@iowarp/clio-coder 0.4.9 → 0.5.0

package/src/core/settings-navigation.ts

@@ -0,0 +1,116 @@
+/** Shared navigation for configure and /settings. Keep this module free of UI and I/O imports. */
+export const SETTINGS_SECTIONS = [
+	{
+		id: "targets",
+		label: "Connections",
+		description: "Providers, endpoints, credentials, and available models.",
+		aliases: ["connections", "connection", "auth", "target", "providers"],
+	},
+	{
+		id: "chat",
+		label: "Chat",
+		description: "Chat model, thinking, model favorites, response length, and retries.",
+		aliases: ["orchestrator", "models", "model", "thinking", "retry"],
+	},
+	{
+		id: "fleet",
+		label: "Fleet",
+		description: "Worker models, profiles, routing, concurrency, retries, and run limits.",
+		aliases: ["workers"],
+	},
+	{
+		id: "context",
+		label: "Context & Memory",
+		description: "Context size, compaction, working set, and proactive memory.",
+		aliases: ["compaction", "memory"],
+	},
+	{
+		id: "safety",
+		label: "Permissions & Limits",
+		description: "Autonomy, approval rules, spending limits, and safety review.",
+		aliases: ["permissions", "autonomy", "budget", "watchdog"],
+	},
+	{
+		id: "interface",
+		label: "Appearance",
+		description: "Display, streaming, notifications, panes, and keyboard shortcuts.",
+		aliases: ["appearance", "terminal", "panes", "pane", "layout"],
+	},
+	{
+		id: "integrations",
+		label: "Integrations",
+		description: "Project skills, external agents, plugins, library, and Git attribution.",
+		aliases: ["skills", "skill", "extensions", "interop"],
+	},
+	{
+		id: "advanced",
+		label: "Advanced",
+		description: "Diagnostics, configuration files, and the full settings editor.",
+		aliases: ["all", "settings", "diagnostics", "doctor", "diag"],
+	},
+] as const;
+
+export type SettingsSectionId = (typeof SETTINGS_SECTIONS)[number]["id"];
+export type SettingsSectionAlias = (typeof SETTINGS_SECTIONS)[number]["aliases"][number];
+export type SettingsSectionName = SettingsSectionId | SettingsSectionAlias;
+
+export function resolveSettingsSection(name: string): SettingsSectionId | undefined {
+	const normalized = name.trim().toLowerCase();
+	return SETTINGS_SECTIONS.find(
+		(section) => section.id === normalized || (section.aliases as readonly string[]).includes(normalized),
+	)?.id;
+}
+
+/** Specific exceptions precede schema roots: policy belongs together even when its consumer is a worker or plugin. */
+export function settingsSectionForPath(path: string): SettingsSectionId {
+	if (
+		path === "safetyNet" ||
+		path === "fleet.permissions" ||
+		path.startsWith("fleet.permissions.") ||
+		path === "integrations.externalAgents.defaults.toolGovernance"
+	)
+		return "safety";
+	const root = path.split(".")[0];
+	switch (root) {
+		case "targets":
+		case "chat":
+		case "fleet":
+		case "context":
+		case "safety":
+		case "interface":
+		case "integrations":
+			return root;
+		default:
+			return "advanced";
+	}
+}
+
+/** Small groups within each area keep related controls together on narrow terminals too. */
+export function settingsGroupForPath(path: string): string {
+	if (path.startsWith("chat.modelPicker")) return "Model picker";
+	if (path.startsWith("chat.retry")) return "Recovery";
+	if (path.startsWith("chat.")) return "Model & responses";
+	if (path.startsWith("context.memory")) return "Proactive memory";
+	if (path.startsWith("context.compaction")) return "Compaction";
+	if (path.startsWith("context.workingSet")) return "Working set";
+	if (path.startsWith("context.")) return "Context limits";
+	if (path.startsWith("fleet.permissions")) return "Worker approvals";
+	if (path.startsWith("fleet.default")) return "Default model";
+	if (path.startsWith("fleet.profiles")) return "Profiles";
+	if (path.startsWith("fleet.agentProfiles")) return "Agent routes";
+	if (path.startsWith("fleet.adaptiveRouting")) return "Automatic routing";
+	if (path.startsWith("fleet.nodes") || path.startsWith("fleet.endpoints")) return "Placement & capacity";
+	if (path.startsWith("fleet.history")) return "Run history";
+	if (path.startsWith("fleet.")) return "Execution limits & recovery";
+	if (path.startsWith("safety.review")) return "Safety review";
+	if (path.startsWith("safety.limits")) return "Spending & tool limits";
+	if (path === "integrations.externalAgents.defaults.toolGovernance") return "External agent permissions";
+	if (path.startsWith("safety") || path === "safetyNet") return "Autonomy";
+	if (path.startsWith("interface.panes.files")) return "Files pane";
+	if (path.startsWith("interface.panes")) return "Panes & layout";
+	if (path.startsWith("interface.")) return "Display & keyboard";
+	if (path.startsWith("integrations.library")) return "Resource library";
+	if (path.startsWith("integrations.externalAgents")) return "External agents";
+	if (path.startsWith("integrations.")) return "Skills, plugins & Git";
+	return "";
+}

package/src/core/theme-token-hex.ts

@@ -1,8 +1,13 @@
 /** Semantic colors shared by Clio's terminal surfaces and generated companion profiles. */
 export type ClioToken =
+	| "editor"
+	| "editorDanger"
+	| "editorAction"
 	| "accent"
 	| "accentDeep"
 	| "action"
+	| "tool"
+	| "agent"
 	| "success"
 	| "warning"
 	| "error"
@@ -22,17 +27,22 @@ export type ClioToken =
  * renderer and splitting the instant shell's Stage 0 chunk.
  */
 const TOKEN_HEX: Readonly<Record<ClioToken, `#${string}`>> = {
-	accent: "#46e5d0",
-	accentDeep: "#1fb7a6",
-	action: "#ff7e29",
-	success: "#57e389",
-	warning: "#ffb454",
-	error: "#ff5c66",
-	info: "#5ba8ff",
-	reason: "#9d8cff",
+	editor: "#40ffbf",
+	editorDanger: "#ff5058",
+	editorAction: "#ffab45",
+	accent: "#53b196",
+	accentDeep: "#3e9389",
+	action: "#d99b62",
+	tool: "#6fada5",
+	agent: "#cf905b",
+	success: "#77b891",
+	warning: "#d3b06b",
+	error: "#db8289",
+	info: "#80a7ce",
+	reason: "#af9bc9",
 	dim: "#6a7a85",
 	muted: "#8a99a4",
-	title: "#46e5d0",
+	title: "#72b8ad",
 	frame: "#2f5d5a",
 	frameStrong: "#2aab9e",
 };

package/src/core/turn-constraints.ts

@@ -0,0 +1,52 @@
+import { toolPlacement } from "../tools/surface.js";
+import { ToolNames } from "./tool-names.js";
+
+/**
+ * Explicit host-supplied scope for one submitted task and its continuations.
+ * Never derived from model arguments or guessed from natural-language text.
+ * These bounds only narrow existing safety, skill, and recipe policy.
+ */
+export interface TurnConstraints {
+	readonly mode?: "answer" | "proposal" | "change";
+	readonly delegation?: "allowed" | "forbidden";
+	readonly allowedTools?: readonly string[];
+	readonly skills?: "allowed" | "disabled";
+}
+
+/** Snapshot caller-owned input before asynchronous admission or queuing. */
+export function snapshotTurnConstraints(value: TurnConstraints | undefined): TurnConstraints | undefined {
+	if (value === undefined) return undefined;
+	if (
+		value === null ||
+		typeof value !== "object" ||
+		Array.isArray(value) ||
+		(value.mode !== undefined && !["answer", "proposal", "change"].includes(value.mode)) ||
+		(value.delegation !== undefined && !["allowed", "forbidden"].includes(value.delegation)) ||
+		(value.skills !== undefined && !["allowed", "disabled"].includes(value.skills)) ||
+		(value.allowedTools !== undefined &&
+			(!Array.isArray(value.allowedTools) ||
+				value.allowedTools.some((name) => typeof name !== "string" || !/^[a-zA-Z0-9_.-]+$/.test(name))))
+	) {
+		throw new Error("Invalid explicit turn constraints");
+	}
+	return Object.freeze({
+		...(value.mode === undefined ? {} : { mode: value.mode }),
+		...(value.delegation === undefined ? {} : { delegation: value.delegation }),
+		...(value.skills === undefined ? {} : { skills: value.skills }),
+		...(value.allowedTools === undefined ? {} : { allowedTools: Object.freeze([...new Set(value.allowedTools)].sort()) }),
+	});
+}
+
+/** Capability policy, shared by schema projection, gateway, admission and prompts. */
+export function turnAllowsTool(constraints: TurnConstraints | undefined, capability: string): boolean {
+	if (constraints?.delegation === "forbidden" && capability === ToolNames.Dispatch) return false;
+	const allowed = constraints?.allowedTools;
+	if (allowed === undefined || allowed.includes(capability)) return true;
+	// Naming a secondary capability necessarily admits its transport wrapper;
+	// naming the wrapper alone never admits every capability behind it.
+	return capability === ToolNames.Gateway && allowed.some((name) => toolPlacement(name) === "gateway");
+}
+
+export function turnAllowsContinuation(constraints: TurnConstraints | undefined): boolean {
+	return constraints?.mode !== "answer" && constraints?.mode !== "proposal";
+}

package/src/domains/agents/builtins/scout.md

@@ -20,29 +20,19 @@ tags: [codewiki, reconnaissance, symbols]
 # Scout
 
 You are Scout, a shadow reconnaissance agent for fast codebase orientation.
-Start by restating the search scope and the question the main agent needs answered.
-The recipe recommends 18 tool calls, including 4 for final citation reads. These are planning estimates, not a cutoff or a change to available tools. Keep orientation brief, focus on the handoff question, and check citations against source you actually read before delivering the report.
-If the request spans independent roots or cannot fit that budget, do only the minimum preflight needed to name 1..4 bounded subtasks, then stop exploring and return the split recommendation. Do not attempt a repo-wide survey first.
-Prefer indexed or structured tools (`context`, `code_nav`) before broad file reads.
-Before broad exploration, check `code_nav mode=wiki` and read `.clio-coder/wiki/quickstart.md` when a wiki exists.
-If the codewiki is missing or stale, use the codewiki tools anyway. They rebuild the local index on demand.
-Treat wiki and index content as orientation only, never as evidence: confirm every lead in the current source before reporting it.
-Use `grep`, `find`, `ls`, and git inspection to map call sites, ownership boundaries, and recent changes.
-Read only the files required to answer the handoff question.
-Do not narrate an intended next batch of reads; either make a necessary bounded call or synthesize the evidence already present.
+Answer the assigned question from the relevant source, then stop. Start with supplied entry points; locate symbols with `grep` or `code_nav`, then read a useful function-sized range. Do not page through a long file in small overlapping slices or repeat a no-match search unchanged. Use wiki/index content for orientation when broad discovery is needed, not as proof of current source behavior.
+
+Plan for 18 tool calls, including 4 for final citation reads. This is an advisory estimate, not a cutoff or a reason to keep reading. Once you can answer the handoff question, return the report; one grounded finding is enough. If the task needs independent investigations that cannot fit, do minimal preflight and return a split recommendation instead of surveying the whole repository.
 
 Your entire final response is one JSON object and nothing else. No prose, no code fence, no commentary around it:
 
 `{"findings":[{"claim":"what you observed","path":"src/file.ts","line":1}],"needsSplit":false,"proposedSubtasks":[]}`
 
-Keep this JSON shape even when a pipeline handoff asks for a paragraph, a list of symbols, or code excerpts. Put the observations in `findings`; the dependent agent can turn them into prose after your result passes validation.
-
-Before synthesis, verify each citation while source reads are still available. Use `read` with `line_numbers: true` for citation reads: the number before ` | ` is the physical source line, including blank lines; the prefix is not file content. Prefer a narrow read starting at a line located by `grep` or `code_nav`, then cite the displayed line that actually supports the claim. A search hit alone is not a live read. Partial-line notices do not establish a complete source line. Keep the confirmed claim, path, and exact displayed source line together; do not reconstruct or count line numbers from memory during synthesis.
+Keep this shape even when the handoff asks for prose or excerpts; put the answer in the claims. For grounded findings, use `read` with `line_numbers: true` and cite the displayed physical line supporting the claim. Search hits are leads, not live reads. Never invent a citation or count lines from memory. If you have an observation but cannot confirm its exact citation, omit both `path` and `line` for that claim; it will be retained as an ungrounded lead, not validation evidence. Omit unsupported claims.
 
-On result-contract repair, fix the reported defect using the source already returned. Read ranges are inclusive bounds, not suggested citation lines. If you cannot confirm the exact supporting line for a finding, remove that finding and retain the confirmed ones. Never move a rejected citation to a range endpoint just to pass validation. Recheck every remaining finding, then emit the complete JSON object again.
+For a split recommendation, use the same top-level keys with `findings: []`, `needsSplit: true`, and 1..4 scoped `proposedSubtasks`. Each subtask has this shape: `{"id":"inspect","task":"bounded assignment","dependencies":[],"expectedResultContract":"scout-report","requestedAuthority":"read-only"}`. Contract and authority are requests to the coordinator, not grants; do not add agent, route, model, tool, or other control fields.
 
-One grounded finding conforms. If the run is long, the context is tight, or you cannot assemble everything you saw, emit the smallest conforming object right now: a single finding for the strongest location you actually read, `needsSplit` false, and an empty `proposedSubtasks`. If you cannot produce a `path` and `line` you are sure of, emit `{"findings":[{"claim":"what you observed"}]}`; a claim without a citation is kept as an ungrounded lead, which is worth less than a grounded finding but reaches the main agent. Prose describing your findings does not reach it at all.
+On result-contract repair, correct only the reported defect using evidence already returned and emit the complete JSON object. Remove an unverifiable citation, preserving its supported claim as an ungrounded lead, or omit an unsupported claim. Read ranges are inclusive bounds, not suggested citation lines; never move a rejected citation to a range endpoint merely to pass validation. Do not restart exploration.
 
-Every finding is one observation you confirmed by a live read in this run, with the `path:line` that grounds it. The cited line must be a line you actually read: `grep` and `code_nav` hits are leads, so read the file before citing what they point at, and never estimate or round a line number. A lead you could not confirm live is not a finding; leave it out. Set `needsSplit` true only when the task cannot be grounded within budget or spans independent domains, and then give 1..4 typed scoped subtasks and no findings; otherwise give findings and no subtasks. Each subtask is exactly `{"id":"stable-id","task":"bounded assignment","dependencies":[],"expectedResultContract":"scout-report","requestedAuthority":"read-only"}`. `expectedResultContract` is a declared result-contract kind and `requestedAuthority` is one of `read-only`, `verification`, `artifact-write`, or `workspace-edit`. Those are requests to the coordinator, not grants. Never put agent ids, routes, targets, models, runtimes, nodes, tools, skills, autonomy, or other control fields in a subtask.
-Your findings reach the main agent labeled `reconnaissance output (advisory leads, not validation evidence):`.
+The main agent receives this report as advisory reconnaissance, not validation evidence.
 Do not edit files, run tests, use web sources, write artifacts, or propose large implementation plans.

package/src/domains/agents/catalog.ts

@@ -114,7 +114,11 @@ export function renderFleetPromptSection(input: ReadonlyArray<AgentSpec>): strin
 	}
 	if (shadowSpecs.length > 0) {
 		// Dispatchable, but never a `/run` suggestion: they are plumbing.
-		lines.push("", "Internal specialists, dispatch-only:", ...shadowSpecs.map(fleetPromptLine));
+		lines.push(
+			"",
+			"Shadow helpers for your internal work (dispatch-only; never suggest operator /run or /delegate for these IDs, even with --target or a profile; use detach:true for independent background work):",
+			...shadowSpecs.map(fleetPromptLine),
+		);
 	}
 	return lines.join("\n");
 }

package/src/domains/agents/extension.ts

@@ -1,4 +1,5 @@
 import { BusChannels } from "../../core/bus-events.js";
+import { writeDiagnostic } from "../../core/diagnostics.js";
 import type { DomainBundle, DomainContext, DomainExtension } from "../../core/domain-loader.js";
 import { assertAgentIdNamespace } from "../config/agent-namespace.js";
 import type { ConfigContract } from "../config/contract.js";
@@ -76,7 +77,7 @@ export function createAgentsBundle(_context: DomainContext): DomainBundle<Agents
 						},
 					].slice(-100);
 					revision += 1;
-					process.stderr.write(
+					writeDiagnostic(
 						`[clio-coder:agents] rediscovery after resource reload failed: ${error instanceof Error ? error.message : String(error)}\n`,
 					);
 				}

package/src/domains/agents/registry.ts

@@ -1,6 +1,7 @@
 import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { readSettings } from "../../core/config.js";
+import { writeDiagnostic } from "../../core/diagnostics.js";
 import { resolvePackageRoot } from "../../core/package-root.js";
 import { clioConfigDir } from "../../core/xdg.js";
 import { enabledPluginResourceRoots } from "../plugins/index.js";
@@ -123,7 +124,7 @@ export function loadRecipesFromDir(
 			if (source.source === "builtin") throw error;
 			const message = error instanceof Error ? error.message : String(error);
 			recordDiagnostic(diagnostics, { kind: "quarantine", source: source.source, filepath, message });
-			process.stderr.write(`[clio-coder:agents] quarantine path=${filepath} source=${source.source} reason=${message}\n`);
+			writeDiagnostic(`[clio-coder:agents] quarantine path=${filepath} source=${source.source} reason=${message}\n`);
 		}
 	}
 
@@ -136,7 +137,7 @@ function mergeRecipes(
 	...sources: ReadonlyArray<ReadonlyArray<AgentRecipe>>
 ): ReadonlyArray<AgentRecipe> {
 	const ignored = (recipe: AgentRecipe, reason: string): void => {
-		process.stderr.write(`[clio-coder:agents] ignore id=${recipe.id} by=${recipe.source} reason=${reason}\n`);
+		writeDiagnostic(`[clio-coder:agents] ignore id=${recipe.id} by=${recipe.source} reason=${reason}\n`);
 		recordDiagnostic(diagnostics, {
 			kind: "ignored",
 			id: recipe.id,
@@ -174,7 +175,7 @@ function mergeRecipes(
 			}
 			const previous = byId.get(recipe.id);
 			if (previous) {
-				process.stderr.write(`[clio-coder:agents] override id=${recipe.id} by=${recipe.source}\n`);
+				writeDiagnostic(`[clio-coder:agents] override id=${recipe.id} by=${recipe.source}\n`);
 				recordDiagnostic(diagnostics, {
 					kind: "overridden",
 					id: previous.id,

package/src/domains/agents/result-contract.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { parseJsonObjectPayload } from "../../core/json-payload.js";
+import { INTERNAL_HELPER_RESULT_KINDS } from "../../worker/protocol.js";
 import { AGENT_AUTOMATION_AUTHORITIES, type AgentAutomationAuthority } from "./spec.js";
 
 export type ResultContract =
@@ -90,6 +91,124 @@ export type ResultContract =
 
 export type ResultContractQuality = "pass" | "fail" | "unmeasured";
 
+export { INTERNAL_HELPER_RESULT_KINDS } from "../../worker/protocol.js";
+export type InternalHelperResultKind = (typeof INTERNAL_HELPER_RESULT_KINDS)[number];
+/** Shared acceptance/capture ceiling: a worker may not accept a result the parent cannot retain. */
+export const STRUCTURED_HELPER_RESULT_MAX_BYTES = 32_768;
+
+export interface StructuredHelperResult {
+	version: 1;
+	kind: InternalHelperResultKind;
+	/** Validated task content, never an authority grant or a host verification claim. */
+	data: Record<string, unknown>;
+}
+
+/** Generation schemas guide serialization; the semantic validators below remain authoritative. */
+export function internalHelperResultSchema(contract: ResultContract): Record<string, unknown> | null {
+	const text = { type: "string", minLength: 1 };
+	const list = (items: Record<string, unknown>) => ({ type: "array", items });
+	const object = (properties: Record<string, unknown>) => ({
+		type: "object",
+		properties,
+		required: Object.keys(properties),
+		additionalProperties: false,
+	});
+	const strings = list(text);
+	switch (contract.kind) {
+		case "scout-report":
+			return object({
+				findings: list({
+					anyOf: [object({ claim: text, path: text, line: { type: "integer", minimum: 1 } }), object({ claim: text })],
+				}),
+				needsSplit: { type: "boolean" },
+				proposedSubtasks: {
+					...list(
+						object({
+							id: text,
+							task: { ...text, maxLength: 4096 },
+							dependencies: { ...strings, maxItems: 4, uniqueItems: true },
+							expectedResultContract: { type: "string", enum: [...RESULT_CONTRACT_KINDS] },
+							requestedAuthority: { type: "string", enum: [...AGENT_AUTOMATION_AUTHORITIES] },
+						}),
+					),
+					maxItems: 4,
+				},
+			});
+		case "research-report":
+			return object({
+				source: { type: "string", enum: ["local", "external"] },
+				findings: list(object({ claim: text, evidence: text })),
+			});
+		case "world-knowledge-report":
+			return object({
+				discovery: { type: "string", enum: ["performed", "caller-supplied-only", "unavailable"] },
+				facts: list(object({ claim: text, evidence: text, sources: strings })),
+				synthesis: strings,
+				uncertainties: strings,
+				followUpVerification: strings,
+			});
+		case "provenance-report":
+			return object({ confirmedFacts: strings, missingEvidence: strings, nextInspections: strings });
+		case "oracle-report":
+			return object({ verdict: text, challenge: text, changesMyMind: text, citedDecisions: strings });
+		case "context-handbook":
+			return object({
+				projectName: text,
+				identity: text,
+				conventions: strings,
+				invariants: strings,
+				sections: list(object({ title: text, body: text })),
+			});
+		default:
+			return null;
+	}
+}
+
+/** Decode a helper value through exactly the ordinary contract and grounding checks. */
+export function validateStructuredHelperResult(
+	input: Omit<ResultContractValidationInput, "output"> & { data: unknown },
+): { validation: ResultContractValidation; structured: StructuredHelperResult | null } {
+	const reject = (reason: string) => ({ validation: failure(input.contract, "unmeasured", reason), structured: null });
+	if (!(INTERNAL_HELPER_RESULT_KINDS as readonly string[]).includes(input.contract.kind))
+		return reject("unsupported internal helper contract");
+	if (input.data === null || typeof input.data !== "object" || Array.isArray(input.data))
+		return reject("helper result must be a JSON object");
+	let output: string;
+	try {
+		output = JSON.stringify(input.data, (_key, value) => {
+			if (
+				value === undefined ||
+				typeof value === "function" ||
+				typeof value === "symbol" ||
+				(typeof value === "number" && !Number.isFinite(value))
+			)
+				throw new Error("non-JSON value");
+			return value;
+		});
+	} catch {
+		return reject("helper result must contain only JSON values");
+	}
+	if (Buffer.byteLength(output, "utf8") > STRUCTURED_HELPER_RESULT_MAX_BYTES) {
+		return reject(`helper result exceeds ${STRUCTURED_HELPER_RESULT_MAX_BYTES} UTF-8 bytes; shorten the result`);
+	}
+	const validation = validateResultContract({ ...input, output });
+	if (validation.conformance !== "pass") return { validation, structured: null };
+	let data = JSON.parse(output) as Record<string, unknown>;
+	// Salvage is data-only: discard unknown fields and any split/control claims.
+	// Preserve ungrounded observations without accidentally promoting their citations.
+	if (validation.scout?.degradedReason !== undefined) {
+		data = {
+			findings: [...validation.scout.findings, ...(validation.scout.ungroundedClaims ?? []).map((claim) => ({ claim }))],
+			needsSplit: false,
+			proposedSubtasks: [],
+		};
+	}
+	// Salvage adds canonical fields; its serialized result must fit too.
+	if (Buffer.byteLength(JSON.stringify(data), "utf8") > STRUCTURED_HELPER_RESULT_MAX_BYTES)
+		return reject(`helper result exceeds ${STRUCTURED_HELPER_RESULT_MAX_BYTES} UTF-8 bytes; shorten the result`);
+	return { validation, structured: { version: 1, kind: input.contract.kind as InternalHelperResultKind, data } };
+}
+
 export interface ResultContractValidation {
 	/** Whether the declared postcondition itself was met. */
 	conformance: "pass" | "fail";
@@ -1196,7 +1315,10 @@ export function withResultSummaryAllowance(contract: ResultContract, maxSummaryB
  * validation with the bound named, never as a silently accepted fragment.
  */
 export function resultContractOutputBytes(contract: ResultContract | null | undefined): number | null {
-	if (contract === null || contract === undefined || contract.kind !== "mutation-report") return null;
+	if (contract === null || contract === undefined) return null;
+	if ((INTERNAL_HELPER_RESULT_KINDS as readonly string[]).includes(contract.kind))
+		return STRUCTURED_HELPER_RESULT_MAX_BYTES;
+	if (contract.kind !== "mutation-report") return null;
 	return (
 		2 * resultSummaryMaxBytes(contract) + 2 * RESULT_COMMIT_MESSAGE_MAX_BYTES + RESULT_OUTPUT_ENVELOPE_HEADROOM_BYTES
 	);
@@ -1829,6 +1951,15 @@ function resultContractRepairMessage(input: ResultContractRepairInput): string {
 	return lines.join("\n");
 }
 
+/** A final-only repair retires the tool-exchange pattern, even at a prefix-cache cost. */
+export function resultContractRepairUserMessage(input: ResultContractRepairInput) {
+	return {
+		role: "user",
+		content: [{ type: "text", text: resultContractRepairMessage(input) }],
+		timestamp: Date.now(),
+	} as const;
+}
+
 /** Name of the synthetic tool call that carries a repair round. */
 export const RESULT_CONTRACT_REPAIR_TOOL = "result_contract";
 

package/src/domains/config/classify.ts

@@ -23,6 +23,7 @@ const HOT_RELOAD_FIELDS = new Set<string>([
 	"safety.autonomy",
 	"chat.modelPicker",
 	"interface.outputDetail",
+	"interface.demo",
 	"interface.smoothStreaming",
 	"interface.panes.notifications",
 	"integrations.git.commitAttribution",
@@ -46,6 +47,7 @@ const NEXT_TURN_FIELDS = new Set<string>([
 	"fleet.nodes",
 	"fleet.permissions",
 	"fleet.retry",
+	"fleet.worktrees",
 	"fleet.limits",
 	"fleet.history",
 	"context",
@@ -73,17 +75,19 @@ function matchesPrefix(path: string, fields: Set<string>): boolean {
 	return false;
 }
 
+/** Shared effect timing for settings editors and the runtime reload path. */
+export function settingsChangeKind(path: string): ChangeKind {
+	if (matchesPrefix(path, HOT_RELOAD_FIELDS)) return "hotReload";
+	if (matchesPrefix(path, RESTART_REQUIRED_FIELDS)) return "restartRequired";
+	if (matchesPrefix(path, NEXT_TURN_FIELDS)) return "nextTurn";
+	return "restartRequired";
+}
+
 export function diffSettings(prev: ClioSettings, next: ClioSettings): ConfigDiff {
 	const changed = collectChangedPaths(prev, next);
 	const diff: ConfigDiff = { hotReload: [], nextTurn: [], restartRequired: [] };
 	for (const p of changed) {
-		if (matchesPrefix(p, HOT_RELOAD_FIELDS)) diff.hotReload.push(p);
-		else if (matchesPrefix(p, RESTART_REQUIRED_FIELDS)) diff.restartRequired.push(p);
-		else if (matchesPrefix(p, NEXT_TURN_FIELDS)) diff.nextTurn.push(p);
-		else {
-			// Unknown field falls back to restartRequired to fail closed.
-			diff.restartRequired.push(p);
-		}
+		diff[settingsChangeKind(p)].push(p);
 	}
 	return diff;
 }

package/src/domains/config/extension.ts

@@ -1,5 +1,6 @@
 import { BusChannels, type ConfigChangePayload } from "../../core/bus-events.js";
 import { type ClioSettings, formatSettingsFailure } from "../../core/config.js";
+import { writeDiagnostic } from "../../core/diagnostics.js";
 import type { DomainBundle, DomainContext, DomainExtension } from "../../core/domain-loader.js";
 import { setGitCommitAttributionEnabled } from "../../core/git-commit-attribution.js";
 import { readStrictLayeredSettings, updateLayeredSettings } from "../../core/settings-layers.js";
@@ -45,7 +46,10 @@ export function createConfigBundle(
 			try {
 				listener(payload);
 			} catch (err) {
-				console.error(`[clio-coder:config] listener for ${kind} threw:`, err);
+				writeDiagnostic(
+					`[clio-coder:config] listener for ${kind} threw: ${err instanceof Error ? err.message : String(err)}`,
+					"error",
+				);
 			}
 		}
 	}

package/src/domains/config/keybindings.ts

@@ -89,9 +89,9 @@ export const CLIO_APP_KEYBINDINGS = {
 	},
 	"clio-coder.status.toggle": {
 		defaultKeys: "alt+u",
-		description: "Dashboard",
+		description: "Dashboard pages: Activity → Context → Status → closed",
 		scope: "composer",
-		kind: "toggle",
+		kind: "cycle",
 		repeat: false,
 		leader: "u",
 	},

package/src/domains/context/codewiki/coordinator.ts

@@ -198,6 +198,16 @@ export function coordinateCodewikiExclusive<T>(cwd: string, task: (workspace: st
 	return enqueueWorkspace(workspace, () => withStateFileLock(codewikiPath(workspace), () => task(workspace)));
 }
 
+/** Reconcile a read tool's private snapshot without a writer lease or workspace mutation. */
+export async function reconcileCodewikiCandidate(
+	request: Extract<CodewikiBuildWorkerRequest, { kind: "ensure" }> & { current: Codewiki | null },
+): Promise<CodewikiBuildWorkerResult> {
+	const outcome = await executeInWorker(request);
+	const codewiki = outcome.codewiki ?? request.current;
+	if (!codewiki) throw new Error("codewiki reconciliation returned no artifact");
+	return { codewiki, fingerprint: outcome.fingerprint, changed: outcome.changed };
+}
+
 /** Build a preview candidate in the worker without acquiring a writer lease or touching disk. */
 export async function buildCodewikiCandidate(
 	cwd: string,

package/src/domains/context/worker/snapshot.ts

@@ -9,18 +9,21 @@ export function captureWorkerContext(
 	source: WorkerContextSource,
 	messages: ReadonlyArray<AgentMessage>,
 ): WorkerContextSnapshot {
+	// Worker prompts and executable tools belong to the child. Pi 0.86 stores
+	// the parent's declarations in its transcript; they are not inherited history.
+	const conversation = messages.filter((message) => message.role !== "system");
 	// Pi's provider transform omits interrupted assistant responses. Match that
 	// rule before validating pairs, so a canceled earlier turn cannot poison all
 	// later dispatches. Their partial tool declarations/results never seed a child.
 	const interrupted = (message: AgentMessage) =>
 		message.role === "assistant" && (message.stopReason === "error" || message.stopReason === "aborted");
 	const interruptedIds = new Set(
-		messages
+		conversation
 			.filter(interrupted)
 			.flatMap(messageToolCalls)
 			.map((call) => call.id),
 	);
-	const visible = messages.filter(
+	const visible = conversation.filter(
 		(message) => !interrupted(message) && !(message.role === "toolResult" && interruptedIds.has(message.toolCallId)),
 	);
 	const end = completeHistoryLength(visible, true);
@@ -29,7 +32,7 @@ export function captureWorkerContext(
 		source: structuredClone(source),
 		messages: structuredClone(visible.slice(0, end)),
 		excludedTailMessages: visible.length - end,
-		excludedInterruptedMessages: messages.length - visible.length,
+		excludedInterruptedMessages: conversation.length - visible.length,
 	};
 	return { ...snapshot, contentHash: contextHash(snapshot) };
 }

package/src/domains/dispatch/active-route-planner.ts

@@ -25,6 +25,7 @@ export function routeValidationProjection(
 	allowUnenvelopedApproval = false,
 ): { jobSpec: JobSpec; restore(validated: JobSpec): DispatchRequest } {
 	const {
+		turnConstraints,
 		contextSeed,
 		systemPrompt,
 		reservation,
@@ -57,6 +58,7 @@ export function routeValidationProjection(
 		restore: (validated) => ({
 			...request,
 			...validated,
+			...(turnConstraints !== undefined ? { turnConstraints } : {}),
 			...(contextSeed !== undefined ? { contextSeed } : {}),
 			...(systemPrompt !== undefined ? { systemPrompt } : {}),
 			...(reservation !== undefined ? { reservation } : {}),