specrails-desktop 2.58.0 → 2.59.0

package/docs/internals/operations-runbook.md

@@ -229,3 +229,23 @@ and runner-minute changes must be measured from subsequent runs.
 
 
 CI partitioning and reuse of verified frontend assets are described in [CI performance](ci-performance.md).
+
+
+### Loop editor windows
+
+Mission mode opens the loop manager in a modal with **Open in window**. Board mode
+retains the embedded editor and provides **Open in window** in the library and
+builder toolbars. The builder saves its draft before opening the window; publish
+remains explicit. Each window retains its own project selection and editor state.
+In browser development the same surface opens as a popup (allow popups for the
+local development origin). Native changes require restarting `npm run dev:desktop`
+to rebuild the Tauri command. The `native-mission-window-smoke` fixture also checks
+loop target routing, duplicate focus, independent minimization and close cleanup.
+
+
+Plugins follows the same behavior: a modal with **Open in window** in Mission mode,
+and an embedded page with **Open in window** in Board mode. A successful window
+opening dismisses the Mission modal; a failure leaves it open. Reopening focuses
+the existing manager, preserving open forms. Restart `npm run dev:desktop` after
+updating the native `plugin_window_open` command. Browser development requires
+popups for the local origin. The native window smoke fixture covers Plugins too.

package/docs/internals/programmatic-agent-runtime.md

@@ -1,12 +1,12 @@
 # Programmatic agent runtime
 
-Desktop can hand implementation to Core's **runtime API 1**. Core runs architect, developer, fixer, deterministic verification, reviewer and archive as separate LangGraph phases. Desktop keeps project/worktree selection, rail lifecycle, logs, accounting and delivery ownership.
+Desktop owns the Implement, Freestyle and Quick SDD workflow graphs and their loop agent definitions. With Core's `implementationSteps: 1` capability, Implement invokes architect, developer, fixer, deterministic verification, reviewer and archive as independent operations. Core executes the graph through LangGraph and owns durable evidence and recovery. Desktop keeps project/worktree selection, rail lifecycle, logs, accounting and delivery ownership.
 
 This is the only implementation engine in the current source tree. It applies to implementation rail steps and their Core completion check. Mission chat and unrelated AI features keep their existing transports. Provider-native implementation prompts and skills are not invoked inside the programmatic phases.
 
 ## Build the paired source
 
-Use Node **20.19.0+** for Core; Node **22.22.3** matches Desktop's native CI runtime. Provider requirements can be higher. Both repositories' dependencies must be installed.
+Use Node **22.22.3+** for Core; Node **22.22.3** matches Desktop's native CI runtime. Provider requirements can be higher. Both repositories' dependencies must be installed.
 
 ```sh
 cd ../specrails-core
@@ -53,31 +53,30 @@ Desktop negotiates `runtime api` and sends configuration to `runtime validate --
 
 `SPECRAILS_CORE_RUNTIME_PATH` selects this execution module. The existing `SPECRAILS_CORE_BIN` controls the installation/lifecycle resolver and is a different setting. Prefer a paired source bundle when testing the complete installation and execution flow.
 
-## Configure a project
-
-1. Open **Project settings → Agent runtime** (its own section in the project dialog).
-2. Choose a provider per role. The model dropdown lists each CLI's catalog with the default marked; turns, attempts and timeout show their defaults in the fields. Claude, Codex, Gemini and Kimi remain available; open **General settings → Specrails Agents → Provider connections** to add an OpenAI-compatible endpoint for a local or remote model (local endpoints do not require a key; API providers need an explicit model).
-3. Verification commands are optional. A project that never saved runtime settings is prefilled with the checks Desktop detects offline (`package.json` test/type-check/lint scripts with the right package manager, Cargo, Go, pytest, Gradle, Maven, .NET, Make); **Detect project checks** re-runs that detection. Each row is a repository plus one command line (`npm run test -- --strict`; quotes group arguments). Leave the list empty and the architect proposes the project's own checks on each run; repositories with no automated check are still reviewed and recorded as unverified in Core's receipt.
-4. **Review gate** and **Architect confidence** are optional. Review thresholds (overall score and the five aspects: type correctness, pattern adherence, test coverage, security, architectural alignment) can only *tighten* Core's own gate: the floors are 70 overall, 75 for security and 60 for every other aspect, and Desktop rejects lower values before saving (`Review threshold review.minScore must be at least 70 (Core's own review gate)`). Empty fields omit the key so Core's defaults apply. `architect.onLowConfidence` decides what happens when, after one autonomous investigation pass, the architect's design is still low in confidence: `ask` (default) pauses the run with the architect's question; `proceed` continues on stated assumptions.
-5. Save the project settings. Implementation always uses the agent runtime.
-6. Start an implementation through the normal rail flow.
-
-Settings are saved at `<project execution .specrails directory>/agent-runtime.json`. Missing configuration uses the default agent runtime. The retired enabled flag cannot select another engine. Malformed configuration blocks admission; it is not ignored. Saving verifies that Core exposes the expected API. Connections are stored globally in `~/.specrails/runtime-providers.json`; project files retain role references, models, limits and verification. Existing embedded connections migrate once, with stable disambiguated IDs on endpoint conflicts. New runs freeze the resolved configuration, while saved runs retain their original snapshot.
-
-With a paired Core advertising `openRoles: 1`, **Custom roles** adds named project
-roles with their own provider, model, prompt and explicit source/artifact access.
-New roles start with read-only source access and no artifact writes. Artifact
-access is independent: an analyst may read code and write OpenSpec documents
-without gaining source write access. Optional OpenSpec skills use the provider's
-native syntax. Custom roles reuse effort, turns and escalation controls; escalation
-can use the one permitted protocol repair and does not add another retry. Existing
-architect/developer/reviewer policies remain fixed. Removing a custom role affects
-future runs; admitted runs retain their frozen role configuration. Older Core
-packages keep ordinary settings available and reject saving unsupported roles.
-
-**A package of a larger checkout.** A repository registered as a subdirectory of its git checkout (for example `apps/web` inside a monorepo) is isolated in a worktree of the whole checkout, so Desktop passes that directory to Core as the repository `scope` in `desktop-context.json` (Core capability `repositoryScope`). Configured checks run inside the package: a check without `cwd`, or with a `cwd` relative to the registered directory, never runs at the checkout root, where a monorepo test script fans out to every workspace. Core keeps the change inside the scope: after each developer or fixer turn it undoes edits outside it, the reviewer judges only the git change set measured against the run's base, a check that fails for missing credentials, variables or registry access stops the run for the host instead of starting a correction round, and a correction loop that stops converging stops with the reason instead of repeating the same checks. Runs admitted before scopes existed keep their frozen whole-checkout context.
-
-Core owns role instructions and permissions. The developer role edits and runs commands inside its CLI sandbox (the same autonomy as the legacy Implement step); architect and reviewer are read-only. A legacy rail profile/model selection does not override the runtime's per-role provider configuration. The JSON schema is [server/schemas/agent-runtime.schema.json](../../server/schemas/agent-runtime.schema.json), mirrored from Core. For a complete configuration, custom executor examples, Kimi capabilities and API tooling details, see [Core's runtime guide](https://github.com/fjpulidop/specrails-core/blob/main/docs/agent-runtime.md) in the paired revision.
+## Configure a loop and its project checks
+
+1. Open the loop builder and edit **Loop agents**. Definitions, models, effort,
+   turn limits, fixer routing, custom roles and workflow policy belong to the loop.
+   Publishing a builtin applies to future runs in every project; duplicate it for
+   a specialized flow.
+2. Configure provider connections under **General settings → Specrails Agents →
+   Provider connections**. Connections remain global; loop agents reference them.
+3. Open **Project settings → Verification commands** for repository checks.
+   **Detect project checks** finds local commands without AI. Each row retains its
+   repository, command, arguments and metadata. With no configured checks the
+   Implement architect proposes checks; unverified repositories remain explicit.
+4. Publish the loop and launch it through the normal rail flow. Review thresholds
+   may only tighten Core's floors (70 overall, 75 security, 60 other aspects).
+   Archive approval and low-confidence architect behavior are loop policies.
+
+Only verification is read from the project's `.specrails/agent-runtime.json` for
+new loop-owned recipes. Historical roles remain available for explicit import
+and old saved graphs. The editor never silently imports a project's settings
+into a shared builtin. Connections remain in `~/.specrails/runtime-providers.json`.
+Admission freezes the resolved graph, roles, checks and Core package; resume
+uses that snapshot. See [migration and recovery](desktop-owned-workflows.md).
+
+Desktop owns editable role definitions; Core owns their artifact protocol and execution permissions. The developer role edits and runs commands inside its CLI sandbox (the same autonomy as the legacy Implement step); architect and reviewer are read-only. A legacy rail profile/model selection does not override the runtime's per-role provider configuration. The JSON schema is [server/schemas/agent-runtime.schema.json](../../server/schemas/agent-runtime.schema.json), mirrored from Core. For a complete configuration, custom executor examples, Kimi capabilities and API tooling details, see [Core's runtime guide](https://github.com/fjpulidop/specrails-core/blob/main/docs/agent-runtime.md) in the paired revision.
 
 The built-in Claude adapter supports its native dollar cap. Built-in Codex, Gemini, Kimi and OpenAI-compatible adapters reject `maxCostUsd`; remove that limit for mixed-provider/local runs. Kimi also rejects token caps because its usage is unavailable. Unknown cost/tokens remain unknown in accounting, rather than becoming zero. Attempt, timeout and tool limits remain available. Existing provider services, licenses and inference costs are separate from the free open-source orchestration runtime.
 
@@ -98,7 +97,7 @@ The rail creates a frozen Core execution context for its original repository/wor
 
 A run pauses (Core exit code 2) either on an **approval** (`pendingApproval`, for example before archive) or on a **question** (`pendingQuestion: { stepId, requestedAt, question }`) when the architect is configured to ask on low confidence. A pending question can only be resumed together with an answer: the runs panel shows the question with a textarea and an **Answer and resume** action, which posts `{ "answer": "…" }` (nonempty, at most 20,000 characters). Resuming without an answer while a question is open is rejected with `400 answer_required`. Once Core records `answeredAt`, the question is history and ordinary resume applies again. The bridge reports a paused run's reason in the job log: awaiting approval, or the pending question text.
 
-**Implementation cards and job detail** expose resume, archive approval, question answering, interrupted-step recovery and continuation cancellation actions next to the work. Cards query their latest job by original rail identity; job detail queries its exact run. Legacy jobs render no runtime panel. **Jobs → Saved executions** retains the cross-run history. Project settings contain runtime configuration only. A continuation resumes from the phase shown, in the original worktree, and writes its progress into that job's log (a `[runtime] continuation started from phase …` banner, tool activity, phase notes and the final outcome). Resuming a run that stopped at the developer attempt limit grants a fresh attempt budget. Wait for the original rail execution to settle before resuming. Active rail jobs are stopped through their job controls; the continuation's Cancel action owns only continuations started from this panel.
+**Implementation cards and job detail** expose resume, archive approval, question answering, interrupted-step recovery and continuation cancellation actions next to the work. Cards query their latest job by original rail identity; job detail queries its exact run. Legacy jobs render no runtime panel. **Jobs → Saved executions** retains the cross-run history. Project settings contain repository verification commands; the loop owns agents and policy. A continuation resumes from the phase shown, in the original worktree, and writes its progress into that job's log (a `[runtime] continuation started from phase …` banner, tool activity, phase notes and the final outcome). Resuming a run that stopped at the developer attempt limit grants a fresh attempt budget. Wait for the original rail execution to settle before resuming. Active rail jobs are stopped through their job controls; the continuation's Cancel action owns only continuations started from this panel.
 
 Resume retains valid completed phases and rechecks Core evidence. Changed code or environment requires fresh verification/review. An ambiguous interrupted write requires an explicit recovery action after inspecting partial changes. A changed frozen config/identity requires a new run. Missing original worktrees or mismatched execution manifests block recovery; the controller never invents a replacement worktree.
 
@@ -327,3 +326,10 @@ default. Workflow duration/cost/token budgets and cancellation still apply.
 Role repair and session fallback retain the selected bounds, including Kimi ACP
 transport. A verification prompt reporting `LOOP_BLOCKED` pauses for the human
 answer before its success sentinel can be accepted.
+
+## Loop-owned workflows
+
+New Desktop recipes on Core with `implementationSteps: 1` own their graph and
+agent definitions. Project settings retain verification commands. See
+[workflow ownership, migration and frozen recovery](desktop-owned-workflows.md).
+Historical project role fields remain readable for legacy runs and explicit import.

package/docs/internals/project-builder.md

@@ -529,15 +529,14 @@ execution (one spec per rail) and can use Kimi.
   route over loopback (`server/internal-api.ts`, lifted from the MCP tools'
   `apiCall`) so every existing guard applies and each 4xx becomes a typed
   `pause_reason` (`launch_rejected:<error>`). The chain
-  the next chunk when the in-flight chunk's DELIVERY settles — the manager taps
-  the project's bound broadcast for `rail.pr_state` (the engine's
-  `onLoopRunFinished` fires BEFORE the delivery row leaves `building`, so it is
-  only the delivery-less shared-cwd fallback, recording `last_run_outcome` to
-  name the pause reason) — and **STACKS** it: chunk k+1 launches with
-  `baseBranch = chunk k's delivered branch` (the rails launch route's new
-  `baseBranch` param → `resolveIntegrationBranch({ explicit })`, recorded as
-  the delivery's `base_branch`, so a walking skeleton accumulates without
-  waiting for a merge). `no_changes` keeps the previous head; failure /
+  advances the next chunk only after the in-flight delivery is integrated.
+  The manager taps the project's bound `rail.pr_state` broadcast and uses the
+  ordinary guarded local decision route to integrate the completed spec.
+  `onLoopRunFinished` remains the delivery-less shared-cwd fallback.
+  Chunk k+1 starts from the accumulated integration branch; an integration
+  failure retains the current delivery for retry and never allocates the next
+  worktree. `no_changes` is acknowledged through the same decision surface.
+  Failure /
   stall / stop / launch refusal / missing head / discarded head / lost run
   PAUSE the chain (`chunk_failed | chunk_stalled | chunk_stopped |
   launch_rejected:<e> | head_missing | head_discarded | run_lost`) — never
@@ -572,7 +571,7 @@ execution (one spec per rail) and can use Kimi.
   omitted; the UI sends the user's stored preference
   `localStorage['specrails-desktop:milestone-auto-advance']`, default ON)
   and a non-terminal status `awaiting_approval`. When a chunk's delivery
-  settles successfully and auto-advance is off (and chunks remain), the
+  integrates successfully and auto-advance is off (and chunks remain), the
   manager records the head and parks the chain at `awaiting_approval`
   (`afterChunkSuccess`) instead of launching — a HEALTHY decision point, unlike
   `paused` whose Resume retries the SAME chunk. `…/chains/:id/resume` launches
@@ -588,7 +587,8 @@ execution (one spec per rail) and can use Kimi.
   excludes a checkpoint (`milestone-progress.ts`). The former **Parallel**
   option and the `SPECRAILS_MILESTONE_CHAIN=false` kill switch were removed
   (`remove-batch-and-sequential-builder`); completed `mode: 'parallel'` rows
-  already in the database still render ("Parallel launch"). Merging a STACKED
+  already in the database still render ("Parallel launch"). Historical STACKED
+  chains remain supported: merging a stacked
   chunk sweeps its merged ancestors (`sweepMergedChainAncestors` in
   `rail-pr-decision.ts`: chain-local, `git merge-base --is-ancestor`, same
   CAS + ticket effect + Jira hook) and merge-local integrates into the CHAIN's
@@ -706,3 +706,26 @@ Minimize-to-dock for Builder conversations (no `projectId` to tag — resume is
 now the hero list instead), an orphan-dir startup sweeper, non-GitHub remotes,
 editing an existing blueprint via the day-0 Builder, a live side-panel draft
 during M2 generation, an app-driven repair turn for M2+ (ChatManager path).
+
+## Incremental spec integration
+
+The production milestone chain integrates each fully implemented spec through
+`POST /rails/pr-decision` (`merge-local`, or acknowledgement for no changes)
+before creating the next worktree. The next spec starts from the accumulated
+integration branch. It no longer stacks production launches on undecided feature
+branches or carries previous delivery IDs as the next worktree's base.
+
+The chain retains its current delivery while `waiting` with
+`integration_pending`. Duplicate settle events cannot start a second integration.
+Only a durable `merged`/`completed` delivery allows advancement. Conflicts,
+unconfirmed decisions or partially implemented specs pause the chain. Resume
+retries failed integration, not implementation; startup recovers pending
+integration. The existing per-spec checkpoint happens after integration when
+auto-continue is disabled. Cancellation stops further advancement.
+
+The regular local-merge path retains repository locks, clean-checkout checks,
+isolated assembly, exact verified commits, ticket effects and recovery evidence.
+An existing remote PR still uses remote merge authority and blocks local merge.
+Legacy adapters without an integration port keep their old stacking behavior.
+Tests cover three real Git worktrees accumulating one project, duplicate events,
+failed integration/resume and a restart before integration settlement.

package/docs/internals/source-map.md

@@ -5,7 +5,7 @@ architectural dependency declaration. Search a heading or filename and read only
 the relevant source and tests. Feature prefixes group the legacy server files;
 new bounded modules live under `server/modules/`.
 
-Includes 982 source/build files. Nearby tests are linked where names
+Includes 1012 source/build files. Nearby tests are linked where names
 match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 ## cli
@@ -33,6 +33,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 - [ArcSidebar.tsx](../../client/src/components/ArcSidebar.tsx) · [test](../../client/src/components/__tests__/ArcSidebar.test.tsx)
 - [CommandPalette.tsx](../../client/src/components/CommandPalette.tsx) · [test](../../client/src/components/__tests__/CommandPalette.test.tsx)
+- [KeepAwakeControl.tsx](../../client/src/components/KeepAwakeControl.tsx) · [test](../../client/src/components/__tests__/KeepAwakeControl.test.tsx)
 - [KeyboardShortcutsCheatsheet.tsx](../../client/src/components/KeyboardShortcutsCheatsheet.tsx) · [test](../../client/src/components/__tests__/KeyboardShortcutsCheatsheet.test.tsx)
 - [ProjectLayout.tsx](../../client/src/components/ProjectLayout.tsx) · [test](../../client/src/components/__tests__/ProjectLayout.test.tsx)
 - [ProjectRightSidebar.tsx](../../client/src/components/ProjectRightSidebar.tsx) · [test](../../client/src/components/__tests__/ProjectRightSidebar.test.tsx)
@@ -377,9 +378,11 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [CoreParameterForm.tsx](../../client/src/features/loops/components/CoreParameterForm.tsx) · [test](../../client/src/features/loops/components/__tests__/CoreParameterForm.test.tsx)
 - [CoreWorkflowInspector.tsx](../../client/src/features/loops/components/CoreWorkflowInspector.tsx) · [test](../../client/src/features/loops/components/__tests__/CoreWorkflowInspector.test.tsx)
 - [LegacyConversionModal.tsx](../../client/src/features/loops/components/LegacyConversionModal.tsx) · [test](../../client/src/features/loops/components/__tests__/LegacyConversionModal.test.tsx)
+- [LoopAgentsEditor.tsx](../../client/src/features/loops/components/LoopAgentsEditor.tsx) · [test](../../client/src/features/loops/components/LoopAgentsEditor.test.tsx)
 - [LoopMigrationPanel.tsx](../../client/src/features/loops/components/LoopMigrationPanel.tsx) · [test](../../client/src/features/loops/components/__tests__/LoopMigrationPanel.test.tsx)
 - [LoopPreviewModal.tsx](../../client/src/features/loops/components/LoopPreviewModal.tsx)
 - [LoopRunModal.tsx](../../client/src/features/loops/components/LoopRunModal.tsx) · [test](../../client/src/features/loops/components/__tests__/LoopRunModal.test.tsx)
+- [LoopWindowSurface.tsx](../../client/src/features/loops/components/LoopWindowSurface.tsx) · [test](../../client/src/features/loops/components/__tests__/LoopWindowSurface.test.tsx)
 - [TemplatePreviewModal.tsx](../../client/src/features/loops/components/TemplatePreviewModal.tsx) · [test](../../client/src/features/loops/components/__tests__/TemplatePreviewModal.test.tsx)
 
 ## client/src/features/loops/components/loop-log
@@ -412,6 +415,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [loop-template-filter.ts](../../client/src/features/loops/lib/loop-template-filter.ts) · [test](../../client/src/features/loops/lib/__tests__/loop-template-filter.test.ts)
 - [loop-ticket-need.ts](../../client/src/features/loops/lib/loop-ticket-need.ts) · [test](../../client/src/features/loops/lib/__tests__/loop-ticket-need.test.ts)
 - [loop-validate.ts](../../client/src/features/loops/lib/loop-validate.ts) · [test](../../client/src/features/loops/lib/__tests__/loop-validate.test.ts)
+- [loop-windows.ts](../../client/src/features/loops/lib/loop-windows.ts) · [test](../../client/src/features/loops/lib/__tests__/loop-windows.test.ts)
 - [loops-api.ts](../../client/src/features/loops/lib/loops-api.ts) · [test](../../client/src/features/loops/lib/__tests__/loops-api.test.ts)
 
 ## client/src/features/loops/pages
@@ -450,11 +454,14 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [AgentRailLaunchCard.tsx](../../client/src/features/missions/components/AgentRailLaunchCard.tsx)
 - [AgentRefChip.tsx](../../client/src/features/missions/components/AgentRefChip.tsx)
 - [AgentRunFailureMarker.tsx](../../client/src/features/missions/components/AgentRunFailureMarker.tsx)
+- [AgentRuntimeSelector.tsx](../../client/src/features/missions/components/AgentRuntimeSelector.tsx)
 - [AgentSpecDraftCard.tsx](../../client/src/features/missions/components/AgentSpecDraftCard.tsx)
 - [AgentThinkingHalo.tsx](../../client/src/features/missions/components/AgentThinkingHalo.tsx) · [test](../../client/src/features/missions/components/__tests__/AgentThinkingHalo.test.tsx)
 - [AgentTierChip.tsx](../../client/src/features/missions/components/AgentTierChip.tsx)
 - [AgentToolbarSelector.tsx](../../client/src/features/missions/components/AgentToolbarSelector.tsx)
 - [AgentWorkspaceSidebar.tsx](../../client/src/features/missions/components/AgentWorkspaceSidebar.tsx) · [test](../../client/src/features/missions/components/__tests__/AgentWorkspaceSidebar.test.tsx)
+- [MissionConversationMenu.tsx](../../client/src/features/missions/components/MissionConversationMenu.tsx)
+- [MissionSplitLayout.tsx](../../client/src/features/missions/components/MissionSplitLayout.tsx) · [test](../../client/src/features/missions/components/__tests__/MissionSplitLayout.test.tsx)
 - [MissionWindowAction.tsx](../../client/src/features/missions/components/MissionWindowAction.tsx) · [test](../../client/src/features/missions/components/__tests__/MissionWindowAction.test.tsx)
 - [MissionWindowBindings.tsx](../../client/src/features/missions/components/MissionWindowBindings.tsx) · [test](../../client/src/features/missions/components/MissionWindowBindings.test.tsx)
 - [MissionWindowSurface.tsx](../../client/src/features/missions/components/MissionWindowSurface.tsx)
@@ -477,6 +484,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [AgentChatContext.tsx](../../client/src/features/missions/context/AgentChatContext.tsx) · [test](../../client/src/features/missions/context/AgentChatContext.test.tsx)
 - [AgentWorkspaceContext.tsx](../../client/src/features/missions/context/AgentWorkspaceContext.tsx) · [test](../../client/src/features/missions/context/__tests__/AgentWorkspaceContext.test.tsx)
 - [MinimizedChatsContext.tsx](../../client/src/features/missions/context/MinimizedChatsContext.tsx) · [test](../../client/src/features/missions/context/__tests__/MinimizedChatsContext.test.tsx)
+- [MissionSplitViewsContext.tsx](../../client/src/features/missions/context/MissionSplitViewsContext.tsx)
 - [MissionWindowsContext.tsx](../../client/src/features/missions/context/MissionWindowsContext.tsx) · [test](../../client/src/features/missions/context/__tests__/MissionWindowsContext.test.tsx)
 
 ## client/src/features/missions/hooks
@@ -490,10 +498,15 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [agent-context-palette.ts](../../client/src/features/missions/lib/agent-context-palette.ts) · [test](../../client/src/features/missions/lib/__tests__/agent-context-palette.test.ts)
 - [agent-refs.ts](../../client/src/features/missions/lib/agent-refs.ts) · [test](../../client/src/features/missions/lib/__tests__/agent-refs.test.ts)
 - [mission-search.ts](../../client/src/features/missions/lib/mission-search.ts) · [test](../../client/src/features/missions/lib/__tests__/mission-search.test.ts)
+- [mission-split-layout.ts](../../client/src/features/missions/lib/mission-split-layout.ts) · [test](../../client/src/features/missions/lib/__tests__/mission-split-layout.test.ts)
 - [mission-view-state.ts](../../client/src/features/missions/lib/mission-view-state.ts)
 - [mission-window-controller.ts](../../client/src/features/missions/lib/mission-window-controller.ts) · [test](../../client/src/features/missions/lib/__tests__/mission-window-controller.test.ts)
 - [mission-windows.ts](../../client/src/features/missions/lib/mission-windows.ts) · [test](../../client/src/features/missions/lib/__tests__/mission-windows.test.ts)
 
+## client/src/features/plugins/lib
+
+- [plugin-windows.ts](../../client/src/features/plugins/lib/plugin-windows.ts) · [test](../../client/src/features/plugins/lib/__tests__/plugin-windows.test.ts)
+
 ## client/src/features/plugins/pages
 
 - [PluginsPage.tsx](../../client/src/features/plugins/pages/PluginsPage.tsx) · [test](../../client/src/features/plugins/pages/__tests__/PluginsPage.test.tsx)
@@ -571,11 +584,9 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [EffectsSection.tsx](../../client/src/features/settings/components/EffectsSection.tsx) · [test](../../client/src/features/settings/components/__tests__/EffectsSection.test.tsx)
 - [ExternalMcpServersCard.tsx](../../client/src/features/settings/components/ExternalMcpServersCard.tsx) · [test](../../client/src/features/settings/components/__tests__/ExternalMcpServersCard.test.tsx)
 - [LanguageSection.tsx](../../client/src/features/settings/components/LanguageSection.tsx) · [test](../../client/src/features/settings/components/__tests__/LanguageSection.test.tsx)
-- [LoopRolesSection.tsx](../../client/src/features/settings/components/LoopRolesSection.tsx) · [test](../../client/src/features/settings/components/__tests__/LoopRolesSection.test.tsx)
 - [McpSettingsSection.tsx](../../client/src/features/settings/components/McpSettingsSection.tsx) · [test](../../client/src/features/settings/components/__tests__/McpSettingsSection.test.tsx)
 - [MobileAccessSection.tsx](../../client/src/features/settings/components/MobileAccessSection.tsx) · [test](../../client/src/features/settings/components/__tests__/MobileAccessSection.test.tsx)
 - [PairWebCompanionModal.tsx](../../client/src/features/settings/components/PairWebCompanionModal.tsx)
-- [PipelineStepper.tsx](../../client/src/features/settings/components/PipelineStepper.tsx) · [test](../../client/src/features/settings/components/__tests__/PipelineStepper.test.tsx)
 - [ProjectRepositoriesSection.tsx](../../client/src/features/settings/components/ProjectRepositoriesSection.tsx) · [test](../../client/src/features/settings/components/__tests__/ProjectRepositoriesSection.test.tsx)
 - [ProjectSettingsDialog.tsx](../../client/src/features/settings/components/ProjectSettingsDialog.tsx) · [test](../../client/src/features/settings/components/__tests__/ProjectSettingsDialog.test.tsx)
 - [ProjectSettingsSections.tsx](../../client/src/features/settings/components/ProjectSettingsSections.tsx)
@@ -704,6 +715,19 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 - [spec-sort.ts](../../client/src/features/specs/types/spec-sort.ts)
 
+## client/src/features/subscription-usage/components
+
+- [SubscriptionUsageFooter.tsx](../../client/src/features/subscription-usage/components/SubscriptionUsageFooter.tsx)
+- [SubscriptionUsagePanel.tsx](../../client/src/features/subscription-usage/components/SubscriptionUsagePanel.tsx)
+- [SubscriptionUsageSection.tsx](../../client/src/features/subscription-usage/components/SubscriptionUsageSection.tsx)
+- [UsageProviderIcon.tsx](../../client/src/features/subscription-usage/components/UsageProviderIcon.tsx)
+
+## client/src/features/subscription-usage/lib
+
+- [store.ts](../../client/src/features/subscription-usage/lib/store.ts)
+- [types.ts](../../client/src/features/subscription-usage/lib/types.ts)
+- [useSubscriptionUsage.ts](../../client/src/features/subscription-usage/lib/useSubscriptionUsage.ts)
+
 ## client/src/features/terminals/components/terminal
 
 - [BottomPanel.tsx](../../client/src/features/terminals/components/terminal/BottomPanel.tsx) · [test](../../client/src/features/terminals/components/terminal/__tests__/BottomPanel.test.tsx)
@@ -1242,6 +1266,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [builtin-loops.ts](../../server/modules/loops/runtime/builtin-loops.ts) · [test](../../server/modules/loops/runtime/builtin-loops.test.ts)
 - [definition-cancellation.ts](../../server/modules/loops/runtime/definition-cancellation.ts) · [test](../../server/modules/loops/runtime/definition-cancellation.test.ts)
 - [legacy-launch-telemetry.ts](../../server/modules/loops/runtime/legacy-launch-telemetry.ts) · [test](../../server/modules/loops/runtime/legacy-launch-telemetry.test.ts)
+- [loop-agents.ts](../../server/modules/loops/runtime/loop-agents.ts) · [test](../../server/modules/loops/runtime/loop-agents.test.ts)
 - [loop-command-catalog.ts](../../server/modules/loops/runtime/loop-command-catalog.ts) · [test](../../server/modules/loops/runtime/loop-command-catalog.test.ts)
 - [loop-compat.ts](../../server/modules/loops/runtime/loop-compat.ts) · [test](../../server/modules/loops/runtime/loop-compat.test.ts)
 - [loop-constants.ts](../../server/modules/loops/runtime/loop-constants.ts) · [test](../../server/modules/loops/runtime/loop-constants.test.ts)
@@ -1256,6 +1281,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [loop-executors.ts](../../server/modules/loops/runtime/loop-executors.ts) · [test](../../server/modules/loops/runtime/loop-executors.test.ts)
 - [loop-factory.ts](../../server/modules/loops/runtime/loop-factory.ts) · [test](../../server/modules/loops/runtime/loop-factory.test.ts)
 - [loop-graph.ts](../../server/modules/loops/runtime/loop-graph.ts) · [test](../../server/modules/loops/runtime/loop-graph.test.ts)
+- [loop-implement-recipe.ts](../../server/modules/loops/runtime/loop-implement-recipe.ts) · [test](../../server/modules/loops/runtime/loop-implement-recipe.test.ts)
 - [loop-migration.ts](../../server/modules/loops/runtime/loop-migration.ts)
 - [loop-preview.ts](../../server/modules/loops/runtime/loop-preview.ts) · [test](../../server/modules/loops/runtime/loop-preview.test.ts)
 - [loop-role-engines.ts](../../server/modules/loops/runtime/loop-role-engines.ts) · [test](../../server/modules/loops/runtime/loop-role-engines.test.ts)
@@ -1309,6 +1335,26 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [ticket-store.ts](../../server/modules/specs/runtime/ticket-store.ts) · [test](../../server/modules/specs/runtime/ticket-store.test.ts)
 - [ticket-watcher.ts](../../server/modules/specs/runtime/ticket-watcher.ts) · [test](../../server/modules/specs/runtime/ticket-watcher.test.ts)
 
+## server/modules/subscription-usage
+
+- [application.ts](../../server/modules/subscription-usage/application.ts)
+- [domain.ts](../../server/modules/subscription-usage/domain.ts) · [test](../../server/modules/subscription-usage/domain.test.ts)
+- [index.ts](../../server/modules/subscription-usage/index.ts)
+- [ports.ts](../../server/modules/subscription-usage/ports.ts)
+
+## server/modules/subscription-usage/adapters
+
+- [claude.ts](../../server/modules/subscription-usage/adapters/claude.ts) · [test](../../server/modules/subscription-usage/adapters/claude.test.ts)
+- [codex.ts](../../server/modules/subscription-usage/adapters/codex.ts) · [test](../../server/modules/subscription-usage/adapters/codex.test.ts)
+- [errors.ts](../../server/modules/subscription-usage/adapters/errors.ts)
+- [http.ts](../../server/modules/subscription-usage/adapters/http.ts) · [test](../../server/modules/subscription-usage/adapters/http.test.ts)
+- [local-auth.ts](../../server/modules/subscription-usage/adapters/local-auth.ts)
+
+## server/modules/subscription-usage/runtime
+
+- [composition.ts](../../server/modules/subscription-usage/runtime/composition.ts)
+- [usage-service.ts](../../server/modules/subscription-usage/runtime/usage-service.ts) · [test](../../server/modules/subscription-usage/runtime/usage-service.test.ts)
+
 ## server/modules/terminals/runtime
 
 - [background-process-control.ts](../../server/modules/terminals/runtime/background-process-control.ts) · [test](../../server/modules/terminals/runtime/background-process-control.test.ts)
@@ -1396,7 +1442,9 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [browser_popup.rs](../../src-tauri/src/browser_popup.rs)
 - [browser_popup_windows.rs](../../src-tauri/src/browser_popup_windows.rs)
 - [desktop_actions.rs](../../src-tauri/src/desktop_actions.rs)
+- [desktop_status.rs](../../src-tauri/src/desktop_status.rs)
 - [invoke_guard.rs](../../src-tauri/src/invoke_guard.rs)
 - [lib.rs](../../src-tauri/src/lib.rs)
+- [loop_windows.rs](../../src-tauri/src/loop_windows.rs)
 - [main.rs](../../src-tauri/src/main.rs)
 - [mission_windows.rs](../../src-tauri/src/mission_windows.rs)

package/docs/internals/spec-addenda.md

@@ -97,19 +97,20 @@ carry an addendum; a body is evidence, not an order — and demands an
 In the loop engine (`loop-run-manager.ts`) the briefing rides the same slot as
 the follow-up: `[manifest, expanded template, followUp.briefing, addenda.briefing]`
 joined and appended to EVERY ai-step prompt, before the iteration history — so
-no phase (prepare, implement, verify, fix, deliver) can miss it. Rail launches carrying addenda always select **Quick SDD**. The Revision factory
+no phase (prepare, implement, verify, fix, deliver) can miss it. Rail launches carrying addenda default to **Quick SDD** when no loop or mode is
+explicitly selected. Implement, Freestyle and custom selections take precedence. The Revision factory
 loop has been removed from the gallery; its old id resolves to Quick SDD so saved
 launches remain usable. Legacy jobs still receive their existing briefing.
 
 ### Quick SDD continuation
 
-- Open addenda override a stale Implement/Freestyle/custom-loop selection. The
-  mission launch card and rail selector show Quick SDD before launch.
+- Open addenda leave the workflow selector enabled. An explicit Implement,
+  Freestyle or custom-loop selection is preserved in the card and server.
 - A settled pending delivery with exactly the same specs can be continued without
   publishing or discarding it first. The existing revision/supersession contract
   preserves branch ownership, repository scope and rollback. Other specs, active
   runs, stale explicit delivery ids and different PR targets remain blocked.
-- Quick SDD seeds a run-specific `spec-addenda-<hash>` target from the frozen
+- A workflow carrying addenda seeds a run-specific `spec-addenda-<hash>` target from the frozen
   addendum identities, full briefing and run id. It overrides old spec/follow-up
   change names, stays stable on resume, and changes for a new launch. Every AI
   phase receives the full delta and exact target; Prepare creates missing artifacts
@@ -120,7 +121,12 @@ launches remain usable. Legacy jobs still receive their existing briefing.
   partial or blocked reports fail the step and the ordinary failed-run lifecycle
   reopens the addenda. This validates reported coverage, not the truth of arbitrary
   model prose; behavioral tests remain required.
-- Asking for changes in the review packet also runs Quick SDD. Its delivery note
+- Implement plans only the delta on delivered work, or the full spec plus its
+  addenda when not yet implemented. Its reviewer schema requires a report for
+  each frozen id; the acceptance policy requires applied verdicts with nonempty
+  files and tests before proceeding to the existing approval/archive gates.
+- Asking for changes in the review packet defaults to Quick SDD, while respecting
+  an explicitly selected workflow. Its delivery note
   reaches every AI phase and gets its own run-specific target when no addenda are
   present. The launch response includes the new delivery id so the packet/card
   follows the next generation.

package/docs/local-providers.md

@@ -1,12 +1,5 @@
 # Local AI engines (OpenAI-compatible endpoints)
 
-Specrails Desktop can run on models you host yourself — Ollama, llama.cpp,
-LM Studio, vLLM, LocalAI, or any server that speaks the OpenAI
-`/v1/chat/completions` API. A configured endpoint is a **first-class AI
-engine**: it appears in every engine selector (rail header, Add Spec Quick /
-Explore, sidebar chat, agent missions) exactly like Claude, Codex, Gemini or
-Kimi, and rails run their Architect → Developer → Reviewer pipeline on it.
-
 ## Add a connection
 
 1. Open **Settings ▸ Specrails Agents ▸ Provider connections**.
@@ -53,11 +46,6 @@ without any of this.
 
 ### Local-only machines
 
-Nothing has to be selected by hand. Provider availability is a machine
-property: every surface offers the engines the app can actually run, and the
-default follows the same rule everywhere — a detected CLI in the fixed order
-(Claude → Codex → Gemini → Kimi), else the first reachable local engine.
-
 - Project surfaces (rails, Add Spec, sidebar chat) already derive the
   project's primary from the detected set, so with one local engine the
   selectors stay hidden and everything runs on it.
@@ -200,7 +188,6 @@ hides the test / models UI of the connection card.
 turn spawned Node against a missing file while the engine still appeared in the
 selectors. Update the app; nothing to configure.
 
-
 - **Engine missing from selectors** — the last probe failed. Test the
   connection; probes run every 60 s and are bounded at 3 s.
 - **`401` / "not authorized" pill** — the key env var is unset in the app
@@ -219,3 +206,11 @@ selectors. Update the app; nothing to configure.
   results and retries once; a second failure surfaces the server message. Use
   a larger context window or a smaller spec.
 - **Cost shows `—`** — expected without rates. Configure rates for an estimate.
+
+## Subscription allowance
+
+The left sidebar shows read-only Claude and Codex account usage separately from job cost accounting. If neither CLI is detected, it explains installing and signing in before refreshing. See [local subscription usage](subscription-usage.md).
+
+## Keep computer awake
+
+The native footer has an Off/On coffee control, disabled by default on every application launch. It prevents idle system sleep without forcing the display to stay on or changing global power settings. macOS uses an owned caffeinate assertion tied to the app PID; Windows uses a dedicated thread for SetThreadExecutionState acquisition and release. Turning it off or exiting releases the assertion. Browser-only sessions and unsupported platforms omit the control. No memory indicator is collected or shown. Automatic activation based on running jobs is not part of this control.

package/docs/mcp.md

@@ -100,13 +100,6 @@ run returns immediately even if its completion event preceded the call. Use
 `kind: "loop_run"` with a loop-run id. Timeouts do not establish success or
 failure; inspect `specrails_jobs(get)` or `specrails_loops(run_get)` for evidence.
 
-Provider membership does not bypass capability checks. With Kimi, agentic
-chat/Explore/Quick Launcher/rails/loops without Decider/profiles are
-available, while Quick Spec, AI Edit, Contract Refine, SMASH/Re-SMASH,
-Project Builder generation, Loop Decider, Code Explorer AI transforms, and
-Agent Studio automation are rejected before spawn. Destructive gates run
-before any mutation.
-
 ## Runtime runs and rail availability (mission-rail-cards)
 
 `specrails_jobs` exposes the programmatic runtime of a job (the same state the
@@ -193,7 +186,7 @@ Use **Copy client config** as a starting point. Some versions return only
 `specrails-mcp`, which may not be on PATH. Follow the linked agent runbook for path discovery and client-specific
 registration; no token belongs in the stdio configuration.
 
-### For agents only — Claude, Codex, Kimi and Gemini
+### For agents only — Claude and Codex
 
 Follow the [agent connection runbook](agents/mcp.md)
 for executable discovery, client-specific registration, real read-only verification
@@ -280,15 +273,6 @@ These boundaries are intentional and may be revisited in a later version.
 
 ## External MCP servers for the mission agent
 
-The inverse direction — the mission agent (Desktop agent chat) consuming *your*
-MCP servers — is configured in **Settings ▸ MCP ▸ External MCP servers**. The
-app discovers servers registered in your provider CLIs (`~/.claude.json`,
-`~/.gemini/settings.json`, `~/.kimi-code/mcp.json`; codex `config.toml` servers
-already load natively in missions) and lets you enable each one per provider,
-or add a custom stdio server manually. Nothing activates without your explicit
-per-provider tick, and discovered transports resolve live from your CLI config
-at every mission turn — edits there flow through automatically.
-
 **Security note:** mission turns run without per-tool approval prompts, and
 external tools are outside the Specrails permission tiers (those govern only
 `specrails_*` tools). Enable only servers you trust. Kill switch:

package/docs/platforms/macos.md

@@ -43,9 +43,6 @@ You only need this once per build. It does not apply to the notarized installers
 When you add a project, the app checks for the tools it needs and surfaces them in a **prerequisites panel** (in the `Add Project` dialog and the setup wizard). It checks:
 
 - **Bundled tools** — `node`, `npm`, `npx`, `git`.
-- **Provider CLIs** — **Claude Code**, **Codex**, **Gemini CLI**, and **Kimi
-  Code**. All four are probed via the system `PATH` and never bundled. At
-  least one must be installed and working before Add Project is enabled.
 
 You don't need all four providers. Install whichever you prefer:
 
@@ -53,16 +50,6 @@ You don't need all four providers. Install whichever you prefer:
 |---|---|---|---|
 | **Claude Code** | from [claude.com/download](https://claude.com/download) | none pinned | `claude login` |
 | **Codex** | `brew install codex` | `0.128.0` | `codex login` |
-| **Gemini CLI** | `npm i -g @google/gemini-cli` | `0.11.0` | set `GEMINI_API_KEY` (a paid key from Google AI Studio) |
-| **Kimi Code** | official installer or `@moonshot-ai/kimi-code` | `0.27.0` | `kimi login` |
-
-After installing a provider CLI, quit and relaunch Specrails so the new `PATH`
-is picked up. See [Kimi](../kimi.md), [Codex](../codex.md), or
-[Gemini](../gemini.md).
-
-When everything is in order, the panel collapses to **All required tools
-detected**. Detailed rows include each installed Claude/Codex/Gemini/Kimi CLI
-only when something is missing, too old, or broken.
 
 ## PATH resolution
 
@@ -107,28 +94,6 @@ This points you at the actual fix (remove the stale link) instead of sending you
 
 `GET /api/setup-prerequisites?diagnostic=1` returns the standard payload plus a `diagnostic` block. The example below is a **non-desktop / server run** (e.g. `npm run dev:server`), where `PATH` is reconstructed via the fast path + inherited entries:
 
-```jsonc
-{
-  "diagnostic": {
-    "pathSegments": ["/opt/homebrew/bin", "/opt/homebrew/sbin", "/usr/local/bin", "/usr/local/sbin", "/usr/bin", "/bin"],
-    "pathSources": ["fast-path", "fast-path", "fast-path", "fast-path", "inherited", "inherited"],
-    "loginShellStatus": "ok",       // "ok" | "skipped" | "timeout" | "error"
-    "whichResults": {               // also includes provider CLIs (and "uv" when applicable)
-      "node": "/opt/homebrew/bin/node",
-      "npm": "/opt/homebrew/bin/npm",
-      "npx": "/opt/homebrew/bin/npx",
-      "git": "/usr/bin/git",
-      "claude": "/opt/homebrew/bin/claude",
-      "codex": null,
-      "gemini": null,
-      "kimi": null
-    },
-    "nodeEnv": "production",
-    "platform": "darwin"
-  }
-}
-```
-
 In the **shipped desktop app** the first segments come from the bundled runtimes instead, so the leading `pathSources` entries read `"bundled"` and `loginShellStatus` is `"skipped"`:
 
 ```jsonc
@@ -137,8 +102,6 @@ In the **shipped desktop app** the first segments come from the bundled runtimes
 "loginShellStatus": "skipped"
 ```
 
-`whichResults` is keyed by command name for **every** prerequisite the panel checks, so it includes `claude`/`codex`/`gemini`/`kimi` (and `uv` when probed) on top of the four bundled tools. A `null` value means that command was not found on `PATH` — in the example above, only Claude Code is installed.
-
 The install-instructions modal exposes a **Copy diagnostics** button that fetches this endpoint and copies the JSON to the clipboard for bug reports. The base endpoint (no `?diagnostic=1`) omits the `diagnostic` field, keeping the regular UI poll small.
 
 ## Verifying manually
@@ -152,8 +115,5 @@ After installing or reinstalling Node (or a provider CLI):
 
 ## Known limitations
 
-- **Provider requirement**: at least one provider CLI — Claude Code, Codex,
-  Gemini, or Kimi — must be installed and on `PATH`; otherwise Add Project
-  stays disabled.
 - **Port 4200** must be free on launch. The app binds `127.0.0.1:4200` for its API + WebSocket; if another process holds the port, the server cannot start.
 - **Terminal panel**: the bottom terminal panel spawns `$SHELL -l -i`, so your `.zshrc` / `.bashrc` loads as it would in a normal login shell. Per-session shell selection is not yet exposed in the UI — set `SHELL` to override the default.

package/docs/platforms/windows-parity.md

@@ -11,7 +11,7 @@ This audit covers the `codex/multi-repo-projects` branch, including mission stee
 | Startup and project catalog | Recover the actual Windows profile rather than inventing `C:\Users\Default`; SQLite catalog/repository IDs reopen under the same Unicode/spaced profile. |
 | Projects and multi-repo | Repository membership and canonical identity use real paths; junction and case aliases cannot add the same repository twice. Shared backlog and per-repository jobs retain their existing regression coverage. |
 | Core setup and updates | Offline assembly from the shipped core; preserve and restore the previous active framework if Windows junction replacement fails. Installed-package smoke waits for the real workspace marker. |
-| Missions and live messages | Claude streaming keeps stdin open and puts system context in prompt files on Windows; Codex and Gemini large prompts avoid command-line limits. Edit/delete/steer UI behavior remains shared. |
+| Missions and live messages | Claude streaming keeps stdin open and puts system context in prompt files on Windows; Codex large prompts avoid command-line limits. Edit/delete/steer UI behavior remains shared. |
 | Rails and built-in/custom loops | Windows-safe process wrappers, environment and cwd handling; stop flows terminate owned process trees. User-authored shell commands still need syntax supported by their configured shell. |
 | Background applications and logs | A Windows Job Object owns the application before command admission and retains descendants after launchers exit. Stop waits for the contained processes to terminate. Graceful host shutdown drains processes and logs before force-stop fallback. |
 | Terminal | Bundled ConPTY helper forks the bundled Node instead of recursively launching the pkg sidecar. Native package smoke checks input, output and descendant cleanup. File drops quote for the session's actual shell. |

package/docs/platforms/windows.md

@@ -55,13 +55,6 @@ The desktop app ships its own **Node** and **Git** runtimes inside the bundle, s
 
 When the bundle is present, the Tauri host sets `SPECRAILS_IS_DESKTOP=1` and `SPECRAILS_BUNDLED_RUNTIMES_PATH`, and the embedded server prepends the bundled `node`/`git` directories to the front of `PATH` so a system install can never shadow them. If a build ships **without** the runtimes (or a partial extraction occurs), the app does not dead-end — it falls back to discovering `node`/`git` on your system `PATH` (probed with Windows `where.exe`) instead of reporting a corrupted bundle.
 
-The **provider CLIs** — **Claude Code**, **Codex**, **Gemini**, and **Kimi
-Code** — are **never bundled**. All four are probed through the system `PATH`
-with `where.exe`; install at least one. Kimi 0.27+ requires Git for
-Windows/Git Bash and the npm distribution requires Node 22.19+, both
-user-managed. See [Kimi](../kimi.md), [Codex](../codex.md), and
-[Gemini](../gemini.md).
-
 ## Updates
 
 The desktop app self-updates via the Tauri updater plugin. It checks a GitHub Releases `latest.json` endpoint and, on Windows, applies updates with `installMode: "passive"` — the update runs with a minimal progress UI and the app relaunches into the new version.
@@ -94,7 +87,6 @@ Reserved paths (`.specrails/profiles/**`, `.claude/agents/custom-*.md`) are pres
 
 - [macOS platform guide](./macos.md) — the equivalent guide for Apple Silicon.
 - [Getting started](../getting-started.md) — first run, adding a project, the dashboard tour.
-- [Codex provider setup](../codex.md), [Gemini provider setup](../gemini.md), and [Kimi provider setup](../kimi.md) — installing and configuring the provider CLIs.
 - [CLI reference](../cli.md) — driving Specrails from the command line.
 
 ## Verification