minima-cli 0.12.3__tar.gz → 0.13.0__tar.gz

{minima_cli-0.12.3 → minima_cli-0.13.0}/.env.example

@@ -35,8 +35,9 @@ MINIMA_RECALL_RANK_BY=balanced
 MINIMA_RECALL_MAX_AGE_DAYS=0
 # Mubit search budget tier: low | mid | high.
 MINIMA_RECALL_BUDGET=mid
-# Log per-evidence score breakdowns (diagnostic; keep off in prod).
-MINIMA_RECALL_EXPLAIN=false
+# Fraction of recalls (0..1) that request + log Mubit's per-evidence fusion-score
+# breakdown (`recall_explain` log lines). 0 = off; try 0.05 when debugging ranking.
+MINIMA_RECALL_EXPLAIN_SAMPLE=0
 
 # --- Recommender tuning ---
 MINIMA_TAU_MIN=0.55

{minima_cli-0.12.3 → minima_cli-0.13.0}/CHANGELOG.md

@@ -4,6 +4,96 @@ All notable changes to Minima are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project aims to follow
 [Semantic Versioning](https://semver.org/).
 
+## [0.13.0] - 2026-07-21
+
+The Mubit reinforcement train: mubit-sdk 0.13.0 adopted end to end, every free
+signal on the memory wire put to work, and the ground-truth spine's per-step gate
+verdicts start feeding Mubit as process rewards (PRs #192–#197).
+
+### Added
+- **Per-step process rewards** (server + harness, #195): the harness's red→green
+  gate verdicts now ride `POST /v1/feedback` as `step_outcomes[]` and relay to
+  Mubit's `record_step_outcome` — finer-grained reflection attribution and the raw
+  material for server-side workflow induction (procedural memory). Feedback truth
+  applies per step: deterministic/user verdicts only (judge gates excluded),
+  verified/failed only, relayed even on unlabeled turns (steps carry their own
+  provenance), capped at 32, duplicate-feedback check doubles as replay dedup.
+  Response gains `step_outcomes_recorded`.
+- **`POST /v1/diagnose` + `GET /v1/memory/health`** (server, #196): Mubit
+  introspection relays — failure lessons matching an error, and a per-namespace
+  memory-hygiene report (stale entries, contradictions, low-confidence counts,
+  promotion candidates). Both degrade to `memory_unavailable` instead of 500ing.
+  Full client parity (Python sync/async, TS SDK, TUI).
+- **Recovery-ladder memory brief** (TUI, #196): the replan rung asks `/v1/diagnose`
+  for "here's how this failed before" and injects matched lessons into the retry
+  preamble, next to the E2 local diagnostics. Fail-open.
+- **Drift + retrieval signals surfaced** (server, #193): Mubit DriftMonitor flags
+  riding every recall now emit `memory_drift:repeated` / `memory_drift:stagnant`
+  diagnostics, and the server's recall confidence feeds escalation as
+  `low_recall_confidence` (only when reported — absence is not a signal).
+- **Sampled retrieval observability** (server, #194): `MINIMA_RECALL_EXPLAIN_SAMPLE`
+  requests Mubit's per-evidence fusion-score breakdown on a sampled fraction of
+  recalls and logs it as `recall_explain` — the "why did memory rank this" tool.
+
+### Fixed
+- **Dereference now shares the recall budget** (server, #193): it was the one read
+  path with no timeout budget — a hung Mubit could stall a recommend for the full
+  30s client timeout.
+- **Supersession folds into staleness** (server, #193): a `superseded_by` entry is
+  treated as stale even when the `is_stale` flag lags the supersession write.
+
+### Changed
+- **mubit-sdk ≥ 0.13.0** (#192): the v0.12.3 keyed-lookup transport shim is deleted
+  in favor of the now-public `Client.lookup`; the TUI's `@mubit-ai/sdk` moves to
+  `^0.13.0` (transport retries now real). All remaining private `_control` handle
+  uses replaced with the typed surface (#194) — recall knobs and `record_outcome`
+  idempotency are first-class SDK parameters now.
+- **Bi-temporal outcome writes** (server, #194): `remember_outcome` passes
+  `occurrence_time` (observation time, not async-ingest landing time). Seeds are
+  deliberately NOT backdated — the seed-vs-live weighting design stands.
+- **Harness memory lane partition** (TUI, #197): harness trace writes stamp
+  `lane=harness`, keeping them explicitly partitioned from the server's typed
+  outcome records. Recall stays unfiltered until unlaned data ages out.
+- Dead `MubitMemory.get_context` surface removed (#193); recall-precision knobs
+  (`entry_types`, `rank_by`, `budget`, `max_age_days`, `explain_sample`) documented
+  in `docs/configuration.md` (#194).
+
+## [0.12.4] - 2026-07-21
+
+### Fixed
+- **Inline render stability — the anchor ledger** (TUI, #187): the composer stays
+  bottom-anchored and Ink can no longer strand or wipe rows. An explicit capped
+  live-frame height makes strand + wipe structurally impossible; inherited scroll
+  margins (a leaked DECSTBM region surviving clear/resize) are reset at boot; empty
+  markdown lines no longer collapse to zero rows. Backed by new PTY regression gates
+  (anchor-ledger repro matrix, mid-run resize, stale-margin asserts).
+- **PTY-suite hermeticity** (#187): a blank `MUBIT_API_KEY` kills a live
+  recall-before-route stall inside the "hermetic" suite — root cause of the historic
+  ~50%/run flake.
+
+### Added
+- **Shift+Tab mode ring with Claude Code permission parity** (TUI, #187): a silent,
+  global mode cycle (build → accept-edits → plan) that works mid-run and over the
+  permission overlay. Plan mode denies write/edit/bash at the dispatcher (new
+  `mode-deny` guard event), the exit-plan gate gains a 4-option landing, accept-edits
+  auto-approval is cwd-scoped, and `[a]` on a bash prompt becomes a persisted
+  per-command-family grant. Mode-aware permissions footer; gate blocks render as
+  `⊘ verify gate` instead of a red denial.
+- **Premium plan routing** (TUI, #187): plan mode decides on premium models only — a
+  hard pre-request candidate pin (`constraints.candidate_models` + `phase:plan` tag)
+  that never silently widens; premium finalize/turn cost is booked like any other.
+- **Honest Mubit-error taxonomy** (server, #132): the memory layer's bare
+  `except Exception` no longer collapses every failure into `memory_unavailable` /
+  `memory_write_failed`. Mubit SDK errors map to class-specific warnings
+  (`memory_auth_failed`, `memory_rejected_payload`, `memory_unsupported`,
+  `memory_server_error`, `memory_unreachable`), and non-Mubit exceptions are labeled
+  `memory_write_bug` / `memory_recall_bug` so a local bug is never disguised as an
+  outage. Logs carry `error_type` alongside the label.
+
+### Changed
+- `uv.lock` refreshed to record the current project version (#190) — the 0.12.2/0.12.3
+  bumps had left it stale at 0.12.1.
+
 ## [0.12.3] - 2026-07-21
 
 ### Fixed

{minima_cli-0.12.3 → minima_cli-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: minima-cli
-Version: 0.12.3
+Version: 0.13.0
 Summary: Minima CLI: cost-aware LLM model routing — recommend cheaper models, backed by Mubit memory.
 Project-URL: Homepage, https://docs.minima.sh
 Project-URL: Documentation, https://docs.minima.sh
@@ -21,7 +21,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.11
 Requires-Dist: anyio>=4.4
 Requires-Dist: httpx>=0.27
-Requires-Dist: mubit-sdk>=0.10.0
+Requires-Dist: mubit-sdk>=0.13.0
 Requires-Dist: pydantic-settings>=2.3
 Requires-Dist: pydantic>=2.7
 Requires-Dist: structlog>=24.1

{minima_cli-0.12.3 → minima_cli-0.13.0}/client_sdk/minima_client/client.py

@@ -18,6 +18,7 @@ from tenacity import (
 from minima.schemas.capabilities import CapabilitiesResponse
 from minima.schemas.common import Constraints, OutcomeLabel, TaskInput
 from minima.schemas.feedback import FeedbackRequest, FeedbackResponse
+from minima.schemas.insight import DiagnoseRequest, DiagnoseResponse, MemoryHealthResponse
 from minima.schemas.models_catalog import ModelsResponse
 from minima.schemas.recommend import RecommendRequest, RecommendResponse
 from minima.schemas.savings import CalibrationResponse, PolicyValueResponse, SavingsResponse
@@ -273,6 +274,38 @@ class MinimaClient:
         raise_for_status(resp)
         return StrategiesResponse.model_validate(resp.json())
 
+    def diagnose(
+        self,
+        error_text: str,
+        *,
+        error_type: str | None = None,
+        limit: int = 5,
+        namespace: str | None = None,
+        user_id: str | None = None,
+    ) -> DiagnoseResponse:
+        """Failure lessons matching an error — 'here's how this failed before'."""
+        req = DiagnoseRequest(
+            error_text=error_text,
+            error_type=error_type,
+            limit=limit,
+            namespace=namespace,
+            user_id=user_id,
+        )
+        resp = self._client.post("/v1/diagnose", json=req.model_dump(exclude_none=True))
+        raise_for_status(resp)
+        return DiagnoseResponse.model_validate(resp.json())
+
+    def memory_health(
+        self, namespace: str | None = None, stale_threshold_days: int = 30
+    ) -> MemoryHealthResponse:
+        """Per-namespace memory hygiene: staleness, contradictions, promotion candidates."""
+        params: dict[str, Any] = {"stale_threshold_days": stale_threshold_days}
+        if namespace is not None:
+            params["namespace"] = namespace
+        resp = self._client.get("/v1/memory/health", params=params)
+        raise_for_status(resp)
+        return MemoryHealthResponse.model_validate(resp.json())
+
     def capabilities(self) -> CapabilitiesResponse:
         resp = self._client.get("/v1/capabilities")
         raise_for_status(resp)
@@ -432,6 +465,38 @@ class AsyncMinimaClient:
         raise_for_status(resp)
         return ModelsResponse.model_validate(resp.json())
 
+    async def diagnose(
+        self,
+        error_text: str,
+        *,
+        error_type: str | None = None,
+        limit: int = 5,
+        namespace: str | None = None,
+        user_id: str | None = None,
+    ) -> DiagnoseResponse:
+        """Failure lessons matching an error — 'here's how this failed before'."""
+        req = DiagnoseRequest(
+            error_text=error_text,
+            error_type=error_type,
+            limit=limit,
+            namespace=namespace,
+            user_id=user_id,
+        )
+        resp = await self._client.post("/v1/diagnose", json=req.model_dump(exclude_none=True))
+        raise_for_status(resp)
+        return DiagnoseResponse.model_validate(resp.json())
+
+    async def memory_health(
+        self, namespace: str | None = None, stale_threshold_days: int = 30
+    ) -> MemoryHealthResponse:
+        """Per-namespace memory hygiene: staleness, contradictions, promotion candidates."""
+        params: dict[str, Any] = {"stale_threshold_days": stale_threshold_days}
+        if namespace is not None:
+            params["namespace"] = namespace
+        resp = await self._client.get("/v1/memory/health", params=params)
+        raise_for_status(resp)
+        return MemoryHealthResponse.model_validate(resp.json())
+
     async def capabilities(self) -> CapabilitiesResponse:
         resp = await self._client.get("/v1/capabilities")
         raise_for_status(resp)

{minima_cli-0.12.3 → minima_cli-0.13.0}/docs/BigPlan/inline-ux-guide.md

@@ -57,22 +57,57 @@ One MP at a time, in this loop:
 > (CSI 3 J) and wipes all `<Static>` scrollback. `app.tsx:3600`. Every panel height in this
 > guide is derived from this.
 
-**Prompt placement (THE RULE, added 2026-07-16)**
+**Prompt placement (THE RULE, added 2026-07-16; anchor ledger 2026-07-20)**
 
 - The prompt section (composer + status footer) is **mounted at the terminal bottom** — from
   frame 1 and permanently. Supersedes the earlier "render from the top (CC-style)" choice.
   Mechanism: a one-time `rows−1` newline reserve at startup (`main.ts`) seats the first
-  paint; a `minHeight = rows − SAFETY − Σ committed-row estimate` + `justifyContent:
-  flex-end` box around the live region keeps every later frame there until the transcript
-  outgrows the screen (then it is inert). The estimate is `computeMsgHeight` — conservative,
-  so the frame can only end at/above the bottom, never overflow toward the wipe threshold.
+  paint; the **anchor ledger** (`layout.ts nextLiveFrameHeight`, wired in `app.tsx`) keeps
+  every later frame there by giving the live box an EXPLICIT height satisfying
+  `H ≥ H_prev − K` (K = rows committed to `<Static>` this frame) and
+  `H ≤ rows − SCROLLBACK_SAFETY_ROWS`. log-update rewrites frames top-anchored, so the
+  floor keeps the frame bottom at/below the old bottom (terminal scroll re-pins it) across
+  EVERY shrink path — perm/question teardown, busy teardown, stream commits, panel close —
+  and the inequalities telescope across Ink's 32ms write throttle. The cap is structural:
+  Ink's wipe threshold reads the root's Yoga height and `<Static>` is position-absolute
+  (excluded), so our own frames can never reach `rows`. Estimate errors degrade to
+  transient flex-end padding (over-count) or a top-clip under `overflow="hidden"`
+  (under-count) — never a strand, never a wipe. Resets: a `<Static>` remount (/clear,
+  rewind, resume) seeds content-sized; a resize seeds one full-height frame that re-anchors
+  within `SCROLLBACK_SAFETY_ROWS` (exact again at the next commit) — including after Ink's
+  one unavoidable old-tree-vs-new-rows resize wipe. The pre-ledger estimate-decay
+  `minHeight` survives behind `MINIMA_TUI_ANCHOR_LEGACY=1` until the ledger has soaked.
+- **Boot resets inherited scroll margins** (`CSI r` + `CSI ?69l` lead the clear write,
+  `main.ts`; root-caused live 2026-07-20, evidence in `shots/anchor-ledger/stale-margins/`):
+  a prior CLI that pinned its UI with DECSTBM and died uncleanly leaves the region in the
+  window forever — margins survive `2J`/`3J`/`H` and resizes, imprison the newline reserve
+  (DSR reported row 24 of 60 after 59 newlines), and seat the composer mid-screen with the
+  ledger faithfully preserving the bad seat. The mount deliberately does NOT cap-seed as a
+  defense (tried, PNG-refuted: it parks early turns at the screen top, 40+ rows from the
+  composer) — the reserve stays the seat, made trustworthy by the margin reset. PTY
+  regression: `tui_verify.sh` scenario `stale-margins`. Field diagnosis:
+  `MINIMA_TUI_DEBUG_ANCHOR=<file>` (reserve line + per-render ledger line + stdout/stderr
+  write-tap + `<file>.raw` byte dump + a DSR cursor probe) and
+  `scripts/real_term_capture.sh` (AppleScript-driven REAL iTerm2/Terminal.app captures —
+  pyte has no pending-wrap and cannot stand in for a real emulator at exact-width rows).
 - **`<Static>` must never sit under a flex-end ancestor** — it is position-absolute in Ink,
   and a flex-end parent offsets it past its own render canvas: committed messages silently
-  clip to nothing. It mounts on the flex-start root, the flex-end box is its sibling.
-- Enforced (not guidance): `render-buffer.test.ts` source pins + `tui-verify`'s
-  `bottom-anchor` check (settled PTY frames must have content within 1 row of the grid
-  bottom; wired on the echo + modes scenarios). D3b's height math (`rows − footerChrome`)
-  builds on this rule.
+  clip to nothing. It mounts on the flex-start root, the ledger box is its sibling. Inside
+  the ledger box the content sits in a `flexShrink={0}` wrapper — Yoga's default shrink
+  would compress children into the fixed height instead of top-clipping them.
+- Every conditional live element must be booked in `contentRows` (pickers via colocated
+  max-row constants, banner via `BANNER_TAGLINES`, stream tail via `markdownBodyHeight`) —
+  an unbooked element top-clips. And every per-line markdown render branch armors empty
+  text (`|| " "`): Ink collapses an empty `<Text>` to ZERO rows while the ruler counts ≥1
+  per source line — that divergence alone floated the composer 6 rows on blank-line-heavy
+  replies (the wide-terminal stream-commit float).
+- Enforced (not guidance): `render-buffer.test.ts` + `anchor-ledger.test.ts` source pins,
+  the simulated log-update property test (`anchor-ledger.test.ts`), and `tui-verify`'s
+  `bottom-anchor` checks at **slack 1** (echo, modes, tasks-footer, panel-toc, both stream
+  scenarios, overlay-anchor, panel-early, big-200x50; slack 2 on plan-council and the
+  post-resize window of resize-reanchor). Before/after evidence:
+  `docs/BigPlan/shots/anchor-ledger/`. D3b's height math (`rows − footerChrome`) builds on
+  this rule.
 
 **Panel system (D3)**
 
@@ -341,9 +376,12 @@ zero extra `3J`, last grid row blank across every settled panel frame, perf medi
 `panelOuterHeight()` + `PANEL_STATUS_ROWS` in layout.ts, explicit heights + truncate rows +
 suppressed footer extras ⇒ frame ≡ rows−2. One real finding: **panel close over a long
 transcript stranded the composer at the screen top** (log-update rewrites the shrunken
-frame at the old top; bottomMountMinRows was inert). Fixed by `closePanelReseat` — closing
-moves the static-estimate basis to the current message count, so THE RULE's decay restarts
-from a fresh screen; pinned by the scenario's post-close bottom-anchor. Also learned: Ink
+frame at the old top; bottomMountMinRows was inert). Fixed at the time by
+`closePanelReseat` — closing moved the static-estimate basis so THE RULE's decay restarted
+from a fresh screen; since 2026-07-20 the anchor ledger (§2) subsumes this for free (the
+panel frame IS the rows−2 identity, so the close floor keeps a full-height frame that
+decays per commit — the basis reset survives only behind `MINIMA_TUI_ANCHOR_LEGACY=1`);
+pinned by the scenario's post-close bottom-anchor. Also learned: Ink
 delivers coalesced stdin as ONE input string — `panelReduce` iterates characters, so key
 storms and `gg` both work regardless of chunking. `tui_assert.py` gained `--before` (frame
 windows that must exclude the post-exit state).
@@ -633,13 +671,18 @@ content would be erased (not scrolled) on the next commit, corrupting scrollback
 fix is the two-line inversion: tear the live stream down FIRST, then commit — the shrink is
 erased in place and the static print scrolls the reply in above the short frame (CC's
 post-reply look; reply tail visible, composer on the bottom rows, zero-wipe intact).
-Residual, documented: at turn end the busy row's teardown (2 rows) shrinks the saturated
-frame once more, floating the frame ~2 rows — cosmetic, self-heals at the next commit, and
-generic to any saturated late shrink (not stream-specific); deferred. The stream gates
-therefore assert `bottom-anchor --bottom-slack 3` (the strand class this kills was 19 rows;
-pre-fix lowest content row 16/36). Gates: `stream-wipe-perf` + `stream-code-80/60` now carry
-bottom-anchor; evidence `shots/mp20-stream-reseat/` (capture.sh re-runs the MP10 stream shot
-and asserts) vs before `shots/mp10-render-audit/stream-code.*`.
+Residual, documented at the time: at turn end the busy row's teardown (2 rows) shrank the
+saturated frame once more — the "generic to any saturated late shrink" class this deferred.
+**Resolved 2026-07-20 by the anchor ledger** (§2): the ledger's floor absorbs every
+saturated late shrink as in-frame padding — busy teardown, perm/question teardown, and the
+wide-terminal stream commit where the reply wraps to FEWER rows than the stream-frame
+shrink (a case the commit-order inversion alone could not fix; before-evidence
+`shots/anchor-ledger/`: low row 42/50 sustained at 200×50). The MP20 ordering stays as UX
+(reply tail adjacent to the composer — the fence-verbatim gates), demoted from correctness.
+The stream gates now assert `bottom-anchor --bottom-slack 1` (were 3). Gates:
+`stream-wipe-perf` + `stream-code-80/60` + `big-200x50`; evidence
+`shots/mp20-stream-reseat/` (the MP20 state) and `shots/anchor-ledger/` (before/after the
+ledger) vs `shots/mp10-render-audit/stream-code.*` (the original strand).
 
 ---
 
@@ -820,6 +863,34 @@ re-issue — per-session, use fresh sessions or the Shift+Tab gate for repeats).
 gate + Esc-stays + cancel discards); behavior pins migrated to the new registration +
 handler. Shots: `shots/mp17-plan-exit/`.
 
+**AMENDMENT (user decision, 2026-07-20): Shift+Tab is a SILENT clean exit — the chord
+never opens the gate.** Claude Code parity: the ring just advances (build → accept-edits →
+plan → build, bypass when enabled), leaving plan mode discards any live council session via
+the mode-exit cleanup effect (transcript notice; the discard aborts the council — a council
+cannot outlive its session) and a PLAIN streaming turn is left to finish (non-disruptive
+switch; the chord never calls `agent.abort()`). Plan APPROVAL lives ONLY in the `exit_plan`
+tool and `/plan finalize` — the 3-option overlay on the chord, the `planTurnSeenRef`
+fast-path, and `requestPlanExitGate` are deleted. Mid-turn exits defer `exit_plan`'s
+unregistration to the turn's end (retire-list swept in the turn's `finally`; `isActive()`
+answers a late call with a graceful "not active") so a turn that advertised the tool never
+hits an unknown-tool error. The ring's plan→bypass sacrifice note above still holds. Gate:
+`plan-exit-gate` scenario re-pinned (tool overlay + approve; Shift+Tab = silent exit, fluid
+ring, the gate text must never appear on the chord).
+
+**Same-day amendments (user decisions, 2026-07-20) — CC permission parity across the ring:**
+(1) **Plan mode DENIES mutations** — write/edit/bash/apply_patch (+todowrite/task per the
+GT blocklist) are blocked at the dispatcher with the exit_plan-steering reason and a
+`mode-deny` guard event; the B2 ask-every-time flow is gone (PLAN_BUNDLE mirrors `deny`;
+the `ask` action stays in the policy grammar). GT-off block reasons also steer to
+exit_plan — the universal gate registers GT on or off, so "Use /plan to exit" was stale.
+(2) **The exit_plan gate is 4 options in CC's ExitPlanMode order**: Finalize &
+auto-accept edits (lands the mode on accept-edits) / Finalize & build / Revise / Cancel —
+same finalize path, only the landing mode differs. (3) **accept-edits auto is cwd-scoped**
+(`editTargetsWithinCwd`): write/edit targets and every apply_patch Add/Update/Delete/
+Move-to path must resolve inside the project dir, else the call keeps the normal prompt
+flow; the Shift+Tab-over-overlay auto-resolve applies the same check via the prompt's raw
+args (no args ⇒ fail safe, prompt stays). Bypass remains unscoped by definition.
+
 ### MP18 — Verify-command consent at first run *(M · after MP9 recommended)*
 
 **Goal:** LLM-authored `verify` shell gets bash-class scrutiny (not trust-the-gate, not
@@ -865,6 +936,24 @@ gate rows: unrunnable without the env, verified with it); `verify-consent.test.t
 runCheck sites, mutation-dodge, library default, env checker). Shots:
 `shots/mp18-verify-consent/`.
 
+**Follow-ups (user acceptance, 2026-07-21):** three fixes from the first live run of the
+CC-parity ring. (a) **Gate blocks render as `⊘ verify gate — completion blocked, statuses
+unchanged:`** (yellow, body uncolored) instead of the red `⚙ todowrite:` error styling — an
+approved-then-gate-blocked todowrite read as "Enter cancelled my todowrite" when it was the
+done-gate refusing unverified completion flips; `isGateBlockReason` (ground_truth.ts,
+prefix-keyed on the three block families) is the renderer's signature, so replayed sessions
+get the same treatment. (b) **Enter on the permission overlay is pinned as ACCEPT** ("Yes
+once") — it always was; now `behavior.test.ts` pins return-in-the-allow-branch and the
+`overlay-anchor` scenario approves with `<CR>` alone. (c) **Bash `[a]` became a persisted
+per-command-family grant** — "Always allow `pip` commands" (leading word per compound
+segment, substitution never analyzed, all-families-granted or prompt), stored per project
+in `~/.minima-harness/perm-grants.json` (perm_grants.ts) so a granted family never re-asks
+across sessions; unanalyzable commands keep the whole-tool session grant. The MP18
+session-only rule STANDS for verify consent: approved verify strings still never touch
+disk — the persisted store holds bash command families only. accept-edits itself stays CC
+parity (bash prompts; the user chose persisted grants over mode-scoped auto-bash).
+Scenario: `bash-grants`.
+
 ### MP19 — Final E2E acceptance demo *(M/L · last)*
 
 **Goal:** the whole story, proven — J1's demo intent, re-scoped to this guide.
@@ -884,8 +973,9 @@ green→milestone → `/v1/feedback` captured with realized usage → `buildGtOv
 `whyText` evidence, all with the STRICT consent checker installed) and once through a real
 PTY (`tui_verify.sh` scenario `acceptance`, 42s, ordered-beat asserts + zero-wipe +
 no-mouse + perf budgets): `/plan start` → council line ticking (MP14) → planner reply →
-Ctrl+G `plan (draft)` (MP16) → Shift+Tab exit gate approves (MP17; finalize via the mock's
-RESOLVE/GT answers seeds the single-step plan + its verify consent, MP18) → `PLANDEMO`
+Ctrl+G `plan (draft)` (MP16) → `/plan finalize` approves (amended 2026-07-20 with the
+silent-exit chord — the MP17 gate rides `exit_plan`/`/plan finalize` only; finalize via the
+mock's RESOLVE/GT answers seeds the single-step plan + its verify consent, MP18) → `PLANDEMO`
 executes phase-scripted: in_progress todowrite (permission overlay shows the verify;
 baseline red) → completing while red → **the done-gate blocks** → `write` fixes → completing
 again → **red→green verified, plan closes** (milestone) → Ctrl+T shows the section's

minima_cli-0.13.0/docs/BigPlan/shots/anchor-ledger/README.md

@@ -0,0 +1,45 @@
+# Anchor-ledger evidence — bottom-anchor defect class (reported 2026-07-20)
+
+> **Status: FIXED.** After-evidence (post anchor-ledger + empty-line armor) below — every
+> scenario bottom-anchored, zero unexpected wipes.
+
+User report: composer/status/footer float mid-screen with dead rows below (both iTerm2 and
+Terminal.app, dev build + brew, ~200×50 terminal); after an Ink overflow wipe the whole UI
+sits squeezed in the top of the screen; giant blank gaps inside the live region.
+
+`capture-specs.sh [before|after]` drives the matrix in a real PTY against the committed mock
+provider (same pattern as tui_verify.sh). Classification per capture: `ESC[3J` count == 1
+plus a bottom-anchor FAIL ⇒ **float class** (frame shrink log-update never compensates);
+count > 1 ⇒ **wipe class** (live frame reached `rows`, Ink clearTerminal destroyed the
+scrollback). raw.bin streams are not committed — re-run the script to regenerate.
+
+## before (pre-fix, main @ 3bfd040)
+
+| scenario | wipes | bottom-anchor | finding |
+|---|---|---|---|
+| overlay-teardown (120×36) | 1 | FAIL — low row 32/36 at t=20.6 | perm-overlay teardown float over a saturated estimate |
+| overlay-teardown-200x50 | 1 | FAIL — low row 46/50 at t=20.6 | same, at the reporter's geometry; earlier runs also caught the wide-terminal stream-commit float (low 42/50 from t=10: at 200 cols the committed reply wraps to FEWER rows than the stream-frame shrink, so the MP20 commit-order fix alone cannot re-anchor) |
+| panel-early (120×36) | 1 | PASS | idle panel open/close on a short transcript self-anchors — closePanelReseat covers close; OPEN needs no reseat |
+| panel-stream (120×36) | 1 | PASS | always-panel (PR #186) over a live stream + Esc close self-anchors |
+| resize-shrink (40→32 rows) | 1 | FAIL — low row 28/32, PERMANENT (no output after t=9.1) | the app repaints once at the new size and never re-anchors |
+| resize-panel-wipe (panel open, 40→32) | **2** | recovers only via the panel-close reseat | Ink re-renders the old 38-row frame against 32 rows → clearTerminal wipe, scrollback destroyed |
+
+The 200×50 before-run also exposed the root of the wide-terminal float: the mock CODE
+reply carries 6 blank separator lines that `markdownBodyHeight` books as rows while Ink
+collapses each empty `<Text>` to ZERO rows — a 6-row estimate-over-print divergence at any
+width (fixed by the empty-line armor in messages.tsx; pinned in anchor-ledger.test.ts).
+
+## after (anchor ledger + empty-line armor)
+
+| scenario | wipes | bottom-anchor |
+|---|---|---|
+| overlay-teardown (120×36) | 1 | PASS (slack 2) |
+| overlay-teardown-200x50 | 1 | PASS whole-run (slack 2) — incl. the stream commits and the perm teardown |
+| panel-early (120×36) | 1 | PASS (slack 1) |
+| panel-stream (120×36) | 1 | PASS (slack 1) |
+| resize-shrink (40→32 + follow-up turn) | 1 | PASS — post-resize within slack 2, exact (slack 1) after the next commit |
+| resize-panel-wipe (panel open, 40→32) | 2 (Ink's unavoidable resize wipe) | PASS (slack 2) — the ledger's cap-seeded reset recovers instead of staying top-stuck |
+
+Durable gates: tui_verify.sh scenarios `overlay-anchor`, `panel-early`, `resize-reanchor`,
+`big-200x50`, plus stream slacks tightened 3→1 and a plan-council ChildTree-teardown
+window. Unit pins: `tests/anchor-ledger.test.ts`.