projmux 0.15.2 → 0.16.0

package/docs/settings-ia.md

@@ -58,7 +58,7 @@ step, never a silent no-op.
     Project`, which forwards to the canonical `create project --root` route for
     that one exact path, and `Unpin candidate`, which removes the preference and
     leaves the directory alone. Nothing here adopts a path automatically.
-  - `Project Sidebar [View]` — holds the two Projects sidebar policies:
+  - `Project Sidebar [View]` — holds the Projects sidebar policy:
     `Runtime diagnostics [Choice]` chooses `When needed` (the read-time default
     with nothing saved) or `Always` for the sidebar's Runtime row. `When needed`
     keeps the row for a refused runtime class or for an observation that could
@@ -68,26 +68,27 @@ step, never a silent no-op.
     Recent Windows links are unchanged, and `projmux runtime diagnostics` and
     `get runtime` never read it. An unrecognized saved value applies the default
     without writing and shows an invalid source.
-    `Closed Project startup` shows exactly two actions when no preference file
-    exists and reports `Continue project / Recreate Project - default` (`이어서 열기 /
-    Project 다시 만들기 - 기본값` in ko-KR). Saved `on` keeps those choices and reports
-    `Continue project / Recreate Project - on - saved`. Saved `off` reports
-    `Continue project - off - saved`, skips the picker, and retains the
-    registered-Continue/unregistered-Fresh automatic
-    adjudication. Reading the row or opening/cancelling the picker never writes
-    the default or changes saved preference bytes/mtime.
+    The closed-Project startup screen has no setting: a registered closed
+    Project always gets it, and a root that is not a registered Project never
+    does. Its two rows are `Continue project` and `Clear layout and open`
+    (`이어서 열기` / `구성 비우고 새로 열기` in ko-KR).
     `Continue project` materializes the Project's current Registry desired state
-    and then moves the client. `Recreate Project` confirms the exact old Project
+    and then moves the client. `Clear layout and open` confirms the exact old Project
     UID and per-kind counts before writing anything,
     atomically replaces the old Project graph with a new Project UID and a new
     canonical Window/shell UID pair, and leaves exactly one same-root claimant
     before ordinary materialization. Esc returns to Projects. Neither action
-    deletes or rewrites snapshots, root, Git, or worktree data. The saved file
-    keeps its `sidebar-startup-picker` spelling.
+    deletes or rewrites the folder, its files, Git, worktree data, or trust.
 - **AI** — `AI` is a product category, never an addressable resource.
   - `Default launch target [Choice]` — an Agent Provider, a Shell Pane, or
     choose-at-launch. It is a keybinding/picker preference and does not weaken
     the canonical `create agent` explicit-provider requirement.
+  - `New splits start in [Choice]` — `Project root` (default) or
+    `Current Pane directory`, shown with the tier that decided it (`project`,
+    `global`, `default`). It writes only the global `[ai] split_cwd_from` and
+    decides UI splits only; the Pane directory is used only inside the Project
+    root, and the CLI does not follow this setting (`create pane|agent` obey
+    `--cwd-from` alone).
   - `Enabled providers [View]` — Claude, Codex, and Antigravity are Providers;
     `Shell`, `Selective` and `Resume` are not Providers and never appear here.
   - `Agent Resume Picker [View]` — states that resume targets an existing Agent
@@ -141,10 +142,10 @@ step, never a silent no-op.
     HUD`, `Working directory` and `Git` are component Views because each owns a
     `Visible` Toggle plus an icon `Choice`; cwd/Git icon `off` removes only the
     icon and leaves the text segment visible. `Agent Usage HUD` is a component
-    View with `Visible`, then Claude/Codex/Antigravity provider Views in the
+    View with `Visible`, then Claude/Codex provider Views in the
     usage-supported catalog order. Each provider owns `Visible` plus only its
-    explicit HUD windows: Claude/Codex own `5h` and `Weekly`; Antigravity owns
-    `Weekly` only. Parent off states gate effective visibility without rewriting
+    explicit HUD windows, `5h` and `Weekly`; Antigravity has no usage source and
+    no provider View. Parent off states gate effective visibility without rewriting
     saved child values. Provider/window rows show saved, effective, and source.
     `Project`, `Clock` and `Settings launcher` are direct visibility Toggles. These global
     presentation values default on except Codex `5h`, which defaults off to
@@ -157,8 +158,6 @@ step, never a silent no-op.
     presentation-only and do not disable their underlying producers, cache,
     backoff, explicit table/JSON command, or cached popup.
   - `Language / Locale [Choice]` and `Agent attention badge style [Choice]`.
-- **Snapshots** — the visible noun is the Snapshot resource. `session-state`
-  remains the config/route spelling and appears only as source detail.
 - **Keybindings** — `Launch & popups`, `Agent & Pane launch`,
   `Pane & Window navigation`, `Sidebar & picker actions` (nested by surface:
   Project Sidebar, Session Picker, Notification Sidebar, Settings), and
@@ -215,15 +214,39 @@ step, never a silent no-op.
   the approve/revoke actions) and `Project hooks [View]` (`Session lifecycle`
   plus `After notification queued`, with the same per-event Views the global
   scope uses, extended by a trust state row).
-- **Snapshots** — the auto-save override and the saved snapshots.
 
 Without an actionable project context the Project surface renders a single
 passive guidance row rather than repeating a disabled reason per row.
 
+## Search
+
+Search reaches every setting from the Settings root. A non-empty query at the
+root lists the current scope's settings as one `path > label` list (rendered
+with `›`) built by walking the navigation catalog, and choosing a result opens
+the owning View with the cursor on that row without running its control --
+Confirm and Action rows included, so `Quit Projmux` and `Reset theme` are
+focused and never fired. The list is scope-pure: a Global query never returns
+Project nodes and a Project query never returns Global ones, and with no project
+context the Project tab returns nothing. User-data collection items -- an
+individual discovery root, pinned Project or candidate -- are data
+rather than settings, so results stop at their parent View and at the
+collection-level controls. Inside a View the query still filters that View's
+rows, and category rows carry their members' search text so search crosses
+categories.
+
+The result rows are built from the catalog alone: no Registry, tmux,
+or filesystem read participates, because a result is a destination
+rather than a rendered value. Where that leaves a row unnameable -- a saved
+user path, a command whose row spelling depends on whether a command is
+already stored, a read-only state row that stands for several rendered lines --
+the result still appears and opens the owning View on its first row instead of
+guessing a row. The same happens when the target row is simply not rendered any
+more: the View opens, unfocused, and nothing errors.
+
 ## Vocabulary and compatibility
 
 Visible nouns follow the shared resource vocabulary: `Project`, `Window`,
-`Pane`, `Agent`, `Provider`, `Notification`, `Snapshot`, with `AI` as a category
+`Pane`, `Agent`, `Provider`, `Notification`, with `AI` as a category
 and `Session` as the runtime projection. The Agent Usage HUD is a presentation
 of what the canonical `agent usage` command provides; there is no addressable
 `Usage` resource, and Settings never spells usage as a readable resource kind.
@@ -271,7 +294,7 @@ result replaces it. Typed validation and staged apply failures stay in the popup
 instead of being visible only on stdout/stderr.
 
 The generic feedback inventory deliberately excludes Welcome, Quit, read-only
-hook/effective/notification diagnostics, Snapshot preview, and key
+hook/effective/notification diagnostics, and key
 capture/probe/diagnostic bodies. Those flows own a viewer, confirmation, or
 multi-step output surface; only an actual Settings write at their boundary is
 eligible for transient mutation feedback.

package/docs/statusbar.md

@@ -29,17 +29,16 @@ row 1  [#S]  #{pane_current_path}  <git>  CPU 12%  MEM 41%   %H:%M
   state surface.
   Settings > Appearance > Status Bar controls `Notifications HUD` and `Agent
   Usage HUD` independently. Agent Usage HUD is a View whose `Visible` parent
-  contains Claude/Codex/Antigravity provider Views; each provider has its own
-  `Visible` plus explicit supported windows (Claude/Codex: `5h`, `Weekly`;
-  Antigravity: `Weekly`). Every leaf defaults on except Codex `5h`, which
+  contains Claude/Codex provider Views; each provider has its own
+  `Visible` plus explicit supported windows (`5h`, `Weekly`). Antigravity has
+  no usage source and no row. Every leaf defaults on except Codex `5h`, which
   defaults off; saving it as on explicitly restores that window. Parent off
   preserves saved children, and returning it on restores them. When only one HUD is visible, its
   sole range receives the full `#{client_width}` budget and the absent range and
   alignment are not emitted. When both are hidden, tmux collapses to one line
   with `status on`,
-  moves the native Window row to `status-format[0]`, unsets stale higher rows,
-  and keeps the app's quiet Session State autosave job on that surviving row;
-  there is no empty HUD row. These toggles hide presentation only and do not
+  moves the native Window row to `status-format[0]`, and unsets stale higher
+  rows; there is no empty HUD row. These toggles hide presentation only and do not
   mutate the Notification queue or usage collection/cache/API state.
   Provider/window visibility also changes only the ambient status projection;
   the cached popup and explicit `agent usage` table/JSON stay lossless. If every
@@ -254,10 +253,16 @@ bind-key -n MouseDown1Status if-shell -F "#{==:#{mouse_status_range},window}" \
 ## Usage element drop order
 
 The compact Codex provider identity is native-first. An authoritative healthy
-app-server snapshot renders as `Codex`; only degraded lanes are qualified as
-`Codex [fallback]` or `Codex [stale]`. Unknown non-stale provenance uses the
-conservative fallback label. These labels are locale-invariant, including on
-en-US and ko-KR narrow rows. The full Usage table, JSON, and diagnostics retain
+app-server snapshot renders as `Codex`; a retained last-known-good snapshot is
+qualified as `Codex [stale]`. A fallback lane carries no text qualifier: it
+keeps the bare `Codex` label, painted in the `provenance` theme color (user
+decision: *"codex[fallback] 하단 status 바대신 주황색의 Codex가나오는게어때"* →
+*"B로 가자"*, a role color of its own rather than a reused threshold color, with
+`[stale]` kept). The text tiers below the bars emit no color, so the same row
+spells `Codex^ 5h:17%` / `X^ 5h:17%` — one ASCII cell instead of the former
+11-cell ` [fallback]` tag. Unknown non-stale provenance uses that same
+conservative fallback presentation. These labels are locale-invariant,
+including on en-US and ko-KR narrow rows. The full Usage table, JSON, and diagnostics retain
 the raw source and closed reason; the statusbar label is presentation only.
 
 The usage segment does not pick a whole-segment tier. It starts from its
@@ -298,11 +303,11 @@ as a secondary bar and cannot be shed by rule 3.
 Only hard rune-truncation, below every listed step, can reach either.
 
 Within a per-provider rule the steps run **tail-first** over the canonical
-provider order (Claude, Codex, Antigravity), so the provider a user reads first
-is the last to lose detail. This is why a 120-cell budget renders
-`Claude 5h [bar] · weekly [bar]   Codex 5h [bar]   Antigravity~~ weekly [bar]`
-— Codex's second window paid for Claude's — where whole-segment tier selection
-dropped both second windows at once and rendered 92 cells into a 120-cell row.
+provider order (Claude, Codex), so the provider a user reads first
+is the last to lose detail. This is why a 100-cell budget renders
+`Claude 5h [bar] · weekly [bar]   Codex 5h [bar]` — Codex's second window paid
+for Claude's — where whole-segment tier selection would drop both second
+windows at once.
 
 The order lives in **exactly one place in code**: `usageShedOrder` in
 `internal/app/usagecmd/usage.go`. The entry names above are that variable's
@@ -345,18 +350,16 @@ the queued notify segment, not to the separate window-list live attention badge.
 the cached usage state in-process and aligns model/window rows with
 right-aligned numeric values, dims unavailable values, keeps stale sync/age
 metadata muted, and colors only threshold values: amber at 80% and red at 95%.
-Antigravity rows keep conversation-local `context` separate from account
-`quota/<exact upstream bucket ID>` rows; the popup displays an absolute reset
-when provided and otherwise the exact optional relative reset seconds. Opaque
-bucket IDs are escaped for terminal/tmux safety and are never assigned a
+Named `quota/<exact upstream bucket ID>` rows display an absolute reset when
+provided and otherwise the exact optional relative reset seconds; cached
+Antigravity rows from the removed adapter are not shown, and an enabled
+Antigravity appears only as an `usage unsupported` row. Opaque bucket IDs are escaped for terminal/tmux safety and are never assigned a
 `5h`/`weekly` cadence. Claude retains aggregate `5h`/`weekly` rows alongside
 typed named/model `limits[]` rows in this popup: model-scoped rows display the
 exact upstream group plus model display identity with a bounded terminal-safe
 label, reset, and per-row age. The compact status line excludes every Claude
 named/model row and continues to use only the aggregate official windows.
-Session State inspection lives under `Projects > Sessions > State`; global
-Settings > Session State is settings-only and the statusbar no longer exposes a
-duplicate State button.
+The statusbar has no State button.
 
 The path popup uses the native picker frame chrome, a one-line title,
 the full wrapped current path, cheap project/git metadata when available, and

package/docs/testing.md

@@ -7,6 +7,8 @@ and humans run the same entrypoints.
 
 - `make test` runs the fast Go unit suite. These tests avoid tmux, TTY, GUI,
   and host shell dependencies.
+- `make vet` runs `go vet ./...`. CI runs it in the Unit Tests job after
+  `make test`.
 - Picker unit coverage includes the backend-neutral item/action contract,
   native title-focused filtering, numeric selection, and shared close actions.
 - `make test-integration` builds `test/docker/Dockerfile` and runs
@@ -40,6 +42,19 @@ and humans run the same entrypoints.
   runner is slow or loaded; a wait that expires still fails with the description
   of what it was waiting for, so a slow machine reports a timeout rather than
   the regression message of the assertion that would have run next.
+- `make test-e2e-update` runs `test/e2e/update-flow.sh` in the Node image
+  (`test/docker/Dockerfile.node`) on a bridged network. It installs an older
+  published `projmux` from the public npm registry, runs the source build's
+  `update apply`, and asserts the global install reaches the latest published
+  version while the exact legacy tmux server, socket, and sessions survive,
+  then checks npm installer autodetection from an npm-shaped path. Because it
+  depends on the public registry and the published package, it is not a
+  required check and stays out of the aggregate `Test`: the separate
+  `Update Flow E2E` workflow runs it on pull requests that change the update
+  path, daily on a schedule, and on manual dispatch. A local run skips when the
+  registry is unreachable; under CI (`CI=true`) or
+  `PROJMUX_UPDATE_FLOW_STRICT=1` the script runs with `--strict`, where a skip
+  fails the run instead.
 - `make test-e2e-contract`, `make test-e2e-reliability`, and
   `make test-e2e-shards` validate typed attempt evidence, bounded semantic
   waits/owned cleanup, and exhaustive four-shard isolation without rerunning

package/docs/theme-palette.md

@@ -54,6 +54,7 @@ onto these stable names:
 | `action_required` | AI needs-input/approval badge color | AI action-required badge (independent of `critical`) |
 | `pane_active_bg` | active-pane background tint | active-pane window-active-style tint (tmux pane chrome) |
 | `focus` | active-pane border color | active-pane border (tmux pane chrome) |
+| `provenance` | fallback-data-source label color | compact usage label for a row served by a fallback source (never a usage threshold color) |
 
 `text_primary` and `chrome_foreground` split the old broad foreground behavior:
 changing primary content text no longer repaints frame/title/search/border/status
@@ -71,6 +72,17 @@ failure, destructive, over-limit, or risk states. `pane_active_bg` and `focus`
 are also public keys driving the active-pane tint and border (tmux-only pane
 chrome, with no ANSI/native role).
 
+`provenance` colors a compact usage label whose numbers came from a fallback
+data source instead of the provider's authoritative one (today: a Codex row
+outside a healthy app-server). It is deliberately neither `warning` nor
+`critical` — those mean usage thresholds — nor the `accent.ai` label color a
+healthy row uses, because it is the only signal that row carries. Every built-in
+preset defines it as an orange (hue 15-45°) whose nearest tmux color differs
+from that preset's five state colors and from `colour121`; the fallback theme
+uses `colour208`, and an explicit light `status_background` darkens that literal
+the same way it darkens the other statusbar text roles. It is a tmux-only role
+(`usage.provenance_fg`) with no ANSI/native counterpart.
+
 Renderer-only role names such as `accent.ai`, `state.progress`, `git.branch`,
 and trust colors remain in `internal/theme/palette.go` until Phase 2+ maps each
 surface to the resolver tokens. The key product contract for this phase is that
@@ -200,6 +212,7 @@ light experience with `daylight` also requires a light terminal theme.
 | `action_required` | `#d97706` | `colour172` |
 | `pane_active_bg` | `#e8e4dc` | `colour254` |
 | `focus` | `#2563eb` | `colour26` |
+| `provenance` | `#944400` | `colour94` |
 
 ## Fallback Inventory
 
@@ -221,6 +234,7 @@ Accents and state:
 | `accent.action` | `141;205;142`, strong `122;199;173` | `colour29` bg / `colour230` fg |
 | `accent.attention` | notify HUD background/project family | `colour53`, project `colour90` |
 | `accent.ai` | notify agent `colour37` family | `colour37` bg / `colour121` fg |
+| `usage.provenance_fg` | not emitted on native surfaces | `colour208` (public `provenance` token) |
 | `state.progress` | `255;204;102`; switch attention/busy dot, pane-border in-progress badge, and pending notify title/bell/badge `colour220` | `colour220` |
 | `state.action_required` | AI approval/input-required status badge amber-orange; currently aliases the established warning token | `colour214` |
 | `state.warning` | usage/status popup warning ANSI 256 wrapper; non-AI warning chrome | `colour214` |

package/docs/tmux-surface-inventory.md

@@ -10,7 +10,6 @@ Primary production sources:
 
 - `internal/integrations/mux/`
 - `internal/integrations/tmux/`
-- `internal/integrations/sessionstate/`
 - `internal/app/`
 - generated config from `projmux config render standalone`,
   `projmux config render app`, and `projmux shell`
@@ -79,7 +78,7 @@ focus resolution, preview, and recent-window inventory.
 
 The typed `internal/integrations/tmux.Client` owns higher-level operations
 such as ensure/open/kill sessions, recent session summaries, preview inventory,
-resource inventory, and session-state capture/replay.
+and resource inventory.
 
 ## Generated Configuration Surface
 
@@ -87,7 +86,7 @@ The standalone and app configs own:
 
 - app/runtime marker options such as `@projmux_app`;
 - status rows, ranges, palette options, mouse dispatch, and popup bindings;
-- AI, attention, notify, recent-window, session-state, and resource hooks;
+- AI, attention, notify, recent-window, and resource hooks;
 - project-root and live-resource options;
 - reload/apply behavior for default and named sockets.
 
@@ -102,11 +101,11 @@ integration or e2e coverage when live tmux behavior changes.
 | Identity | `display-message -p`, `list-clients -F` | focus, switch, hooks |
 | Pane/window inventory | `list-panes -a -F`, `list-windows -F` | preview, notify, attention, recent windows |
 | Session lifecycle | `has-session`, `new-session`, `attach-session`, `switch-client`, `kill-session` | attach, switch, sessions |
-| Split/window creation | `split-window`, `new-window` | AI split, shell, session restore |
+| Split/window creation | `split-window`, `new-window` | AI split, shell, Project materialization |
 | Metadata | `set-option -p`, `show-options`, `display-message` | AI state, labels, app ownership |
-| Hooks | `set-hook`, `show-hooks`, `run-shell -b` | notify, attention, autosave, recent windows |
+| Hooks | `set-hook`, `show-hooks`, `run-shell -b` | notify, attention, recent windows |
 | Interactive UI | `display-popup`, `capture-pane`, `resize-pane` | popup surfaces, title watch, layout |
-| State replay | `rename-window`, `select-layout`, `select-pane`, `send-keys` | session state |
+| Topology materialization | `rename-window`, `select-layout`, `select-pane`, `send-keys` | Project Continue and Registry reconcile |
 | Config | `source-file`, global/session options | install, apply, shell |
 | Resource inventory | `list-panes -a -F` with PID/TTY/project fields | Linux resource attribution |
 
@@ -121,7 +120,6 @@ Changes to this surface should preserve the repository validation order:
 5. `make test-integration`;
 6. `make test-e2e`.
 
-The maintained test list in [agent-workflow.md](agent-workflow.md) must change
-with behavior. Live tests must use isolated tmux sockets and must validate
-returned ids or queried server state rather than pane ordering, screen content,
-or `send-keys` as a completion signal.
+Live tests must use isolated tmux sockets and must validate returned ids or
+queried server state rather than pane ordering, screen content, or `send-keys`
+as a completion signal.

package/docs/troubleshooting.md

@@ -126,10 +126,8 @@ history without a current activation is excluded. A complete comparison with no
 mismatches emits no comparison block. An unreadable Registry or missing,
 inconsistent, orphaned, or unobservable activation produces an `unavailable` or
 `incomplete` enumeration signal; confirmed mismatches remain visible alongside
-those gaps. A foreign Codex state domain, opaque generation, or a present or
-unreadable generation pool is unobservable from the default daemon probe.
-Private pool generations can also have version-shaped IDs, so Doctor does not
-infer their running endpoint from that spelling or from admission-current.
+those gaps. A foreign Codex state domain or an opaque generation is
+unobservable from the default daemon probe.
 
 The additive `codex_endpoint_mismatch` JSON field carries the same mismatch set,
 enumeration gaps, and evidence strength without changing the schema version.

package/docs/upgrading.md

@@ -52,6 +52,141 @@ still requires an explicit `PROJMUX_INSTALLER=github-release`.
 
 ## Behavior Changes
 
+### Closed Project startup setting removed
+
+The closed-Project startup screen is now shown for every registered Project
+that has no running session, and it is never shown for a folder that is not a
+registered Project -- Enter registers and opens that folder in one step.
+With nothing left to choose, the setting that turned the screen off is gone.
+
+- Settings > Projects > Project Sidebar > Closed Project startup is removed.
+  Project Sidebar keeps its Runtime diagnostics choice.
+- `~/.config/projmux/sidebar-startup-picker` is no longer read. The first
+  `projmux config apply` after upgrading (which `make install` and
+  `projmux update apply` also run) removes it and prints one
+  `reclaimed retired closed-Project startup setting: removed 1 file` line.
+  Only a regular file with that name is removed; a failure is reported and
+  never fails the apply, and later applies print nothing.
+- **A saved `off` is not migrated.** If you had turned the screen off, a
+  registered closed Project shows it again. Its default row is Continue
+  project, so Enter opens the Project the way `off` did.
+- The second row is renamed from **Recreate Project** to
+  **Clear layout and open** (ko-KR: **구성 비우고 새로 열기**). It clears only
+  the Project's saved Window and Agent layout; the folder, its files,
+  `.projmux/config.toml`, and trust stay. Its confirmation screen uses the same
+  name, and its cancel row is **Keep the saved layout**. What the row does is
+  unchanged.
+- `switch sidebar-open --mode fresh` keeps its token, so a sidebar started by
+  an older client still reaches the renamed row's action.
+
+### Antigravity statusLine support removed
+
+projmux no longer installs, reads, or judges the Antigravity `statusLine` in
+`~/.gemini/antigravity-cli/settings.json`. Only the official hooks entry
+(`projmux` in `~/.gemini/config/hooks.json`) remains.
+
+- The first `projmux config apply` after upgrading (which `make install` and
+  `projmux update apply` also run) removes only a `statusLine` whose `command`
+  carries the `projmux-managed:antigravity-statusline:v1` marker, whatever its
+  `enabled`, `stack_with_default`, extra keys, or executable path. The rest of
+  the file keeps its bytes and mode. It is never re-installed, and
+  `projmux agent integrate antigravity` never creates or writes the file.
+  `agent integrate antigravity --remove` also removes the marker entry.
+- A user-owned `statusLine`, or any value without the marker, is left
+  untouched and can no longer block install, cause a conflict, or change the
+  doctor status. A malformed or unreadable settings file is skipped.
+- Until that removal runs, a leftover bridge calling
+  `internal agent-hook ingest antigravity-hook --event Statusline` exits 0 with
+  empty stdout and changes nothing.
+- Antigravity usage display (`agent usage`, the statusbar HUD and popup, and
+  the Settings usage rows), the Antigravity approval-required notification,
+  and the mid-turn busy detail are gone until Antigravity offers official
+  events for them. `agent usage --model antigravity` is still accepted and
+  prints the `usage unsupported` note; `agent capabilities` reports Antigravity
+  usage as unsupported. Working state still follows the official
+  `PreInvocation`/`Stop` hooks.
+- Leftover `~/.config/projmux/statusbar-visibility-*antigravity*` files,
+  `<state>/usage/antigravity-*.json` sidecars, and cached Antigravity rows in
+  `snapshots.json` are ignored, not deleted. Doctor JSON no longer has
+  `statusline_config_path`, and the diagnostic is named `Antigravity hooks`.
+
+### Project snapshots removed
+
+`registry.json` is now the only saved Project state. projmux no longer saves or
+restores Project snapshots anywhere else, so these surfaces are gone:
+
+- the `create snapshot`, `get snapshots`, `delete snapshot`,
+  `restore snapshot`, and `prune snapshot` commands. `create`, `get`,
+  `delete`, and `prune` now refuse the `snapshot` kind with a usage error. The
+  `restore` command group had no other child and is removed with them, so
+  `restore snapshot` fails as an unknown command. `prune` now prunes only stale
+  Projects and Agents;
+- the hidden `session-state` route;
+- the Global and Project **Snapshots** pages in Settings: the auto-save toggle
+  and interval, the per-Project auto-save override, and the save latest, save
+  named, preview, and delete actions;
+- the snapshot view in the session popup and its `SessionPopup:OpenState`
+  keybinding;
+- the session-state section of `projmux doctor`, including
+  `doctor --section session-state` and the `session_state_resume` and
+  `session_state_prune` JSON fields.
+
+projmux no longer emits `session-state.outcome` diagnostics records. Records
+with that event in existing logs are still read and accepted.
+
+The existing `${XDG_STATE_HOME:-$HOME/.local/state}/projmux/sessions` directory
+is no longer read. `projmux config apply` (which `make install` runs) removes
+the `*.json` snapshot files in it once, along with the `sessionstate-autosave`
+and `sessionstate-autosave-interval` files and the
+`sessionstate-projects/<session>/autosave` files under the config directory,
+and then removes the `sessions/` and `sessionstate-projects/` directories if
+they end up empty. It only removes regular files with those names and never
+follows symlinks. Any other entry there is kept, and the apply that removes
+the files lists it on its one `reclaimed retired Project snapshot files: ...`
+line; later applies with nothing left to remove print nothing. To keep the old files,
+copy those directories before you upgrade. `PROJMUX_SESSIONSTATE_AUTOSAVE` is
+ignored. Tmux configs rendered by older installs may
+still call `projmux internal tmux autosave-session-state`; that route stays and
+exits 0 without writing anything.
+
+Closed Projects start from the Registry: **Continue project** materializes the
+Project's stored Windows and Panes, and **Recreate Project** (since renamed
+**Clear layout and open**) replaces them with a fresh graph.
+Settings > Projects > Project Sidebar > Closed Project startup and its
+`sidebar-startup-picker` file were unchanged by that release; a later release
+removed them
+([Closed Project startup setting removed](#closed-project-startup-setting-removed)).
+Settings no longer saves a
+named layout from a live session into `<project>/.projmux/layouts`, and no
+current surface opens those files.
+Leftover `.projmux/layouts` files on disk and layout entries in
+`trusted-projects.json` are kept and ignored.
+
+### Private Codex generation files reclaimed
+
+The private Codex generation pool is gone; app-server lifetime belongs to
+`codex app-server daemon`. Nothing reads the files that pool left on disk, and
+`projmux config apply` (which `make install` and `projmux update apply` also
+run) removes them once:
+
+- under `${XDG_STATE_HOME:-$HOME/.local/state}/projmux/codex-generations/`:
+  `rolling-upgrade.json` and its `.flock`, the stored `qualification/*.json`
+  records, and the leased release bundles in `bundles/sha256-<digest>/`, which
+  are the bulk of that directory;
+- under `${XDG_STATE_HOME:-$HOME/.local/state}/projmux/g/<key>/`: each private
+  host's `.projmux-launch-<generation>.json` intent, its `.guard`, and the
+  app-server socket nothing listens on anymore.
+
+Each directory is removed once it ends up empty. Only entries whose names have
+exactly those shapes are removed, and symlinks are never followed. A private
+host whose socket still accepts a connection keeps its whole directory and is
+named on the report line instead, so an app-server that outlived projmux does
+not lose the socket under it. Any other entry is kept and listed on the single
+`reclaimed retired Codex generation files: ...` line that apply prints; later
+applies with nothing left to remove print nothing. A failure is reported on
+that line and never fails the apply, and a rerun converges. To keep the old
+files, copy those directories before you upgrade.
+
 ### Claude dialogue endpoint revalidation
 
 The heterogeneous dialogue release moves the public message envelope and
@@ -124,8 +259,7 @@ That is evidence of incompatibility, not permission to proceed. Operators must
 refuse a binary-only downgrade before installation and must not permit the old
 binary to write final-v2 bytes. To roll back during the prerelease window, stop
 the final writer, restore the exact pre-normalization Registry backup, and
-restore the matching intermediate binary as a pair. Snapshots are not migration
-or rollback inputs and are never rewritten by this normalization.
+restore the matching intermediate binary as a pair.
 
 Rollback rehearsal is byte-oriented: record the backup path, mode, SHA-256,
 and matching pre-release binary revision; stop every final-v2 writer; atomically
@@ -346,7 +480,7 @@ commands and exit 1. Use `internal ...` for generated plumbing and `config
 render|apply` for public configuration work.
 
 The mixed roots retain only `attach project`, `focus project|window|pane`, `pin
-project`, and `prune project|snapshot`. Shortcuts and singular/plural resource
+project`, and `prune agent|project`. Shortcuts and singular/plural resource
 kind aliases are unchanged. The ledger contains the complete removed
 argv/replacement/error matrix.
 
@@ -359,8 +493,8 @@ queue maintenance.
 
 ### Managed Agent hook producer migration
 
-The installer now writes Codex, Claude, Antigravity named hooks, Antigravity
-Statusline, and the tmux bell fallback with the canonical
+The installer now writes Codex, Claude, Antigravity named hooks, and the tmux
+bell fallback with the canonical
 `projmux internal agent-hook ingest ...` entrypoint. Copyable integration
 commands use `projmux agent integrate <provider>`.
 
@@ -374,8 +508,9 @@ through v0.11.1 before the next release when you need the migration-window
 event guarantee.
 
 Migration is ownership- and transaction-aware. Codex managed blocks and the
-Claude, Antigravity, Statusline, and tmux-bell markers are the only ownership
-evidence. Missing integrations and markerless commands are not installed or
+Claude, Antigravity, and tmux-bell markers are the only ownership
+evidence (the legacy Antigravity statusLine marker is only ever removed; see
+[Antigravity statusLine support removed](#antigravity-statusline-support-removed)). Missing integrations and markerless commands are not installed or
 rewritten. Provider file plans and conflicts are collected before the first
 file write. Live bell state is then inventoried on the exact target socket
 before its first command; a later bell failure rolls back both that live state