projmux 0.9.0 → 0.10.0

package/docs/agent-workflow.md

@@ -30,10 +30,10 @@
 - `make fix`: safe automatic fixes such as `go fix` and repository-approved cleanup steps.
 - `make npm-pack`: macOS-hosted local npm binary package staging and `npm pack --dry-run` for the root package plus platform packages, including native-key-adapter checks for both Darwin architectures; release staging reuses the release matrix archives.
 - `make security`: pinned govulncheck, gosec, staticcheck, gitleaks history/current-tree, actionlint, and shellcheck gates. Reviewed gosec/staticcheck findings use checked-in fingerprint/count baselines so only new findings fail.
-- `make test`: fast unit coverage for app-layer AI split native agent launch/selective popup-toggle/settings/status/notification parity including AI pane option metadata, watcher metadata bootstrap for existing panes, capture-backed reply detection, missing-pane watcher shutdown, armed focus-only reply badge clearing, busy attention preservation on focus clear, manual AI topic preservation while watcher status still updates, agent-labeled desktop notification message context with pane-title-first body text, global/project-local lifecycle hook dispatch for post-create/pre-create/post-attach/send-noti with project hook and `.projmux/config.toml` trust-store hashing plus env/settings kill-switch gating, declarative startup command and hook run coverage, `send-noti` stdin JSON delivery plus `PROJMUX_NOTIFY_*` env payload, notify queue write success/failure/depth-guard dispatch rules, notify/statusbar/sidebar origin-client focus routing, project config env/kube session environment application, Settings project config env/kube/startup form writes with trust-store refresh and preserved hook commands, startup command send-keys orchestration plus startup pane replay markers, pre-create abort behavior, and shared projmux notification icon paths, and scoped even row/column resizing after shell and agent splits, status-bar git/kube segment parity including muted git branch block styling, compact dirty/staged/ahead/behind state colors, and bounded git/kube child execution, statusbar pwd display-only native-framed path popup with shared popup-wait-key/no-extra-payload-line command coverage, no clipboard or tmux buffer copy, and popup-wait-key cursor/raw-mode restore coverage, statusbar usage native HUD popup alignment/height-budget/threshold palette/muted sync-staleness/fallback coverage without raw CLI popup or popup-toggle stacking, statusbar settings click popup fallback and settings chip right-edge rendering without default trailing space, popup-toggle stale marker recovery, isolated `projmux shell` tmux app launch/config generation including home fallback plus project-context default session targeting from `PROJMUX_CWD` or nearest project marker, app-owned project-name statusbar layout, distinct project badge color, and quiet debounced session-state autosave command/app-config trigger, shell-entry welcome release prompt and inline update handling, shell update skip-by-latest-tag behavior plus best-effort stale-cache refresh, pane/window keybindings, keymap.toml tmux override rendering/stale unbinds including retired direct/UserKey cleanup, Settings Keybindings root/list/detail capture flows including parse-error rows, unsafe raw capture and timeout guards, disable/reset writes, app config regeneration, live tmux source-file reload, no-live-tmux save behavior, and stage-by-stage apply recovery copy, window rename bindings, pane rename helper/binding, pane-exit rebalance command/hooks, hook-pane and after-select-pane based attention focus hooks, attention badge toggle/clear/list/window rendering, attach/current/kill/pin/preview/prune/sessions/session-popup/settings commands, switch, tag, tmux helper commands, update status/check/apply cache and installer detection including GitHub Release binary asset selection/extraction/replacement, doctor install-missing command selection, AI notify integration diagnostics, and Session State resume metadata diagnostics, Settings AI notify integration diagnostics read-only status/conflict/CLI guidance, and Settings About update status/check action wiring, untitled standalone popup-toggle marker close/config install, direct popup minimum sizing, AI picker minimum width and height, sidebar minimum width and compact badge spacing, preview select writes, popup render output after cycling, switch picker pin action behavior without inline settings rows, nested settings hub sections for AI defaults, project picker filesystem scan/pin actions, Project Root settings source/shadowing/set/current/clear flows, app/keybinding info including Ctrl-M rename forwarding, and About version/source rendering, switch picker focused-session kill, switch picker launcher-key abort bindings, switch explicit project-root, unconfigured-root, and weak managed-root heuristic parity, switch popup hiding new-session candidates while sidebar keeps create-capable rows, switch row project-name display with `~` pinned to the top and live-session-first sorting, pretty-path, preview-context including kube context/namespace, switch settings subcommand flows including add-current-pin, interactive add-pin picker, and settings label/preview polish including Phase 2 Settings/hookmaker/project-startup/trust/quit destructive row color regression strings, native preview wiring, baseline picker surface parity including prompt/footer/header fallback without app-name filler and search-key scoped card matching, sidebar compact action-only key footer, sidebar preview-window/start-position behavior without focus-time session switching, sidebar row/window ANSI styling with pane-aggregated attention badge state and AI topic labels, Alt+2/Alt+3 legacy popup row, preview-window, pane metadata, and pane-snapshot parity, switch read0 card rows with active/inactive title styling, right-side status badges, combined directory/git metadata with muted inactive branch styling and bounded slow-repository branch enrichment, statusbar-matched block window tabs with window attention badges, read0 expect-key action parsing, restored pin/tag card badges, and restrained selected-row marker styling, switch preview metadata without duplicated directory/git rows, preview metadata rendering, popup pane display names for AI agents, AI topics, and shell commands, switch preview cycle bindings, sessions picker preview/cycle/open/kill wiring including attached-session fallback behavior, sessions picker launcher-key abort bindings, popup/switch preview summary formatting, popup sessions tmux entry helpers, switch/popup/session rendering, session identity, session-state Claude/Codex/Antigravity resume and declarative startup replay, session snapshot capture/autosave recipe classification including save/autosave pre-capture resume metadata refresh from live AI session ids including Antigravity conversation ids, Claude transcript paths, and Codex rollout log cwd matching/ambiguity skips, candidate discovery, config path derivation, popup preview read-models, and pure state rules including preview, tag, and lifecycle stores.
-- `make test`: fast unit coverage for app-layer AI split native agent launch/selective popup-toggle/settings/status/notification parity including AI pane option metadata, watcher metadata bootstrap for existing panes, capture-backed reply detection, missing-pane watcher shutdown, armed focus-only reply badge clearing, busy attention preservation on focus clear, manual AI topic preservation while watcher status still updates, agent-labeled desktop notification message context with pane-title-first body text, global/project-local lifecycle hook dispatch for post-create/pre-create/post-attach/send-noti with project hook and `.projmux/config.toml` trust-store hashing plus env/settings kill-switch gating, declarative startup command and hook run coverage, `send-noti` stdin JSON delivery plus `PROJMUX_NOTIFY_*` env payload, notify queue write success/failure/depth-guard dispatch rules, notify/statusbar/sidebar origin-client focus routing, project config env/kube session environment application, Settings project config env/kube/startup form writes with trust-store refresh and preserved hook commands, startup command send-keys orchestration plus startup pane replay markers, pre-create abort behavior, and shared projmux notification icon paths, and scoped even row/column resizing after shell and agent splits, status-bar git/kube segment parity including muted git branch block styling and compact dirty/staged/ahead/behind state colors, statusbar pwd display-only native-framed path popup with shared popup-wait-key/no-extra-payload-line command coverage, no clipboard or tmux buffer copy, and popup-wait-key cursor/raw-mode restore coverage, statusbar usage native HUD popup alignment/height-budget/threshold palette/muted sync-staleness/fallback coverage without raw CLI popup or popup-toggle stacking, statusbar settings click popup fallback and settings chip right-edge rendering without default trailing space, popup-toggle stale marker recovery, isolated `projmux shell` tmux app launch/config generation including home fallback plus project-context default session targeting from `PROJMUX_CWD` or nearest project marker, app-owned project-name statusbar layout, distinct project badge color, and quiet debounced session-state autosave command/app-config trigger, shell-entry welcome release prompt and inline update handling, shell update skip-by-latest-tag behavior plus best-effort stale-cache refresh, pane/window keybindings, keymap.toml tmux override rendering/stale unbinds including retired direct/UserKey cleanup, Settings Keybindings root/list/detail capture flows including parse-error rows, unsafe raw capture and timeout guards, disable/reset writes, app config regeneration, live tmux source-file reload, no-live-tmux save behavior, and stage-by-stage apply recovery copy, window rename bindings, pane rename helper/binding, pane-exit rebalance command/hooks, hook-pane and after-select-pane based attention focus hooks, attention badge toggle/clear/list/window rendering, attach/current/kill/pin/preview/prune/sessions/session-popup/settings commands, switch, tag, tmux helper commands, update status/check/apply cache and installer detection including GitHub Release binary asset selection/extraction/replacement, doctor install-missing command selection, AI notify integration diagnostics, and Session State resume metadata diagnostics, Settings AI notify integration diagnostics read-only status/conflict/CLI guidance, and Settings About update status/check action wiring, untitled standalone popup-toggle marker close/config install, direct popup minimum sizing, AI picker minimum width and height, sidebar minimum width and compact badge spacing, preview select writes, popup render output after cycling, switch picker pin action behavior without inline settings rows, nested settings hub sections for AI defaults, project picker filesystem scan/pin actions, Project Root settings source/shadowing/set/current/clear flows, app/keybinding info including Ctrl-M rename forwarding, and About version/source rendering, switch picker focused-session kill, switch picker launcher-key abort bindings, switch explicit project-root, unconfigured-root, and weak managed-root heuristic parity, switch popup hiding new-session candidates while sidebar keeps create-capable rows, switch row project-name display with `~` pinned to the top and live-session-first sorting, pretty-path, preview-context including kube context/namespace, switch settings subcommand flows including add-current-pin, interactive add-pin picker, and settings label/preview polish including Phase 2 Settings/hookmaker/project-startup/trust/quit destructive row color regression strings, native preview wiring, baseline picker surface parity including prompt/footer/header fallback without app-name filler and search-key scoped card matching, sidebar compact action-only key footer, sidebar preview-window/start-position behavior without focus-time session switching, sidebar row/window ANSI styling with pane-aggregated attention badge state and AI topic labels, Alt+2/Alt+3 legacy popup row, preview-window, pane metadata, and pane-snapshot parity, switch read0 card rows with active/inactive title styling, right-side status badges, combined directory/git metadata with muted inactive branch styling, statusbar-matched block window tabs with window attention badges, read0 expect-key action parsing, restored pin/tag card badges, and restrained selected-row marker styling, switch preview metadata without duplicated directory/git rows, preview metadata rendering, popup pane display names for AI agents, AI topics, and shell commands, switch preview cycle bindings, sessions picker preview/cycle/open/kill wiring including attached-session fallback behavior, sessions picker launcher-key abort bindings, popup/switch preview summary formatting, popup sessions tmux entry helpers, switch/popup/session rendering, session identity, session-state Claude/Codex/Antigravity resume and declarative startup replay, session snapshot capture/autosave recipe classification including save/autosave pre-capture resume metadata refresh from live AI session ids including Antigravity conversation ids, Claude transcript paths, and Codex rollout log cwd matching/ambiguity skips, candidate discovery, config path derivation, popup preview read-models, and pure state rules including preview, tag, and lifecycle stores.
+- `make test`: fast unit coverage for app-layer AI split native agent launch/selective popup-toggle/settings/status/notification parity including AI pane option metadata, watcher metadata bootstrap for existing panes, capture-backed reply detection, missing-pane watcher shutdown, armed focus-only reply badge clearing, busy attention preservation on focus clear, manual AI topic preservation while watcher status still updates, agent-labeled desktop notification message context with pane-title-first body text, global/project-local lifecycle hook dispatch for post-create/pre-create/post-attach/send-noti with project hook and `.projmux/config.toml` trust-store hashing plus env/settings kill-switch gating, declarative startup command and hook run coverage, `send-noti` stdin JSON delivery plus `PROJMUX_NOTIFY_*` env payload, notify queue write success/failure/depth-guard dispatch rules, notify/statusbar/sidebar origin-client focus routing, project config env/kube session environment application, Settings project config env/kube/startup form writes with trust-store refresh and preserved hook commands, startup command send-keys orchestration plus startup pane replay markers, pre-create abort behavior, and shared projmux notification icon paths, and scoped even row/column resizing after shell and agent splits, status-bar git/kube segment parity including muted git branch block styling, compact dirty/staged/ahead/behind state colors, and bounded git/kube child execution, statusbar pwd display-only native-framed path popup with shared popup-wait-key/no-extra-payload-line command coverage, no clipboard or tmux buffer copy, and popup-wait-key cursor/raw-mode restore coverage, statusbar usage native HUD popup alignment/height-budget/threshold palette/muted sync-staleness/fallback coverage without raw CLI popup or popup-toggle stacking, statusbar settings click popup fallback and settings chip right-edge rendering without default trailing space, popup-toggle stale marker recovery, isolated `projmux shell` tmux app launch/config generation including home fallback plus project-context default session targeting from `PROJMUX_CWD` or nearest project marker, app-owned project-name statusbar layout, distinct project badge color, and quiet debounced session-state autosave command/app-config trigger, shell-entry welcome release prompt and inline update handling, shell update skip-by-latest-tag behavior plus best-effort stale-cache refresh, pane/window keybindings, keymap.toml tmux override rendering/stale unbinds including retired direct/UserKey cleanup, Settings Keybindings root/list/detail capture flows including parse-error rows, unsafe raw capture and timeout guards, disable/reset writes, app config regeneration, live tmux source-file reload, no-live-tmux save behavior, and stage-by-stage apply recovery copy, window rename bindings, pane rename helper/binding, pane-exit rebalance command/hooks, hook-pane and after-select-pane based attention focus hooks, attention badge toggle/clear/list/window rendering, attach/current/kill/pin/preview/prune/sessions/session-popup/settings commands, switch, tag, tmux helper commands, update status/check/apply cache and installer detection including GitHub Release binary asset selection/extraction/replacement, doctor versioned read-only report/section/verbosity contracts, AI notify integration diagnostics, and Session State resume metadata diagnostics, Settings AI notify integration diagnostics read-only status/conflict/CLI guidance, and Settings About update status/check action wiring, untitled standalone popup-toggle marker close/config install, direct popup minimum sizing, AI picker minimum width and height, sidebar minimum width and compact badge spacing, preview select writes, popup render output after cycling, switch picker pin action behavior without inline settings rows, nested settings hub sections for AI defaults, project picker filesystem scan/pin actions, Project Root settings source/shadowing/set/current/clear flows, app/keybinding info including Ctrl-M rename forwarding, and About version/source rendering, switch picker focused-session kill, switch picker launcher-key abort bindings, switch explicit project-root, unconfigured-root, and weak managed-root heuristic parity, switch popup hiding new-session candidates while sidebar keeps create-capable rows, switch row project-name display with `~` pinned to the top and live-session-first sorting, pretty-path, preview-context including kube context/namespace, switch settings subcommand flows including add-current-pin, interactive add-pin picker, and settings label/preview polish including Phase 2 Settings/hookmaker/project-startup/trust/quit destructive row color regression strings, native preview wiring, baseline picker surface parity including prompt/footer/header fallback without app-name filler and search-key scoped card matching, sidebar compact action-only key footer, sidebar preview-window/start-position behavior without focus-time session switching, sidebar row/window ANSI styling with pane-aggregated attention badge state and AI topic labels, Alt+2/Alt+3 legacy popup row, preview-window, pane metadata, and pane-snapshot parity, switch read0 card rows with active/inactive title styling, right-side status badges, combined directory/git metadata with muted inactive branch styling and bounded slow-repository branch enrichment, statusbar-matched block window tabs with window attention badges, read0 expect-key action parsing, restored pin/tag card badges, and restrained selected-row marker styling, switch preview metadata without duplicated directory/git rows, preview metadata rendering, popup pane display names for AI agents, AI topics, and shell commands, switch preview cycle bindings, sessions picker preview/cycle/open/kill wiring including attached-session fallback behavior, sessions picker launcher-key abort bindings, popup/switch preview summary formatting, popup sessions tmux entry helpers, switch/popup/session rendering, session identity, session-state Claude/Codex/Antigravity resume and declarative startup replay, session snapshot capture/autosave recipe classification including save/autosave pre-capture resume metadata refresh from live AI session ids including Antigravity conversation ids, Claude transcript paths, and Codex rollout log cwd matching/ambiguity skips, candidate discovery, config path derivation, popup preview read-models, and pure state rules including preview, tag, and lifecycle stores.
+- `make test`: fast unit coverage for app-layer AI split native agent launch/selective popup-toggle/settings/status/notification parity including AI pane option metadata, watcher metadata bootstrap for existing panes, capture-backed reply detection, missing-pane watcher shutdown, armed focus-only reply badge clearing, busy attention preservation on focus clear, manual AI topic preservation while watcher status still updates, agent-labeled desktop notification message context with pane-title-first body text, global/project-local lifecycle hook dispatch for post-create/pre-create/post-attach/send-noti with project hook and `.projmux/config.toml` trust-store hashing plus env/settings kill-switch gating, declarative startup command and hook run coverage, `send-noti` stdin JSON delivery plus `PROJMUX_NOTIFY_*` env payload, notify queue write success/failure/depth-guard dispatch rules, notify/statusbar/sidebar origin-client focus routing, project config env/kube session environment application, Settings project config env/kube/startup form writes with trust-store refresh and preserved hook commands, startup command send-keys orchestration plus startup pane replay markers, pre-create abort behavior, and shared projmux notification icon paths, and scoped even row/column resizing after shell and agent splits, status-bar git/kube segment parity including muted git branch block styling and compact dirty/staged/ahead/behind state colors, statusbar pwd display-only native-framed path popup with shared popup-wait-key/no-extra-payload-line command coverage, no clipboard or tmux buffer copy, and popup-wait-key cursor/raw-mode restore coverage, statusbar usage native HUD popup alignment/height-budget/threshold palette/muted sync-staleness/fallback coverage without raw CLI popup or popup-toggle stacking, statusbar settings click popup fallback and settings chip right-edge rendering without default trailing space, popup-toggle stale marker recovery, isolated `projmux shell` tmux app launch/config generation including home fallback plus project-context default session targeting from `PROJMUX_CWD` or nearest project marker, app-owned project-name statusbar layout, distinct project badge color, and quiet debounced session-state autosave command/app-config trigger, shell-entry welcome release prompt and inline update handling, shell update skip-by-latest-tag behavior plus best-effort stale-cache refresh, pane/window keybindings, keymap.toml tmux override rendering/stale unbinds including retired direct/UserKey cleanup, Settings Keybindings root/list/detail capture flows including parse-error rows, unsafe raw capture and timeout guards, disable/reset writes, app config regeneration, live tmux source-file reload, no-live-tmux save behavior, and stage-by-stage apply recovery copy, window rename bindings, pane rename helper/binding, pane-exit rebalance command/hooks, hook-pane and after-select-pane based attention focus hooks, attention badge toggle/clear/list/window rendering, attach/current/kill/pin/preview/prune/sessions/session-popup/settings commands, switch, tag, tmux helper commands, update status/check/apply cache and installer detection including GitHub Release binary asset selection/extraction/replacement, doctor versioned read-only report/section/verbosity contracts, AI notify integration diagnostics, and Session State resume metadata diagnostics, Settings AI notify integration diagnostics read-only status/conflict/CLI guidance, and Settings About update status/check action wiring, untitled standalone popup-toggle marker close/config install, direct popup minimum sizing, AI picker minimum width and height, sidebar minimum width and compact badge spacing, preview select writes, popup render output after cycling, switch picker pin action behavior without inline settings rows, nested settings hub sections for AI defaults, project picker filesystem scan/pin actions, Project Root settings source/shadowing/set/current/clear flows, app/keybinding info including Ctrl-M rename forwarding, and About version/source rendering, switch picker focused-session kill, switch picker launcher-key abort bindings, switch explicit project-root, unconfigured-root, and weak managed-root heuristic parity, switch popup hiding new-session candidates while sidebar keeps create-capable rows, switch row project-name display with `~` pinned to the top and live-session-first sorting, pretty-path, preview-context including kube context/namespace, switch settings subcommand flows including add-current-pin, interactive add-pin picker, and settings label/preview polish including Phase 2 Settings/hookmaker/project-startup/trust/quit destructive row color regression strings, native preview wiring, baseline picker surface parity including prompt/footer/header fallback without app-name filler and search-key scoped card matching, sidebar compact action-only key footer, sidebar preview-window/start-position behavior without focus-time session switching, sidebar row/window ANSI styling with pane-aggregated attention badge state and AI topic labels, Alt+2/Alt+3 legacy popup row, preview-window, pane metadata, and pane-snapshot parity, switch read0 card rows with active/inactive title styling, right-side status badges, combined directory/git metadata with muted inactive branch styling, statusbar-matched block window tabs with window attention badges, read0 expect-key action parsing, restored pin/tag card badges, and restrained selected-row marker styling, switch preview metadata without duplicated directory/git rows, preview metadata rendering, popup pane display names for AI agents, AI topics, and shell commands, switch preview cycle bindings, sessions picker preview/cycle/open/kill wiring including attached-session fallback behavior, sessions picker launcher-key abort bindings, popup/switch preview summary formatting, popup sessions tmux entry helpers, switch/popup/session rendering, session identity, session-state Claude/Codex/Antigravity resume and declarative startup replay, session snapshot capture/autosave recipe classification including save/autosave pre-capture resume metadata refresh from live AI session ids including Antigravity conversation ids, Claude transcript paths, and Codex rollout log cwd matching/ambiguity skips, candidate discovery, config path derivation, popup preview read-models, and pure state rules including preview, tag, and lifecycle stores.
 - `make test` also covers GitHub Release updater resource and integrity boundaries: bounded compressed responses, decompressed tar streams, total and per-file regular bytes, entry counts, required SHA-256 asset digests, release-host/redirect allowlisting, scratch cleanup, and no atomic replacement after rejection.
-- `make test` also freezes doctor plain/JSON read-only output and exit/no-write baselines, the typed compatibility install-plan split from human hints, deprecated install-flag combination warnings as exactly one stderr line, unchanged install/dry-run/include-optional/manual/unresolved execution semantics, compatibility stdout fixtures, and canonical CLI/Settings/About wording that presents doctor as read-only diagnostics.
+- `make test` also freezes Doctor schema-versioned plain/JSON fixtures, exact text/JSON row and section projection parity, shared-inventory parity, default-versus-verbose detail ownership, projected exit semantics, Phase 2 ordered runtime/log typed findings (backend, bounded socket probe/output, bounded regular generated-config reads and digest drift, state/log/journal permissions, non-regular/symlink/oversize rejection, Windows ACL privacy uncertainty, and bounded safe errors), exact removed-flag migration errors, typed display-only remediation, raw path/socket/routing/message/config/argv negative coverage, support-report scalar-array allowlisting and schema compatibility, and the strict no-installer/no-migration/no-operational-journal write or repair boundary across the full flag matrix.
 - `make test` also covers resume-title cleaning at the shared Claude/Codex/Antigravity choke point: known Claude command, local-command, task-notification, and system-reminder scaffolding is discarded so discovery falls through to the first real prompt, while inline `<`, leading HTML, and custom-element prompts remain intact.
 - `make test` also covers the hardcoded usage HUD manual refresh key, full enabled-adapter collection through the existing throttle/backoff policy, cooldown no-op, cached popup rerender, and unchanged click/`u` cache-only behavior.
 - `make test` also covers Settings > AI Settings > Enabled agents Phase 0 config behavior: missing config enables Claude, Codex, and Antigravity, unknown saved provider names are ignored without disabling known providers, Settings toggles persist Claude/Codex/Antigravity only, shell/selective are absent from enabled-agent rows, and a saved default split mode warns when its provider is disabled.
@@ -42,27 +42,28 @@
 - `make test` also covers Notify sidebar pane-grouped read-model rows and interactions: collapsed pane inbox group construction, fixed three-line group cards with stable project/provider, topic/context, aggregate metadata, and latest-preview slots including topic-with-project cases, child-count badges that match expandable child rows without rendering `+0`, childless group headers without strong fold affordance, selected/expanded marker-only row shape changes, duplicate label/preview reduction, worst-severity aggregation, inactive/gone group display and child-count rendering, pane-less fallback grouping, compact newest-first child event rows with warn/critical severity preservation, Right/Left fold mutation plus childless Right no-op refresh, folded and expanded live group Enter focus+ack with mixed-severity critical rows, inactive-but-routable group Enter focus+ack, gone group Enter cleanup without focus including critical rows, target-gone race cleanup, transient focus-failure no-ack refresh, child Enter focus/ack preservation, explicit group acknowledgement including mixed-severity critical rows, and grouped deferred refresh output with expanded-state pruning.
 - `make test` also covers the AI provider metadata registry for Claude/Codex/Antigravity launch providers: registry-derived enabled-agent defaults and ordering, Settings enabled-agent rows, AI picker visibility for disabled providers, ambient usage model scope derivation for currently registered adapters, hook diagnostic provider metadata, Antigravity session-state support metadata, and explicit diagnostics for disabled providers.
 - `make test` also covers the Antigravity v1.1.12 hook contract: authoritative CLI `--event` selection with legacy payload fallback, sanitized camelCase common/invocation/post-tool/Stop fixtures, empty/absent/populated `workspacePaths` handling with inherited-pane-first attribution, explicit-error-centric Stop severity including unknown-reason diagnostics, the official five-event catalog with disabled permission-changing `PreToolUse`, and valid non-permission-changing hook response JSON.
-- `make test` also covers the Antigravity v1.1.12 statusline bridge: official stacked managed-object golden, settings install/reinstall/remove byte and mode preservation, custom-command conflict and malformed/symlink/permission preflight, empty custom stdout, official snake_case identity/agent/confirmation/context-token/quota fixture parsing, busy/quiet state mapping including Stop → late busy → idle completion preservation and next-PreInvocation reset, stable approval dedupe identity, structured conversation-local context sidecar writes with the legacy string-percent fallback, opaque quota bucket ordering/identity and collision guards, remaining-fraction validation/conversion, independent absolute/relative reset persistence, context-only/empty/null/disabled/malformed quota degradation, and separate CLI/HUD/statusbar `ctx` versus `quota/<bucket>` rendering.
-- `make test` also covers usage HUD/all-model filtering from Settings > AI Settings > Enabled agents: ambient `status usage` and `usage --model all` scope collection/rendering to enabled Claude/Codex/Antigravity providers, all-disabled all-model output shows a Settings fallback without refreshing adapters, disabled cached rows/backoff do not leak into ambient output, exact fixed-window versus quota filtering, and explicit `usage --model claude|codex|antigravity` still collects/renders the requested provider even when disabled.
+- `make test` also covers the Antigravity v1.1.12 statusline bridge: official stacked managed-object golden, settings install/reinstall/remove byte and mode preservation, custom-command conflict and malformed/symlink/permission preflight, empty custom stdout, official snake_case identity/agent/confirmation/context-token/quota fixture parsing, busy/quiet state mapping including Stop → late busy → idle completion preservation and next-PreInvocation reset, stable approval dedupe identity, structured conversation-local context sidecar writes with the legacy string-percent fallback retained as private hook/notify diagnostics, opaque quota bucket ordering/identity and collision guards, remaining-fraction validation/conversion, independent absolute/relative reset persistence, and context-only/empty/null/disabled/malformed quota degradation without context usage snapshots.
+- `make test` also covers usage HUD/all-model filtering from Settings > AI Settings > Enabled agents: ambient `status usage` and `usage --model all` scope collection/rendering to enabled Claude/Codex/Antigravity providers, all-disabled all-model output shows a Settings fallback without refreshing adapters, disabled cached rows/backoff do not leak into ambient output, exact fixed-window versus lossless named-quota filtering, official-window status projection with exact Antigravity `gemini-weekly` aliasing and unknown quota exclusion, weekly-only provider preservation through long/primary/text tiers, legacy context suppression in text/JSON/popup, data-driven popup absolute-count columns without percent-derived counts, Claude typed `limits[]` aggregate-only/aggregate-plus-model/null/unknown/malformed parser tables with nullable scope/model ID/surface and bounded injection-safe labels, exact named identity/reset/freshness store/text/JSON/popup round trips, aggregate-only replacement plus malformed/backoff last-known-good preservation, Claude named-row status exclusion, and explicit `usage --model claude|codex|antigravity` still collects/renders the requested provider even when disabled.
 - `make test` also covers Codex rollout rate-limit window classification by `window_minutes`: old-schema primary 5-hour plus secondary weekly snapshots, new-schema primary weekly plus null secondary behavior, unknown-window skipping, and golden snapshot output for both rollout schemas.
 - `make test` also covers AI semantic badge renderer aggregation for window-list, sidebar rows, switch window tabs, popup pane summaries, and pane-border topic badges using prompt-required > response-complete > in-progress priority while preserving blank no-state lanes, response-complete live badge consume on attention clear without idling action-required/progress badges, plus Settings > Appearance AI badge style selection for dot/emoji/off pane-border, Alt-1 sidebar window/preview tabs, and tmux window-status compatibility with dot as the persisted/config fallback.
 - `make test` also covers AI semantic badge Phase 3 theme-role hardening: `@projmux_ai_badge_kind` storage values and aggregate priority stay unchanged, `minimal` remains a read-time alias for the `off` badge style, progress/success/action-required badge roles stay distinct, permission/input status badges do not use critical red, and critical notify queue severity does not drive live AI status badge colors or desktop notification urgency.
 - `make test` also covers keybinding surface tier catalog rules, action-centered `keymap.toml` `keys = [...]` multi-alias parsing/writing, quoted internal `Surface:Action` tables, legacy popup action ID aliases, canonical popup toggle names, AI split popup-vs-direct action labels, generated tmux config multi-alias rendering, global/direct conflict detection, surface-scoped native picker command conflict detection, Settings Keybindings list/search/detail surface-aware picker-local labels, compact action-list state copy, flat Keys list/action detail rows, key detail remove/test rows, capture-unavailable Add key direct recorder routing with Advanced typed entry retained on Action detail, recorder Recording/Staged/Confirmed transitions, empty Enter no-op, Esc cancellation, staged candidate replacement, native byte-stream normalization/confirmation/conflict recovery, and one-reader/no-event-leak lifecycle, collapsed Troubleshooting entry copy, Settings delivery diagnostics that split logical key/raw bytes/tmux received key while distinguishing missing, ambiguous, adapter-needed, and delivered states, safe direct key pool and risky/reserved diagnostic-only copy, Projmux-owned Ghostty/Windows Terminal advanced delivery copy, raw escape/CSI-u/xterm modified/UserKey/UserSequence rejection from primary keymap storage, Labs compatibility redirect to the Keybindings root, existing macOS capture/add-key flows, unsafe raw capture, reset behavior, stale guide docs guards, and welcome/runtime footer copy that avoids hardcoded launch-key guides.
+- `make test` also covers known retired live no-prefix cleanup for the old `C-t` pane-label binding: cleanup renders before current binds, explicit current `C-t` reassignment wins, repeated apply is byte-idempotent, and `keymap.toml` plus unrelated bindings remain unchanged.
 - Darwin native-key focused coverage includes portable physical chord parsing for Alt/Option, Control, Control-Option, Shift, letters/digits/navigation/function keys, `darwin && cgo` synthetic event-to-canonical-chord mapping for Option, Control, shifted letters, function keys, and arrows with unmatched/plain event pass-through, shared `keymap.toml` custom-action loading (including `M-a`), focused tmux client discovery, canonical `send-keys -K -c` dispatch through the existing root key table, native Settings Add key capture winning over simultaneous terminal text/error results after ignoring the activation Enter while the non-Darwin path preserves immediate terminal capture, default-on shell startup, `PROJMUX_NATIVE_KEYS=0`/`false` and Settings `[ui].native_keys = false` broker opt-out gates, broker direct no-op behavior, one-time pre-permission consent guidance, broker-only process replacement after an Accessibility wait so fresh macOS permission state is observed without restarting tmux, preservation of the direct no-server shutdown boundary while permission is pending, and an explicit Linux/Windows/no-CGO shell startup no-op boundary.
 - `make test` covers the default picker key ownership across catalog, generated tmux config, terminal adapters, setup probes, and native popup close hints: `Alt-4` opens AI Resume as a guaranteed launch default, while `Alt-7` opens the AI split picker as its editable default.
-- `make test` also covers canonical `projmux setup terminal` and deprecated `projmux init` argument/plan/file/error parity across terminal detection, preview no-write, apply/backup, Ghostty candidate conflicts, Windows Terminal merge, config overrides, and symlink refusal/allow; the legacy warning and replacement, canonical help without `--dry-run`, and setup remediation hints are asserted separately.
+- `make test` also covers canonical `projmux setup terminal` terminal detection, preview no-write, apply/backup, Ghostty candidate conflicts, Windows Terminal merge, config overrides, and symlink refusal/allow; removed top-level command dispatch/help negatives, canonical rejection and help absence of the removed legacy-only `--dry-run` flag, and setup remediation hints are asserted separately.
 - `make test` also covers the direct split pane-id output contract: `--print-pane-id` parsing, explicit Claude/Codex/Antigravity/shell output as exactly one `%N` line, unchanged empty stdout without the flag, prompt argv-tail preservation, pre-launch rejection for saved-default/selective/resume picker paths, actionable missing/invalid tmux result errors, and the tmux `split-window -P -F "#{pane_id}"` contract.
 - `make test` also covers welcome revisit policy: legacy welcome state remains readable without suppressing shell entry, Enter continues without storing release skip, `s` stores an update skip for the current latest tag when an update is available, source installs show disabled Upgrade guidance, stale update cache refresh is best-effort, Settings > About > Welcome opens a Settings-native viewer without pending state, and shell prompt display does not schedule a redundant attach popup.
 - `make test` also covers transport-dependent app tmux defaults for pane/window navigation (`M-Left`/`M-Right`/`M-Up`/`M-Down` and `M-S-Left`/`M-S-Right`) while keeping visible default chords, allowing additive safe plain aliases that do not store or remove the transport defaults, and no UserKey/CSI-u generated fallback.
 - `make test` also covers direct `projmux ai split --agent <claude|codex|antigravity|shell|selective|resume>` launches, enabled-agent gating for disabled direct launches and disabled saved defaults, `--force-agent` as an explicit direct CLI-only override, selective picker filtering with all-disabled shell fallback guidance, resume picker routing/New delegation/zero-session fallback/Phase 1 fresh fallback contract, config-default preservation, extra args appended to resolved agent executables, managed pane metadata, title watcher startup, layout application, plain shell split behavior, selective picker delegation, invalid direct-agent usage errors, and regressions that direct concrete-agent and saved-default splits create a new pane without probing existing AI pane metadata or selecting an existing pane, including when launched from the current AI pane.
 - `make test` also covers managed Antigravity hooks integration in an isolated home: named-entry install/dry-run/remove/idempotency, byte-preserving unmanaged JSON edits, explicit four-event absolute commands with no `PreToolUse` permission policy, valid non-blocking stdout fallbacks, conflict/malformed/symlink/permission diagnostics, provider registry/doctor/Settings install-remove-dry-run guidance, PreInvocation thinking/busy state, quiet PostInvocation/PostToolUse bookkeeping with tool-error diagnostics, and Stop decision/notify behavior.
 - `make test` also covers Settings rendered-entry reachability across root/section/detail builders with a closed owner-loop table, handlerless-value rejection, passive info/disabled Enter no-op behavior, `send-noti` visibility in Hooks, no nested Project recipe inside Hooks, Project recipe/AI/Labs view-first detail rows, Appearance Path/Git/Notify icon direct off/symbol/emoji preview selection with no Change page, Notifications root/Desktop notifications/Delivery sources relocation, removal of standalone queue/hook-override rows, `PROJMUX_NOTIFY_HOOK` state merged into Delivery sources, localized Korean Desktop notifications root/detail chrome without visible English residue, Delivery sources command-row clipboard copy, and Labs limited to Live system resources plus overview-first Project Hooks while legacy picker env/file values remain native-compatible.
-- `make test` also covers the macOS/Linux/WSL live resource status Lab: default-off and atomic saved-value persistence, direct Labs on/off mutation plus live tmux option update, generated app/standalone conditional placement between git and clock for both Lab modes, independent CPU 70/90 and memory 75/90 warning/critical boundary classification, mixed-severity per-metric tmux style runs, secondary-style unavailable values without severity leakage, light/dark semantic-role rendering, Linux `/proc/stat` first/delta/reset/malformed/overflow and stale-reference handling, Linux `/proc/meminfo` `MemAvailable` semantics, macOS native Mach CPU tick and free/inactive memory sampling, 0–100 clamping, atomic private sample-cache writes, and compact unavailable rendering.
+- `make test` also covers the macOS/Linux/WSL live resource status Lab: default-off and atomic saved-value persistence, direct Labs on/off mutation plus live tmux option update, generated app/standalone conditional placement between git and clock for both Lab modes, independent CPU 70/90 and memory 75/90 warning/critical boundary classification, mixed-severity per-metric tmux style runs without visible severity words, secondary-style unavailable values without severity leakage, fixed four-column percent slots and invariant metric/segment visible widths across nil/0/9/15/69/70/74/75/89/90/99/100 under default/custom themes, light/dark semantic-role rendering, Linux `/proc/stat` first/delta/reset/malformed/overflow and stale-reference handling, Linux `/proc/meminfo` `MemAvailable` semantics, macOS native Mach CPU tick and free/inactive memory sampling, 0–100 clamping, atomic private sample-cache writes, and compact unavailable rendering.
 - `make test` also covers AI desktop notification dedupe precedence (env override > Settings saved value > default), Desktop notifications mode persistence through `desktop-notify-mode`, saved-config precedence over live tmux options, `projmux tmux apply` regeneration of `@projmux_desktop_notify_mode`, configured dedupe-window collapse/send behavior, Settings > Notifications AI dedupe preset/custom rows, explicit notify focus consume rules for selected critical rows and older same-pane non-critical AI cleanup, preservation of critical/permission/stop-failure/external/git/k8s rows during bulk cleanup, OS Toast click-to-focus queue consume, WSL Toast protocol handler hidden-launcher registration with `wsl.exe --exec` URI forwarding, and attention clear paths that do not ack the queue.
 - `make test` also covers AI hook runtime action precedence over catalog defaults, runtime quiet for known Codex notify events, runtime notify for known Claude quiet events, generic in-app-only notify rows for known Codex hook events without specialized handlers, suppression of desktop notification and `send-noti` dispatch on that generic path, separation of runtime hook action from catalog install events, Settings > Notifications hook quiet policy display/write behavior without external install/remove execution, hook desktop notification payload parity with the in-app queue text across the shared OS notification payload, normal/transient OS urgency and expiration for critical AI queue rows, and dormant title/capture fallback gating once a pane is hook-active.
 - `make test` also covers Settings > Session State as global settings-only UI with default-off auto-save, Sidebar startup picker relocation/compatibility, and no window/pane tree, Settings > Project > Session State project-derived identity plus project auto-save override/effective source rows and distinct Save latest snapshot / Save named snapshot labels, closed-project save disabled reasons, named snapshot portable path conversion, project/global auto-save precedence, Projects > Sessions > State read-only latest/named snapshot overview with window/pane cwd/recipe/agent-resume health, user-facing `projmux session-state` status/save/delete/restore dry-run actions including explicit manual save bypass of disabled autosave and agent resume status/confidence preview, and Project open sidebar startup coverage for Session State opt-in `Start project`, default-off empty creation, Latest snapshot, Named snapshot, Empty session, Back, saved-at row metadata, existing-session skip, startup-before-trust ordering, detached sidebar open continuation before client-scoped separate trust popup handoff without sidebar inline trust UI, trust approve continuation, and trust deny/cancel no-session sidebar refresh behavior.
 - `make test` also covers `projmux shell` usage without startup selector flags, project-context default target lookup from `PROJMUX_CWD` or nearest project marker, explicit `--session` separation from project-derived defaults, and direct empty attach behavior without shell startup picker/replay.
-- `make test` also covers pane identity separation and projection: canonical `rename-pane-label` prompts with `pane label:` initialized only from the current label, Enter confirms, empty Enter clears, and native Esc cancels; unchanged Ctrl-Shift-M default and Settings selection plus deprecated `rename-pane-topic` alias remain label-only. AI topic set/clear keep existing topic/manual ownership, no raw-title action is exposed, and pane border/window tab/popup/sidebar/recent-window resolve user label → agent AI topic → known shell → raw title.
+- `make test` also covers pane identity separation and projection: canonical `rename-pane-label` prompts with `pane label:` initialized only from the current label, Enter confirms, empty Enter clears, and native Esc cancels; unchanged Ctrl-Shift-M default and Settings expose only `rename-pane-label`, while stale `[bindings.rename-pane-topic]` keymaps fail with an exact `[bindings.rename-pane-label]` replacement. AI topic set/clear keep existing topic/manual ownership, no raw-title action is exposed, and pane border/window tab/popup/sidebar/recent-window resolve user label → agent AI topic → known shell → raw title.
 - `make test` also covers session snapshot pane identity capture, old/new decode, and replay field-matrix contracts: `Pane.Label`, raw title, recipe topic/manual ownership, startup fields, and agent/resume metadata stay separate; old snapshots leave label and ownership absent without equality inference; tmux creation-returned pane ids are the replay targets; and agent direct-start never copies a saved topic into the raw title.
 - `make test` also covers Antigravity v1.1.12 current-storage resume discovery from sanitized synthetic `last_conversations.json` and workspace-bearing `conversation_metadata.json` fixtures: exact/depth workspace filtering, URI/path list variants, required metadata summaries, safe-title/short-UUID and blank-turn degradation, normalized UUID plus exact regular `<uuid>.db` existence/mtime validation, missing DB/sidecar/traversal/file-symlink rejection without DB reads, malformed/missing/unknown/workspace-less clean degradation, the separate live hook/session-state lane plus disk-picker last-conversation > metadata > legacy source dedupe without cross-provider behavior changes, high live/medium cache/low history preview and doctor confidence, and picker selection wiring to `agy --conversation <uuid>`.
 - `make test-e2e` also runs a disposable exact tmux server save → destroy → production restore flow for shell/startup/agent panes, changes `pane-base-index` before restore to reject index-derived targets, verifies raw tmux metadata plus visible label resolution, and replays an old snapshot with cleared label/manual ownership.
@@ -78,12 +79,15 @@
 - `make test` also covers the Globalization Phase 2 formatter foundation: compact/full relative age and duration formatting, locale-specific just-now text, notification count plural/count preservation, list joins that preserve payload items, status token and target label localization, terminal cell-width measurement/truncation, and ANSI/tmux style wrappers treated as zero-width.
 - `make test` also covers the Globalization Phase 3 notify runtime migration: AI notify category rendering for `en-US`/`ko-KR`, Codex/Claude hook literal preservation for agent names, tool names, commands, paths, URLs, provider messages, subagent and teammate payloads, desktop notification and in-app queue display parity, notify sidebar/statusbar locale formatter output, and raw queue storage schema preservation.
 - `make test` also covers statusbar notify width fallbacks that preserve normal INFO/WARN/CRIT badges at readable widths, use dotless clipped text/count at very narrow widths, and keep hard truncation closed with `#[default]`.
+- `make test` also covers Usage popup MODEL/WINDOW budget projection for percent-only, absolute-count, and unsupported rows; untruncated Antigravity labels; bounded rune-safe future-provider ellipsis; ANSI visible-width alignment; popup-only inactive named-quota filtering; and retained inactive quota metadata in text/JSON/cache surfaces.
 - `make test` also covers the Globalization Phase 4 Settings and popup guidance migration: `en-US`/`ko-KR` Settings root title/chips/rows/footer rendering, native picker search/empty/footer rendering without overflow, Settings row padding by terminal cell width, shell welcome guide catalog rendering, and long Korean ANSI/tmux-styled guide truncation safety while preserving key/command/path literals.
 - `make test` also covers the Globalization Phase 5 locale settings surface: `PROJMUX_LOCALE` > global `[ui].locale` > `LC_ALL` > `LC_MESSAGES` > `LANG` > `en-US` priority, Settings > Appearance > Language / Locale row/detail visibility, `auto` current-locale/source display, unsupported locale fallback warnings, global config writes, and preserved command/config/env/path literals.
 - `make test` also covers the Globalization Phase 6 governance guard: Go string-literal audit classification for hardcoded Korean candidates, English user-facing candidates, and ignored literal/data/debug examples; no unapproved runtime Korean literals outside catalog/formatter/test fixtures; `en-US` coverage for every embedded default catalog key; and required `ko-KR` coverage for migrated notify, Settings, picker, welcome, update, and help surfaces.
 - `make test` also covers `projmux ai integrate tmux-bell` dry-run/install/remove tmux command planning, managed `alert-bell` hook append/idempotence/removal, preservation of unmanaged bell hooks, and `projmux ai ingest bell --pane` queue push/metadata/dedupe behavior for non-AI-managed panes.
 - `make test` also covers `projmux ai ingest log` tail/path rendering and bounded JSONL log trimming for ingest diagnostics.
 - `make test` also covers the Phase 0 operational diagnostics foundation: closed safe-event schema, control/length/home sanitization, lossy stable top-level error messages with dynamic pane/title/body/transcript/config-value exclusion, exhaustive allowlisted top-level/multi-mode command classification including direct-help and explicit dry-run success exclusion with boolean `=false` safeguards, exactly-once state-changing/error outcomes with explicit zero-success/error-one coverage for the six automatic `ai ingest`, attention arm/clear/window, session-state autosave, and recent-window record paths plus an explicit-mutation success regression, private permission repair, platform replace-existing bounded complete-record retention, corrupt-tail recovery, OS-owned inter-process lock identity/crash recovery and explicit 200 ms budget, concurrent short-process rotation, common text/JSON/tail/filter reader fixtures, and unchanged top-level runtime/usage/exitCoder output and exit semantics.
+- `make test` also covers Operational diagnostics Phase 2 lifecycle adoption: the maintained explicit-mutation inventory (attach/current/kill/sessions/switch plus session-popup open, window recent, prune ephemeral, focus session switching, shell open-app, snapshot replay creation, popup-toggle cancel restore, and tmux apply); session create/attach/switch/kill and `tmux apply` start/outcome success/error tables; composite create-then-attach and prune-kill-then-attach failure-stage attribution while preserving one outer pair; shared run IDs and no duplicate top-level outcome; best-effort store/write failure injection; closed operation/code pairing; apply typed no-server versus generic runner failure classification; focus success sealing at the actual switch-client boundary; unchanged read-only/hot-path zero-success recording; typed no-write runtime health projection with latest-state and bounded failure-code semantics; Doctor runtime/log typed consumer reuse; and support-report raw socket/path/session/window/pane/name negative fixtures. `make test-integration` additionally runs real create/attach/switch/kill success/failure routing against a run-unique `-L` socket, validates exact lifecycle pairs and apply classifications without raw routing, and guards cleanup with the queried actual socket path beneath the run-unique smoke root.
+- `make test` also covers the Phase 1 explicit redacted support report: complete preview-before-write ordering, deterministic private archive entries and manifest schema/redaction metadata, Doctor schema-version-1 structural reuse with closed static diagnostic allowlists, strict no-repair bounded operations reads, config-presence-only and AI-ingest count-only projection, exhaustive seeded free-text/path/routing/content negative redaction, missing/corrupt/unreadable source reasons, collision/partial-temp safety, and report success/error exclusion from legacy-hook migration and operational outcomes.
 - `make test` also covers welcome revisit policy: legacy `skip_version` readability without shell suppression, `s` Skip until next vs Enter continue, Settings > About > Welcome native viewer, best-effort shell update cache refresh, and attach-popup no-duplicate/no-op behavior.
 - `make test` also covers `projmux quit` action-picker rows, cancel/close no-op behavior, explicit quit of only app-owned tmux runtimes marked by `@projmux_app=1`, missing/default runtime no-ops, dispatcher wiring, and `Settings > About > Quit projmux` routing through the same picker before any shutdown side effect.
 - `make test` also covers the built-in semantic palette foundation: non-empty fallback truecolor/tmux tokens, distinct action/attention/AI/progress/danger roles, native picker chip/current/titlebar render strings including titlebar frame `surface` / `chrome_foreground` inheritance without separate overlay ANSI, statusbar git/notify/usage/settings palette regressions, attention/pane-border/popup/switch progress color guards, renderer-only lead-mode topic prefix styling, settings/trust/destructive row color guards, global-only theme resolver behavior for `global`/`fallback` source labels (project `[theme]` is not a source), preset fill, explicit token override, unknown-preset/invalid-color warnings that ignore only the global layer, and truecolor-to-tmux mapping with generated `xterm*:RGB` terminal feature support, semantic role map (`RenderRoles`/`ANSIRoles`) fallback byte-identity for non-background historical palette literals plus explicit-theme repaint of Tier A/B chrome/state roles while Tier C renderer-only literals stay fixed, split foreground behavior where legacy `foreground` fills `text_primary` and `chrome_foreground` but `text_primary` does not repaint frame/title/search/border/status chrome, Phase 6 public token (`progress`/`success`/`action_required`/`pane_active_bg`/`focus`) repaint of the tmux and ANSI roles with `action_required` kept independent of `critical`, default `projmux` background tokens pinned to terminal default without separate terminal preset variants, Phase 6b pane-body-vs-popup/status background separation where an explicit `background` repaints the inactive pane body, an explicit `surface` repaints popups/native frames, and an explicit `status_background` repaints only the bottom status bar, native popup-toggle `display-popup -s` body style propagation from the effective theme without touching global popup/shell/status styles, and Settings global theme editing with the merged Global/Effective view, directly selectable prefixed theme token rows, no legacy `foreground` row, no project theme editor, and no font keys.
@@ -92,8 +96,9 @@
 - `make test` also covers notify reconcile eviction policy: expired rows are removed only when their real tmux pane/session target is gone, expired live and unexpired gone rows remain pending, inventory failures skip target-based eviction, hard-cap overflow keeps the newest 256 rows, and ephemeral prune triggers cleanup through the reconcile hook after session kills.
 - `make test` also covers stale state cleanup policy: successful prune, tagged-kill, sessions-picker, and switch/sidebar session kills trigger best-effort preview-row cleanup; notify refresh publishing sweeps dead-PID sockets while preserving live-PID sockets; Session State prune listing distinguishes dead sessions from old live persistent sessions without deleting either, explicit named deletion removes only selected snapshots, malformed snapshots remain preserved with a warning, and doctor documents the manual-only retention policy.
 - `make test` also covers Recent Windows Phase 2/3/4 keybinding, popup, and runtime recorder integration: `RecentWindows:Open` owns the guaranteed `M-3` launch default, generated tmux config uses client-scoped `tmux popup-toggle recent-windows`, the popup body runs `projmux window recent`, generated tmux config installs background `window record` hooks for window and client-session changes plus first-use population without `session-window-changed`, `window record` snapshots current tmux socket/session/window/active-pane metadata into the socket-scoped store with escaped field parsing, repeated same-window record fires dedupe instead of growing entries, the queue remains bounded by `recentwindows.DefaultLimit`, Settings > Keybindings shows Recent Windows with the `M-3` default, setup probe text names Recent Windows, `SessionPopupToggle` no longer owns the guaranteed `M-3` default, and escaped tmux field separators are parsed for current/list window metadata.
-- `make test` also covers the Linux resource-attribution Phase 0 contract: tmux-only typed socket/session/window/pane PID/TTY/project-anchor inventory without unsupported placeholder values; one-pass procfs stat/meminfo collection; PID+starttime reuse defense and SID ownership; first/invalid/logical-CPU-change unknown CPU; host-share/core-equivalent CPU and RSS/host-ratio memory; unique pane-to-window-to-project conservation; linked-anchor `Shared / ambiguous`, missing-anchor `Unassigned`, setsid escape, fast-exit/race/permission partial states; and explicit host remainder/overage without silent clamping. The opt-in `PROJMUX_RESOURCE_TMUX_SOCKET=projmux go test -run TestResourceAttributionRealTmuxReadOnlySmoke -v ./internal/integrations/tmux` test provides sanitized real-socket count-only evidence; benchmark commands and current measurements are maintained in [resource-attribution.md](resource-attribution.md).
-- `make test` also covers the Resource Inspector Phase 1 vertical slice: immediate warming chrome; Project → Window → Pane → read-only detail hierarchy; explicit Unassigned/Shared/Other rows; maintained pane display identity; CPU/Memory/Name sorting, stable-id search metadata, refresh selection/query preservation and vanished-row nearest-neighbor behavior; truthful RSS-sum, partial/unavailable/overage rendering; gated non-overlapping two-second and Ctrl-R sampling with cancellation and prior-sample disposal; direct CLI and client-scoped popup mode; no-default `Resources:Open` catalog/Settings/config/custom-alias close behavior; statusbar `resources` range/click byte-equivalence, Labs visibility independence, other-client isolation, and existing `projmux status resources`/window-click fallback regression.
+- `make test` also covers the Linux resource-attribution Phase 0 contract: tmux-only typed socket/session/window/pane PID/TTY/current-path/project-anchor inventory without unsupported placeholder values; explicit project-anchor priority plus read-only current-path fallback through canonical pinned/root-child discovery, longest-root matching, outside/home exclusion, and linked explicit/fallback conflict handling; one-pass procfs stat/meminfo collection; PID+starttime reuse defense and SID ownership; first/invalid/logical-CPU-change unknown CPU; host-share/core-equivalent CPU and RSS/host-ratio memory; unique pane-to-window-to-project conservation; linked-anchor `Shared / ambiguous`, missing-anchor `Unassigned`, setsid escape, fast-exit/race/permission partial states; and explicit host remainder/overage without silent clamping. The opt-in `PROJMUX_RESOURCE_PROJECT_FALLBACK_SMOKE=1 go test -run TestResourceProjectFallbackTransientSmoke -v ./internal/integrations/tmux` test provides an isolated read-only fallback fixture, while `PROJMUX_RESOURCE_TMUX_SOCKET=projmux PROJMUX_RESOURCE_EXPECT_PROJECT_ROOT=/path/to/project go test -run TestResourceAttributionRealTmuxReadOnlySmoke -v ./internal/integrations/tmux` provides sanitized live-socket project-bucket/count evidence; benchmark commands and current measurements are maintained in [resource-attribution.md](resource-attribution.md).
+- `make test` also covers the Resource Inspector Phase 1 vertical slice: immediate non-actionable warming chrome; Project → Window → Pane → read-only detail hierarchy with project/window `PANES n` and pane `PROCESSES n` projections; explicit attributed buckets plus the non-actionable Other summary; shared label → active-agent topic → interactive shell → raw-title pane identity precedence with reused `Process <PaneCommand>`/PID-SID/Pane %N/TTY secondary and detail naming; resource-only Right/Enter forward, Left back with root no-op, all-depth Esc close, and complete Alt-Left action/hint removal; statusbar-parity CPU 70/90 and memory 75/90 exact semantic boundaries with severity-word-free values, unavailable `--`, lifecycle text, and resolved default/custom theme roles; Name-default Tab-computed CPU/Memory/Name ordering that remains stable across automatic refresh; stable-id search metadata plus refresh selection/query/breadcrumb/focus preservation and vanished-row nearest-neighbor behavior; fresh/stale/partial/unavailable/empty/gone/overage transitions with atomic refresh-progress/footer updates; an exact fixed five-row divider/Host/Attributed/Coverage/Sample bottom summary dock that remains independent of scroll/search and separate from the action footer, with bounded diagnostics on Sample only, minimum navigable list height, and no divider/border bleed; changed-row synchronized differential frames at 80x24 and wide en-US/ko-KR layouts; truthful RSS-sum rendering; immediate automatic pre-collection not-fresh progress with the last complete sample retained, gated non-overlapping two-second and Ctrl-R sampling, cancellation, and prior-sample disposal; direct CLI and client-scoped popup mode; no-default `Resources:Open` catalog/Settings/config/custom-alias close behavior; statusbar `resources` range/click byte-equivalence, Labs visibility independence, other-client isolation, and existing `projmux status resources`/window-click fallback regression.
+- `make test` also covers the Resource Inspector readable-layout Phase 0 contract: non-duplicating scope breadcrumbs; separate host, attributed, Other, diagnostic, list/detail, and contextual-action bands; primary identity separated from secondary context; vertically comparable CPU/Memory/count clusters; deterministic 80x24 and wide themed frame geometry without border bleed; en-US/ko-KR copy and explicit Unassigned/Shared stable-root parity; read-only pane detail without search, pointer, Enter, or sort affordances; explicit non-actionable Other/empty/vanished surfaces; populated/empty deferred action reconciliation without hidden sort; and resource-scoped directional hierarchy flow while collector, attribution, cadence, and client-scoped popup contracts remain unchanged.
 - Current focused unit coverage also includes strict notify SOT behavior
   (TTL does not remove rows, focus success and target-gone clicks ack,
   reconcile reports inactive `queue-stale` rows), `notify list --live` queue/live explanations, notify sidebar
@@ -110,14 +115,14 @@
   permissions on load/save, best-effort behavior when chmod is unsupported,
   symlink-safe repair that does not chmod an external target, and race-safe
   notify/recent-windows lock retry jitter under concurrent store operations.
-- Picker focused unit coverage includes backend-neutral picker item/action mapping, native title-focused filtering, numeric selection, shared close actions including raw native custom actions, deprecated picker backend value normalization, AI picker title chrome and stable search-key ordering, Settings title chrome and root section order, Settings Labs without backend/source or hidden keybindings rows, legacy picker env/file normalization to native, compact multi-line metadata gutters with one-column-indented metadata, proportional native scrollbar thumb rendering, native row width clamps that preserve ANSI resets and Korean/wide-cell frame geometry with matched scrollbar/no-scrollbar row budgets including Settings > Appearance AI badge preview rows and parent long emoji preview rows, native app-background and semantic selected/muted/accent/warning/critical role coverage for fallback/effective themes across content padding, empty no-footer rows, footer rows, scrollbars, split-preview gaps, reset-to-padding continuation, and Korean Settings > Appearance AI badge style chips/prompt/emoji rows, multiline partial next/previous item row rendering with rendered-row scrollbar units, fixed split-preview and sidebar list viewports with scrollbar tracks, native up/down-family navigation wrap with empty-list safety and PageUp/PageDown/Home/End clamp regression coverage, native mouse down/follow-drag/release behavior, deferred native row updates that preserve filter/selection state and can repeat from event triggers, preview tab/control normalization before width clipping, optional native frame titlebars without same-line rule fill and with title/chip gap inheritance guards, titled native Alt-1 sidebar chrome, statusbar-preserving sidebar popup height, native-only compact project sidebar popup sizing, cheap Alt-1 first-paint rows with deferred git/window/attention/preview enrichment, fixed three-line Alt-1 sidebar row geometry across cheap/enriched paints, bulk switch existing-session classification with per-candidate fallback, and notify sidebar title/popup sizing.
+- Picker focused unit coverage includes native picker item/action mapping, direct native routing with no backend selector, stale selector env/file non-observation without lookup/delete/rewrite/propagation, native title-focused filtering, numeric selection, shared close actions including raw native custom actions, fuzzy-score reference fixtures, AI picker title chrome and stable search-key ordering, Settings title chrome and root section order, Settings Labs without picker source or hidden keybindings rows, compact multi-line metadata gutters with one-column-indented metadata, proportional native scrollbar thumb rendering, native row width clamps that preserve ANSI resets and Korean/wide-cell frame geometry with matched scrollbar/no-scrollbar row budgets including Settings > Appearance AI badge preview rows and parent long emoji preview rows, native app-background and semantic selected/muted/accent/warning/critical role coverage for fallback/effective themes across content padding, empty no-footer rows, footer rows, scrollbars, split-preview gaps, reset-to-padding continuation, and Korean Settings > Appearance AI badge style chips/prompt/emoji rows, multiline partial next/previous item row rendering with rendered-row scrollbar units, fixed split-preview and sidebar list viewports with scrollbar tracks, native Up/Down and Ctrl-N/Ctrl-P navigation wrap with empty-list safety and PageUp/PageDown/Home/End clamp regression coverage, native mouse down/follow-drag/release behavior, deferred native row updates that preserve filter/selection state and can repeat from event triggers, preview tab/control normalization before width clipping, optional native frame titlebars without same-line rule fill and with title/chip gap inheritance guards, titled Alt-1 sidebar chrome, statusbar-preserving sidebar popup height, compact project sidebar popup sizing, cheap Alt-1 first-paint rows with deferred git/window/attention/preview enrichment, fixed three-line Alt-1 sidebar row geometry across cheap/enriched paints, bulk switch existing-session classification with per-candidate fallback, and notify sidebar title/popup sizing.
 - Picker/setup lifecycle coverage includes deferred native key-reader stop and repeated reopen cleanup, plus per-probe controlling-TTY cleanup and timeout-then-next-key reads without stale goroutines stealing input.
 - Doctor focused unit coverage includes tmux required/stale behavior on every host, Windows `stty` skip behavior, and tmux bell fallback diagnostics.
 - Shell focused unit coverage includes `projmux shell` routing to `tmux -L projmux -f <generated config> new-session -A -s <session> [-c <cwd>]`, generated tmux config callbacks, native key-broker platform policy, runtime overrides, and nested-socket guards.
 - `make test` also covers npm retire/staging path canonicalization for the resolved projmux executable so generated tmux config and hooks never embed a `node_modules/.projmux-<hash>` directory, plus error-suppressed attention and rebalance-panes hooks.
-- `make test-integration`: Docker-backed Linux integration smoke with real `tmux`, `git`, and `stty`; covers `doctor`, tmux config print/install/apply, default-off/on live resource config plus two-sample procfs status rendering, notify queue CRUD against isolated HOME/XDG paths, private operational-log persistence/mode repair/readback/hot-path exclusion/best-effort write failure, and built-CLI propagation of a fake tmux `split-window -P -F "#{pane_id}"` result to `--print-pane-id` stdout.
-- `make test-install-smoke`: Docker-backed source install smoke; covers `make install`, atomic binary replacement, `tmux apply` against a live `projmux` socket, and post-install notify queue initialization.
-- `make test-e2e`: Docker-backed real-tmux workflow smoke for session/pane setup, a direct shell `--print-pane-id` split whose returned `%N` handle is verified against the isolated live server, an attached-client `rename-pane-label` command-prompt flow covering current-label initial value, Enter confirm, native Esc cancel, empty clear, and AI topic/manual/raw-title non-mutation, app config sourcing, reply-state notify reconciliation, focus notify fallback, status notify rendering with contextual project/state/agent badges, and an isolated attached-client `display-popup` Settings recorder flow that verifies staged-before-write Enter confirmation plus Esc cancellation against a temporary HOME/keymap. Host-only terminal, WSL, macOS, and GUI notification behavior remains outside Docker; see [docs/testing.md](testing.md).
+- `make test-integration`: Docker-backed Linux integration smoke with real `tmux`, `git`, and `stty`; covers Doctor schema 2 missing/corrupt/permission degradation, runtime socket/config current/stale findings against a guarded run-unique `-L` socket, source byte/mode/mtime/inventory no-repair evidence, explicit support-report no-request/preview/private archive and Doctor-schema inspection, missing/corrupt/permission-denied source manifest reasons with no source-mode repair, preview-writer failure before output creation, collision byte/mode preservation and temp cleanup, tmux config print/install/apply including stale live `C-t` pane-label retirement, current `M-p` preservation, current `C-t` reassignment, repeated apply/keymap byte preservation, and unrelated live/current binding preservation, default-off/on live resource config plus two-sample procfs status rendering, notify queue CRUD against isolated HOME/XDG paths, private operational-log persistence/mode repair/readback/hot-path exclusion/best-effort write failure, and built-CLI propagation of a fake tmux `split-window -P -F "#{pane_id}"` result to `--print-pane-id` stdout. Root containers run the permission case through `runuser`+`nobody`; environments without that adapter take an explicit asserted skip instead of treating root chmod access as denial.
+- `make test-install-smoke`: Docker-backed source install smoke; covers `make install`, atomic binary replacement, `tmux apply` against a live `projmux` socket, post-install notify queue initialization, and installed-binary temporary HOME/XDG support-report preview → explicit private archive → manifest/Doctor schema inspection with exact smoke-root cleanup.
+- `make test-e2e`: Docker-backed real-tmux workflow smoke for session/pane setup, a direct shell `--print-pane-id` split whose returned `%N` handle is verified against the isolated live server, an attached-client `rename-pane-label` command-prompt flow covering current-label initial value, Enter confirm, native Esc cancel, empty clear, and AI topic/manual/raw-title non-mutation, app config sourcing, reply-state notify reconciliation, focus notify fallback, status notify rendering with contextual project/state/agent badges, and an isolated attached-client `display-popup` Settings recorder flow that verifies staged-before-write Enter confirmation plus Esc cancellation against a temporary HOME/keymap while stale retired picker env/file values remain inert, unchanged, and silent. Host-only terminal, WSL, macOS, and GUI notification behavior remains outside Docker; see [docs/testing.md](testing.md).
 
 ## When To Update This List
 - A feature moves between unit, integration, and e2e coverage levels.

package/docs/architecture.md

@@ -53,8 +53,8 @@ Responsibilities:
 - selection handoff into core actions
 - picker-agnostic close/dismiss actions
 
-Picker-specific display and search rules are tracked in
-[picker-ui-plan.md](picker-ui-plan.md).
+Picker-specific display, search, input, and popup rules are tracked in
+[native-picker.md](native-picker.md).
 
 This keeps parity with the existing shell workflow while moving state and behavior into Go.
 

package/docs/cli.md

@@ -26,7 +26,6 @@ projmux <command> [args...]
 | `doctor` | Run read-only runtime and integration diagnostics. |
 | `diagnostics` | Read the private bounded operational event log. |
 | `focus` | Switch the active client to a session/window/pane target. |
-| `init` | Preview or apply supported terminal key delivery mappings. |
 | `kill` | Terminate tagged tmux sessions. |
 | `notify` | Manage the pending AI notify queue (push/list/ack/reconcile). |
 | `pin` | Manage pinned project directories. |
@@ -64,10 +63,9 @@ sub-verbs are entry hooks invoked by tmux keybindings (e.g.
 `sidebar-focus` is wired to the sidebar's focus binding so navigation keeps
 the active session in sync).
 
-Settings > Labs remains available for experimental settings, but picker backend
-selection/source rows have been retired. The native picker is always used;
-legacy `PROJMUX_PICKER_BACKEND` and `picker-backend` values remain read-compatible
-and normalize to native.
+Settings > Labs remains available for experimental settings, but picker
+selection/source rows have been retired. The native picker is always used, and
+there is no picker selection configuration or migration behavior.
 
 ## setup
 
@@ -102,14 +100,10 @@ write through a symlink unless `--allow-symlink` is passed (dotfiles repos).
 than one default location (Ghostty `config` vs `config.ghostty`). If setup
 shows every key arriving, skip terminal remediation.
 
-The top-level `projmux init` command remains a deprecated compatibility alias
-during the migration period. It prints the exact `projmux setup terminal`
-replacement to stderr and still accepts the legacy `--dry-run` flag.
-
 ## doctor
 
 ```
-projmux doctor [--json]
+projmux doctor [--json] [--section deps|runtime|integrations|session-state|logs] [--verbose]
 ```
 
 Runs read-only diagnostics, including a dependency check for `tmux ≥ 3.4`,
@@ -129,24 +123,57 @@ Live `hook`/`session-id` metadata is high confidence; DB-validated Antigravity
 sources are medium confidence; legacy `antigravity-history` is low confidence.
 Disk discovery never lowers or overwrites an already captured live source.
 
-The default plain report exits non-zero when a required dependency is missing
-or stale, and exits `0` when only optional dependencies or AI notify
-integrations are missing. `--json` preserves its current successful exit after
-emitting the report even when a required dependency is missing or stale. It
-emits a machine-readable object with `dependencies`,
-`ai_notify_integrations`, and `session_state_resume`; the default is the human
-report with suggested install commands per platform, AI integration
-install/remove/dry-run commands, and Session State resume metadata health.
-Users explicitly run any displayed install guidance or command outside doctor.
-Doctor does not diagnose terminal key delivery; use `projmux setup` for that.
-
-Compatibility notice: `--install-missing`, `--dry-run`, and
-`--include-optional` are deprecated install flags. During the compatibility
-period their install, preview, optional-dependency, output, and exit behavior
-remain unchanged, and each invocation using one or more of them emits one
-stderr warning. They cannot be combined with `--json`; `--dry-run` and
-`--include-optional` still require `--install-missing`. These mutation paths
-will be removed when doctor becomes read-only diagnostics only.
+The default text report shows per-section summaries plus failing or warning
+items. `--verbose` adds successful checks and complete typed detail, including
+versions, paths, confidence/source metadata, and displayed remediation.
+`--section` projects the same inventory used by text and JSON: `deps` selects
+dependencies, `integrations` selects AI notify integrations, and
+`session-state` selects resume metadata plus retention guidance. `runtime`
+selects the fixed `tmux` backend, an actual one-second read-only probe of the
+app socket, and generated-versus-live config digest state. `logs` selects the
+state/log/journal presence, private permissions and metadata-only writability
+checks plus a bounded aggregate of recent safe operational error codes. These
+sections expose only closed status codes and counts: no path, socket name,
+routing identity, message, config content, or argv is rendered.
+The recent-error count is the size of the newest 20-record window, not a
+lifetime total; `logs.recent-errors.bounded` means older errors were omitted.
+The probe captures at most 4 KiB, generated config inspection reads at most
+1 MiB, and the journal seam reads at most 5 MiB.
+Symlinks and non-regular inputs are rejected without following or blocking on
+them. On Windows, POSIX mode bits cannot establish ACL privacy, so otherwise
+valid paths report the closed `privacy-unverified` warning rather than a false
+private/insecure classification, followed by a separate metadata-only `ready`
+or `not-writable` finding; Doctor never changes ACLs.
+
+JSON reports have integer `schema_version: 2`. An unfiltered report retains the
+existing typed `dependencies`, `ai_notify_integrations`,
+`session_state_resume`, and `session_state_prune` detail and adds ordered
+`runtime` and `logs` finding arrays. Every finding has closed `severity`,
+stable `code`, and closed `remediation`; bounded aggregates may add `count`
+and `safe_codes`. A filtered report contains only the selected typed field(s).
+`--verbose` is accepted with `--json` but does not change JSON fields or values.
+
+Default and verbose text exit non-zero only when their projected dependency
+inventory contains a required missing or stale dependency. A non-`deps`
+section exits `0`. JSON preserves its successful exit after emitting a report,
+even when required dependencies are missing or stale.
+
+Doctor is read-only for every flag combination. It never creates or repairs
+state/log paths, installs packages, runs displayed remediation, changes
+terminal or tmux state, generates/applies config, migrates files, or writes
+operational-log outcomes. Missing, malformed, or permission-denied journals
+degrade to typed log findings without failing the command. The removed `--install-missing`,
+`--include-optional`, and Doctor `--dry-run` mutation flags fail as unknown
+usage with an exact instruction to remove the flag and run displayed
+remediation explicitly outside Doctor; they are never ignored. Doctor does not
+diagnose terminal key delivery; use `projmux setup` for that.
+
+JSON migration: consumers must switch on `schema_version` before decoding.
+Version 2 changes the previously empty/reserved `runtime` and `logs` arrays to
+the typed finding shape above; field meanings inside the version 1 dependency,
+integration, and Session State inventories are unchanged. Consumers that only
+understand version 1 must reject version 2 rather than decoding the new arrays
+as the old empty placeholder shape.
 
 `Settings > Notifications > Delivery sources` shows active Codex, Claude, and
 Antigravity hooks plus tmux statuses, conflicts, config paths, and
@@ -161,6 +188,7 @@ than a standalone Settings row.
 ```
 projmux diagnostics log [--tail N] [--json]
                         [--level info|error] [--component NAME] [--path]
+projmux diagnostics report [--output <path>]
 ```
 
 Reads the local operational event journal through the same tolerant JSONL
@@ -181,6 +209,41 @@ channel and never change command output or exit status. See
 [operational-diagnostics.md](operational-diagnostics.md) for the file,
 retention, concurrency, and privacy contracts.
 
+Session create/attach/switch/kill and `tmux apply` use correlated
+`lifecycle.start`/`lifecycle.outcome` records instead of a duplicate generic
+top-level outcome. The text and JSONL views expose only the closed safe
+`operation` and optional `code` enums; session names, socket paths, tmux
+targets, subprocess argv, and generated configuration are never recorded.
+
+`diagnostics report` is the explicit consent boundary for creating one local
+private `tar.gz` support archive. The invocation first prints a redacted
+destination label, the complete included/omitted entry list, stable omission reasons, report
+schema, and redaction mode; the first parent/temp/archive write happens only
+after that preview is successfully written. `--output` selects the local
+destination. Without it, the command uses a timestamped archive in the current
+directory. Existing destinations are never replaced.
+
+The archive contains `manifest.json`, safe projmux version/platform/backend
+metadata, a redacted projection of Doctor JSON schema version 2,
+config presence states (never values), up to 50 recent errors from the existing
+bounded operations reader, and count-only AI ingest diagnostics. Paths,
+session/window/pane/thread/routing identifiers, run IDs, tool/version output,
+commands, guidance, reasons, and other free text are field-scoped hashes unless they
+match a closed diagnostic enum/static-name allowlist. Raw config/environment
+values, argv/stdin, prompts, notification text, pane output, transcripts, and
+hook payloads are never collected. Missing, corrupt, or unreadable sources are
+recorded as stable manifest omissions. Report collection does not repair source
+permissions, migrate hooks, append an operational outcome, contact a network,
+upload, create an issue, or run in the background; only the explicitly selected
+output parent/temp/archive can be written.
+
+The redacted Doctor projection keeps `schema_version`, closed runtime/log
+finding enums, and structural/count
+numbers as numbers. Numeric routing fields such as `window_index` and
+`pane_index` become field-scoped hash strings under `default-hash-v1`; consumers
+must treat this support projection as redacted evidence rather than decoding it
+back into the unredacted Doctor Go types.
+
 ## focus
 
 ```
@@ -308,14 +371,27 @@ Codex shares the global `30s`). `--json` emits the snapshot array; when
 backoff is active the wrapper `{snapshots, backoff}` object is emitted
 instead.
 
-Antigravity emits a conversation-local `context` row and separate official
-account rows labelled `quota/<upstream bucket ID>`. `--window quota` selects
-the latter; opaque IDs such as `weekly` are not aliases for the fixed
-`weekly` window. Used percent is `100 * (1 - remaining_fraction)`.
+Claude keeps the canonical aggregate `5h` and `weekly` rows and projects each
+valid typed upstream `limits[]` entry as a named `quota/<exact group>` row.
+Model-scoped rows append the exact upstream model display identity in text
+output; terminal controls are escaped and the visible label is bounded without
+normalizing the stored identity. JSON preserves the typed named-quota metadata,
+including nullable scope/model ID/surface, reset, `updated_at`, and `stale`.
+These percent-only rows never synthesize token counts. A malformed limits block
+fails that adapter refresh so the prior complete Claude slice remains visible;
+a valid aggregate-only response replaces and removes obsolete named rows.
+
+Antigravity emits official account rows labelled
+`quota/<upstream bucket ID>`. Conversation-local context remains private
+hook/notify diagnostic metadata and legacy cached context rows are suppressed
+from text and JSON output. `--window quota` selects named account rows; opaque
+IDs such as `weekly` are not aliases for the fixed `weekly` window. Used
+percent is `100 * (1 - remaining_fraction)`. `--window context` remains
+accepted for compatibility and returns no Usage rows.
 `reset_time` and optional `reset_in_seconds` are preserved independently,
 including the distinction between absent and explicit zero. Invalid,
 disabled, missing, or empty quota data degrades without reinterpreting the
-conversation context row.
+private conversation context diagnostic.
 
 ## resources
 
@@ -325,15 +401,18 @@ projmux resources
 
 Opens the native, read-only Resource Inspector. It samples only while this
 interactive process is alive, paints `warming` immediately, then refreshes at
-a non-overlapping two-second cadence. Enter drills Project → Window → Pane →
-Pane detail; Esc or Alt-Left returns, and root Esc closes. Search matches the
-current scope's display name and stable tmux id. Tab cycles CPU, Memory, and
-Name sorting; Ctrl-R requests an immediate refresh. A plain `r` remains search
-input.
+a non-overlapping two-second cadence. Right or Enter drills Project → Window →
+Pane → Pane detail; Left returns (and is a no-op at the root), while Esc closes
+the popup at every depth. Search matches the current scope's display name and
+stable tmux id. Tab cycles CPU, Memory, and Name sorting; Ctrl-R requests an
+immediate refresh. A plain `r` remains search input.
 
 CPU list values are host-capacity share; pane detail also shows
-core-equivalent CPU. Memory is explicitly an RSS sum (shared pages can be
-counted more than once) plus its host ratio. `Unassigned`,
+core-equivalent CPU. Project and window rows count panes, while pane rows count
+the attributed processes. Pane rows and detail share the resolved pane identity
+and label the tmux current command, PID/SID, pane id, and TTY separately. Memory
+is explicitly an RSS sum (shared pages can be counted more than once) plus its
+host ratio. `Unassigned`,
 `Shared / ambiguous`, and non-drillable `Other / unattributed` remain explicit,
 as do warming, partial, unavailable, unknown, and overage states. No process
 command list, mutation, history, graph, daemon, persistence, or Session State
@@ -365,9 +444,14 @@ projmux status resources
   `~/.cache/tmux/kube-segment-<session>.txt` first (TTL governed by
   `TMUX_KUBE_CACHE_TTL`, default `5s`). Picks up a per-session
   `KUBECONFIG` from `${XDG_RUNTIME_DIR:-~/.cache}/kube-sessions/<session>.yaml`.
-- `usage` — HUD-style `Claude (Nm) 5h [bar] N% · weekly [bar] N%   Antigravity
-  ctx [bar] N% · quota/<bucket> [bar] N%`. Degrades through six tiers as `--max-width`
-  shrinks. Triggers an opportunistic, throttled refresh (per-adapter
+- `usage` — HUD-style provider blocks containing only official `5h` and
+  `weekly` windows. Antigravity's exact `quota/gemini-weekly` snapshot is
+  projected as `weekly` without changing its cached identity; other named
+  quotas and context never consume status width. Claude typed `limits[]`
+  named/model rows are likewise excluded, so only its aggregate `5h` and
+  `weekly` rows reach the status line. Narrow tiers keep one primary window per
+  provider (`5h`, otherwise `weekly`) before hard truncation.
+  Triggers an opportunistic, throttled refresh (per-adapter
   throttle, `30s` floor) so a stale cache self-heals.
 - `notify` — newest-first HUD block with project, state, optional agent, text,
   age, and `+<extras>`. Window/pane ids remain routable metadata but are not
@@ -400,8 +484,14 @@ non-specialized placeholders and no-op. `session` opens the existing-session
 popup; `pwd` shows the current pane path in a native-framed display-only
 popup; `kube` and `git` open the project switcher popup;
 `settings` toggles the settings popup for the tmux client; `usage` opens the
-detailed `projmux usage` table popup; `notify` focuses and acks the newest
-actionable queue target. The internal `usage-refresh` shortcut entry point
+detailed cached account-usage popup. Legacy context rows are suppressed and
+named quotas retain exact identity/reset/freshness values. Claude model-scoped
+rows distinguish the exact group and model display identity with bounded,
+terminal-safe labels; JSON retains their full typed metadata. `USED`, `LIMIT`,
+and `LEFT` appear together only when at least one displayed row has real
+absolute counts; percent-only datasets omit those columns rather than
+synthesizing counts.
+`notify` focuses and acks the newest actionable queue target. The internal `usage-refresh` shortcut entry point
 runs the same throttled, per-adapter collection policy as `status usage` and
 then reopens the display-only usage popup from cache.
 `MouseDown1Status` errors are
@@ -640,9 +730,9 @@ restore is included: Antigravity ingest stores `conversationId` as pane thread
 metadata for matching and as session-state resume metadata. Restore uses
 `agy --conversation <uuid>` when that id is present and UUID-shaped; otherwise
 session-state preview/doctor render `resume unavailable`. Structured statusline
-`context_window.used_percentage` is persisted with its conversation id and
-surfaced by the usage HUD as the separate `context` row. The official `quota`
-map is persisted independently and surfaces each valid entry as
+`context_window.used_percentage` is persisted with its conversation id as
+private hook/notify diagnostic metadata and is not surfaced as account usage.
+The official `quota` map is persisted independently and surfaces each valid entry as
 `quota/<exact bucket ID>` with independently retained absolute and relative
 reset values. Bucket IDs are never mapped to `5h`/`weekly`, and account quota
 is never inferred from the conversation-local gauge.
@@ -840,15 +930,21 @@ accepted by `popup-toggle` mirror the historical sessionizer surface:
 `rename-pane` sets only the pane-scoped user label
 `@projmux_pane_label`; an empty label clears the option. It does not change the
 raw tmux pane title, AI topic, or AI topic manual-ownership flag. The canonical
-keybinding action id is `rename-pane-label`; `rename-pane-topic` remains a
-deprecated label-only keymap alias for one compatibility period.
+keybinding action id is `rename-pane-label`. The retired `rename-pane-topic`
+keymap action is no longer accepted: replace a stale
+`[bindings.rename-pane-topic]` table with `[bindings.rename-pane-label]`.
+The advanced `projmux ai topic set/clear` commands remain available and keep
+AI topic ownership separate from the user pane label and raw pane title.
 `apply` regenerates the app tmux config and reloads the live `-L projmux`
 server without restarting it. `make install` and `projmux upgrade` invoke it
 after replacing the binary. Settings > Keybindings normally runs the same
 save/config/reload flow automatically; use `projmux tmux apply` as the CLI
 recovery or sync path after hand-editing `keymap.toml`, after saving Settings
 outside tmux, or after resolving a reported config-generation or live-reload
-failure.
+failure. Reload also removes the known retired no-prefix `C-t` pane-label
+binding from older live servers before installing current bindings. If the
+current keymap assigns `C-t` to another action, that current action is bound
+after cleanup and remains the owner.
 
 ## update
 

package/docs/configuration.md

@@ -183,7 +183,7 @@ shows the keymap error row and refuses to overwrite it until the file is fixed.
 
 The file currently affects generated tmux config from `projmux tmux
 print-config`, `projmux tmux install`, `projmux tmux print-app-config`,
-`projmux tmux install-app`, and `projmux shell`. Terminal init adapters such as
+`projmux tmux install-app`, and `projmux shell`. Terminal remediation adapters such as
 Ghostty and Windows Terminal install built-in plain-byte mappings where needed;
 they do not read `keymap.toml` or copy saved keys into terminal configs.
 Changing terminal-layer mappings still requires rerunning `projmux setup
@@ -439,7 +439,6 @@ confidence for DB-validated cache sources or low confidence for legacy history.
 | `PROJMUX_SESSIONSTATE_AUTOSAVE` | Session snapshot autosave override for the global fallback. Values such as `off`, `false`, or `0` disable autosave for projects that inherit the global setting; explicit project auto-save `on`/`off` still takes precedence. |
 | `PROJMUX_SESSIONSTATE_DEBUG` | When non-empty, quiet autosave surfaces suppressed session-state errors to stderr. |
 | `PROJMUX_FOCUS_DEBUG` | When non-empty, `projmux focus` prints one telemetry line to stderr. |
-| `PROJMUX_PICKER_BACKEND` | Legacy picker backend override. Any value, including old `fzf` settings, now resolves to the native picker. |
 | `PROJMUX_INSTALLER` | Installer source hint used by update flows. npm installs set this automatically; advanced release installs can set `github-release`. |
 | `PROJMUX_SHELL_UPDATE_CHECK_TIMEOUT_MS` | Timeout in milliseconds for the best-effort release check attempted by `projmux shell` when the update cache is missing or stale. Invalid, zero, or negative values use the default. |
 
@@ -841,7 +840,9 @@ warning at 70–89%, and critical at 90% or above; memory is normal below 75%,
 warning at 75–89%, and critical at 90% or above. The two values are classified
 and styled independently. Normal and unavailable (`--`) values use the
 secondary status-text theme role, warnings use the warning role, and critical
-values use the bold critical role. No threshold values are stored in config.
+values use the bold critical role. Visible severity words are omitted and each
+percent uses a fixed four-column slot, including `%`, so metric transitions do
+not resize the segment. No threshold values are stored in config.
 
 The CPU delta cache is internal state at
 `${XDG_STATE_HOME:-~/.local/state}/projmux/live-resources-sample.json`.