projmux 0.15.2 → 0.15.3

package/docs/architecture.md

@@ -1008,10 +1008,14 @@ tmux transport mirror:
   recovery route.
 - `rename pane` changes `Pane.metadata.name` and its `@projmux_pane_label`
   mirror only. It never writes the raw tmux `pane_title`.
-- `rename window` is the explicit stable-identity path: it changes only
-  `Window.metadata.name`, its root-scoped same-kind name reservation, and the
-  exact live `@projmux_window_name` transport mirror. It does not change tmux
-  `window_name`.
+- `rename window` is the explicit stable-identity path: it changes
+  `Window.metadata.name`, its root-scoped same-kind name reservation, the exact
+  live `@projmux_window_name` transport mirror and, when the invocation has a
+  proven runtime route, the tmux tab `window_name` through the canonical
+  `rename-window -t @N -- <name>` -- the same argv shape the rename key and the
+  Window menu Rename item go through. With no route it stays Registry-only and
+  says on stderr that the tab did not converge. It never changes
+  `metadata.displayName`.
 - `rename project` likewise writes only `Project.metadata.name` and the exact
   live session's `@projmux_project_name`; it never renames the tmux session.
   `rebind project` preserves the Project uid and session name while updating
@@ -1906,7 +1910,10 @@ Resource-first create:
   touched.
 - **Everything is detached.** No create path issues `switch-client`,
   `select-window`, `select-pane`, or `attach-session`. `focus pane` and
-  `-o pane-id` are how a caller ends up in the new pane.
+  `-o pane-id` are how a caller ends up in the new pane. One exception: the
+  human intent route `internal tmux window-create` (`window.create` key, Window
+  menu New At End) moves exactly the pressing client to the new Window after
+  its create commits; public `create` stays detached.
 - **Focus is navigation-only.** `focus project|window|pane` reads live tmux
   inventory and may move an existing client, but has no Registry store and
   issues no session/Window/Pane creation, identity-marker, rename, respawn, or
@@ -2004,9 +2011,11 @@ Selector and the implicit active target:
 
 Projmux keeps visible naming separate from source metadata:
 
-- **User pane label** is persistent pane-scoped metadata stored in
-  `@projmux_pane_label`. The Rename Pane action sets or clears only this field;
-  it does not write the AI topic or raw pane title.
+- **User pane label** is pane-scoped metadata stored in `@projmux_pane_label`,
+  the live mirror of the Pane's Registry `metadata.name`. The Rename Pane action
+  renames the Registry Pane through the same owner as `rename pane`, which
+  writes this mirror; an empty response changes nothing, and the action never
+  writes the AI topic or raw pane title.
 - **Pane border label** is the primary visible pane name. In the app tmux
   config and native previews it resolves to user pane label first, agent AI
   topic second, known interactive shell command (`zsh`, `bash`, `fish`, `sh`,

package/docs/claude-coordination-endpoints.md

@@ -127,6 +127,22 @@ failure before any byte is a non-ambiguous `provider-write-zero`; partial bytes,
 a write error after bytes, or a lost helper response is ambiguous and has
 `autoResend=false`. A complete write plus helper return is only a transport
 handoff, not proof that Claude parsed, displayed, processed, or answered it.
+Push content has no length cap of its own: only the 8192-byte serialized
+auth+user frame bounds it, and a size excess ends as
+`provider-frame-too-large: frameBytes=N limitBytes=8192` with zero provider
+bytes; the reply tool argv body stays at 4096 bytes.
+
+`agent message send` applies the same budget to a Claude target before
+acceptance, for plain sends and `--reply-to` alike. The sender renders the
+content with the helper's renderer, once with its own executable and once with
+the fixed executable phrase, keeps the longer frame, and counts an assumed
+48-byte auth token; it never reads a messaging token. A frame over 8192 bytes
+exits nonzero with `provider-frame-too-large: frameBytes=N limitBytes=8192`
+before any receipt is stored or the helper is called. Codex targets are not
+pre-checked. A helper started before this rule still caps push content at 4096
+bytes and fails a larger body with `provider-frame-invalid-content`; the
+sender's receipt then names the rendered content bytes and asks to re-activate
+(restart) the target Agent.
 
 The frozen frame is closed to Claude Code `2.1.263`. A different provider
 version, helper replacement, provider restart, registration replacement, or
@@ -212,16 +228,21 @@ independently.
 validator's verdict on preserved real frame shapes. Neither it nor L20 proves
 installed-provider compatibility, value drift (the corpus keeps top-level key
 shape with placeholder values), or acceptance of unknown frames and fields (the
-closed vocabulary rejects them by design). The L20 fixture emits none of the
-corpus's dropped side frames. Two recorded real shapes are rejected today:
+closed vocabulary rejects them by design). L20 replays every corpus item whose
+verdict is `drop` through the production reply-only validator: the Claude
+fixture reads the corpus at run time from `PROJMUX_FAKE_CLAUDE_OBSERVED_FRAMES`,
+emits each dropped side frame with its key set unchanged after init and before
+its startup result, and the scenario requires the emitted names to equal the
+corpus drop set. Those frames are key-shape placeholders, not model output. L20
+does not emit the two recorded real shapes that are rejected today:
 `result-success-25-keys` (the result allowlist lacks `origin`) and
 `system-init-allowlist-diff` (the init allowlist lacks `memory_paths` and
 `terminal_slash_commands`). Shapes without preserved evidence are gaps, not
-items: `command_lifecycle` keys and values, a non-null assistant
-`context_management`, `system` `thinking_tokens`, hook and user `tool_result`
-frames, the exact real init key set, every nested value, `rate_limit_event`
-envelope keys beyond `type` and `rate_limit_info`, and the lost earlier shape
-inventories.
+items, so neither the corpus nor L20 exercises them: `command_lifecycle` keys
+and values, a non-null assistant `context_management`, `system`
+`thinking_tokens`, hook and user `tool_result` frames, the exact real init key
+set, every nested value, `rate_limit_event` envelope keys beyond `type` and
+`rate_limit_info`, and the lost earlier shape inventories.
 
 Provider sources: [SessionStart and Stop hooks](https://code.claude.com/docs/en/hooks)
 and [cross-session messaging](https://code.claude.com/docs/en/cross-session-messaging).

package/docs/cli-guide.md

@@ -252,8 +252,27 @@ The contract:
 `create window|pane|agent|<provider>` is resource-backed on every spelling.
 There is no mode flag and no second parser: the same argv means the same thing
 whether or not `--project` is present, and `-w`, `--create-window`, `--pane`,
-`--selector`, `--placement`, `--name`, `--label`, `--cwd`, `--add-dir`, `-o`,
-and the `--` payload all reach the same parser either way.
+`--selector`, `--placement`, `--cwd-from`, `--name`, `--label`, `-o`, and the
+`--` payload all reach the same parser either way. `--cwd` and `--add-dir` are
+provider create flags: they are defined on `create agent` and the three provider
+shortcuts, not on `create window` or `create pane`.
+
+`--cwd-from project|pane` selects where the new split starts. `project` (the
+default) starts it in the owner Project root. `pane` starts it in the active
+Pane's live directory while that directory is inside the owner Project root, and
+otherwise starts it in the root and says so in one stderr line; it never
+refuses. The flag cannot be combined with `--cwd`, which names an Agent working
+directory outright.
+
+On the CLI the flag is the only input: `create pane`, `create agent`, and the
+provider shortcuts never read `[ai] split_cwd_from`, so with no `--cwd-from`
+they always start in the owner Project root, whatever the global or project
+config says. A CLI result is determined by its arguments, and scripts must not
+change behavior because someone changed a Settings value. That config (and the
+`AI > New splits start in` Settings row that writes it) only decides splits
+started from the UI -- keybinding splits, the launcher, the resume picker's new
+row, and the Pane menu -- in the order flag > project config > global config >
+default. See [configuration.md](configuration.md).
 
 The scope resolves in two branches:
 
@@ -339,7 +358,10 @@ they name `--project` as the fix:
   gone — a `recoverable` runtime is reported, never adopted.
 
 Every create is **detached**: no create moves the client. Use `focus pane` or
-`-o pane-id` when you want to end up in the new pane. A natural create validates
+`-o pane-id` when you want to end up in the new pane. One exception: the human
+intent route `internal tmux window-create` (the `window.create` key and the
+Window menu New At End) moves the pressing client to the new Window after its
+create commits; public `create` stays detached. A natural create validates
 the inherited exact route and Pane containment. An explicit resource scope
 binds the selected app resource route without letting unrelated inherited
 `TMUX`/`TMUX_PANE` choose or change the resource target; exact Project plus
@@ -415,12 +437,20 @@ disabling the keys.
 ### Rename and rebind live convergence
 
 `rename project|window|pane` commits the selected Registry `metadata.name` and
-then updates only its exact UID-bound live transport field:
+then updates only its exact UID-bound live transport fields:
 
 - Project: `@projmux_project_name` (never the tmux session name)
-- Window: `@projmux_window_name` (never tmux `window_name`)
+- Window: `@projmux_window_name` and the tmux tab `window_name` (never
+  `displayName`)
 - Pane: `@projmux_pane_label` (never raw `pane_title`)
 
+The Window tab converges only when the invocation has a proven runtime route,
+which is what running inside the projmux tmux runtime gives it. Outside one the
+rename is Registry-only: it exits zero and prints one line on stderr saying the
+tab still shows the old name until a rename runs inside that runtime. There is
+no flag for either behavior; the next time that Window is materialized from the
+Registry, the tab carries the committed name.
+
 `rename agent` changes only the Agent's stable root-scoped `metadata.name`.
 It does not change the Agent topic, provider, lifecycle state, or managed Pane
 name/title. `create agent` derives the managed Pane's name from the Agent's
@@ -2046,6 +2076,8 @@ projmux internal tmux popup-sessions
 projmux internal tmux popup-preview <session>
 projmux internal tmux rebalance-panes
 projmux internal tmux rename-pane <pane> <label>
+projmux internal tmux window-rename --client <key> --anchor <%pane> (--name-stdin | -- <name>)
+projmux internal tmux pane-rename   --client <key> --anchor <%pane> (--name-stdin | -- <name>)
 projmux internal tmux print-config     [--bin <path>]
 projmux internal tmux print-app-config [--bin <path>]
 projmux internal tmux install     [--bin <path>] [--config <path>] [--include <path>]
@@ -2059,10 +2091,18 @@ accepted by `popup-toggle` mirror the historical sessionizer surface:
 `notify-sidebar`, `recent-windows`, `resource-inspector`, `ai-split-picker-right`,
 `ai-split-picker-down`, `ai-split-resume-right`, `ai-split-resume-down`,
 `ai-split-settings`.
-`rename-pane` sets only the pane-scoped user label
-`@projmux_pane_label`; an empty label clears the option. It does not change the
-raw tmux pane title, AI topic, or AI topic manual-ownership flag. The canonical
-keybinding action id is `rename-pane-label`. The retired `rename-pane-topic`
+`rename-pane` is a label-only helper: it sets only the pane-scoped
+`@projmux_pane_label`, and an empty label clears the option. It does not change
+the Registry Pane name, so the next Continue restores that name, and it does not
+change the raw tmux pane title, AI topic, or AI topic manual-ownership flag. No
+generated binding uses it.
+`window-rename` and `pane-rename` are the generated rename routes behind the
+`rename-window` and `rename-pane-label` keybinding actions and the Window menu
+Rename item. They resolve the anchor Pane to its exact Registry Window or Pane
+and rename it through the same owner as `projmux rename window|pane`, then
+report one line to the client. The generated bindings pass the prompt response
+with `--name-stdin` inside a quoted here-document; see
+[keybindings.md](keybindings.md#rename-keys) for the input rules. The retired `rename-pane-topic`
 keymap action is no longer accepted: replace a stale
 `[bindings.rename-pane-topic]` table with `[bindings.rename-pane-label]`.
 The `projmux agent topic set/clear` commands keep

package/docs/cli.md

@@ -39,7 +39,7 @@ Root parser bridges outside the route graph are censused from their parser token
 
 Every route declares one allowed-effect record over seven independent resource axes. A pipe separates conditional success outcomes; preflight refusal remains zero-effect. `domain-effect=null` means the route has no typed extension beyond this resource tuple.
 
-The machine-readable manifest contains 190 route-effect records, including hidden plumbing that the public route sections omit.
+The machine-readable manifest contains 191 route-effect records, including hidden plumbing that the public route sections omit.
 
 | Axis | Closed vocabulary |
 | --- | --- |
@@ -75,7 +75,7 @@ projmux <command> [args...]
 | [`projmux notification`](#projmux-notification) | canonical | Manage pending notification workflow state |
 | [`projmux open`](#projmux-open) | canonical | Open a Project runtime and move the current client to it |
 | [`projmux pin`](#projmux-pin) | canonical | Manage pinned project directories |
-| [`projmux prune`](#projmux-prune) | canonical | Prune stale Projects and snapshots |
+| [`projmux prune`](#projmux-prune) | canonical | Prune stale Projects, Agents, and snapshots |
 | [`projmux quit`](#projmux-quit) | shortcut | Quit the app-owned projmux tmux runtime |
 | [`projmux reconcile`](#projmux-reconcile) | canonical | Preview or repair Registry and exact tmux resource drift |
 | [`projmux rebind`](#projmux-rebind) | canonical | Rebind a Project to a new absolute root without moving files |
@@ -761,7 +761,7 @@ Subcommands:
 
 | Route | Summary |
 | --- | --- |
-| [`projmux agent message send`](#projmux-agent-message-send) | Submit bounded peer coordination; --source selects a source Agent anchor, not caller authentication (default: active Pane) |
+| [`projmux agent message send`](#projmux-agent-message-send) | Submit bounded peer coordination; --source selects a source Agent anchor, not caller authentication (default: active Pane); exits nonzero after printing a failed, refused, expired, or stale receipt |
 | [`projmux agent message status`](#projmux-agent-message-status) | Read a payload-free broker delivery receipt |
 | [`projmux agent message qualify`](#projmux-agent-message-qualify) | Explicitly qualify one exact Claude target using owned current-version isolation evidence and one marker push |
 
@@ -769,7 +769,7 @@ Canonical spelling: `projmux agent message send`, `projmux agent message status`
 
 #### `projmux agent message send`
 
-Submit bounded peer coordination; --source selects a source Agent anchor, not caller authentication (default: active Pane)
+Submit bounded peer coordination; --source selects a source Agent anchor, not caller authentication (default: active Pane); exits nonzero after printing a failed, refused, expired, or stale receipt
 
 Selectorless authority: `explicit-target` — the route or caller must name the exact target.
 
@@ -1215,10 +1215,10 @@ Allowed effects:
 ```
 projmux create project --root <absolute-path> [--name <name>] [--label key=value]... [-o <mode>]
 projmux create window [--project <ref> | -p <ref>] [--name <name>] [--label key=value]... [-o <mode>] [-- <payload>]
-projmux create pane [--project <ref> | -p <ref>] [--window <ref> | -w <ref>]... [--pane <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [-o <mode>] [-- <payload>]
-projmux create agent --provider <provider> [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--pane <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [-o <mode>] [-- <payload>]
-projmux create codex [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [-o <mode>] [-- <payload>]
-projmux create claude|antigravity [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--window <ref> | -w <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [-o <mode>] [-- <payload>]
+projmux create pane [--project <ref> | -p <ref>] [--window <ref> | -w <ref>]... [--pane <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
+projmux create agent --provider <provider> [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--pane <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
+projmux create codex [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
+projmux create claude|antigravity [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--window <ref> | -w <ref>]... [--create-window] [--all-windows | --primary-window] [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
 projmux create notification --text <s> --target <SESSION[:WINDOW[.PANE]]> [--socket <s>]
 projmux create snapshot
 ```
@@ -1308,7 +1308,7 @@ Allowed effects:
 - `domain-effect=null`
 
 ```
-projmux create pane [--project <ref> | -p <ref>] [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [-o <mode>] [-- <payload>]
+projmux create pane [--project <ref> | -p <ref>] [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
 ```
 
 Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `pane-id`, `none`, `receipt`
@@ -1331,7 +1331,7 @@ Allowed effects:
 - `domain-effect=null`
 
 ```
-projmux create agent --provider <provider> [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [-o <mode>] [-- <payload>]
+projmux create agent --provider <provider> [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
 ```
 
 Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `pane-id`, `none`, `receipt`
@@ -1396,7 +1396,7 @@ Allowed effects:
 - `domain-effect=null`
 
 ```
-projmux create codex [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [-o <mode>] [-- <payload>]
+projmux create codex [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--interactive-only] [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
 ```
 
 Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `pane-id`, `none`, `receipt`
@@ -1419,7 +1419,7 @@ Allowed effects:
 - `domain-effect=null`
 
 ```
-projmux create claude [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [-o <mode>] [-- <payload>]
+projmux create claude [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
 ```
 
 Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `pane-id`, `none`, `receipt`
@@ -1442,7 +1442,7 @@ Allowed effects:
 - `domain-effect=null`
 
 ```
-projmux create antigravity [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [-o <mode>] [-- <payload>]
+projmux create antigravity [--project <ref> | -p <ref>] [--cwd <path>] [--add-dir <path>]... [--window <ref> | -w <ref>]... [--pane <ref>]... [--selector key=value]... [--create-window] [--all-windows | --primary-window] [--name <name>] [--label key=value]... [--placement right|down] [--cwd-from project|pane] [-o <mode>] [-- <payload>]
 ```
 
 Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `pane-id`, `none`, `receipt`
@@ -2600,7 +2600,7 @@ projmux pin project list|add|remove|toggle|clear
 
 ## `projmux prune`
 
-Prune stale Projects and snapshots
+Prune stale Projects, Agents, and snapshots
 
 Selectorless authority: `refusal` — there is no safe selectorless action; refuse before output or mutation.
 
@@ -2618,16 +2618,39 @@ Allowed effects:
 ```
 projmux prune snapshot [--older-than <duration>]
 projmux prune project --missing --older-than <duration> [--yes]
+projmux prune agent --older-than <duration> [--no-session-ref] [--no-pane] [--exclude <agent-ref>]... [--yes]
 ```
 
 Subcommands:
 
 | Route | Summary |
 | --- | --- |
+| [`projmux prune agent`](#projmux-prune-agent) | Delete Offline or Failed Agents past a bounded age whose session ref or managed Panes are gone; live Panes and Running Agents are never selected |
 | [`projmux prune project`](#projmux-prune-project) | Delete Projects whose spec.root has been missing for a bounded age |
 | [`projmux prune snapshot`](#projmux-prune-snapshot) | Inspect or delete preserved session snapshots (canonical spelling) |
 
-Canonical spelling: `projmux prune project`, `projmux prune snapshot`
+Canonical spelling: `projmux prune agent`, `projmux prune project`, `projmux prune snapshot`
+
+### `projmux prune agent`
+
+Delete Offline or Failed Agents past a bounded age whose session ref or managed Panes are gone; live Panes and Running Agents are never selected
+
+Selectorless authority: `explicit-fan-out` — the route spelling is an intentional global or whole-set opt-in.
+
+Allowed effects:
+
+- `identity=removed`
+- `address=released`
+- `topology=removed`
+- `desired-state=removed`
+- `runtime=unchanged`
+- `focus=unchanged`
+- `cardinality=zero-or-more`
+- `domain-effect=null`
+
+```
+projmux prune agent --older-than <duration> [--no-session-ref] [--no-pane] [--exclude <agent-ref>]... [--yes]
+```
 
 ### `projmux prune project`
 
@@ -2847,7 +2870,7 @@ Subcommands:
 | Route | Summary |
 | --- | --- |
 | [`projmux rename project`](#projmux-rename-project) | Rename a Projmux Project resource; with no selector inside tmux, the active Project |
-| [`projmux rename window`](#projmux-rename-window) | Rename a Projmux Window resource; inside tmux a reference resolves within the active Project or ControlSession and no selector means the active Window |
+| [`projmux rename window`](#projmux-rename-window) | Rename a Projmux Window resource; inside tmux a reference resolves within the active Project or ControlSession, no selector means the active Window, and the tmux tab is renamed with it |
 | [`projmux rename pane`](#projmux-rename-pane) | Rename a Projmux Pane resource; inside tmux a reference resolves within the active Project or ControlSession and no selector means the active Pane; does not change tmux pane_title |
 | [`projmux rename agent`](#projmux-rename-agent) | Rename an Agent stable resource name within the active Project or ControlSession without changing its topic, provider, or managed Pane |
 
@@ -2880,7 +2903,7 @@ Output modes (`-o`): `receipt`, `none`
 
 ### `projmux rename window`
 
-Rename a Projmux Window resource; inside tmux a reference resolves within the active Project or ControlSession and no selector means the active Window
+Rename a Projmux Window resource; inside tmux a reference resolves within the active Project or ControlSession, no selector means the active Window, and the tmux tab is renamed with it
 
 Selectorless authority: `natural-omitted` — omission resolves one predictable current resource or documented contextual read/scope; any selector replaces it.
 

package/docs/configuration.md

@@ -342,6 +342,7 @@ success = "#5faf87"
 action_required = "#ffaf00"
 pane_active_bg = "default"
 focus = "#00ffff"
+provenance = "#ff8700"
 ```
 
 `text_primary` controls primary content text in native terminal-rendered UI.
@@ -360,6 +361,13 @@ active-pane background tint, and `focus` is the active-pane border color. Each
 of these is a public token: leave it unset to keep the historical built-in
 color, or set it to repaint the matching chrome.
 
+`provenance` is the compact usage label color for a provider row whose numbers
+came from a fallback data source rather than its authoritative one (today: a
+Codex row outside a healthy app-server). It is independent of `warning` and
+`critical`, which stay reserved for usage thresholds, and of the ordinary AI
+label color; the fallback value is orange. See `docs/usage-tracking.md` for what
+the label looks like and `docs/theme-palette.md` for the preset contract.
+
 Supported presets are `projmux`, `high-contrast`, `blue-hour`, `carbon-violet`,
 `daylight`, `ember`, `forest`, and `rose`. `daylight` is the fully-light
 preset; the others are dark. Preset colors paint projmux chrome only (status
@@ -517,6 +525,63 @@ desktop intent for both app-server and hook-fallback authority. Existing
 runtime override exists, take precedence only while hook fallback is current;
 they are never inferred or copied into the semantic policy store.
 
+## Split Start Directory
+
+New splits start in the owner Project root. `[ai] split_cwd_from = "pane"`
+starts UI splits in the active Pane's live directory instead, while that
+directory is inside the owner Project root. Settings exposes the same value as
+`AI > New splits start in` (`Project root` / `Current Pane directory`); choosing
+one writes only the global `[ai] split_cwd_from`.
+
+Config paths (global and project both honored):
+
+```text
+~/.config/projmux/config.toml      # global
+<project>/.projmux/config.toml     # project
+```
+
+Schema:
+
+```toml
+[ai]
+split_cwd_from = "project" # project|pane; where a new shell or Agent split starts
+```
+
+Resolution depends on who starts the split.
+
+**CLI** (`create pane`, `create agent`, and the provider shortcuts) — the flag
+only:
+
+1. `--cwd-from project|pane`
+2. otherwise `project`
+
+The CLI opens no config file for this decision. A CLI result is determined by
+its arguments, so scripts and automation keep starting in the Project root when
+someone changes this setting.
+
+**UI** (keybinding splits, the launcher, the resume picker's new row, and the
+Pane menu) — the config tiers:
+
+1. an explicit per-call value (flag)
+2. project `[ai] split_cwd_from`, read from the owner Project root
+3. global/user `[ai] split_cwd_from`
+4. built-in default (`project`)
+
+There is no environment override, and an unknown value skips its own tier. The
+project tier is always read from the owner Project root, so where a Pane sits
+never changes which config decides. The Settings row shows the UI result and the
+tier that decided it (`project`, `global`, or `default`).
+
+With `pane` selected, the active Pane is the origin of the split: the Pane a
+keybinding ran in, the Pane a right-click menu was opened on, or the anchor Pane
+a CLI create resolved. Its live directory is used only when it is inside the
+owner Project root. `$HOME`, another registered Project tree, a directory that no
+longer exists, and an unreadable directory all start in the Project root and
+report one line naming the reason and that root — on stderr for a CLI create
+with `--cwd-from pane`, and as one client message for a split started from the
+UI. A split is never refused for this reason. `--cwd` on `create agent` still
+names the Agent working directory outright and ignores this setting.
+
 ## AI Resume Picker
 
 The Agent resume picker lists the most recent

package/docs/heterogeneous-dialogue-canary.md

@@ -348,14 +348,19 @@ a recorded verdict moves. Neither it nor L20 proves:
 - acceptance of unknown frames or fields, which the closed vocabulary rejects
   by design.
 
-The L20 fixture emits none of the corpus's dropped side frames. Recorded real
-shapes the validator rejects today:
+L20 replays every corpus item whose verdict is `drop` through the production
+reply-only validator. Its Claude fixture reads the corpus at run time, emits each
+dropped side frame with its key set unchanged after init and before its startup
+result, and the scenario requires the emitted names to equal the corpus drop
+set. Those frames are key-shape placeholders, not model output. L20 does not
+emit the recorded real shapes the validator rejects today:
 
 - `result-success-25-keys`: the result allowlist lacks `origin`;
 - `system-init-allowlist-diff`: the init allowlist lacks `memory_paths` and
   `terminal_slash_commands`.
 
-Shapes without preserved evidence are gaps, not corpus items: `command_lifecycle`
+Shapes without preserved evidence are gaps, not corpus items, so neither the
+corpus nor L20 exercises them: `command_lifecycle`
 keys and values; a non-null assistant `context_management` value; `system`
 `thinking_tokens` frames; hook and user `tool_result` frames; the exact real init
 key set; nested values of every frame; `rate_limit_event` envelope keys beyond

package/docs/keybindings.md

@@ -195,7 +195,8 @@ Optional direct keys can be added for actions such as:
 | `ai-split-right` | Open a new direct AI split to the right |
 | `ai-split-down` | Open a new direct AI split below |
 | `new-window` | New tmux window in the current pane directory |
-| `rename-window` | Rename the current tmux window |
+| `rename-window` | Rename the current Window in the Registry; see [Rename keys](#rename-keys) |
+| `rename-pane-label` | Rename the current Pane in the Registry; see [Rename keys](#rename-keys) |
 
 `AISplitPickerToggle` is the `Alt-7` popup picker toggle. It opens or closes
 the picker UI where the user chooses the AI split mode. It is separate from
@@ -297,6 +298,44 @@ A mouse menu acts on what was clicked, not on what is focused: Kill, Rename, and
 New At End in the status-line Window menu act on the clicked Window, and the
 Rename prompt starts with that Window's name.
 
+## Rename keys
+
+`rename-window` (`window.rename`) and the Window menu Rename item run
+`internal tmux window-rename`; `rename-pane-label` (`pane.rename`) runs
+`internal tmux pane-rename`. Neither has a default key. Both are Registry
+renames through the same owner as `projmux rename window` and
+`projmux rename pane`: the Pane the key was pressed in, or the menu target,
+resolves to its exact Registry Window or Pane, its `metadata.name` changes, and
+its mirror converges with it. A Window rename writes `@projmux_window_name`
+and, after the Registry commit, the tmux `window_name`; a Pane rename writes
+`@projmux_pane_label`. A Continue that rebuilds the session from the Registry
+therefore keeps the new name, including for the first Window of a session.
+
+The prompt response is used exactly as typed:
+
+- An empty or whitespace-only response changes nothing, not even the label,
+  and the client is told nothing was changed.
+- A response that is not a valid name, such as one with a space, leading or
+  trailing whitespace, or a character like `'`, `"`, `$`, `;`, `%`, or `#`, is
+  refused with the reason and the usable spelling projmux would accept, for
+  example `a-b` for `a b`. Nothing is written.
+- A name already used by another Window of the same Project or ControlSession,
+  or by another Pane of the same root, is refused. No suffix is added.
+- A Pane with no Registry identity, such as one on a server projmux does not
+  manage, is refused with no write.
+- A name a launcher chose, such as an Agent Pane's, renames like any other.
+
+Every result is one line on the client that pressed the key. The response
+reaches projmux on stdin inside a quoted here-document, so no shell parses it.
+tmux still format-expands the `run-shell` command before any shell runs, as it
+does at its own `:` prompt: a `#{...}` sequence in a response is substituted and
+a `#(...)` sequence is run by tmux as a format job. Names cannot contain `#`, so
+a response that still holds one is refused.
+
+`internal tmux rename-pane <pane> <label>` is a separate label-only helper with
+no generated binding. It writes `@projmux_pane_label` without touching the
+Registry, so the next Continue restores the Registry name.
+
 The standalone `~/.tmux.conf` snippet keeps tmux's stock `prefix <`, `prefix >`,
 `MouseDown3Status`, `M-MouseDown3Status`, and `M-MouseDown3Pane` menus; it
 carries only the `MouseDown3Pane` menu. A `keymap.toml` that assigns a managed

package/docs/legacy-cli-retirement.md

@@ -37,7 +37,7 @@ unknown-command contract.
 | direct `tag list|toggle|clear`, `tag project ...` | `runtime tag ...` |
 
 The surviving mixed-root commands are exactly `attach project`, `focus
-project|window|pane`, `pin project`, and `prune project|snapshot`. The Shortcut
+project|window|pane`, `pin project`, and `prune agent|project|snapshot`. The Shortcut
 routes `doctor`, `quit`, `resources`, `settings`, `shell`, `switch`, and
 `welcome` remain. Singular/plural resource-kind aliases remain.
 

package/docs/settings-ia.md

@@ -88,6 +88,12 @@ step, never a silent no-op.
   - `Default launch target [Choice]` — an Agent Provider, a Shell Pane, or
     choose-at-launch. It is a keybinding/picker preference and does not weaken
     the canonical `create agent` explicit-provider requirement.
+  - `New splits start in [Choice]` — `Project root` (default) or
+    `Current Pane directory`, shown with the tier that decided it (`project`,
+    `global`, `default`). It writes only the global `[ai] split_cwd_from` and
+    decides UI splits only; the Pane directory is used only inside the Project
+    root, and the CLI does not follow this setting (`create pane|agent` obey
+    `--cwd-from` alone).
   - `Enabled providers [View]` — Claude, Codex, and Antigravity are Providers;
     `Shell`, `Selective` and `Resume` are not Providers and never appear here.
   - `Agent Resume Picker [View]` — states that resume targets an existing Agent
@@ -220,6 +226,31 @@ step, never a silent no-op.
 Without an actionable project context the Project surface renders a single
 passive guidance row rather than repeating a disabled reason per row.
 
+## Search
+
+Search reaches every setting from the Settings root. A non-empty query at the
+root lists the current scope's settings as one `path > label` list (rendered
+with `›`) built by walking the navigation catalog, and choosing a result opens
+the owning View with the cursor on that row without running its control --
+Confirm and Action rows included, so `Quit Projmux` and `Reset theme` are
+focused and never fired. The list is scope-pure: a Global query never returns
+Project nodes and a Project query never returns Global ones, and with no project
+context the Project tab returns nothing. User-data collection items -- an
+individual discovery root, pinned Project, candidate or snapshot -- are data
+rather than settings, so results stop at their parent View and at the
+collection-level controls. Inside a View the query still filters that View's
+rows, and category rows carry their members' search text so search crosses
+categories.
+
+The result rows are built from the catalog alone: no Registry, tmux,
+filesystem or snapshot read participates, because a result is a destination
+rather than a rendered value. Where that leaves a row unnameable -- a saved
+user path, a command whose row spelling depends on whether a command is
+already stored, a read-only state row that stands for several rendered lines --
+the result still appears and opens the owning View on its first row instead of
+guessing a row. The same happens when the target row is simply not rendered any
+more: the View opens, unfocused, and nothing errors.
+
 ## Vocabulary and compatibility
 
 Visible nouns follow the shared resource vocabulary: `Project`, `Window`,

package/docs/statusbar.md

@@ -254,10 +254,16 @@ bind-key -n MouseDown1Status if-shell -F "#{==:#{mouse_status_range},window}" \
 ## Usage element drop order
 
 The compact Codex provider identity is native-first. An authoritative healthy
-app-server snapshot renders as `Codex`; only degraded lanes are qualified as
-`Codex [fallback]` or `Codex [stale]`. Unknown non-stale provenance uses the
-conservative fallback label. These labels are locale-invariant, including on
-en-US and ko-KR narrow rows. The full Usage table, JSON, and diagnostics retain
+app-server snapshot renders as `Codex`; a retained last-known-good snapshot is
+qualified as `Codex [stale]`. A fallback lane carries no text qualifier: it
+keeps the bare `Codex` label, painted in the `provenance` theme color (user
+decision: *"codex[fallback] 하단 status 바대신 주황색의 Codex가나오는게어때"* →
+*"B로 가자"*, a role color of its own rather than a reused threshold color, with
+`[stale]` kept). The text tiers below the bars emit no color, so the same row
+spells `Codex^ 5h:17%` / `X^ 5h:17%` — one ASCII cell instead of the former
+11-cell ` [fallback]` tag. Unknown non-stale provenance uses that same
+conservative fallback presentation. These labels are locale-invariant,
+including on en-US and ko-KR narrow rows. The full Usage table, JSON, and diagnostics retain
 the raw source and closed reason; the statusbar label is presentation only.
 
 The usage segment does not pick a whole-segment tier. It starts from its