projmux 0.14.2 → 0.15.0

package/docs/codex-installed-compatibility.md

@@ -0,0 +1,69 @@
+# Installed Codex compatibility (legacy observation)
+
+The machine-readable ledger is retained as historical liveness evidence only.
+It is **not** capability authority for `durable-zero-turn-resume` or
+`remote-new-session`; those predicates require the exact executable tuple and
+the Phase-1 conformance record described in
+[`codex-native-required-migration.md`](codex-native-required-migration.md).
+The legacy [`codex-installed-capabilities.json`](codex-installed-capabilities.json)
+schema separates method evidence from the semantic result:
+
+- `method` records the CLI/RPC spellings used by one observation. Changing a
+  wire method does not itself change capability support.
+- `result` is exactly `supported`, `unsupported`, or `infra-error`.
+  An unavailable endpoint and incomplete evidence are infrastructure errors,
+  never evidence that the upstream capability is unsupported.
+- `evidence` contains only content-free semantic facts. A supported turn-free
+  attach requires an exact living tmux Pane and the same no-turn thread to stay
+  loaded with runtime state `idle` or `active` after the creator connection is
+  closed.
+- `versions` independently records the installed CLI, managed payload, and
+  running app-server tuple. `last_observed` names the canonical probe and run.
+
+## Last observation
+
+On 2026-09-02, installed tuple `0.152.0 / 0.152.0 / 0.152.0` produced a living
+Pane observation for the old `turn-free-thread-live-attach` predicate. It is
+now classified `infra-error/evidence-incomplete`, because liveness plus
+`thread/loaded/list` did not prove stored resume and did not observe the exact
+remote-new thread's first real turn. The canonical
+`TestInstalledIsolatedPreTurnBootstrapSmoke` created a thread without a turn,
+observed it in `thread/loaded/list`, started `codex resume --remote unix://` in
+an exact isolated tmux Pane, closed the creating connection, then passed two
+fresh loaded/runtime observations while the exact Pane remained alive. Runtime
+status was `idle`; model, turn, and network calls were zero.
+
+The checked-in observation preserves exact branch-head facts from hosted
+[Actions run 33566050834](https://github.com/crevissepartners/projmux/actions/runs/33566050834),
+attempt 1. Aggregate artifact `9823166206`
+(`installed-codex-qualification-33566050834-1`) is the durable last
+observation. It must not be cited as payload-free support.
+
+The observation historically extended the earlier `pre-turn-attach` owner.
+That hosted evidence remains run `33560743314`,
+aggregate artifact `9821171919`, where the same tuple's direct pre-turn
+qualification was `pass`. Neither pass is an input to the new exact
+payload-free capability authority.
+
+Scheduled and manual `Installed Codex Qualification` artifacts use
+qualification schema v2 and embed this schema-versioned capability ledger.
+`PROJMUX_CODEX_EVIDENCE_RUN` records the exact Actions run/attempt; this ledger
+records `github-actions:33566050834:1`.
+
+## Canonical test list
+
+- `TestCapabilityReducerSeparatesMethodFromSemanticResult` — method changes do
+  not alter supported/unsupported/infra-error reduction.
+- `TestCapabilityReducerKeepsUnavailableEndpointAsInfraError` — an unavailable
+  endpoint cannot become unsupported.
+- `TestInstalledIsolatedPreTurnBootstrapSmoke` — historical owner for
+  turn-free start/read/loaded observation and live-Pane liveness; not a
+  payload-free support verdict.
+- `TestInstalledExactPayloadFreeCapabilityMatrix` — exact private owner for
+  zero-turn start/read/stored-resume plus content-free remote-new liveness. It
+  sends no input or turn, so remote-new remains unknown.
+- `TestInstalledCensusDeletionReceiptHasOneOwnerPerPrimitive` — topology and
+  protocol ownership plus the Phase 2 merge receipt.
+
+The maintained repository-wide list in `docs/agent-workflow.md` records the
+current Phase-1 authority separately.

package/docs/codex-native-required-migration.md

@@ -1,4 +1,83 @@
-# Codex Native-Required Create Migration (0.14.0)
+# Codex Native-Required Create and Payload-Free Fallback
+
+## Current payload-free behavior (Codex 0.153.0)
+
+`projmux create codex` and `projmux create agent --provider codex` with no
+payload now open one managed plain-interactive Pane and return one Running
+Agent for each exact target. The same pre-provider decision is used by the AI
+picker's default launch intent. Projmux does not call app-server `Current` or
+`Resolve`, start a thread or turn, or enter a durable-resume barrier for this
+shape. The current Codex 0.153.0 tuple cannot durably hand a zero-turn thread
+to an independent TUI, so a native attempt cannot be a prerequisite for a
+usable payload-free create.
+
+This automatic fallback uses the same provider argv and output as the existing
+payload-free `--interactive-only` lane. It is distinguishable only through the
+content-free lifecycle declaration `payload-free-fallback`: `describe agent`
+shows it as `LifecycleDeclared`, and Doctor reports the aggregate
+`payload_free_fallback` count. No prompt, hidden turn, transcript content, or
+provider response is stored to produce that signal.
+
+The Phase-7 zero-turn durable-readiness failure is retained only as historical
+negative safety evidence. A typed Failed Agent with no Pane is not functional
+create success. Prompted native create, app-server picker resume, existing
+Agent resume, and generation-pinned routes keep their native contracts.
+
+## Exact payload-free capability authority (Phase 1)
+
+Payload-free qualification is now owned by
+`internal/integrations/agents/codexgeneration`. A record is valid for exactly
+one tuple: RoleTUI binary SHA-256 and size, RoleAppServer binary SHA-256 and
+size, app-server version, protocol transport/schema, private socket locator and
+bound-runtime digests, state-domain identity/path digest, and platform/arch.
+Changing any one axis is a cache miss. A missing, corrupt, trailing, future
+schema, stopped, or rebound tuple projects `unknown` and the Phase-0
+`plain-fallback`; no semver family, changelog, or successful `thread/read` is an
+authority substitute.
+
+The record reduces two independent executable predicates:
+
+- `durable-zero-turn-resume` requires the same hashed exact thread to pass
+  zero-turn start, independent read, and stored resume. Read visibility alone
+  cannot promote it. Exact 0.153.0 private evidence is read-visible but stored
+  resume is `unsupported/no-rollout-found`.
+- `remote-new-session` requires more than a living TUI. The remote-new thread
+  and the exact first real input's thread must match, the turn identity must be
+  present, and the content-free turn cardinality must be exactly one. An
+  unrelated first-turn event or liveness-only observation stays `unknown`.
+
+Evidence stores timestamps, digests, closed outcomes, cardinality, and boolean
+identity facts only. It has no field for prompts, provider output, turns,
+transcripts, socket paths, or state paths. Doctor JSON/text and the create
+planner consume the same immutable record projection. Phase 1 intentionally
+maps every verdict—including a supported private observation—to
+`plain-fallback`; the remote-new production launch belongs to Phase 2.
+
+The private installed matrix is opt-in and starts/stops only exact root-owned
+app-server and tmux fixtures:
+
+```sh
+smoke_root="$(mktemp -d /tmp/projmux-payload-free-XXXXXX)"
+env -u TMUX -u TMUX_PANE \
+  PROJMUX_CODEX_PAYLOAD_FREE_SMOKE_ROOT="$smoke_root" \
+  PROJMUX_CODEX_PAYLOAD_FREE_SOURCE_HOME=/absolute/private/copied-source-home \
+  PROJMUX_CODEX_PAYLOAD_FREE_0152_0=/absolute/0.152.0/bin/codex \
+  PROJMUX_CODEX_PAYLOAD_FREE_0152_1=/absolute/0.152.1/bin/codex \
+  PROJMUX_CODEX_PAYLOAD_FREE_0153_0=/absolute/0.153.0/bin/codex \
+  go test ./internal/testutil/codexinstalled \
+    -run '^TestInstalledExactPayloadFreeCapabilityMatrix$' -count=1 -v
+```
+
+An unset binary row is logged `unavailable`; the fixture never synthesizes a
+tuple. The installed probe sends no input, prompt, or turn. It may record
+content-free TUI liveness/loaded state, but remote-new remains `unknown`
+without a separately supplied exact first-real-input thread/turn observation.
+Use the documented short smoke-root shape: an overlong private tmux socket path
+is rejected before any lifecycle operation and cannot masquerade as liveness.
+After fixture cleanup the socket has no current route identity, so transient
+private evidence cannot be reused by another route.
+
+## Native-required prompted create (0.14.0)
 
 0.14.0 makes native authority a requirement for a *prompted* managed Codex
 create instead of something projmux attempts and silently gives up on. Where an
@@ -37,7 +116,7 @@ Exactly one create shape is native-required. All five conditions must hold:
 - `--interactive-only` is not passed, and
 - the create is not carrying a capability selection from the split-UI picker.
 
-Anything outside that shape keeps its previous behavior unchanged. The closed
+The payload-free exception above is selected before this gate. The closed
 outcome table lives in `internal/app/codex_native_thread.go`
 (`codexNativeLaunchOutcomeTable`) and is pinned by
 `TestCodexNativeLaunchOutcomeTableIsClosed`.
@@ -120,9 +199,10 @@ rather than the app-server are unaffected and keep the current CLI lane.
 
 ## The escape hatch: `--interactive-only`
 
-`--interactive-only` is the only public spelling that asks for a plain
-interactive Codex Agent with no native thread binding, and it is the only way to
-reach the plain CLI lane on purpose.
+`--interactive-only` remains the only public spelling that explicitly asks for
+a plain interactive Codex Agent with no native thread binding. Payload-free
+fresh create now chooses that existing lane automatically, without changing the
+flag's spelling or prompted-create meaning.
 
 ```sh
 projmux create codex --interactive-only -- "interactive task"
@@ -151,8 +231,8 @@ projmux create agent --provider codex --interactive-only -- "interactive task"
 | Surface | Behavior |
 | --- | --- |
 | `projmux agent resume` | unchanged. A stored Agent whose native resume cannot be proven keeps its existing safe fallback to one provider resume of the stored conversation. `internal/app/agent_resume.go` has a net diff of zero lines in this release. |
-| Empty-prompt Codex create (`projmux create codex` with no payload) | unchanged byte-for-byte, including argv, hook acknowledgement, output, and late refinement. An empty prompt is not attachable native input, so it was never in the gated shape. |
-| Multi-operand payload (`projmux create codex -- a b`) | unchanged. The legacy CLI owns provider parsing for a multi-operand payload, so it is not a native create candidate and keeps the plain lane. |
+| Payload-free Codex create (`projmux create codex` with no payload) | pre-provider plain fallback: one usable managed Pane and one Running Agent per exact target, with zero native thread/turn/resume-barrier calls and the content-free `payload-free-fallback` declaration. |
+| Multi-operand payload (`projmux create codex -- a b`) | unchanged refusal. Native `turn/start` accepts one text item; Projmux does not join operands or silently reinterpret them as a plain fallback. |
 | Claude and Antigravity | unchanged lifecycle, fan-out, and hook activation contract. |
 | Public hook env and payload schema | unchanged. |
 | Post-thread-creation failures | unchanged. A native failure *after* `thread/start` returned still refuses without offering any second lane — including `--interactive-only` — because starting another Codex process could submit the same prompt twice. |
@@ -160,7 +240,7 @@ projmux create agent --provider codex --interactive-only -- "interactive task"
 ## Verifying this yourself
 
 ```sh
-go test ./internal/app/ -run 'TestCodexInstallCapability|TestInteractiveOnlyIsTheOnlyPlainCodexLaneAndBothSpellingsAreEquivalent|TestDefaultNativeCodexFanOutRefusesWithZeroMutationsAndInteractiveOnlyKeepsCardinality|TestEmptyPromptCodexCreateIsByteForByteUnchangedByTheNativeRequiredGate|TestClaudeAndAntigravityLifecycleAndHookContractAreUnchangedByTheNativeGate|TestUnavailableNative|TestCodexNativeLaunchOutcomeTableIsClosed'
+go test ./internal/app/ -run 'TestCodexCreatePayloadCardinalityInteractiveOnlyAndReadinessOutcomeTable|TestPayloadFreeCodexCreateUsesSafePlainFallbackAndInteractiveOnlyEquivalentLane|TestPayloadFreeCodexPlainLaunchFailureRollsBackWithoutProviderMutation|TestEmptyPromptCodexSplitProducersKeepOnePlainCLILane|TestPromptedNativeCodexCreateIssuesOneTurnAndNeverRepeatsThePromptInPaneArgv|TestNativeResumePicker|TestUnavailableNativeResume|TestClaudeAndAntigravity|TestCodexNativeLaunchOutcomeTableIsClosed'
 go test ./internal/integrations/agents/codexappserver/ -run TestStartDefaultThread
 ```
 
@@ -172,7 +252,16 @@ go test ./internal/integrations/agents/codexappserver/ -run TestStartDefaultThre
 | Picker resume refuses instead of rebinding onto the rollout lane, and offers no launch-mode escape hatch | `TestUnavailableNativePickerResumeRefusesInsteadOfRebindingOntoTheRolloutLane` |
 | `agent resume` keeps its safe fallback to one provider resume | `TestUnavailableNativeResumeKeepsTheStoredConversationOnTheProviderResumeLane` |
 | Both `--interactive-only` spellings are equivalent, and non-Codex providers refuse it at zero transactions | `TestInteractiveOnlyIsTheOnlyPlainCodexLaneAndBothSpellingsAreEquivalent` |
-| Empty-prompt create is unchanged | `TestEmptyPromptCodexCreateIsByteForByteUnchangedByTheNativeRequiredGate` |
+| Payload cardinality × `--interactive-only` × readiness stays a closed pre-provider decision table | `TestCodexCreatePayloadCardinalityInteractiveOnlyAndReadinessOutcomeTable` |
+| Canonical and shortcut payload-free create are byte/argv-equivalent to the explicit plain lane and touch no provider route | `TestPayloadFreeCodexCreateUsesSafePlainFallbackAndInteractiveOnlyEquivalentLane` |
+| Exact tuple keys, immutable cache fixed points, and one-axis drift/corrupt/future/trailing fail closed | `TestCapabilityCacheInvalidatesEveryExactTupleAxis`, `TestCapabilityCacheCorruptFutureAndTrailingRecordsResolveUnknown` |
+| Read visibility and stored resume reduce independently; remote-new requires the exact first real thread/turn | `TestExactPayloadFreeCapabilitySeparatesReadVisibleFromStoredResumable`, `TestRemoteNewCapabilityRequiresExactFirstRealInputThreadAndTurn` |
+| Doctor and create plan consume byte-semantic identical capability projections while Phase 1 stays plain | `TestCodexPayloadFreeDoctorAndCreatePlannerShareExactRecordProjection`, `TestCodexPayloadFreeUnknownCapabilityCannotBypassPhaseZeroFallback` |
+| Available exact installed binaries are qualified independently in creator-live/closed private rows | `TestInstalledExactPayloadFreeCapabilityMatrix` |
+| Saved-default, provider-picker, and direct-provider AI intents produce one managed plain lane without native mutation | `TestEmptyPromptCodexSplitProducersKeepOnePlainCLILane` |
+| A failed plain launch rolls Registry and tmux back and never tries a provider lane | `TestPayloadFreeCodexPlainLaunchFailureRollsBackWithoutProviderMutation` |
+| The installed outcome requires a Running plain Agent/Pane, no session ref, zero provider-thread delta, diagnostic signals, isolated socket cleanup, and ambient mutation zero | `TestInstalledPayloadFreePlainFallbackOutcomeSmoke` |
+| Phase-7 readiness failure remains negative safety evidence rather than functional create success | `TestPhase7PayloadFreeReadinessFailureIsNegativeSafetyEvidenceOnly`, `TestInstalledPayloadFreeCreateOutputClassificationRequiresFunctionalPlainSuccess` |
 | Claude and Antigravity are unchanged | `TestClaudeAndAntigravityLifecycleAndHookContractAreUnchangedByTheNativeGate` |
 | One payload sends exactly one `turn/start` and never repeats the prompt in Pane argv | `TestPromptedNativeCodexCreateIssuesOneTurnAndNeverRepeatsThePromptInPaneArgv` |
 | The post-mutation row still refuses a second lane | `TestIndeterminateNativeCreateRefusesASecondLaneAndWritesZero` |

package/docs/column-profiles.md

@@ -0,0 +1,83 @@
+# Column profiles
+
+Plural Registry reads (`get projects|windows|panes|agents`) now default to
+`NAME STATUS ACTIONS`. The route already selects the resource kind. Runtime
+reads default to their identity, containment, and classification columns. Use `-o wide` (or `--output wide`) to print the full
+column profile. Terminal width and data length never select a profile.
+
+Removing KIND changes these four default tables from four columns to three and
+moves NAME, STATUS and ACTIONS one position left. Existing positional parsers
+can break; request `-o wide` or recover each resource's `kind` from `-o json`.
+Mixed Registry/Runtime pickers keep KIND in both profiles.
+
+Scripts that need diagnostic columns must request `-o wide` or a structured projection explicitly. Registry JSON items
+retain `context.value`, `context.source`, and `context.observed`; `describe` keeps
+resource and termination detail. Existing JSON, metadata, uid, name, ref and none
+projections retain their contracts, as do singular reads and selector cardinality.
+`wide` is accepted only on the seven plural columnar read routes.
+
+| Surface / kind | Default | Wide |
+| --- | --- | --- |
+| Registry Project | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED AGE |
+| Registry Window | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED PROJECT AGE |
+| Registry Pane | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED PROJECT WINDOW AGENT TERMINATION AGE |
+| Registry Agent | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED INTERACTION PROJECT WINDOW SESSION TERMINATION AGE |
+| Runtime Session | SESSION NAME CLASS | SESSION NAME CLASS UID RESOURCE REASON |
+| Runtime Window | WINDOW SESSION NAME CLASS | WINDOW SESSION NAME CLASS UID RESOURCE REASON |
+| Runtime Pane | PANE WINDOW TITLE CLASS | PANE WINDOW TITLE CLASS UID RESOURCE REASON |
+
+Registry defaults omit KIND, CONTEXT, SOURCE, OBSERVED, AGE and each kind's owner-chain,
+INTERACTION, SESSION and TERMINATION diagnostics shown in the wide column above.
+Runtime defaults omit UID, RESOURCE and REASON. Wide retains their full values;
+stdout is unbounded and copyable, including long names, context, provider session
+references and diagnostic reasons. Free text may contain spaces: structured JSON
+is the recovery surface for machine consumers of those values. An empty resource
+list still emits no bytes, while an empty runtime report retains its host and
+availability header.
+
+ACTIONS comes from the existing Registry navigation projector over the same
+invocation graph used for context and runtime observation. It adds no tmux
+observation or Registry write. Eligible actions retain their existing order;
+ControlSession-owned rows retain their existing empty action set (`-` in the
+CLI). NAME remains the durable Registry address; CONTEXT remains presentation.
+
+The Registry and Runtime diagnostics pickers consume the same typed catalog in
+`internal/app/column_profiles.go` and open with compact columns:
+
+| Picker | Compact default | Explicit wide |
+| --- | --- | --- |
+| Registry mixed | KIND NAME STATUS ACTIONS | KIND NAME STATUS PROGRESS TERMINATION ACTIONS RUNTIME UID |
+| Runtime mixed | KIND ID IN NAME CLASS | KIND ID IN NAME CLASS RESOURCE REASON |
+
+Press **Alt-W** to toggle wide columns and press it again to return to compact.
+The footer shows the effective key and the next projection. The query, selected
+row, row order, full search values and current observation survive each toggle.
+The choice lasts for this open picker, including visits to a row's action menu;
+closing and reopening starts compact. Toggling writes no Registry or config.
+
+Settings > Keybindings > Sidebar & picker actions exposes **Registry Inspector**
+and **Runtime Diagnostics**, each with **Toggle compact / wide columns**. Their
+canonical IDs are `resource-inspector.columns.toggle` and
+`runtime-diagnostics.columns.toggle`. Existing single-key overrides are supported;
+there is no saved/global column profile or picker-local key sequence.
+
+Compact Registry NAME keeps the full invocation context (or the full durable name
+when context is empty), and omits the repeated provider/phase and role adornments
+that wide NAME retains. A full-UID/Hangul hierarchy with the existing action lists
+fits the 75-cell content budget at 80 columns without cutting NAME. Compact uses
+one separating cell per column; a previously clipped 76-cell regression row now
+uses 73 cells with all values intact. Wide retains two separating cells. The picker
+adds no NAME, RESOURCE, RUNTIME or REASON truncation bounds. Wide keeps the catalog
+field order and full projected values, including the existing PROGRESS producer's
+own policy.
+
+Wide rows can be clipped by the fixed viewport. The representative 142-cell
+Registry row clips at 80/120/180-column clients and fits from a 184-column client
+with the production 80%-width borderless popup. The native frame, scrollbar gutter
+and pointer reserve five cells: a 180-column client gives 139 label cells, and a
+184-column client gives 142. Actual action lists, runtime targets and free text can make rows wider,
+so no fixed client width guarantees all wide values. Enter opens the existing
+row action menu with each wide field on a separate detail row. JSON/`describe`
+and CLI `-o wide` provide recovery for values that still do not fit. There is no
+horizontal navigation or pagination; footer overflow and provider behavior are
+unchanged.

package/docs/configuration.md

@@ -596,6 +596,44 @@ without an app-server read. Only a thread-only candidate is validated with
 starts the shared daemon. Failure retains the persisted id or uses the current
 rollout fallback, and a read response can never substitute a different id.
 
+## Release channel
+
+Which release line this install is offered updates from. The axis is orthogonal
+to the install path: every installer can be judged on either channel.
+
+Files:
+
+```text
+~/.config/projmux/config.toml      # global/user
+```
+
+Schema:
+
+```toml
+[update]
+release_channel = "rc"   # "stable" (default) or "rc"
+```
+
+Set it from Settings > About > Updates > Release channel. The default is
+`stable`, and it is the default in the strong sense: an install that has never
+touched the toggle, an empty value, and a channel this binary does not
+recognise all resolve to `stable`, so no configuration mistake can put an
+install on prereleases it never asked for.
+
+Resolution priority is:
+
+1. `[update] release_channel`, once the key exists
+2. `PROJMUX_RELEASE_CHANNEL`
+3. built-in default (`stable`)
+
+The stored setting takes the axis away from the environment only once it
+exists, which is why merely opening the Settings row does not write it. An
+install driven by `PROJMUX_RELEASE_CHANNEL` therefore keeps its opt-in until
+somebody actually uses the toggle — and after that, turning the toggle off puts
+the install back on the stable line even while the environment variable is
+still set. Turning it off does not downgrade a prerelease that is already
+installed; that install stays put until its stable line ships.
+
 ## Environment Variables
 
 | Variable | Purpose |
@@ -619,6 +657,7 @@ rollout fallback, and a read response can never substitute a different id.
 | `PROJMUX_SESSIONSTATE_DEBUG` | When non-empty, quiet autosave surfaces suppressed session-state errors to stderr. |
 | `PROJMUX_FOCUS_DEBUG` | When non-empty, `projmux focus` prints one telemetry line to stderr. |
 | `PROJMUX_INSTALLER` | Installer source hint used by update flows. npm installs set this automatically; advanced release installs can set `github-release`. |
+| `PROJMUX_RELEASE_CHANNEL` | Release channel the update judgment is made against, orthogonal to `PROJMUX_INSTALLER`. Only an exact `rc` opts in; unset, empty, and unrecognised values all mean the default `stable` channel, which never sees a prerelease. An rc install is answered with whichever of the stable and rc lines is newer, so it returns to stable as soon as that line ships. Read only until `[update] release_channel` exists; see [Release channel](#release-channel). |
 | `PROJMUX_SHELL_UPDATE_CHECK_TIMEOUT_MS` | Timeout in milliseconds for the best-effort release check attempted by `projmux shell` when the update cache is missing or stale. Invalid, zero, or negative values use the default. |
 
 ## Welcome State
@@ -872,14 +911,14 @@ while `on` and `off` take precedence. Auto-save only updates the latest
 snapshot. Named snapshots are manual and are never updated by auto-save.
 
 With no saved preference, Project open from the Alt-1 sidebar shows a native
-`Start project` step with exactly `Continue project` and `Open fresh`.
+`Start project` step with exactly `Continue project` and `Recreate Project`.
 Settings > Projects > Project Sidebar > Closed Project startup reports this as
-`Continue project / Open fresh - default`. A saved `on` keeps the same explicit
-choice and reports `Continue project / Open fresh - on - saved`. A saved `off`
+`Continue project / Recreate Project - default`. A saved `on` keeps the same explicit
+choice and reports `Continue project / Recreate Project - on - saved`. A saved `off`
 reports `Continue project - off - saved` and skips the picker: a registered root
 continues, while an unregistered root follows the existing Fresh adjudication.
 Resolving or cancelling the missing-file default never creates the preference
-file or changes saved bytes or mtime. `Open fresh` atomically replaces the old Project graph
+file or changes saved bytes or mtime. `Recreate Project` confirms first, then atomically replaces the old Project graph
 with a new Project UID and a new canonical Window/shell UID pair. Exactly one
 same-root Project claimant remains. Snapshot bytes, the root directory,
 Git/worktree data, and the trust decision remain unchanged. Esc returns to