@iowarp/clio-coder 0.4.9 → 0.5.0

package/docs/guide/commands-and-modes.md

@@ -9,11 +9,20 @@ Source of truth: `src/cli/index.ts`, `src/interactive/slash-commands.ts`,
 `src/domains/dispatch/**`, `src/tools/registry.ts`, and the current test suite.
 For process exit codes, stdout deliverable guarantees, and machine-readable JSON streaming formats, see [exit-codes-and-output.md](exit-codes-and-output.md).
 
+## Demo guidance
+
+Interactive sessions enable capability guidance by default (`interface.demo: true`). During real project work, Clio identifies useful opportunities: a helper can check callers, a skill can guide a workflow, verification can check a change, or project context can preserve findings. She briefly connects the capability to the task, uses it when already appropriate and authorized, or offers a concrete follow-up when it expands the scope. Accepting an offer leads to execution on the current project, not another explanation or a toy demonstration. Declined offers are not repeated; simple answers and failures do not need a pitch. One bounded reminder after three successful source-inspection calls helps the model surface a relevant next step during substantial work. It uses existing tool-result annotations, never forces a tool or starts another model turn, and observes the live setting. Headless runs and workers do not receive this guidance.
+
+Use `clio-coder --no-demo` for a quiet session, `clio-coder --demo` to enable guidance for one session, or **Appearance → Display & keyboard → Demo guidance** in `/settings` or configure to change the saved preference. Session flags do not rewrite settings. Footer tips change live; the persona updates on the next turn. Asking Clio to stop suggestions affects her conversational guidance; the setting controls footer tips too.
+
+The compact footer remains two lines. A small Tip appears for about ten seconds, no more than once a minute, with each topic shown once per session: welcome/help, active agent inspection, tool-result inspection, and context composition above 40% occupancy. Shortcuts use your current bindings, including changes while a tip is visible; an agent tip disappears when no agent is running. Notices, blocked tools, retries, interviews, and expanded dashboards suppress tips. No extra model calls or idle demonstrations are scheduled.
+
 ## CLI Commands
 
 | Command | Purpose |
 | --- | --- |
 | `clio-coder` | Launch the interactive terminal UI. |
+| `clio-coder gui [--open]` | Start the graphical application. Early preview for browsing documentation, inspecting sessions and workspace telemetry; `--open` opens the browser automatically. |
 | `clio-coder run "<task>" [flags]` | Run one headless main-agent turn. Use `--json` for JSONL events. |
 | `clio-coder run "<task>" --agent <id> [flags]` | Dispatch one explicit fleet agent non-interactively and write a receipt. |
 | `clio-coder acp [--cwd PATH] [--permission-timeout MS]` | Serve Clio as an ACP v1 agent over stdio for ACP frontends. |
@@ -24,14 +33,14 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `clio-coder --with-panes` | Activate guest pane integration for this invocation when Clio is inside a reachable herdr session. |
 | `clio-coder --no-panes` | Keep panes off even when settings turn them on. |
 | `clio-coder --autonomy <level>` | Start this interactive session at `read-only`, `suggest`, `auto-edit`, or `full-auto` without modifying `settings.yaml`. Passing `--autonomy` before a subcommand is refused with exit 2 (`clio-coder run --autonomy` remains the headless form). |
-| `clio-coder --no-skills` | Disable skill discovery for one invocation while still honoring explicit `--skill` paths. |
+| `clio-coder --no-skills` | Disable skill discovery for one invocation and automatic skill/marketplace prompt guidance while still honoring explicit `--skill` paths. |
 | `clio-coder --skill <path>` | Load one explicit skill file or directory for one invocation (repeatable). |
 | `clio-coder configure` | Run the configuration wizard. Ctrl+C reports `configuration cancelled`, writes no target, and exits 130; when first-run onboarding is cancelled, startup stops instead of opening the TUI with no usable target. |
 | `clio-coder configure --interop` | Review other coding agents detected on this machine and connect one as a delegation peer. Without a TTY it prints the proposals and writes nothing. |
 | `clio-coder configure --list` | List user-facing runtime ids. |
 | `clio-coder configure --list --all` | List every registered runtime, including aliases. |
 | `clio-coder config [inspect] [--json]` | Print the effective customization graph across settings, context files, rules, skills, prompts, agents, extensions, safety, memory, hooks, and operator profile. |
-| `clio-coder targets [--json] [--probe] [--target <id>]` | List configured targets, health, auth, runtime, model, and capabilities. |
+| `clio-coder targets [--json] [--probe [--reasoning] [--tools]] [--target <id>]` | List targets and metadata; `--reasoning` and `--tools` explicitly generate qualification requests. |
 | `clio-coder targets add` | Add a target interactively or through configure flags. |
 | `clio-coder targets use <id> [--model <id>] [--orchestrator-model <id>] [--background-model <id>] [--fleet-target <id>] [--fleet-model <id>]` | Select the named roles only when any role flag is present. `--background-model` selects memory; `--orchestrator-model` selects chat; `--fleet-model` or `--fleet-target` selects fleet. Other roles and thinking levels are preserved. Without role flags, chat and fleet use the target default (or shared `--model`), while memory is preserved. Confirmation names only roles whose settings changed. Model IDs must match a nonempty discovered or cached inventory exactly; unavailable discovery is reported explicitly. |
 | `clio-coder targets fleet [--json]` | List the configured fleet profiles with their target, runtime, model, and thinking level. `targets workers` is an accepted alias. |
@@ -45,7 +54,7 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `clio-coder auth status [target-or-runtime]` | Inspect auth state. |
 | `clio-coder auth login [target-or-runtime] [--api-key <value>]` | Add credentials through the supported flow. |
 | `clio-coder auth logout [target-or-runtime]` | Remove stored credentials. |
-| `clio-coder doctor [--fix] [--json]` | Diagnose state. Plain `doctor` is read-only and leaves even a partially initialized home byte-for-byte untouched. With `--fix`, create missing structure and templates, repair credential permissions, refresh install metadata, and record fleet preflight results. Settings remain strict; lifecycle migrations belong to `upgrade`, not `doctor --fix`. |
+| `clio-coder doctor [--fix] [--json] [--deep [--tools-timeout <seconds>]]` | Diagnose state. Plain `doctor` is read-only and leaves even a partially initialized home byte-for-byte untouched. With `--fix`, create missing structure and templates, repair credential permissions, refresh install metadata, and record fleet preflight results. Settings remain strict; lifecycle migrations belong to `upgrade`, not `doctor --fix`. `--deep` adds a live tool-call probe per target and a dry run of the validation contract. See [Doctor](doctor.md). |
 | `clio-coder mcp list\|trust\|untrust` | List configured MCP servers or manage explicit project trust with `trust <id> [--action-class read\|execute\|unknown]` and `untrust <id>`. |
 | `clio-coder tools list [--json]` | List the pinned external tool registry and whether each program resolves from `PATH`, Clio's vendored data directory, or nowhere. |
 | `clio-coder tools status <id> [--json] [--reset-profile]` | Inspect one registered tool. `--reset-profile` applies only to yazi's generated profile. |
@@ -69,7 +78,7 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `clio-coder eval validate\|run\|report\|compare\|gate` | Validate, run, report, compare, and gate local evaluation suites (Suite v2). |
 | `clio-coder memory list\|propose\|promote\|approve\|reject\|prune` | Manage scoped, evidence-linked memory records. |
 | `clio-coder trace runs [--db PATH] [--limit N] [--json]` | List runs recorded in the durable trace mirror beside the ledger. |
-| `clio-coder trace inspect --json` | Emit the fixed, bounded recent accounting projection used by the Workbench. It accepts no path, identifier, or limit and omits request text, error prose, event payloads, process commands, PIDs, and hosts. |
+| `clio-coder trace inspect --json` | Emit the fixed, bounded recent accounting projection used by the graphical application. It accepts no path, identifier, or limit and omits request text, error prose, event payloads, process commands, PIDs, and hosts. |
 | `clio-coder trace phases <runId> [--db PATH]` | Show one run's recorded phases. |
 | `clio-coder trace tail <runId> [--follow] [--db PATH]` | Tail one run's recorded events; `--follow` streams as they land. |
 | `clio-coder trace procs <runId> [--db PATH]` | Show the processes one run spawned. |
@@ -79,7 +88,7 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `clio-coder dev evolve manifest init\|validate\|summarize` | Create and check typed harness change manifests. |
 | `clio-coder extensions list\|discover\|install\|enable\|disable\|remove` | Manage installed extension packages and resource roots. `clio-coder ext` is an accepted alias. |
 | `clio-coder library list\|search\|register\|inspect\|validate\|install\|update\|enable\|disable\|drift\|pin\|remove` | Manage packages of kind plugin, skill, agent, prompt or fleet at user/project scope; `install/update --dry-run` preview. `library skills` lists runtime skills; `library inventory --json` is the fixed GUI read. |
-| `clio-coder docs [topic] [--no-open]` | Open the documentation in the web app, rendered directly from the canonical Markdown. Reuse the configured background app or start a foreground loopback server; `--no-open` prints its launch link. |
+| `clio-coder docs [topic] [--no-open] [--foreground]`, `clio-coder docs --stop` | Open the documentation in your browser, rendered directly from the canonical Markdown. Use the installed background app when there is one. Otherwise start a loopback server in the background, reuse it on the next call, and stop it with `--stop` or after 15 minutes without an open page. `--no-open` prints the launch link. `--foreground` serves privately in this terminal until Ctrl+C. |
 | `clio-coder usage report [--repo <path>] [--days <n>] [--json]` | Cross-session usage facts from session/run ledgers and retained out-of-turn calls, including known failed-compaction spending and missing coverage. The window defaults to 30 days and the JSON schema is marked experimental. |
 | `clio-coder dev share export --out <path> [--project\|--user\|--both] [--context] [--prompts] [--skills] [--settings] [--extensions]` | Export project context, prompts, skills, settings fragments, and extension bundles. |
 | `clio-coder dev share import <path> [--dry-run] [--force] [--project\|--user] [--json]` | Import a share archive with conflict reporting. |
@@ -99,6 +108,7 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 
 | Flag | Meaning |
 | --- | --- |
+| `--cwd <dir>` | Enter `<dir>` before the run resolves anything against the working directory, the way `acp --cwd` does. Applies to the main agent and to `--agent`. See [Headless Working Directory](#headless-working-directory). |
 | `--target <id>` | One-run main-agent or dispatch target override. |
 | `--model <wireId>` | One-run model override. |
 | `--thinking <level>` | One-run thinking level: `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, or `max`. |
@@ -110,9 +120,14 @@ For process exit codes, stdout deliverable guarantees, and machine-readable JSON
 | `--json-events <mode>` | Main-agent JSON stream mode: `full` or `terminal`; implies `--json`. |
 | `--session <id>` | Append this turn to an existing session identified by `<id>`. |
 | `--continue` | Append this turn to the most recent session for the current working directory. |
+| `--fail-on-noop` | Exit 1 when the main-agent run was a no-op, and seal its receipt as `failed` with `outcomeDetail: "noop"`. Main agent only; with `--agent` it is a usage error. See [Headless No-op Runs](#headless-no-op-runs). |
+| `--timeout <seconds>` | Wall-clock limit for the whole main-agent run, boot included. On expiry the run starts the coordinated shutdown a SIGTERM starts, seals its receipt with outcome `timed_out`, and exits 124. A positive number of seconds; anything else is a usage error. Main agent only; with `--agent` it is a usage error. |
 | `--agent <recipe-id>` | Dispatch a fleet agent instead of the main agent. Unknown ids fail fast. |
 | `--skill <path>` | Load one explicit skill file or skill directory for this run. Repeatable. |
-| `--no-skills` | Disable skill discovery for this run while still honoring explicit `--skill` paths. |
+| `--no-skills` | Disable skill discovery for this run and automatic skill/marketplace prompt guidance while still honoring explicit `--skill` paths. |
+| `--turn-mode <mode>` | Main-agent workflow guidance (`answer`, `proposal`, `change`). Guides prompt and turn continuation (`answer` and `proposal` disable autonomous continuation turns; `proposal` renders `tasks` `plan`/`add` as blocked proposals). Not an authorization grant: mutating tools (`write`, `edit`) are not denied by `mode` alone; enforcement requires `--allow-tools` or `--autonomy read-only`. See [Turn Constraints](#turn-constraints). |
+| `--no-delegate` | Forbid worker delegation (`dispatch`) for this run; the agent must work directly. |
+| `--allow-tools <names\|none>` | Comma-separated allowlist of capability names permitted for this turn, or `none` to disable all tools. Enforces mechanical restriction at admission and runtime. |
 | `--agent-profile <name>` | Use a named fleet profile for dispatch. |
 | `--agent-runtime <id>` | Pick the first fleet profile whose target uses this runtime. |
 | `--tool-profile <name>` | Restrict dispatched-agent tools: `minimal-local`, `science-local`, or `full-agent`. |
@@ -132,6 +147,40 @@ unimplemented rung that resolves to no panes, prints a refusal during boot, and
 is labelled `NOT IMPLEMENTED` in Settings. Use `auto` or `--with-panes` only
 when Clio is already inside a reachable herdr session.
 
+### Headless Working Directory
+
+`clio-coder run --cwd <dir> "<task>"` behaves the same as `cd <dir> && clio-coder run "<task>"`. The process enters `<dir>` before it reads layered project settings, context files, skills, `@file` references, or the session ledger, and every tool path resolves against it. Relative paths in other arguments, such as `--skill`, `--steer-channel`, and `@file`, resolve against `<dir>` as well. The path is canonicalized first, so the run ledger records the physical directory as the run's `cwd`.
+
+- A missing path, a file, or a directory the process cannot enter fails with exit code 2 and a message naming the resolved path. No model is called.
+- `--cwd` with no value is a usage error with exit code 2.
+- An orchestrator that runs Clio inside a git worktree can pass the worktree path here instead of changing its own working directory before the spawn.
+- `CLIO_CODER_HOME`, `CLIO_CODER_CONFIG_DIR`, `CLIO_CODER_DATA_DIR`, `CLIO_CODER_STATE_DIR`, and `CLIO_CODER_CACHE_DIR` are read as given and are not resolved before the process enters `<dir>`. A relative value therefore points under `<dir>`, not under the directory the driver spawned from. A driver that sets any of them together with `--cwd` must pass absolute paths.
+
+### Headless No-op Runs
+
+Every headless main-agent receipt carries a `safety` summary and a `noop` flag, whatever the flags. `safety.decisions` counts how admission decided each call (`allowed`, `blocked`, `permissionRequested`) and `safety.blockedAttempts` lists every call whose outcome was blocked, with its tool, action class, rule, and reason. These are the names and shapes a dispatched worker's receipt already uses. A call that parked for approval and was denied, because a headless run has no operator to approve it, counts under `permissionRequested` every time, including a repeat whose reason the loop guard replaced with its own guidance.
+
+`safety.blockedAttempts` keeps the first 50 blocked calls, and clips each reason to 500 characters. When more calls than that were blocked, `safety.blockedAttemptsTruncated` counts the ones left out; the field is absent otherwise. The per-tool `blocked` counts in `toolStats` stay exact either way.
+
+`noop` is true when either condition holds:
+
+- at least one block remains unresolved and no mutating call succeeded, or
+- the run called tools and none of them succeeded.
+
+A mutating call is one the tool registry admitted with action class `write`, the class autonomy `auto-edit` runs without asking: `write`, `edit`, and an outward `web_fetch`. A terminating result does not count. The `artifact` tool's plan, review, or report is the turn's answer written to a file, so a run whose every edit was blocked and that then wrote a report about it is still a no-op. A successful `bash` call does not count, because its `execute` class says that a command ran, not that it wrote. A run that called no tool and answered in prose is not a no-op.
+
+A later successful substantive read or command can recover a block of the same
+action class. Bookkeeping, discovery, and terminal reports do not count as that
+recovery. A successful dispatch is not counted as the main agent's write; inspect
+worker receipts when assessing delegated changes.
+
+An unresolved block with no successful write exits 1 and seals `failed` with
+`outcomeDetail: "noop"`, even without `--fail-on-noop`. A successful `limitation`
+call likewise records failure with detail `limitation`. The flag additionally
+fails runs whose attempted tools all failed without a block. Existing errors,
+interruptions, and timeouts retain their outcomes. The model's final prose is
+still available; a normal provider stop alone does not prove task completion.
+
 ### Headless Session Continuity
 
 A headless turn (`clio-coder run`) starts a fresh session unless `--session <id>` or `--continue` specifies a session to append to.
@@ -161,6 +210,17 @@ clio-coder run \
   --model qwen3.8-27b
 ```
 
+### Turn Constraints
+
+Headless runs can explicitly constrain one submitted turn and its continuations using host-enforced bounds (`src/core/turn-constraints.ts`). Turn constraints are never guessed from natural language or derived from model-generated arguments; they can only narrow existing safety, skill, and recipe policies.
+
+- **Workflow mode (`--turn-mode <mode>`):** Selects workflow guidance (`answer` | `proposal` | `change`). Mode guides system prompt rendering and turn continuation discipline (`turnAllowsContinuation` disables autonomous continuation turns for both `answer` and `proposal`). Under `proposal`, tasks board `plan` and `add` actions automatically record `initialStatus: "blocked"` with a note awaiting operator authorization. **Important:** `mode` is prompt and workflow guidance, not an authorization boundary. `turnAllowsTool` ignores mode entirely; mutating tools such as `write` or `edit` are *not* denied by `--turn-mode proposal` alone. To mechanically enforce read-only execution or restrict modifications, pass an explicit capability allowlist (`--allow-tools read,grep,find,ls`) or set `--autonomy read-only` / `suggest`.
+- **Worker delegation (`--no-delegate`):** Sets `delegation: "forbidden"`. `turnAllowsTool` mechanically denies the `dispatch` tool, and prompt compilation instructs the model to work directly without spawning workers.
+- **Capability allowlist (`--allow-tools <names|none>`):** Restricts executable tools to an explicit comma-separated list of capability names, or disables all tools when passed `none`. Mechanically enforced by `turnAllowsTool` and tool execution admission. Naming a secondary capability (such as `data` or `clio_docs`) automatically admits its gateway transport wrapper, while naming `gateway` alone never admits every capability behind it.
+- **Skill discovery suppression (`--no-skills`):** Suppresses automatic skill discovery from catalog roots and marketplace guidance while still honoring explicitly specified skill paths (such as `--skill <path>`). Programmatic turn constraints can also set `skills: "disabled"`, which mechanically rejects `context(scope="skills")` calls at the tool boundary.
+
+In prompt generation, turn constraints render as the final `# Current task scope` section of the system prompt (`src/domains/prompts/compiler.ts`). Because they appear after identity, role, context, and memory, adjusting turn constraints between turns preserves the preceding `stablePrefix` for models with prefix caching.
+
 ## Interactive Slash Commands
 
 Slash commands are available inside the TUI. Type `/` at the start of the prompt to open the grouped command palette autocomplete.
@@ -191,7 +251,8 @@ The registry table below lists the available interactive slash commands. On a ba
 | `/council` | `/council [--roster <name>] [--rounds <n>] [--synthesis <judge\|vote\|none>] <task>` | Ask a roster of read-only members the same task, with an optional vote or judge synthesis |
 | `/agents` | `/agents` | Open the Library on Agents. |
 | `/cost` | `/cost` | Show session token and cost totals |
-| `/context` | `/context compact [instructions] \| /context recall <ref> \| /context init \| /context refresh \| /context reset` | Context hub: window overlay plus compact, recall, init, refresh, and reset |
+| `/doctor` | `/doctor [deep]` | Show a diagnostic report with errors and warnings first and full wrapped check details; `deep` adds live tool probes on the session's targets and a validation-contract dry run at the session's autonomy. See [Doctor](doctor.md). |
+| `/context` | `/context compact [instructions] \| /context recall <ref> \| /context init [--preview] [--heuristic] [--adopt] [--global] [--propose\|--apply\|--rewrite] \| /context refresh \| /context reset` | Context hub: window overlay plus compact, recall, init, refresh, and reset |
 | `/fleet` | `/fleet [run [--var <key=value>] <name>]` | Open Fleet Runs, or run a fleet contract with an approval preview. Configure fleets with `/settings fleet`. |
 | `/decisions` | `/decisions` | Show settled interview decisions and operator revisions |
 | `/tasks` | `/tasks add [--expect <path>] [--verify <checkId>[:timeoutMs]] <text> \| /tasks hand <id> \| /tasks done <id> \| /tasks drop <id>` | Show the session board or manage project operator tasks |
@@ -199,7 +260,7 @@ The registry table below lists the available interactive slash commands. On a ba
 | `/view` | `/view [filter] \| /view verify <runId>` | Browse session artifacts and verify receipts |
 | `/panes` | `/panes show <run-or-agent> \| /panes open <preset-or-argv> \| /panes zoom [target] \| /panes close [target]` | Inspect the pane layer, watch a live run in a pane, or open a utility pane (`files`, `logs`, `shell`, `files --once`, or a command); a second open focuses the pane already there |
 | `/files` | `/files [open\|close\|pick]` | Toggle the files pane docked below the session; picks land in the composer as `@` mentions. See [Panes and the Files Pane](panes-and-files.md) |
-| `/thinking` | `/thinking [level]` | Set the chat thinking level, or open Settings → Orchestrator |
+| `/thinking` | `/thinking [level]` | Set the chat thinking level; bare `/thinking` opens a picker of the levels this route supports |
 | `/model` | `/model [pattern]` | Open model selector or set a model |
 | `/settings` | `/settings [chat\|fleet\|targets\|context\|safety\|interface\|integrations] [group]` | Open interactive settings, optionally at a durable area and UI group |
 | `/resume` | `/resume` | Resume a past session |
@@ -209,19 +270,29 @@ The registry table below lists the available interactive slash commands. On a ba
 | `/fork` | `/fork` | Fork from an assistant turn |
 | `/export` | `/export [path]` | Export a self-contained HTML transcript by default; a `.md` path writes Markdown |
 
+### Notes on individual commands
+
+The notes below explain commands whose behavior needs more than a usage line.
+
 Operator tasks are durable project work in `.clio-coder/user-tasks.json`. Use
 `clio-coder tasks add "Fix the solver" --expect src/solver.ts --verify test:solver:60000`
 or `/tasks add Fix the solver --expect src/solver.ts --verify test:solver:60000`.
-Both `--expect <path>` and `--verify <checkId>[:timeoutMs]` are repeatable. Expected
-outputs use repository-relative paths; verification ids must exist in the project
-verifier catalog or package scripts when added. An omitted timeout uses the
-check's declared timeout, and requested timeouts are bounded as in dispatch
-intent. If a complete value matches a declared id containing colons, it names
-that check; otherwise the final numeric suffix is the timeout. Acceptance travels
-with the task when handed and picked, and seeds the board's required validation
-evidence. Under high rigor, a turn that changes files while this task is active
-must record a passing validation receipt for every named check or a successful
-`limitation` receipt whose `paths` array includes the exact check id. A task's
+Both `--expect <path>` and `--verify <checkId>[:timeoutMs]` are repeatable.
+Expected outputs use repository-relative paths, and verification ids must exist
+in the project verifier catalog or package scripts when added.
+
+An omitted timeout uses the check's declared timeout, and requested timeouts are
+bounded as in dispatch intent. If a complete value matches a declared id
+containing colons, it names that check; otherwise the final numeric suffix is the
+timeout.
+
+Acceptance travels with the task when handed and picked, and seeds the board's
+required validation evidence. Under high rigor, a turn that changes files while
+this task is active must record a passing validation receipt for every named
+check or a successful `limitation` receipt whose `paths` array includes the exact
+check id.
+
+A task's
 completion note alone does not satisfy acceptance. `clio-coder tasks list`,
 `hand <uN>`, `done <uN>`, and `drop <uN>` manage the same inbox as `/tasks`.
 
@@ -236,19 +307,20 @@ Library discovery notices have their own searchable `n` view and independent cou
 Workspace output rows show their basename before the relative path. In View preview, press `i` for scrollable provenance with the full backing path and available session/run/correlation identities; press `i` again for content. This toggle resets the pane's scroll position. `o` reports the backing path, and `v` verifies resources that support verification. Enter or Tab opens a selected preview; Esc returns to the list, then closes. Empty results keep focus in the list. View's literal search is separate from the shared ListOverlay fuzzy search described below.
 
 `/context` with no arguments opens the context-window ledger overlay, including
-the working-set section (policy, evicted items and tokens, events, recalls, churn).
-The subcommands own the durable project-context noun: `compact` summarizes older
-turns in the session window, `recall <ref>` prints an evicted tool-result body
-back into the transcript by the ref its `[evicted ...]` marker names (it never
-enters model context; the model recalls with `context(scope="recall", ref=...)`),
-`init` bootstraps or updates `CLIO-CODER.md` and the
-codewiki, `refresh` re-indexes the codewiki and refreshes `.clio-coder/state.json`
-without touching `CLIO-CODER.md`, and `reset` deletes accumulated
-context artifacts (`.clio-coder/codewiki.json`, `.clio-coder/state.json`,
-`.clio-coder/handoffs/`, `.clio-coder/proposals/`). Its interactive choice preserves or
-deletes `CLIO-CODER.md`; cancellation makes no changes. Session reset stays `/new`;
-there is deliberately no `/context clear`. The spellings `/context-init`,
-`/context-clear`, and `/context-view` are gone and are not aliased to anything.
+the working-set section (policy, evicted items and tokens, events, recalls,
+churn). Its subcommands own the durable project-context noun:
+
+| Subcommand | Effect |
+| --- | --- |
+| `compact` | Summarizes older turns in the session window. |
+| `recall <ref>` | Prints an evicted tool-result body back into the transcript by the ref its `[evicted ...]` marker names. It never enters model context; the model recalls with `context(scope="recall", ref=...)`. |
+| `init` | Bootstraps or updates `CLIO-CODER.md` and the codewiki. |
+| `refresh` | Re-indexes the codewiki and refreshes `.clio-coder/state.json` without touching `CLIO-CODER.md`. |
+| `reset` | Deletes accumulated context artifacts (`.clio-coder/codewiki.json`, `.clio-coder/state.json`, `.clio-coder/handoffs/`, `.clio-coder/proposals/`). Its interactive choice preserves or deletes `CLIO-CODER.md`; cancellation makes no changes. |
+
+Session reset stays `/new`; there is deliberately no `/context clear`. The
+spellings `/context-init`, `/context-clear`, and `/context-view` are gone and are
+not aliased to anything.
 There are no slash-command aliases. `/context compact`, `/quit`, `/model`,
 `/settings`, and `/skill <name>` are their only spellings. Retired or foreign
 spellings stay errors that name `/help` instead of guessing which operation the
@@ -331,18 +403,23 @@ wrong by the time it was read.
 The `/resume` picker accepts Page Up and Page Down to move by its 12 visible rows. Arrow keys continue to move one session at a time, and typing continues to filter the list. Task identity occupies the primary column, with the session name or ID as a fallback; metadata yields as the terminal narrows. Filtering preserves the selected session when it still matches, and undo from an empty result restores that selection. Confirmation resumes the visibly selected session, including with customized list bindings.
 
 Only active commands run. Typing anything command-shaped that the registry does
-not own checks the loaded prompt templates across native and foreign prompt roots.
-Built-in command names are reserved across interactive and headless modes; a
+not own checks the loaded prompt templates across native and foreign prompt
+roots.
+
+If the token names neither a command nor a template, it reports
+`is not a command` and points at `/help`. It is never sent to the model. That
+covers spellings removed outright, such as `/status` and `/receipts`, as well as
+ordinary typos. It replaces the earlier behavior where an unrecognized spelling
+reached the model as prose and was answered conversationally, which left the
+operator believing a command had run when nothing had.
+
+Built-in command names are reserved across interactive and headless modes. A
 template with the same basename is omitted from `/prompts` with a collision
-diagnostic instead of shadowing a command on one surface and expanding on another.
-If a matching template is found in an untrusted project root, Clio prints that the
-prompt template comes from an untrusted project root and directs the operator to set
-`integrations.projectResources.trustProjectImports`, sending nothing to the model. If the token names
-neither a command nor a template, it reports `is not a command` and points at `/help`;
-it is never sent to the model. That covers spellings removed outright, such as
-`/status` and `/receipts`, as well as ordinary typos. It replaces the earlier
-behavior where an unrecognized spelling reached the model as prose and was answered
-conversationally, which left the operator believing a command had run when nothing had.
+diagnostic instead of shadowing a command on one surface and expanding on
+another. A matching template discovered in another agent's folder makes Clio
+direct the operator to import it explicitly first; imported foreign templates
+additionally require `integrations.projectResources.trustProjectImports`, and
+blocked templates send nothing to the model.
 
 A headless `clio-coder run "/typo"` refuses the same way. The verdict is reached
 before boot, so no session is opened and no turn is spent; the diagnostic names
@@ -364,34 +441,59 @@ The accepted spelling of every command is the table under [Interactive Slash Com
 
 Configuration lives in one place: the `/settings` overlay. `/settings <section>` reaches every section directly. `/thinking <level>` and `/model <pattern>` stay as quick setters that apply without opening anything.
 
-Settings → Targets presents an operational console table (`HEALTH`, `ID`, `ROLES`, `RUNTIME`, `LATENCY`) with an in-place action/detail drawer for URL, default model, last probe error, and reachability. `Enter` opens actions for `Use` (switches active chat target and rebases model), `Connect` (runs the API-key or OAuth flow then probes), `Probe`, and `Remove` (with preflight analysis of affected routes/profiles). Probing runs live when the overlay opens or when explicitly requested. Target creation is initiated via `clio-coder targets add`.
+Settings → Connections presents an operational console table (`HEALTH`, `ID`, `ROLES`, `RUNTIME`, `LATENCY`) with an in-place action/detail drawer for URL, default model, last probe error, and reachability. `Enter` opens actions for `Use` (switches active chat target and rebases model), `Connect` (runs the API-key or OAuth flow then probes), `Probe`, and `Remove` (with preflight analysis of affected routes/profiles). Probing runs live when the overlay opens or when explicitly requested. Target creation is initiated via `clio-coder targets add`.
+
+Settings → Fleet is an entity workbench organized with dim group headers (`Defaults`, `Profiles`, `Agent routes`, `Placement`). Dispatched worker defaults and profile rows render as compact summaries (`fast-local node-a/example-coder-model  high  auto`), drilling into fields (`target`, `model`, `thinkingLevel`, `node`) on `Enter`. Profile removal is a named destructive action with affected-route preflight.
+
+Running and retrying dispatches live in the `/fleet` or `Alt+W` Fleet Runs board. Its default cards show task previews, route, status, trust/evidence, telemetry and the current operation when available. `Enter` expands the selected card to show its full task and route, policy and budget, and bounded answer. Long task previews explicitly point to Enter detail. Empty boards offer `/run` or `/delegate` and no selection action.
 
-Settings → Fleet is an entity workbench organized with dim group headers (`Defaults`, `Profiles`, `Agent routes`, `Placement`). Dispatched worker defaults and profile rows render as compact summaries (`fast-local node-a/example-coder-model  high  auto`), drilling into fields (`target`, `model`, `thinkingLevel`, `node`) on `Enter`. Profile removal is a named destructive action with affected-route preflight. Running and retrying dispatches live in the `/fleet` or `Alt+W` Fleet Runs board. Its default cards show task previews, route, status, trust/evidence, telemetry and the current operation when available. `Enter` expands the selected card to show its full task and route, policy and budget, and bounded answer. Long task previews explicitly point to Enter detail. Empty boards offer `/run` or `/delegate` and no selection action. An ordinary sealed completion without validation shows `unverified; no validation observed`; Enter restores the full provenance summary. Unknown or failed trust facts remain visible by default. Completion is not scientific validation.
+An ordinary sealed completion without validation shows `unverified; no validation observed`, and `Enter` restores the full provenance summary. Unknown or failed trust facts remain visible by default. Completion is not scientific validation.
 
 `/run` and `/delegate` put the worker's answer on screen. Both echo the typed
-line dim above the block, then stream the run into the transcript as an attributed
-block: a header (`◇ coder · node-a/example-coder-model · run 2mkas6s` for fleet workers,
-or `◇ codex (acp) · run 7hq2ab` for ACP peers), the worker's prose down a rail,
-one coalesced line of tool names, and a one-line footer carrying the outcome glyph,
-token count, duration, and contract status (such as `└ ✓ ok · 8.4k tok · 18s · contract unmeasured`),
-with the failure reason printed on the rail above the footer when a run fails.
-Model-launched workers use `◆` and operator-launched workers use `◇`; both follow the same Output style. Standard shows a short reported summary, Detailed adds bounded activity labeled `now:` for current work and `last:` for completed calls, and Compact keeps identity and outcome. Pending checkpoint questions remain visible in Compact. The footer shows the active worker count alongside the main agent's phase. Use `/view transcript` or `/view dispatch:<runId>` for full available details. Memory workers do not appear as transcript blocks. A failover keeps one block with an attempt annotation.
+line dim above the block, then stream the run into the transcript as an
+attributed block: a header (`◇ coder · node-a/example-coder-model · run 2mkas6s`
+for fleet workers, or `◇ codex (acp) · run 7hq2ab` for ACP peers), the worker's
+prose down a rail, one coalesced line of tool names, and a one-line footer
+carrying the outcome glyph, token count, duration, and contract status, such as
+`└ ✓ ok · 8.4k tok · 18s · contract unmeasured`. A failure reason prints on the
+rail above the footer.
+
+Model-launched workers use `◆` and operator-launched workers use `◇`. Both follow
+the same Output style: Standard shows a short reported summary, Detailed adds
+bounded activity labeled `now:` for current work and `last:` for completed calls,
+and Compact keeps identity and outcome. Pending checkpoint questions remain
+visible in Compact.
+
+The footer shows the active worker count alongside the main agent's phase. Use
+`/view transcript` or `/view dispatch:<runId>` for full available details. Memory
+workers do not appear as transcript blocks, and a failover keeps one block with
+an attempt annotation.
 
 That block is the only place a `/run` answer goes. The main agent is not told
 about it, which is what makes a side run a side run; asked about the answer, it
-will say it has not seen one. `--share` on either command hands the result over
-when the run finishes, and `/share [runId]` does it afterwards for a run already
-on screen. Bare `/share` takes the newest finished run the operator started
-themselves (never a model-asked `◆` run), while `/share <runId>` may name a
-model-asked run explicitly. What crosses is the receipt's own bounded text under a
+will say it has not seen one.
+
+To hand the answer to the main agent, use `--share` on either command to pass it
+over when the run finishes, or `/share [runId]` afterwards for a run already on
+screen. Bare `/share` takes the newest finished run the operator started
+themselves and never a model-asked `◆` run; `/share <runId>` may name a
+model-asked run explicitly.
+
+<details>
+<summary>How a shared result enters the session, and why the model does not discard it</summary>
+
+What crosses is the receipt's own bounded text under a
 `[worker result] coder · run 2mkas6s · ok · shared by the operator` header,
 entering the session through the ordinary user-turn path so replay and
-compaction treat it as operator text. The header names the operator as the
-origin, and the system prompt tells the main agent that such a note is
-operator steering whose run id names a receipt it can read, so a model that
-never dispatched the run does not discard it as unattributed output. A turn
-that only relays a shared note does not trip the unbacked-worker-claim
-advisory.
+compaction treat it as operator text.
+
+The header names the operator as the origin, and the system prompt tells the main
+agent that such a note is operator steering whose run id names a receipt it can
+read, so a model that never dispatched the run does not discard it as
+unattributed output. A turn that only relays a shared note does not trip the
+unbacked-worker-claim advisory.
+
+</details>
 A council run shares as a council. `/share <synthesis runId>` brings the whole
 `council-report` in as one bounded block: every final-round member's answer under
 its roster label, each with its verdict when it declared one, then the synthesis
@@ -433,6 +535,39 @@ from the active branch. It retains settled and superseded values from
 operator supersede a decision or enter a correction. A correction is submitted
 to the model as an ordinary operator turn after the durable snapshot changes.
 
+The compact footer stays at two rows: current work, target/model, thinking and context
+occupancy, then shortcut hints with throughput and the dashboard shortcut. Normal
+editor rails have no MESSAGE/FOLLOW-UP labels, model labels, or send/newline hints.
+Footer shortcuts rotate every twelve seconds through small groups of currently bound
+composer actions, including send/newline, model/thinking controls, queues and navigation.
+They respect remapped and disabled bindings and remain available with Demo guidance off.
+Notices and contextual Demo tips take priority over shortcut reminders; parked permission
+controls remain visible on the editor rail. The workspace path and Git branch return between hint cycles. Neon teal is
+reserved for the editor rails; dashboard accents, tool colors, and agent colors
+use a quieter intensity tier.
+
+`Alt+U` cycles Activity, Context, Status, then closes the dashboard. Expanded pages
+share one-quarter of the available viewport (minimum eight rows), with padding
+that keeps the composer anchored across page changes. Activity shows current
+worker progress; finished runs collapse into invocation history. Context shares
+its category palette and occupancy grid with `/context`, plus cache and compaction
+telemetry when available. Status pairs Cost & Connections with Local Machine:
+tracked cost and the configured Clio spending ceiling, provider quota availability,
+ready MCP client IDs, active plugin packages, extension counts, and worker/tool
+activity. Provider quotas are explicitly unreported until supplied by a provider;
+the Clio ceiling is not a provider account balance.
+
+The local sampler updates every two seconds without subprocesses or inference-server
+requests. CPU/RAM and Clio process RSS use OS counters. On Linux, network and disk
+rates come from kernel counters; each shows the busiest interface or whole disk,
+not a potentially double-counted total. Supported GPU drivers expose utilization
+and VRAM through sysfs. Missing counters stay unavailable; WSL measurements are
+labeled as guest measurements and do not describe the Windows host or remote GPU.
+Counter resets wait for a fresh baseline instead of showing negative rates. Memory
+bank and context-engine activity remain visible. `/cost`, `/mcp`, `/library`, `/context`, and
+Fleet Runs retain deeper inspection. Narrow or short terminals explicitly indicate
+when detail does not fit.
+
 The read-only `/memory` overlay keeps durable and session memory attributable
 in one place. It lists approved evidence-backed lessons, then the live task
 bank by private status, knowledge, and procedural class, including each
@@ -478,7 +613,7 @@ cancels the underlying owner. The menu does not search as you type.
 | `Alt+L` | Toggle top-level Library | `l` |
 | `Alt+M` | Toggle model picker | `m` |
 | `Alt+O` | Cycle Compact, Standard, Detailed output | `o` |
-| `Alt+U` | Toggle dashboard | `u` |
+| `Alt+U` | Cycle dashboard: Activity → Context → Status → closed | `u` |
 | `Alt+W` | Toggle Workers | `w` |
 | `Alt+E` | Toggle files from Clio focus | `e` |
 | `Shift+Tab` | Cycle supported thinking effort | `t` |
@@ -641,13 +776,15 @@ and are labeled accordingly.
 
 ## Operating Posture and Autonomy
 
-Clio Coder operates with a single, unified tool surface. There are no separate tool-visibility modes; what varies is the `autonomy` level (`read-only` | `suggest` | `auto-edit` | `full-auto`), edited in the `/settings` Autonomy & Safety section.
+Clio Coder operates with a single, unified tool surface. There are no separate tool-visibility modes; what varies is the `autonomy` level (`read-only` | `suggest` | `auto-edit` | `full-auto`), edited in the `/settings` Permissions & Limits section.
 
 Tool and command execution is governed by:
 - **Target Capabilities:** What the selected model target actually supports (such as tools, streaming, and vision).
 - **Safety Net:** Granular rule packs loaded from `damage-control-rules.yaml`, project policies, and protected artifact paths; always on, identical at every autonomy level.
 - **Autonomy Mapping:** Once the net passes a call, the level decides whether it runs, asks, or is denied. See [safety-model.md](../architecture/safety-model.md) for the full matrix.
 
+At `auto-edit` a recognized command runs without asking. Recognized commands include the repository test runners such as `npm test`, `pytest`, `python -m unittest`, `ctest`, and `make check`, which execute repository code. The full list is in [tool-usage.md](tool-usage.md#bash-run-a-shell-command).
+
 When an action asks for confirmation, whether from a safety-net rail or from the autonomy level, the call parks and three surfaces say so at once. The transcript row reads `⏸ awaiting approval` with `action ·`, `axis ·`, and `target ·` lines under it; the footer phase pill reads `⏸ confirm`; and a consequence-tier dialog opens with the tool, target, action, authenticated requester, one-shot authority, reversibility, and deny and stop effects. Titles distinguish workspace authority, outward consequences, safety-net confirmation, system changes, and worker escalations. The dialog sits at bottom center with five rows reserved for the composer and footer, and it re-anchors on resize. The composer rail switches to `CONFIRM` and repeats the keys while the prompt owns the keyboard.
 
 The keys are the same on both surfaces: `Enter` allows this one call, `Esc` denies it, and `s` denies it and stops the turn so nothing asks again. `Enter` allows only from an empty composer. While the composer holds a draft, the habitual send key does nothing, the rail and the dialog footer read `[Backspace] clear draft` instead of `[Enter] allow`, and only the deletion keys (`Backspace`, `Delete`, `Ctrl+U`, `Ctrl+W`, `Ctrl+K`) reach the editor until the draft is gone. Every other key is swallowed. A call that parks while another overlay holds the screen is announced with an `[approval]` notice and the dialog opens as soon as that overlay closes; the dialog lays itself out for any terminal width, so no width is too narrow for it. Approving or denying never changes the level.
@@ -746,34 +883,55 @@ structural hash. The same builder is used by `clio-coder context init`, `clio-co
 refresh`, session freshness checks, tool-demand backfill, and in-session
 incremental updates.
 
-`clio-coder context map` derives an archify architecture specification from the structural index without model calls and writes it to `.clio-coder/artifacts/maps/<repo>.architecture.json` (or `--out <path>`). Map generation reconciles the existing structural index before mapping; missing index refuses, naming `clio-coder context index`. Pinned source citations require that the workspace is clean at repository root and indexed file bytes match current files and Git blobs under a GitHub origin and full `HEAD` revision. Unknown or dirty source states fall back cleanly to usable uncited seeds; `--json` reports path, counts, repository metadata, reconciled index status, and source state (`clean`, `dirty`, or `unknown`). Clio produces the deterministic seed while Archify validates and delivers it. Standard validation checks schema conformance and layout composition, while source review assesses semantic claims and visual review in a browser assesses layout presentation. Custom model-authored maps can remain layout-invalid until refined.
+`clio-coder context map` derives an archify architecture specification from the structural index without model calls and writes it to `.clio-coder/artifacts/maps/<repo>.architecture.json` (or `--out <path>`). Map generation reconciles the existing structural index before mapping; a missing index refuses and names `clio-coder context index`.
+
+Pinned source citations require that the workspace is clean at repository root and indexed file bytes match current files and Git blobs under a GitHub origin and full `HEAD` revision. Unknown or dirty source states fall back cleanly to usable uncited seeds. `--json` reports path, counts, repository metadata, reconciled index status, and source state (`clean`, `dirty`, or `unknown`).
+
+Clio produces the deterministic seed while Archify validates and delivers it. Standard validation checks schema conformance and layout composition, source review assesses semantic claims, and visual review in a browser assesses layout presentation. Custom model-authored maps can remain layout-invalid until refined.
 
 ### Working-set replay
 
-`clio-coder context replay --sessions <path>...` accepts individual session directories,
-Clio sessions roots, and ledger JSONL files; `--synthetic <ids>` adds one or more procedural
-corpora (`science-long`, `refactor`, `exploration`) generated in memory from a fixed seed, so
-the committed tables can be rebuilt byte for byte on any checkout without private transcripts.
-Clio traces remove prior eviction/recall sidecars and select the active branch. Both sources
-drive the live fold, projection, policy, and eviction planner at deterministic turn
-boundaries. The default inclusion cascade for ledgers requires at least eight turns, eight
-tool results, and one file re-read; `--no-filter` retains every otherwise-readable trace.
-Markdown goes to stdout unless `--md` names a file, while `--json` writes a stable report
-including the configuration, the corpus, git revision when available, and exact command line.
-`--protect-last-turns` and `--min-evictable-tokens` override those two working-set settings
-for the replay only; they never update saved settings. Saturated events is pooled over
-applied eviction events and reports how often a policy exhausted its usable candidates,
-which distinguishes a budget that measures policy choice from one that simply runs out of
-evictable material. Recall tokens is the token-weighted complement of precision: what a
-perfect recall would read back for evicted items the session referenced again. Cold prefix
-tokens is the projected working set after the earliest evicted position of each event, which
-is what an exact-prefix cache re-prefills on the next request. The replay also models the
-summary stage: when the projection is still over the threshold after an eviction, it applies
-the same `findCutPoint(keepRecentTokens)` cut the live path uses, appends a stand-in
-`compactionSummary`, counts it, and treats what the cut removed as lost for retention.
-Summaries (mean) is therefore the number of lossy, token-spending compactions a policy forced
-per trace. The summary-headroom mean always carries its contributing trace count because
-traces that never require summary compaction do not enter that nullable mean.
+`clio-coder context replay --sessions <path>...` accepts individual session
+directories, Clio sessions roots, and ledger JSONL files. `--synthetic <ids>`
+adds one or more procedural corpora (`science-long`, `refactor`, `exploration`)
+generated in memory from a fixed seed, so the committed tables can be rebuilt
+byte for byte on any checkout without private transcripts.
+
+Both sources drive the live fold, projection, policy, and eviction planner at
+deterministic turn boundaries. Clio traces remove prior eviction/recall sidecars
+and select the active branch.
+
+| Flag | Effect |
+| --- | --- |
+| `--no-filter` | Retains every otherwise-readable trace. The default inclusion cascade for ledgers requires at least eight turns, eight tool results, and one file re-read. |
+| `--md <file>` | Writes Markdown to that file instead of stdout. |
+| `--json` | Writes a stable report including the configuration, the corpus, git revision when available, and the exact command line. |
+| `--protect-last-turns`, `--min-evictable-tokens` | Override those two working-set settings for the replay only. They never update saved settings. |
+
+<details>
+<summary>What each reported metric means, and how the replay models the summary stage</summary>
+
+**Saturated events** is pooled over applied eviction events and reports how often
+a policy exhausted its usable candidates, which distinguishes a budget that
+measures policy choice from one that simply runs out of evictable material.
+
+**Recall tokens** is the token-weighted complement of precision: what a perfect
+recall would read back for evicted items the session referenced again.
+
+**Cold prefix tokens** is the projected working set after the earliest evicted
+position of each event, which is what an exact-prefix cache re-prefills on the
+next request.
+
+The replay also models the summary stage. When the projection is still over the
+threshold after an eviction, it applies the same `findCutPoint(keepRecentTokens)`
+cut the live path uses, appends a stand-in `compactionSummary`, counts it, and
+treats what the cut removed as lost for retention. **Summaries (mean)** is
+therefore the number of lossy, token-spending compactions a policy forced per
+trace. The summary-headroom mean always carries its contributing trace count,
+because traces that never require summary compaction do not enter that nullable
+mean.
+
+</details>
 
 `clio-coder context working-set --session <id|path>` is a read-only inspection command for
 one ledger. It prints evicted refs with reason, superseding ref, and token count; aggregate
@@ -887,19 +1045,14 @@ The footer owns live activity. Transcript actions have static running or outcome
 
 ## TUI Surface Refinements
 
-The Clio TUI has been enhanced to maximize readability, operational focus, and command discovery:
+The Clio TUI maximizes operational focus, ergonomics, and discoverability:
 
-- **Welcome header:** Before your first prompt the header is three rows and no box: a masthead (`>C_ Clio Coder v0.4.7` on the left, `~/iowarp/clio-coder · main*` on the right), the route (`✓ dynamo · qwen3.8-27b`), and one next step (`describe a task · Enter to send · / for commands`). The next step names whatever actually blocks work first: no route or model sends you to `/model`, an unavailable or degraded route to `/settings targets`, a missing or stale `CLIO-CODER.md` to `/context init` or `/context refresh`. A healthy route shows no latency; a failing one shows its reason. Your first submit collapses the header to one live row, `>C_ Clio Coder v0.4.7 · dynamo · qwen3.8-27b · ~/iowarp/clio-coder · main*`, which follows a mid-session model change. `/new` returns to the three-row form; `/resume`, `/tree`, `/fork` and `/handoff` collapse it after a successful transition. Interactive resume uses `/resume`; `--continue` is a headless `clio-coder run` option. See [tui-design.md](../architecture/tui-design.md#51-welcome-launchpad--session-header) for the width-degradation order and route vocabulary.
-- **Unmistakable Clio Composer:** The input editor features an explicit left section tag reflecting current prompt semantics (`MESSAGE` while idle, `FOLLOW-UP` while Clio runs, and orange `STEER` when Enter steers in-flight execution). The hydrated composer keeps target/model fields separate until rendering. Narrow labels retain a recognizable family and variant, such as `blade… · qwopus3.…dense-q6 · low`. Includes the dim placeholder `Ask Clio…  / for commands` and lower-rail hint `Enter send · Ctrl+J newline` at wider widths.
-- **Progressively Disclosed Footer:** The compact footer uses a quiet two-zone status layout that suppresses idle decoration (`tools none`, `◌ idle`, and duplicate turn receipts). Line 1 displays workspace location, git branch/dirty state, and active phase only when meaningful, shortening workspace parents and dropping branch decoration before live activity or worker counts; Line 2 displays the context window gauge, current Output style, and session cost. `Alt+U` toggles the expanded dashboard, which orders information by operational urgency (Activity, Context, Session, Workspace).
-- **Footer Notification Degradation Ladder:** The footer notification badge reserves the severity head (`glyph count noun`) and `[Ctrl+G x] dismiss` tail first, allocating remaining width to an ellipsized message body. Under narrow terminal constraints, it degrades cleanly down the ladder without clipping action keys.
+- **Welcome Launchpad & Session Header:** Prior to your first prompt, Clio renders a framed launchpad dashboard (`src/interactive/welcome-dashboard.ts`) with 11 detail rows (model route status, workspace path, permissions/autonomy, guidance, target inventory, and fleet recipes), accompanied by ASCII wordmark art at ≥76 columns and rotating hints at ≥160 columns. A bottom action row indicates the immediate step or blocker (`describe a task · Enter to send · / for commands`, or route blockers such as `/model` or `/settings targets`). On prompt submission, the launchpad collapses to a single live header row (`>C_ Clio Coder v0.5.0 · <target/model> · <workspace> · <branch>*`) tracking mid-session route or branch changes. `/new` restores the launchpad; `/resume`, `/tree`, `/fork`, and `/handoff` collapse it after transition. See [tui-design.md](../architecture/tui-design.md#51-welcome-launchpad--session-header).
+- **Quiet, Focused Clio Composer:** Normal composition rails remain clean and uncluttered (`src/interactive/clio-editor.ts`), omitting duplicate model identity or newline hints already provided by the footer. Exceptional operational states elevate to the top rail: `CONFIRM` (`warning` token, or `CONFIRM · FULL-AUTO` in `editorDanger`) when an approval prompt owns input, `PREPARING` during turn dispatch, `COMPACTING` during context compaction, or `FULL-AUTO` (`editorDanger`). Native editor scroll indicators (`↑/↓` line counts) remain on line 0 when drafts scroll. When the draft is empty, line 1 shows context-aware dim placeholder text (`Ask Clio…  / for commands`, `A parked call is waiting for your decision`, `Clio has your prompt and is preparing the turn`, or `Clio is compacting the session context`). During parked permission prompts, the bottom rail carries fitted decision keys (`confirmRailHint` via `src/interactive/permission-hint.ts`: `Enter` allow, or `Backspace` clear draft to allow if a draft is present; `Esc` deny; `s` stop turn; `v` inspect mutation; standing approval terms toggle via `?` on the permission card itself).
+- **Two-Line Compact Footer & Expanded Dashboard:** The compact footer (`src/interactive/footer/pages.ts`) renders an ambient two-line strip: Line 1 displays live activity phase (`accent`) and active worker counts (`agent`), model/target identity, thinking level, context meter bar, and token usage; Line 2 surfaces urgent input prompts (`Ctrl+C again to quit`, `Ctrl+G → choose key`), active notices, or rotating shortcut hints alternating with workspace cwd and git dirty state on the left, alongside session throughput and dashboard toggle keys on the right. Pressing `Alt+U` expands the dashboard into 1/4 of the viewport (minimum 8 rows), cycling through `Activity` (live worker cards and finished history), `Context` (meter bar/grid, category swatches, headroom), `Status` (Cost & Connections, Local Machine metrics, memory bank), and closed.
 - **Grouped Slash Command Palette:** Typing `/` opens an autocomplete command palette grouped by operational category (`Run`, `Inspect`, `Configure`, `Sessions`) with compact argument hints. Every suggestion is the command's one canonical spelling.
 - **Voice-First Transcript & Receipts:** User (`› `) and assistant (`✦ `) prose are formatted with a two-cell hanging indent, ensuring wrapped continuation lines remain visually tied to their voice prefix. Tool ledgers maintain full terminal width. Completed turn receipts honor Output style: Compact omits the separate receipt, Standard shows a small completion line with available duration, and Detailed includes available call counts, token usage and reasoning provenance.
-- **Transactional Settings Center:** Open `/settings` or deep-link to one of
-  `chat`, `fleet`, `targets`, `context`, `safety`, `interface`, or
-  `integrations`. Value edits construct change plans offering `Apply this
-  session`, `Apply and save globally`, or `Cancel`; narrow terminals use a
-  drill-down layout below 72 columns.
+- **Transactional Settings Center:** Open `/settings` or deep-link to one of `chat`, `fleet`, `targets`, `context`, `safety`, `interface`, or `integrations`. Value edits construct change plans offering `Apply this session`, `Apply and save globally`, or `Cancel`; narrow terminals use a drill-down layout below 72 columns.
 
 ## Overlay and Presentation Conventions
 
@@ -983,3 +1136,7 @@ Task-board guidance and ordinary continuation preserve proposal-only scope. Defe
 `clio-coder eval validate --package <path|kind:name> --eval <name>` validates a named package suite. `clio-coder eval run` with the same package flags runs it; `--user` or `--project` selects the installed copy. Materio declares `scripts` for its offline Python contracts. The experimental skill-scenario lane is `clio-coder eval skill <name|path> [--scenario <id>]`. See [Library packages](resource-library.md).
 
 The old top-level CLI `skills` and `plugins` groups are retired; use `clio-coder library`. In the editor, `/library`, `/skills`, `/agents` and `/prompts` open the shared browser. `/resources` and `/plugins` give a replacement hint. `/skill <name>` activates a skill; `/interop` handles local-agent discovery and reviewed adoption.
+
+Context composition keeps tool-definition schemas separate from tool-result messages. Provider usage anchors the total; category splits remain estimates. Growth beyond the decomposed estimate is assigned to the conversation/framing residual, not proportionally added to fixed prompt sections. Assistant output includes the latest completed response as well as in-flight output. Older snapshots without a tool-result split remain readable; subsequent live calls refresh the decomposition.
+
+Editor rails use a bold teal line at rest and a small moving teal/orange highlight while Clio works. Pending permission decisions use an orange pulse while retaining their keys. Effective `full-auto` autonomy adds a red `FULL-AUTO` label and red rail endcaps; it does not change approval or safety behavior. Rails stop animating while the composer contains a draft, or when `CLIO_CODER_REDUCE_MOTION=1`, `CLIO_CODER_SCREEN_READER=1`, `NO_COLOR`, or `TERM=dumb` applies. The full-auto label remains visible without color.