempt annotation.
 
 That block is the only place a `/run` answer goes. The main agent is not told
 about it, which is what makes a side run a side run; asked about the answer, it
@@ -392,8 +403,8 @@ rather than dropped, because the operator named that run.
 
 `/new` resets the transcript and the pool bare `/share` draws from, so a run
 from the previous session cannot be shared into the new one. Worker tool
-arguments never cross at all: the transcript carries tool names only, the same
-rule the dispatch board follows.
+arguments never cross as raw input: transcript and board activity can show tool
+names and their redacted action descriptors.
 
 Blocks survive a resume. Each attempt writes a `workerRun` session entry naming
 the run, its origin, and its runtime, and `/resume` rebuilds the block from that
@@ -604,6 +615,11 @@ cancel it with `Esc`) and while a permission ask is parked (it is already
 waiting on you). A steer that arrives as the run ends is resubmitted as a fresh
 prompt. Headless `--steer-channel` lines are always next-slot steers.
 
+Explicitly addressed worker steering stays addressed to that worker. A stale,
+completed, ambiguous or unavailable target produces a notice and preserves the
+draft; it does not become a new main-agent prompt. The late-steer resubmission
+above applies to an unaddressed steer for the main agent.
+
 For running dispatches, the editor also accepts:
 
 ```text
@@ -618,7 +634,7 @@ do not accidentally become steering requests.
 The `Alt+W` Fleet Runs board makes this control path discoverable: use
 Up/Down or `j`/`k` to select a run, `s` to close the board and prefill its
 exact `@<runId> ` steering prefix, and `x` to cancel a live worker or queued
-retry. A steer first reports `queued`; only the worker's
+retry. At narrow widths, the footer prioritizes available steer/cancel actions over navigation and detail hints; Enter still expands the selected card. Completed runs offer no steer/cancel actions. A steer first reports `queued`; only the worker's
 `clio_coder_steer_received` acknowledgement reports `received`. Single-shot
 subprocess runtimes and ACP delegation do not expose a live steering channel
 and are labeled accordingly.
@@ -685,7 +701,7 @@ to execute through the existing engine worker path, the sanctioned Claude Code w
 
 | Command | Purpose |
 | --- | --- |
-| `pnpm run ci` | Local and GitHub PR gate: typecheck, lint, library package pin and skill audit checks, build, the deterministic test suite, and the trace-viewer suite. |
+| `pnpm run ci` | Local and GitHub PR gate: typecheck, lint, library package pin and skill audit checks, build, the deterministic test suite, and the web application suite. |
 | `pnpm run ci:release` | Maintainer release gate: `pnpm run ci`, then the `check-release` dist and packaging audit. |
 | `pnpm run typecheck` | Strict TypeScript pass. |
 | `pnpm run lint` | Biome checks plus `scripts/check-hygiene.ts`, which runs the boundary invariants, the library package pin and skill audit checks, and the README and docs drift rules. |
@@ -873,12 +889,12 @@ The footer owns live activity. Transcript actions have static running or outcome
 
 The Clio TUI has been enhanced to maximize readability, operational focus, and command discovery:
 
-- **Welcome header:** Before your first prompt the header is three rows and no box: a masthead (`>C_ Clio Coder v0.4.7` on the left, `~/iowarp/clio-coder · main*` on the right), the route (`✓ dynamo · qwen3.8-27b`), and one next step (`describe a task · Enter to send · / for commands`). The next step names whatever actually blocks work first: no route or model sends you to `/model`, an unavailable or degraded route to `/settings targets`, a missing or stale `CLIO-CODER.md` to `/context init` or `/context refresh`. A healthy route shows no latency; a failing one shows its reason. Your first submit collapses the header to one live row, `>C_ Clio Coder v0.4.7 · dynamo · qwen3.8-27b · ~/iowarp/clio-coder · main*`, which follows a mid-session model change. `/new` returns to the three-row form; `/resume`, `/tree`, `/fork`, `/handoff` and `--continue` open collapsed. See [tui-design.md](../architecture/tui-design.md#51-welcome-launchpad--session-header) for the width-degradation order and route vocabulary.
-- **Unmistakable Clio Composer:** The input editor features an explicit left section tag reflecting current prompt semantics (`MESSAGE` while idle, `FOLLOW-UP` while Clio runs, and orange `STEER` when Enter steers in-flight execution). Includes the dim placeholder `Ask Clio…  / for commands` and lower-rail hint `Enter send · Ctrl+J newline` at wider widths.
-- **Progressively Disclosed Footer:** The compact footer uses a quiet two-zone status layout that suppresses idle decoration (`tools none`, `◌ idle`, and duplicate turn receipts). Line 1 displays workspace location, git branch/dirty state, and active phase only when meaningful; Line 2 displays the context window gauge, current Output style, and session cost. `Alt+U` toggles the expanded dashboard, which orders information by operational urgency (Activity, Context, Session, Workspace).
+- **Welcome header:** Before your first prompt the header is three rows and no box: a masthead (`>C_ Clio Coder v0.4.7` on the left, `~/iowarp/clio-coder · main*` on the right), the route (`✓ dynamo · qwen3.8-27b`), and one next step (`describe a task · Enter to send · / for commands`). The next step names whatever actually blocks work first: no route or model sends you to `/model`, an unavailable or degraded route to `/settings targets`, a missing or stale `CLIO-CODER.md` to `/context init` or `/context refresh`. A healthy route shows no latency; a failing one shows its reason. Your first submit collapses the header to one live row, `>C_ Clio Coder v0.4.7 · dynamo · qwen3.8-27b · ~/iowarp/clio-coder · main*`, which follows a mid-session model change. `/new` returns to the three-row form; `/resume`, `/tree`, `/fork` and `/handoff` collapse it after a successful transition. Interactive resume uses `/resume`; `--continue` is a headless `clio-coder run` option. See [tui-design.md](../architecture/tui-design.md#51-welcome-launchpad--session-header) for the width-degradation order and route vocabulary.
+- **Unmistakable Clio Composer:** The input editor features an explicit left section tag reflecting current prompt semantics (`MESSAGE` while idle, `FOLLOW-UP` while Clio runs, and orange `STEER` when Enter steers in-flight execution). The hydrated composer keeps target/model fields separate until rendering. Narrow labels retain a recognizable family and variant, such as `blade… · qwopus3.…dense-q6 · low`. Includes the dim placeholder `Ask Clio…  / for commands` and lower-rail hint `Enter send · Ctrl+J newline` at wider widths.
+- **Progressively Disclosed Footer:** The compact footer uses a quiet two-zone status layout that suppresses idle decoration (`tools none`, `◌ idle`, and duplicate turn receipts). Line 1 displays workspace location, git branch/dirty state, and active phase only when meaningful, shortening workspace parents and dropping branch decoration before live activity or worker counts; Line 2 displays the context window gauge, current Output style, and session cost. `Alt+U` toggles the expanded dashboard, which orders information by operational urgency (Activity, Context, Session, Workspace).
 - **Footer Notification Degradation Ladder:** The footer notification badge reserves the severity head (`glyph count noun`) and `[Ctrl+G x] dismiss` tail first, allocating remaining width to an ellipsized message body. Under narrow terminal constraints, it degrades cleanly down the ladder without clipping action keys.
 - **Grouped Slash Command Palette:** Typing `/` opens an autocomplete command palette grouped by operational category (`Run`, `Inspect`, `Configure`, `Sessions`) with compact argument hints. Every suggestion is the command's one canonical spelling.
-- **Voice-First Transcript & Receipts:** User (`› `) and assistant (`✦ `) prose are formatted with a two-cell hanging indent, ensuring wrapped continuation lines remain visually tied to their voice prefix. Tool ledgers maintain full terminal width. Completed turn receipts honor output verbosity (`minimal` none, `default` compact dim `turn · in N · out M`, `verbose` full receipt with call counts, cache reads/writes, reasoning provenance, and verification caveats).
+- **Voice-First Transcript & Receipts:** User (`› `) and assistant (`✦ `) prose are formatted with a two-cell hanging indent, ensuring wrapped continuation lines remain visually tied to their voice prefix. Tool ledgers maintain full terminal width. Completed turn receipts honor Output style: Compact omits the separate receipt, Standard shows a small completion line with available duration, and Detailed includes available call counts, token usage and reasoning provenance.
 - **Transactional Settings Center:** Open `/settings` or deep-link to one of
   `chat`, `fleet`, `targets`, `context`, `safety`, `interface`, or
   `integrations`. Value edits construct change plans offering `Apply this
@@ -922,7 +938,7 @@ The detail pane displays structured descriptions, usage, or state metadata using
 ### Responsive Width Adaptation
 
 All TUI overlays fluidly adapt to narrow terminals down to 40 columns:
-- `/view` falls back to one pane on narrow terminals. Type to filter, use Enter to read, Escape to return to the list, and Escape again to close. Ctrl+U clears the filter; long text wraps and scrolls. Tab also switches panes.
+- `/view` falls back to one pane on narrow terminals. Type to filter, use Enter to read, Escape to return to the list, and Escape again to close. Ctrl+U clears the whole query while the filter has focus; long preview text wraps and scrolls. Tab also switches panes.
 - Settings provides a drill-down navigation stack below 72 columns (sections → rows → details) with breadcrumbs and `Esc` backtracking.
 - Text content and detail descriptions wrap cleanly without line truncation.