carthagent 1.0.7 → 1.1.0-beta.2

package/docs/release-notes-beta.1.md

@@ -0,0 +1,60 @@
+# Carthagent 1.1.0-beta.1
+
+The first 1.1 beta brings the native Projects, Ship, Voyages and daily-quest experience from preview.13 together with fixes verified through real DeepSeek work and account transactions.
+
+## Fixed
+
+- **Ship reviews for nested apps:** capture the application's own tracked and new source even when its Git root is an ancestor directory. Workspace containment, excluded directories, symlink protection and snapshot freshness remain enforced.
+- **Clear implementation-tool guidance:** Ship explains when planning unlocks direct write/edit/shell tools, the extra strict-workflow prerequisites, and how direct tools differ from code-mode discovery.
+- **Long-running headless tasks:** reconnect the wait observer after an HTTP header timeout without resending an admitted task.
+- **Useful shop errors:** unaffordable items show `insufficient_coins`; invalid and expired quotes have distinct errors.
+- **Quest evidence preview:** use **Ctrl+G** instead of the command palette's Ctrl+P. Incomplete evidence is rejected locally before submission.
+
+## Verified-delivery rewards
+
+From a completed Ship session, open Voyages and choose **Claim verified delivery
+reward**. An eligible current required-check handoff earns **25 coins, 100 XP
+and 1 km**, at most **three per UTC day**. Preview and confirmation are explicit;
+duplicate run/project-snapshot claims cannot earn twice. Only digests are sent,
+not source code or check output. The backend trusts the authenticated local
+harness attestation; it does not independently rerun the repository.
+
+The matching backend is deployed. Live earned claim, exact replay and native
+service restart passed on the owner's account: 20 → 45 coins, 0 → 100 XP and
+0 → 1 km, preserving equipment. See [reward acceptance results](beta-rewards-e2e-results.md).
+
+## Verified in real use
+
+- DeepSeek completed an accepted, snapshot-bound Ship delivery repairing Invest-With-Friends' existing build/type/lint failures. Independent checks confirmed **32 passing tests**, clean typecheck, lint with **0 errors / 13 existing warnings**, and a successful production build.
+- Production HTTP checks rejected **25 invalid trade payloads**.
+- A real 30-coin equipment purchase debited once, and ownership/equipment persisted through restart. Duplicate purchases, unowned equipment, locked items, stale profile writes and insufficient funds were rejected.
+- Three distinct daily outcomes completed grading; one was assessed complete and two needed more evidence. Cross-quest duplicate claims were rejected. Ctrl+G validation and draft cancellation were checked in the live TUI.
+
+## Beta scope and known limitations
+
+- Daily quests assess selected evidence; they are not independent verification. **Daily-assessment rewards are disabled:** no coins, XP, distance or equipment are granted for assessment alone. Verified-delivery claims are a separate path.
+- Native friends/badges views are not implemented.
+- Long quest summaries can overlap the actions heading in the terminal.
+- The Invest-With-Friends delivery is a verification example, not a deployment of that application. Its full authenticated Google/database/trading flows remain unverified; its production environment needs an auth secret, and its existing trade endpoint checks market status before authentication.
+
+See [the launch-readiness report](launch-readiness-live-results.md) for detailed results and limitations.
+
+## Install or upgrade
+
+```sh
+ctg update --channel beta --check
+ctg update --channel beta
+ctg --version # 1.1.0-beta.1
+```
+
+Or install the exact npm version:
+
+```sh
+npm install -g carthagent@1.1.0-beta.1
+```
+
+This is a GitHub prerelease, published to npm's `next` tag. Stable `latest` remains 1.0.7. The beta channel deliberately selects this beta even though SemVer orders the older `preview.13` label above `beta.1`; an explicit channel switch is supported. `ctg update --channel stable` returns to stable.
+
+## Runtime provenance
+
+Five native runtime builds are produced by [prebuild run 41398315323](https://github.com/B-icy/Carthagent/actions/runs/41398315323), from source `7a027f0aa792d40802acc92e7d12630b510df241`. The runtime recipe remains combined-v5 on upstream `843a6c514e606b436a7fe713422ace0a93ad3d61`, compatibility `2.0.32`. The packaged `lib/opencode/runtime-release.json` pins the beta's archive and executable digests; release assets include that manifest and combined checksums.

package/docs/release-notes-beta.2.md

@@ -0,0 +1,60 @@
+# Carthagent 1.1.0-beta.2 — release candidate
+
+This candidate simplifies Cloud sign-in and keeps billing recovery connected to
+the task already open in your terminal. Publication and installed acceptance are
+pending; these notes do not establish availability on npm.
+
+## Cloud sign-in and first use
+
+- Hosted models are named **Carthagent Cloud**. **Ship mode** remains the verified
+  coding workflow. Existing provider IDs and login aliases continue to work.
+- Fresh Cloud sign-in goes directly through browser authorization. Legacy import
+  and upstream-key methods require `CARTHAGENT_ADVANCED_AUTH=1`.
+- The browser identifies the account and terminal being connected. Device codes
+  last 20 minutes, with continuation-preserving sign-in recovery.
+- Successful CLI sign-in suggests one small project task and points Cloud users
+  to `/account` for identity and actual available usage.
+
+## Review billing, then continue explicitly
+
+- `/billing checkout builder`, `pro` or `max` shows authenticated plan terms
+  before opening checkout. Eligible new Builder customers pay **$1 for the first
+  month, then $10/month**; Pro starts at **$25/month**, Max at **$50/month**.
+- The separate one-time starter usage credit is attempted on first terminal
+  authorization. Browser signup alone does not grant it.
+- Existing card subscribers review Stripe's prorated amount before confirming a
+  change. The renewal anchor and consumed/reserved usage are preserved. Existing
+  grandfathered subscriptions retain their documented allowance policy.
+- After payment, run `/billing refresh` in the existing session, or
+  `ctg billing refresh` outside the TUI. Then explicitly continue the task.
+  Checkout does not automatically submit a prompt or restart work.
+
+## Acceptance and limitations
+
+Backend onboarding and retention reporting are deployed through PRs #178 and
+#179. Native onboarding PR #238 is merged; first-task guidance is in PR #239.
+The original onboarding suite passed 1,131 tests with five skips; corrected
+native CI passed on Linux, macOS and Windows. These results precede final
+beta.2 installed-package and public-acquisition acceptance.
+
+Stripe test-mode access remains unavailable; real decline/SCA, tax/discount and
+the full financial-transition matrix are not verified. No new live purchase or
+end-to-end paid task continuation is claimed. Browser screenshot capture remains
+unavailable. Local terminal acceptance initially showed event-stream timing
+failures; the subsequent full installed-package run passed all 28 probes/scenarios
+with the pinned beta.1 runtime, as did CI package acceptance. Final beta.2 draft
+acceptance against its own manifest and assets is still required.
+
+Verified-delivery rewards remain 25 coins, 100 XP and 1 km per eligible claimed
+delivery, up to three per UTC day. Daily classifier assessments remain unrewarded.
+
+## Planned release channel
+
+The candidate targets npm `next` and the beta updater channel. Stable `latest`
+remains 1.0.7. Exact installation and update instructions will be verified after
+the immutable release and its five runtime archives are published.
+
+Runtime prebuild: [41505735348](https://github.com/B-icy/Carthagent/actions/runs/41505735348),
+source `d999644028ed0c0dc70bcaf58060db4018278e48`. The runtime recipe remains
+combined-v5 on upstream `843a6c514e606b436a7fe713422ace0a93ad3d61`, compatibility
+2.0.32. The final package must pin the generated archive and executable digests.

package/docs/release-notes-native-draft.md

@@ -0,0 +1,73 @@
+# Draft release notes: native OpenCode migration
+
+> **UNRELEASED — draft only.** Planned version: **1.1.0**. No tag or release
+> has been published.
+> This document is not a release announcement and does not imply that the
+> native default switch or full product acceptance is complete. The packaged
+> five-platform runtime manifest is a reviewed candidate; publishing assets
+> and passing release gates are still pending.
+
+## Proposed highlights (subject to acceptance)
+
+- Native OpenCode project, task, worktree, and session workflow with Carthagent
+  delivery status and workspace context.
+- Carthagent-owned OpenCode runtime and profile, isolated from the user's normal
+  OpenCode configuration, service, credentials, data, and sessions.
+- Headless execution with text output or selected-session JSONL lifecycle
+  events, plus workspace delivery status in JSON.
+- Read-only access to legacy Pi transcripts through archive list, search, read,
+  and export commands. No transcript import or continuation is provided.
+- Existing command names and aliases retained where supported by the native
+  CLI compatibility layer.
+
+## Migration and compatibility notes
+
+- In this candidate, native execution remains opt-in with `CTG_NATIVE=1`.
+  Without the variable, the existing CLI remains the default. Making native
+  execution the default is pending UI tests and the remaining migration and
+  release acceptance gates; do not set the variable persistently unless that
+  routing is intentional.
+- The native runtime uses the package-owned OpenCode 2.0.32 executable and CTG's
+  isolated profile. It does not update or reuse regular OpenCode installations
+  or credentials.
+- Legacy Pi session files are read-only archives; they cannot be resumed,
+  continued, or imported as native OpenCode sessions.
+- Unsupported options fail closed. In the current adapter, `--bash-cap` and
+  `--isolate` are unsupported, and budget or policy options require advertised
+  enforcement capabilities.
+- Acceptance is not complete. See the [migration ledger](opencode-migration.md),
+  [compatibility matrix](native-compatibility.md), and
+  [terminal evidence status](native-terminal-semantics.md#evidence-status-pr-162)
+  for unresolved gates. Do not describe this migration as generally available
+  until release ownership confirms those gates and the installed product.
+
+## Install/update (for a future published release only)
+
+After the planned release passes acceptance and is published, the
+documented exact-tag npm installation form is:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#vX.Y.Z
+```
+
+Replace the placeholder only with the real published release tag. Version
+`1.1.0` is planned, but no final tag has been created. This candidate packages
+the reviewed immutable owned-runtime manifest for five platforms, pinned to
+OpenCode source revision `843a6c514e606b436a7fe713422ace0a93ad3d61` and runtime
+identity `0.0.0-ctg.2.0.32`. The assets still need to accompany a draft release
+and pass final release verification and installed acceptance. The composed
+preview resolves upstream `@opencode/cli@2.0.32` through Node's package resolver,
+including npm-hoisted layouts; that preview dependency is distinct from CTG's
+owned runtime identity. Performance, UI tests, native-default acceptance, and
+full installed acceptance remain open in the
+[migration ledger](opencode-migration.md#delivery-ledger).
+The shared native update operation supports npm-installed packages and clean
+source clones: for a clone it fetches the selected origin tag into a private ref
+before checking out its resolved commit, and refuses dirty clones. Do not infer
+that every native command surface is wired to this operation. `ctg update`
+updates Carthagent, not a user's regular OpenCode installation, and does not
+change the native opt-in default. See the
+[upgrade guide](native-upgrade.md#release-installation-and-update) for the
+current command-path distinction. Native migration acceptance remains open; do
+not infer completion of unrelated CLI, UI, or transport follow-ups not yet
+composed here.

package/docs/release-notes-preview.10.md

@@ -0,0 +1,121 @@
+# 1.1.0-preview.10 release candidate
+
+> **NOT YET PUBLISHED — candidate guidance, not a release announcement.**
+> Published preview.9 remains immutable. This candidate still needs its final
+> tag, draft/assets, exact-tag installed default-resolver acceptance, public
+> release, and anonymous public default-resolver acceptance. No stable release
+> or stable control-plane update is part of this candidate.
+
+## What changes
+
+Native remains the default `ctg` interface; `ctg native` is a compatibility
+alias. Ship retains approval, checks, review, repair, recovery and resume; Lite
+remains direct execution. Stable 1.0.7 retains the legacy console, and legacy
+Pi transcripts remain read-only archives. The owned native profile remains
+separate from other coding-tool credentials and sessions.
+
+**Native daily coding quests (PR #227)** are available through `/voyages` →
+**Daily coding quests**, using normal Carthagent Ship device sign-in:
+
+- Select a server assignment and individual evidence from an owned session's
+  exact active Ship report, or supply a clearly labeled manual claim. Nothing
+  is selected by default. Edit/redact sensitive text yourself; there is no
+  automatic secret-scrubbing guarantee or whole-project/transcript upload.
+- Inspect the complete canonical outbound JSON. Editing invalidates that exact
+  preview. Submission requires fresh, explicit consent for this request and
+  disclosure of external **JEV** processing. Login or completing local delivery
+  is not consent; cancel does not send. Identity/connection/location invalidation
+  clears the draft/consent and returns the action selection to **Refresh**.
+- The exact request and stable submission ID are durably journaled before send.
+  Recover an uncertain send by **GET/status first**; read-only refresh/poll never
+  replays. Any explicit replay uses the saved ID and exact body, not a new ID.
+  Journal failure fails closed; accepted IDs remain usable across restart.
+- Acceptance is not completion. Local raw payloads are erased on known
+  acceptance; unknown-send payloads expire after up to 24 hours on journal
+  access, not a background timer. Explicit local erasure retains polling IDs
+  and cannot withdraw evidence already sent. Backend raw evidence is erased
+  on terminal processing (pending up to 24 hours; outages can delay cleanup);
+  metadata retention is 90 days. Immediate provider/backup deletion is not promised.
+- Graded decisions assess submitted evidence, **not independent verification**.
+  Scores are not calibrated confidence. There are **no coins, XP, distance,
+  inventory or other rewards**; personal quests remain separate.
+
+See [native daily quest guidance](native-daily-quests.md) for schema, privacy,
+retention, consent and recovery details.
+
+## Candidate provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package candidate | `1.1.0-preview.10` |
+| Feature source head | `5e759c4c4d21b1df10ecdcd130ad59cd377bcc15` |
+| Original prebuild source | `7a9d49fe7e2dcc8358a4c28e3539479df5be55a1` |
+| Prebuild workflow run | `40950483282` |
+| Full manifest SHA-256 | `2d4adee543f5dec37abf8a67c677cecfc5de294031a1c37d23fea43bc90fe757` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch SHA-256 | `b4238d77827d7ccf8f87fb0326551eaa62268d9387cd89e29bd0cf12bd6dafaa` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Runtime / compatibility | `0.0.0-ctg.2.0.32` / `2.0.32` |
+
+All five prebuilds succeeded: Linux x64/arm64, macOS x64/arm64 and Windows x64.
+The original **13-file bundle** was independently verified through the
+production acquirer, with byte-identical manifest regeneration. Runtime,
+upstream, patch and lock identities are unchanged, but this manifest pins the
+**fresh five-platform archive and executable hashes**, not preview.9 hashes.
+Prebuild provenance is not final package identity or installed acceptance.
+
+## Recorded evidence and limits
+
+These are supplied source/development-runtime results, not tests rerun by this
+version/docs preparation and not exact-candidate installed acceptance.
+
+- **Source quality at `5e759c4`: 1,069 passed, 0 failed, 5 skipped.** The first
+  historical quality run had 1,068 passed, 1 failed, 5 skipped: a legacy
+  dashboard 401-versus-403 assertion of unknown cause. Isolated and serial runs
+  passed; that does not establish a causal fix. Feature-head normal
+  [PR CI40951839410](https://github.com/B-icy/Carthagent/actions/runs/40951839410)
+  and [push CI40951831992](https://github.com/B-icy/Carthagent/actions/runs/40951831992)
+  both passed all eight jobs. Release-candidate CI remains a separate gate.
+- **Actual native daily flow:** one authorized provider attempt reached graded
+  `needs_evidence`, not quest completion or rewards. Raw-payload erasure and
+  read-only polling after an actual client restart passed. Genuine background
+  cancellation notice, reset to Refresh, and delayed Enter behavior passed.
+  Unknown network-send replay was not forced live; that coverage is offline only.
+- **Actual native wallet flow:** fresh normal device approval; cancel made no
+  purchase and left 50 coins. One explicitly authorized 40-coin `bottoms:shorts`
+  purchase left 10 coins, owned items 9 → 10 and profile version v1 → v2.
+  Actual client restart preserved it; equipment was unchanged. This is not a
+  daily-quest reward or proof of live unknown-response purchase replay.
+- **Website browser E2E blocked:** Chrome was missing and one install attempt
+  failed because Linux ARM64 was unavailable. Public Voyages HTTP 200 is not
+  signed-in browser proof.
+- **Native-host CI caveat:** the initial `7a9d49f` PR macOS Node 24 service-stop
+  5,000 ms timeout is not causally fixed. New failure-only diagnostics leave
+  deadlines and assertions unchanged; review returned no findings (`[]`) and
+  Linux native-host passed. Both later feature-head CI runs passed, including
+  macOS Node 22/24; that is gate evidence, not a causal shutdown fix or full
+  cross-platform interactive UI proof.
+
+## Trying it and remaining gates
+
+Before publication, use only reviewed artifacts with the
+[explicit manual-kit method](native-manual-testing.md); do not weaken hashes or
+expect the public default resolver to find unpublished assets. No claim is made
+that this exact candidate has passed installed-package acceptance.
+
+Only **after publication** of the final tag and reviewed assets:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.10
+# Or select published experimental releases (possibly a later preview):
+ctg update --channel experimental --check
+ctg update --channel experimental
+```
+
+Drafts are not updates. Experimental releases never advance the stable pointer.
+Final package/manifest review, final CI, tag/draft/assets, exact-tag installed
+acceptance with the normal resolver, publication and anonymous public installed
+acceptance remain release gates. See the [upgrade guide](native-upgrade.md) for
+profile preservation and stable-channel recovery. Historical
+[preview.9 notes](release-notes-preview.9.md) are retained unchanged, not current
+candidate status or evidence that immutable preview.9 gains these changes.

package/docs/release-notes-preview.11.md

@@ -0,0 +1,76 @@
+# 1.1.0-preview.11 experimental release
+
+Experimental preview. Install it explicitly with the experimental channel;
+stable 1.0.7 is unchanged and published preview.10 remains immutable.
+
+## What changes
+
+**Projects / Voyages left pane (PR #230).** On a wide enough terminal the left
+rail has two modes, **Projects** (the existing session list) and **Voyages**.
+
+- Switching modes keeps the current page. It does not create, interrupt, or
+  close a coding session, and it does not change the session or draft.
+- The Voyages navigator shows read-only profile and daily assignment
+  summaries. Select an entry explicitly to open its detail page. Opening a
+  quest does not compose evidence or grant consent. **Return to coding** opens
+  the selected session, or Home when no session is selected.
+- Each mode keeps its own selection and scroll position, and the chosen mode
+  is restored after a normal restart (without reopening a detail page).
+- **Focus pane** (or the configured shortcut) moves keyboard focus into the
+  pane; `Escape` returns focus to the page. Clicking a page control while the
+  pane is focused keeps focus on that control.
+- The compact rail uses `Q` (quests), `P` (profile), `E` (equipment),
+  `R` (refresh), `S` (sign in) and `B` (return to coding); numbered rows are
+  actual assignments. When the terminal is too narrow for the rail, use the
+  command palette, `/voyages`, or `/quests`.
+- Badges and friends have no native views yet. The pane never invents links or
+  data the server did not return.
+
+**Dialog resize fix.** Select dialogs no longer register one terminal-resize
+listener per row, which produced `MaxListenersExceededWarning` in large lists.
+
+Daily coding quests, Ship, Lite and the native default `ctg` interface behave
+as in preview.10. Assessments still award no coins, XP, or other rewards.
+
+## Provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package | `1.1.0-preview.11` |
+| Prebuild source | `47fe2a6d52492f5f614a704605486ec6e8ed9f79` |
+| Prebuild workflow run | [41145521256](https://github.com/B-icy/Carthagent/actions/runs/41145521256) |
+| Full manifest SHA-256 | `6afe56eff1d2d08e798c7e329e817a980f7184a47bbb771c2a3e231eb3687862` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch (combined-v4) SHA-256 | `1f2309bb3a31dfb8e8a0827a6a1144a1f76a005abff58f6f48857639ec02478a` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Runtime / compatibility | `0.0.0-ctg.2.0.32` / `2.0.32` |
+
+All five native prebuilds (Linux x64/arm64, macOS x64/arm64, Windows x64)
+passed the full runtime typecheck and the build recipe's test list in one run.
+
+Two tests that are timing-sensitive on CI were hardened. Neither change touches
+product code:
+
+- `navigation-rail`: waits for the pane's status text to refresh on the next
+  render pass instead of reading it immediately after a click.
+- `plugin-source` (real watchers): confirms the helper watch is live before
+  the atomic save. On the current `macos-15-arm64` runner image, a macOS file
+  watcher can miss a write made immediately after it starts.
+
+## Trying it
+
+```sh
+ctg update --channel experimental --check
+ctg update --channel experimental
+ctg --version   # 1.1.0-preview.11
+```
+
+Or install the exact tag:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.11
+```
+
+`ctg update --channel stable` returns to stable 1.0.7 without `--force`. See
+the [upgrade guide](native-upgrade.md) for profile preservation. Historical
+[preview.10 notes](release-notes-preview.10.md) are retained unchanged.

package/docs/release-notes-preview.12.md

@@ -0,0 +1,55 @@
+# 1.1.0-preview.12 experimental release
+
+Experimental preview. Install it explicitly with the experimental channel;
+stable 1.0.7 is unchanged and published preview.11 remains immutable.
+
+## What changes
+
+**npm package keeps the `ctg` command.** Preview.11 declared its command as
+`./bin/ctg.mjs`. npm 11 treats that path as invalid and removes it during
+`npm publish`, so a registry copy of preview.11 would have installed without a
+`ctg` command. Preview.11 was therefore published on GitHub only. Preview.12
+declares `bin/ctg.mjs` and normalizes the repository URL, so `npm publish` makes
+no corrections to the manifest.
+
+**Release check.** `tools/verify-release-version.mjs` (run by the release
+workflow before anything is uploaded) now runs `npm publish --dry-run` and
+fails if npm would auto-correct or remove any field, if `bin.ctg` is not a
+plain relative path, or if the packed package lacks an executable
+`bin/ctg.mjs`.
+
+Product behaviour, the Projects / Voyages left pane, the native runtime source,
+and the CTG patch are identical to
+[preview.11](release-notes-preview.11.md). The runtime is rebuilt only because
+each runtime manifest is bound to its exact package version.
+
+## Provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package | `1.1.0-preview.12` |
+| Prebuild source | `5c2c8730e140435a5a4f003ff30089efec006453` |
+| Prebuild workflow run | [41156564357](https://github.com/B-icy/Carthagent/actions/runs/41156564357) |
+| Full manifest SHA-256 | `b29fb261d88d052593421a42d4100d515b6b48454ca687ebdeceef9b32743742` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch (combined-v4) SHA-256 | `1f2309bb3a31dfb8e8a0827a6a1144a1f76a005abff58f6f48857639ec02478a` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Runtime / compatibility | `0.0.0-ctg.2.0.32` / `2.0.32` |
+
+## Trying it
+
+```sh
+ctg update --channel experimental --check
+ctg update --channel experimental
+ctg --version   # 1.1.0-preview.12
+```
+
+Or install the exact version from npm or the exact tag:
+
+```sh
+npm install -g carthagent@1.1.0-preview.12
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.12
+```
+
+`ctg update --channel stable` returns to stable 1.0.7 without `--force`. See
+the [upgrade guide](native-upgrade.md) for profile preservation.

package/docs/release-notes-preview.13.md

@@ -0,0 +1,68 @@
+# 1.1.0-preview.13 experimental release
+
+Experimental preview. Install it explicitly with the experimental channel;
+stable 1.0.7 is unchanged and published preview.12 remains immutable.
+
+## What changes
+
+**Directory-first Projects rail.** The native left rail is organized around
+folders: a current-folder card with Browse, New session and model controls,
+distinct folder and group headings, and an active-session marker. A
+folder-browser dialog adds Back, Forward, Up, Home, direct paths and
+filtering, with async cancellation, exact path handling and preserved drafts.
+
+**Shared folder/model setup for new sessions.** Global and per-folder New
+session entries route through one setup flow. The session is created only on
+the first send, keeping the chosen folder, agent, model and applicable
+variant; unavailable selections are blocked instead of silently substituted.
+Pre-session `/model` is supported.
+
+**Isolated source-preview launcher.** `script/ctg/source-preview.sh` runs the
+checked-in development patch against its own profile for verification without
+touching the published runtime or its caches. The combined-v5 patch is a
+replacement patch: it contains all of combined-v4 plus these sources and
+their tests, and applies directly to the pinned upstream.
+
+The upstream revision, lockfile and detached runtime identity are unchanged
+from preview.12; the runtime is rebuilt because each runtime manifest is
+bound to its exact package version.
+
+**Ship and Voyages follow-up fixes.** Beam replay requests include the required
+nonempty reasoning placeholder when earlier assistant messages have no recorded
+reasoning. The delivery plan entry point stays visible in the code-mode catalog,
+and final review accepts single-assertion aliases and assertion arrays. Voyages
+and quest lists activate on mouse release so newly opened dialogs remain open;
+rail clicks select the intended quest and respect modal focus.
+Delivery tool guidance explicitly identifies JSON-text responses and requires
+relative file paths for promised outputs, avoiding prose-as-filename contracts.
+
+## Provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package | `1.1.0-preview.13` |
+| Prebuild source | `e5de273811a11c2f8678b54605c0068ab8cfcf38` |
+| Prebuild workflow run | [41380550073](https://github.com/B-icy/Carthagent/actions/runs/41380550073) |
+| Full manifest SHA-256 | `5083dbe10b6f4be2550ab0abb04c9299197dacabe4b9d3556bd3b03fc9f6151a` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch (combined-v5) SHA-256 | `ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Runtime / compatibility | `0.0.0-ctg.2.0.32` / `2.0.32` |
+
+## Trying it
+
+```sh
+ctg update --channel experimental --check
+ctg update --channel experimental
+ctg --version   # 1.1.0-preview.13
+```
+
+Or install the exact version from npm or the exact tag:
+
+```sh
+npm install -g carthagent@1.1.0-preview.13
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.13
+```
+
+`ctg update --channel stable` returns to stable 1.0.7 without `--force`. See
+the [upgrade guide](native-upgrade.md) for profile preservation.

package/docs/release-notes-preview.9.md

@@ -0,0 +1,130 @@
+# 1.1.0-preview.9 release candidate
+
+> **UNPUBLISHED — candidate guidance, not a release announcement.** No tag,
+> draft creation, asset upload, or publication is part of candidate preparation.
+> Published-channel updates cannot install this prebuild. Final-tag acceptance
+> and release-owner approval remain required before publication.
+
+## What this candidate contains
+
+- **Native by default**, inherited from preview.8. `ctg native` remains a
+  compatibility alias; `CTG_NATIVE` no longer selects another console. Stable
+  1.0.7 remains the legacy release. The owned runtime and private CTG profile
+  remain separate from regular OpenCode installations and credentials. Legacy
+  Pi sessions remain read-only archives, not resumable native sessions.
+- **Ship versus Lite:** Ship retains approval, checks, review, repair, recovery,
+  and resume delivery workflow; Lite is direct execution. This is not a claim of
+  complete behavioral parity across all interfaces or platforms.
+- **Native Voyages (PR #225):** `/voyages` exposes profile customization, wallet,
+  equipment and shop. Normal `/login` browser device approval binds the CLI to
+  the approving user's existing web player, which remains authoritative. There
+  is no separate CLI wallet, cookie import, paid-model requirement, or coding
+  coin award. Older account-only credentials may need a new device sign-in.
+- **Explicit mutations:** customization and equipment changes require
+  confirmation. A paid purchase requires a server quote with price and expiry,
+  followed by explicit confirmation. Cancel does not purchase. Ownership,
+  funds, eligibility and profile version are checked by the server; refresh on
+  conflicts rather than overwriting another client. Equip separately after
+  purchase. An uncertain purchase retains its pending request across restart:
+  recover using the same quote and request key, not a new purchase or deleted
+  profile state. Signed-out/unavailable data is not a saved balance.
+- **Credential refresh identity and coordination fixes** preserve account
+  identity boundaries and coordinate refreshed credentials rather than treating
+  unrelated identity or stale state as a successful refresh.
+- **PTY and Windows cleanup fixes** preserve full-duplex terminal input and
+  coherent paint snapshots, and verify fixture browser cleanup against captured
+  process identities. Passing source tests is not proof
+  of every physical terminal or operating-system UI interaction.
+
+## Candidate provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package candidate | `1.1.0-preview.9` |
+| Prebuild source | `c51c5ae11293e63b658df297abc732db88d9109a` |
+| Prebuild workflow run | `40151970983` |
+| Candidate manifest SHA-256 | `aa5de65b633219423d21b1cc645945028a2d5565714b71760cbcc18badc5f4e5` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch SHA-256 | `b4238d77827d7ccf8f87fb0326551eaa62268d9387cd89e29bd0cf12bd6dafaa` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Detached runtime version | `0.0.0-ctg.2.0.32` (compatibility `2.0.32`) |
+
+All five native builds (Linux x64/arm64, macOS x64/arm64, Windows x64) and
+assembly succeeded. The **original 13-file prebuild bundle** was independently
+verified through the production acquirer; manifest regeneration was
+byte-identical. Upstream, patch, lock, and detached runtime identity are
+unchanged from preview.8. The prebuild source above is not the final release
+package commit: package/lock, complete generated manifest, and candidate docs
+must be reviewed together before any final tag is selected.
+
+Archive/provenance verification is not execution acceptance. The new Linux
+ARM64 bytes passed isolated staged native-host and Ship-model probes, including
+plugin/RPC contracts, device-flow start/cancel, model discovery, service stop,
+and fixture cleanup. These use an explicit reviewed-artifact selector, not the
+installed package's default resolver. Independent execution on the other four
+targets and full final-tag installed acceptance remain pending. Earlier preview.8
+source and artifact evidence remains historical and is not blanket acceptance
+for preview.8 or preview.9.
+
+## Recorded acceptance and its limits
+
+The following supplied source/development-runtime results precede final-tag
+release acceptance; they are not a claim that candidate-document edits reran CI.
+
+| Scope | Recorded outcome |
+| --- | --- |
+| Final source quality, Linux | 934 tests: 929 passed, 5 skipped |
+| Windows-only cases | Four of the Linux-skipped cases actually passed Windows CI |
+| Python | 28 passed |
+| Local ARM full required-owned/default-resolver gate | 28 probes, 0 failures, 0 skips |
+| Exact source PR CI and main CI | All eight checks passed in each |
+
+The local ARM result does not establish independent execution of the new
+preview.9 prebuild bundle or its future final-tag public assets.
+
+Live **actual TUI development-runtime** testing covered browser device approval,
+name cancellation and save, owned Beanie equip, restart, web persistence,
+expiry recovery, and revocation. The web player was authoritative. The user's
+wallet contained **10 coins**, with no affordable paid quote: **no live paid
+debit or paid-request replay was proven**. Do not turn pending-recovery test
+coverage into a claim of a real paid purchase.
+
+Actual **60x12** terminal navigation was functional, not model-based visual
+approval. Physical clipboard behavior is not proven. Full cross-OS UI and
+controlled paired performance remain unknown. There is no full behavior-parity,
+lower-token/cost, or paid-model benchmark claim.
+
+## Trying the candidate and remaining release gates
+
+Before publication, use the matching prebuild archives and independently pinned
+candidate manifest through the [explicit manual-kit artifact method](native-manual-testing.md).
+Do not replace trust hashes to accept other bytes or expect the public default
+resolver to find unpublished assets. Provider-free fixtures are scripted, not
+model-quality evidence; live provider use requires deliberate credential and
+spending authorization.
+
+Only **after** `v1.1.0-preview.9` and its reviewed runtime assets are published:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.9
+# Or, from an installation supporting channels:
+ctg update --channel experimental --check
+ctg update --channel experimental
+```
+
+Experimental selection follows published semantic versions and may select a
+later release; use the exact tag when reproducing preview.9. Drafts are never
+updates, and prereleases do not advance the stable control-plane pointer.
+See the [upgrade guide](native-upgrade.md) for non-destructive source checkout,
+profile preservation, and stable-channel recovery.
+
+Still pending: independently execute the other four platform outputs; review the final
+package and manifest; obtain separate approval for the tag/draft/upload steps;
+run full final-tag required-owned installed acceptance against the draft using
+the normal resolver; obtain publication approval; then prove anonymous public
+default-resolver installed acceptance. No backend edits or publication actions
+are included in this version/pins/documentation candidate update.
+
+The [older native migration draft](release-notes-native-draft.md) is preserved
+unchanged as historical planning material, including its old opt-in routing and
+unreleased-version assumptions. It is not current candidate installation guidance.