fix(ci): green main's Lint and unblock the 0.9.14 release gates

Four gates that main currently fails. All four are advisory on pull
requests (`continue-on-error: ${{ github.event_name == 'pull_request' }}`)
and **fatal on push**, which is why `Lint` has been red on main since
04:08Z while every PR rollup looked green — CI runs 35054467418,
35054908721 and 35050587333 all failed `Lint` on exactly these.

1. Blocking-call budget: `crates/tui/src/tools/shell.rs` std_fs 2 -> 3.
   #6208's Q6 (e522e4f93c) replaced `if !path.exists()` with
   `std::fs::metadata(&path)` in `load_default_policy`. The checker counts
   the textual `std::fs::` form, so an equivalent stat that was previously
   uncounted became counted. Net blocking work went *down*: the same call
   now also carries the cache key that removed a full read plus TOML parse
   and regex recompile from every shell execution. `load_default_policy` is
   a synchronous fn, so the site cannot move to `spawn_blocking` without
   restructuring its callers — this is the "raise the budget if the site
   can only run on synchronous code" case the checker names.

2. Runtime contract budget: Act/Operate full catalogs gain `session_get`
   and `session_search` (50 -> 52 tools). #5715 (eefdcb42f5) added them
   as bounded read-only workspace-scoped recall. `--update` deliberately
   refuses identity changes, so this is the explicit maintainer edit the
   `_comment` history calls for, with a note appended in that style. Plan
   full is unchanged — the session tools are not offered there.

3. Feature release-note receipts: seven feature commits since v0.9.13
   referenced six issues with no changelog entry, which is advisory in PR
   CI but **blocking on every release path** (check-versions.sh:33-38).
   Added entries for #5715, #6099, #6035 (Added) and #6033, #6085
   (Changed), and attached #6151 to the two edit-gating entries whose
   commits carry that reference.

4. The `[Unreleased]` compare link still pointed at v0.9.12; check-versions
   only validates the link for the current workspace version, so it went
   unnoticed across a release.

Verification on this machine (macOS aarch64, source 55a9e1b778):

  [runtime-contract-budget] PASS: all 55 metrics are exactly at budget.
  blocking-call budget: 626 sites across 181 files, within budget
  Feature release-note receipts OK: 16 linked issue reference(s) checked
    in v0.9.13..HEAD.
  Version state OK: workspace=0.9.13, npm=0.9.13, npm-binary=0.9.13,
    lockfile in sync.
  Ran 19 tests in 0.015s OK   (test_check_runtime_contract_budget.py)
  Ran 3 tests in 0.000s OK    (test_measure_runtime_contract.py)

Not verified here: the runtime-contract byte/token ceilings are measured
from macOS. The `_comment` history records that macOS measurements have
under-counted before and had to be re-locked from a Linux Lint run
(2026-09-13, after b4d48e9a4). If CI's Lint reports numeric drift on these
values, re-lock them from that run rather than re-measuring locally; the
name-set identities and digests are host-independent and will not move.

Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

CHANGELOG.md

@@ -28,10 +28,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   parsed *before* and would not parse *after* — repairing an already-broken
   file is the commonest reason to edit source at all, so pre-existing breakage
   and new files fail open. The check precedes the write, so a rejection leaves
-  the file untouched and `apply_patch` cannot half-apply (#6204, #6206).
+  the file untouched and `apply_patch` cannot half-apply (#6204, #6206, #6151).
 - Rust files that were already `rustfmt`-clean are re-normalized after an edit,
   so the next patch's anchors still match. Hand-formatted files are never
-  rewritten, and every failure path skips and lets the edit land (#6205).
+  rewritten, and every failure path skips and lets the edit land (#6205, #6151).
 - Native clients can finish provider setup without dropping to the CLI:
   `DELETE /v1/providers/{id}/key` clears a Codewhale-owned credential through
   the same shared owner as `codewhale auth clear`, and `GET /v1/providers`
@@ -60,9 +60,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   symlinks are never followed. A saved session's oversized tool outputs are
   served as artifacts at `GET /v1/sessions/{id}/artifacts` and
   `GET /v1/sessions/{id}/artifacts/{artifact_id}`. (#6163)
+- A session that ended mid-turn is no longer invisible to the model. The newest
+  workspace-scoped session still holding a crash-recovery checkpoint is
+  surfaced as a one-line `## Prior Session` notice in the session-pinned prompt
+  prefix — metadata reads only, excluding the live session and any session this
+  process instance created. Clean sessions get no block, so their prefix bytes
+  are unchanged. Two bounded read-only tools, `session_search` and
+  `session_get`, give the model workspace-scoped recall over the same store
+  (one-line summaries and an 8-message tail, labeled untrusted user data, read
+  on the blocking pool). Resuming stays the user's decision: the hint tells the
+  model to offer a continuation, never to silently take one (#5715).
+- `codewhale exec --hooks` opts a headless run into the same `HookExecutor` the
+  TUI builds — global config, reviewed plugin snapshots, and trusted project
+  `hooks.toml`. Headless runs previously fired no hooks at all. `tool_call_before`
+  can still deny and `shell_env` still applies; a hook `ask` resolves
+  fail-closed without a terminal. Fleet worker subprocesses never opt in, and
+  `permissions.toml` typed rules are unchanged (#6099).
+- `codewhale doctor` flags fleet and profile model pins that the provider's own
+  roster no longer offers. A pin is reported only when a *fresh* cached live
+  roster for that exact route exists and omits it — stale, failed, or absent
+  rosters prove nothing and are counted as `unverifiable` rather than raising a
+  false warning. Each row names the route and every owner of the pin; the pin
+  is surfaced, never rewritten (#6035).
 
 ### Changed
 
+- Configured MCP servers now connect lazily instead of all at session boot. The
+  pool owns a `connecting` set marked at spawn and cleared on resolution or
+  abort, so "connecting" is no longer inferred as enabled-minus-connected. The
+  boot pass scopes to the eager set — `required` servers plus those covered by
+  `tools.always_load` / `allowed_tools` — and a turn naming an unstarted server
+  spawns its connects alongside, under the existing five-second deadline. A
+  configured-but-unstarted server now reads as configured on every surface
+  (session-boot rows, Extensions tab, launch card), never as connecting.
+  `docs/MCP.md` documents the lifecycle (#6033).
+- The launch card's MCP problems row runs its own remedy. It already printed
+  `/mcp login <name>` or `/mcp`; it now joins the shared paint/click/keyboard
+  ordering, so Up/Down lands on it and Enter or a click types the printed
+  command into the composer for you to send. Typing beats copying: no clipboard
+  dependency over SSH, and you see the command before a second Enter runs it
+  (#6085).
+
 - Computer Use is the only computer-use product in Extensions and
   `/mcp recommendations`. Cua is no longer suggested as a parallel
   desktop-control MCP; enable the first-party `computer-use` plugin
@@ -8747,7 +8785,7 @@ overflow report and `/theme` picker edge-wrapping patch in #1814.
 
 Older releases (v0.8.39 and earlier) are archived in [docs/CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md).
 
-[Unreleased]: https://github.com/Hmbown/CodeWhale/compare/v0.9.12...HEAD
+[Unreleased]: https://github.com/Hmbown/CodeWhale/compare/v0.9.13...HEAD
 [0.9.13]: https://github.com/Hmbown/CodeWhale/compare/v0.9.12...v0.9.13
 [0.9.12]: https://github.com/Hmbown/CodeWhale/compare/v0.9.11...v0.9.12
 [0.9.11]: https://github.com/Hmbown/CodeWhale/compare/v0.9.10...v0.9.11

crates/tui/CHANGELOG.md

@@ -28,10 +28,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   parsed *before* and would not parse *after* — repairing an already-broken
   file is the commonest reason to edit source at all, so pre-existing breakage
   and new files fail open. The check precedes the write, so a rejection leaves
-  the file untouched and `apply_patch` cannot half-apply (#6204, #6206).
+  the file untouched and `apply_patch` cannot half-apply (#6204, #6206, #6151).
 - Rust files that were already `rustfmt`-clean are re-normalized after an edit,
   so the next patch's anchors still match. Hand-formatted files are never
-  rewritten, and every failure path skips and lets the edit land (#6205).
+  rewritten, and every failure path skips and lets the edit land (#6205, #6151).
 - Native clients can finish provider setup without dropping to the CLI:
   `DELETE /v1/providers/{id}/key` clears a Codewhale-owned credential through
   the same shared owner as `codewhale auth clear`, and `GET /v1/providers`
@@ -60,9 +60,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   symlinks are never followed. A saved session's oversized tool outputs are
   served as artifacts at `GET /v1/sessions/{id}/artifacts` and
   `GET /v1/sessions/{id}/artifacts/{artifact_id}`. (#6163)
+- A session that ended mid-turn is no longer invisible to the model. The newest
+  workspace-scoped session still holding a crash-recovery checkpoint is
+  surfaced as a one-line `## Prior Session` notice in the session-pinned prompt
+  prefix — metadata reads only, excluding the live session and any session this
+  process instance created. Clean sessions get no block, so their prefix bytes
+  are unchanged. Two bounded read-only tools, `session_search` and
+  `session_get`, give the model workspace-scoped recall over the same store
+  (one-line summaries and an 8-message tail, labeled untrusted user data, read
+  on the blocking pool). Resuming stays the user's decision: the hint tells the
+  model to offer a continuation, never to silently take one (#5715).
+- `codewhale exec --hooks` opts a headless run into the same `HookExecutor` the
+  TUI builds — global config, reviewed plugin snapshots, and trusted project
+  `hooks.toml`. Headless runs previously fired no hooks at all. `tool_call_before`
+  can still deny and `shell_env` still applies; a hook `ask` resolves
+  fail-closed without a terminal. Fleet worker subprocesses never opt in, and
+  `permissions.toml` typed rules are unchanged (#6099).
+- `codewhale doctor` flags fleet and profile model pins that the provider's own
+  roster no longer offers. A pin is reported only when a *fresh* cached live
+  roster for that exact route exists and omits it — stale, failed, or absent
+  rosters prove nothing and are counted as `unverifiable` rather than raising a
+  false warning. Each row names the route and every owner of the pin; the pin
+  is surfaced, never rewritten (#6035).
 
 ### Changed
 
+- Configured MCP servers now connect lazily instead of all at session boot. The
+  pool owns a `connecting` set marked at spawn and cleared on resolution or
+  abort, so "connecting" is no longer inferred as enabled-minus-connected. The
+  boot pass scopes to the eager set — `required` servers plus those covered by
+  `tools.always_load` / `allowed_tools` — and a turn naming an unstarted server
+  spawns its connects alongside, under the existing five-second deadline. A
+  configured-but-unstarted server now reads as configured on every surface
+  (session-boot rows, Extensions tab, launch card), never as connecting.
+  `docs/MCP.md` documents the lifecycle (#6033).
+- The launch card's MCP problems row runs its own remedy. It already printed
+  `/mcp login <name>` or `/mcp`; it now joins the shared paint/click/keyboard
+  ordering, so Up/Down lands on it and Enter or a click types the printed
+  command into the composer for you to send. Typing beats copying: no clipboard
+  dependency over SSH, and you see the command before a second Enter runs it
+  (#6085).
+
 - Computer Use is the only computer-use product in Extensions and
   `/mcp recommendations`. Cua is no longer suggested as a parallel
   desktop-control MCP; enable the first-party `computer-use` plugin

scripts/check-blocking-calls-budget.json

@@ -344,7 +344,7 @@
     "std_fs": 1
   },
   "crates/tui/src/tools/shell.rs": {
-    "std_fs": 2,
+    "std_fs": 3,
     "thread_sleep": 1
   },
   "crates/tui/src/tools/shell/tests.rs": {

scripts/runtime-contract-budget.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "One-way numeric ceilings and exact structural identities for the provider-free runtime contract. Decreases pass; increases or identity changes fail. Lock in decreases with: python3 scripts/check-runtime-contract-budget.py --update The v0.9.8 child-receipt restore grew every production tool surface by 1496 schema bytes / 374 estimated tokens (agent tool). The v0.9.8 workshop read/tool-result byte fields then grew every production tool surface by 371 schema bytes / 93 estimated tokens. Both raises are explicit maintainer decisions; identities stay on the pre-raise digests only if the name set is unchanged — re-measure on Linux CI if Lint reports identity drift. The v0.9.8 pinned session prefix added the <context_update> sentence to the base prompt (5848 -> 6084 bytes, every representative stage re-hashed), and the host-side Workflow/Goal verbs plus honest child posture grew the tool catalog (active 16531 -> 16602 bytes, full 71473 -> 72371); both are explicit v0.9.8 maintainer decisions measured from the release train. The v0.9.9 configured-skills change hides only custom configured-root paths, preserves discoverable default-root paths, normalizes Windows prompt separators, and trims 50 redundant skills-prompt bytes. The skill/memory/goal/handoff identities were re-measured without raising any ceiling. Explicit maintainer decision for #5473/#5492. The v0.9.10 full surfaces intentionally add the safe read_media tool; their measured schemas remain below the prior byte/token ceilings. Representative prompt byte metrics now use the same host-independent normalized text as their identities; the normalized base is 6089 bytes. The v0.9.11 model-visible sub-agent surface intentionally retires six legacy agents/* tools in favor of the canonical agent tool; all affected schema and prompt metrics decrease. The v0.9.12 plugin prompt-match slice intentionally adds the request_plugin_install tool to the full tool surfaces (plan full: +518 schema bytes / +130 estimated tokens / 29 -> 30 tools) so a strong prompt match can surface the human review CTA; explicit maintainer decision for #5663/#5579. The v0.9.13 profile pins a non-executed bare bash shell so interpreter guidance is reproducible across hosts. The duplicate tts catalog entry is intentionally hidden; speech remains canonical and the alias remains available for saved-transcript dispatch. Explicit v0.9.13 maintainer decision (2026-09-08): after removing 1426 repeated guidance bytes and pinning the bash-v2 fixture, accept only the measured tool byte/token ceilings from all-features macOS source e27735bb63c897f88061c71567701fd971f5d396, verified libtest SHA-256 5e8cbe213f32c4ecdec63494c4de5e31857b4a40134edf7b21a55bca926b1b38: active 13274/3319 in every mode, Plan full 39885/9972, Act/Operate full 67603/16901, with no margin. Against the prior budget, active +390 bytes is agent -41 plus retained bash command syntax +431. Plan full also retains Git commit_plan +253, update_goal progress +583, github bounded local-report guidance +127, review complete-input refusal +35, and send_later dispatching status +14. Act/Operate full instead has github +2151 and additionally speech +230, hidden tts -2120, and tasks/automation exact model-route fields +274 each. The older budget predates v0.9.12: that tag had already removed 361 agent bytes and added the two 274-byte route fields; the retained initial increase versus the tag is 751 source-attributed bytes (agent +320, bash +431), not the +390 budget delta. Only the seven active definitions form the initial request; full catalogs include deferred tools. Estimated tokens use the existing bytes/4 heuristic, not provider usage or billing. Prompt, representative-context, skill-discovery and tool-name identities/ceilings are unchanged. Explicit v0.9.13 maintainer decision (2026-09-09): source ccc5dadfa2279545bf084d37cff3617e41ceaae2 intentionally exposes create_goal, get_goal and update_goal before continuation, so all three initial surfaces now contain ten tools. Measure exact source 4648d148eea64782be857eda6952af2c539cbfcc with the hosted macOS all-features libtest SHA-256 4485c88c7a8b66b8bb9a135807321e417a1e266457ecb74cffc7dfb92f850fc4: four exact provider-free metric tests pass. Active schemas are exactly 17847 bytes / 4462 estimated tokens (+4573 / +1143 for the three eager goal definitions); Plan full is 40597 / 10150 and Act/Operate full is 68315 / 17079, with no margin. The +712 full-catalog bytes are request_user_input guidance +358, update_goal state-change guidance +98, list_dir home-relative path guidance +56, explicit review max_passes schema +197, and three defer_loading true-to-false values +3. The three active name sets/digests, their counts, and measured active/full byte/token ceilings change; full name identities and all prompt, representative-context and skill-discovery measurements remain unchanged. This updates the earlier seven-tool initial-request receipt; bytes/4 remains an estimate, not measureLine truncated
+  "_comment": "One-way numeric ceilings and exact structural identities for the provider-free runtime contract. Decreases pass; increases or identity changes fail. Lock in decreases with: python3 scripts/check-runtime-contract-budget.py --update The v0.9.8 child-receipt restore grew every production tool surface by 1496 schema bytes / 374 estimated tokens (agent tool). The v0.9.8 workshop read/tool-result byte fields then grew every production tool surface by 371 schema bytes / 93 estimated tokens. Both raises are explicit maintainer decisions; identities stay on the pre-raise digests only if the name set is unchanged — re-measure on Linux CI if Lint reports identity drift. The v0.9.8 pinned session prefix added the <context_update> sentence to the base prompt (5848 -> 6084 bytes, every representative stage re-hashed), and the host-side Workflow/Goal verbs plus honest child posture grew the tool catalog (active 16531 -> 16602 bytes, full 71473 -> 72371); both are explicit v0.9.8 maintainer decisions measured from the release train. The v0.9.9 configured-skills change hides only custom configured-root paths, preserves discoverable default-root paths, normalizes Windows prompt separators, and trims 50 redundant skills-prompt bytes. The skill/memory/goal/handoff identities were re-measured without raising any ceiling. Explicit maintainer decision for #5473/#5492. The v0.9.10 full surfaces intentionally add the safe read_media tool; their measured schemas remain below the prior byte/token ceilings. Representative prompt byte metrics now use the same host-independent normalized text as their identities; the normalized base is 6089 bytes. The v0.9.11 model-visible sub-agent surface intentionally retires six legacy agents/* tools in favor of the canonical agent tool; all affected schema and prompt metrics decrease. The v0.9.12 plugin prompt-match slice intentionally adds the request_plugin_install tool to the full tool surfaces (plan full: +518 schema bytes / +130 estimated tokens / 29 -> 30 tools) so a strong prompt match can surface the human review CTA; explicit maintainer decision for #5663/#5579. The v0.9.13 profile pins a non-executed bare bash shell so interpreter guidance is reproducible across hosts. The duplicate tts catalog entry is intentionally hidden; speech remains canonical and the alias remains available for saved-transcript dispatch. Explicit v0.9.13 maintainer decision (2026-09-08): after removing 1426 repeated guidance bytes and pinning the bash-v2 fixture, accept only the measured tool byte/token ceilings from all-features macOS source e27735bb63c897f88061c71567701fd971f5d396, verified libtest SHA-256 5e8cbe213f32c4ecdec63494c4de5e31857b4a40134edf7b21a55bca926b1b38: active 13274/3319 in every mode, Plan full 39885/9972, Act/Operate full 67603/16901, with no margin. Against the prior budget, active +390 bytes is agent -41 plus retained bash command syntax +431. Plan full also retains Git commit_plan +253, update_goal progress +583, github bounded local-report guidance +127, review complete-input refusal +35, and send_later dispatching status +14. Act/Operate full instead has github +2151 and additionally speech +230, hidden tts -2120, and tasks/automation exact model-route fields +274 each. The older budget predates v0.9.12: that tag had already removed 361 agent bytes and added the two 274-byte route fields; the retained initial increase versus the tag is 751 source-attributed bytes (agent +320, bash +431), not the +390 budget delta. Only the seven active definitions form the initial request; full catalogs include deferred tools. Estimated tokens use the existing bytes/4 heuristic, not provider usage or billing. Prompt, representative-context, skill-discovery and tool-name identities/ceilings are unchanged. Explicit v0.9.13 maintainer decision (2026-09-09): source ccc5dadfa2279545bf084d37cff3617e41ceaae2 intentionally exposes create_goal, get_goal and update_goal before continuation, so all three initial surfaces now contain ten tools. Measure exact source 4648d148eea64782be857eda6952af2c539cbfcc with the hosted macOS all-features libtest SHA-256 4485c88c7a8b66b8bb9a135807321e417a1e266457ecb74cffc7dfb92f850fc4: four exact provider-free metric tests pass. Active schemas are exactly 17847 bytes / 4462 estimated tokens (+4573 / +1143 for the three eager goal definitions); Plan full is 40597 / 10150 and Act/Operate full is 68315 / 17079, with no margin. The +712 full-catalog bytes are request_user_input guidance +358, update_goal state-change guidance +98, list_dir home-relative path guidance +56, explicit review max_passes schema +197, and three defer_loading true-to-false values +3. The three active name sets/digests, their counts, and measured active/full byte/token ceilings change; full name identities and all prompt, representative-context and skill-discovery measurements remain unchanged. This updates the earlier seven-tool initial-request receipt; bytes/4 remains an estimate, not measureLine truncated
   "document_kind": "codewhale.runtime_contract_budget",
   "representative_context": {
     "fixture_id": "representative-v1",
@@ -86,9 +86,9 @@
     "modes": {
       "act": {
         "active": {
-          "bytes": 31438,
+          "bytes": 31453,
           "identity_sha256": "cf523fcd7528ab2e14efffd7fe6b0916a370d6a8b8426d15a159aa823a7b86ce",
-          "tokens_est": 7860,
+          "tokens_est": 7864,
           "tool_names": [
             "agent",
             "bash",
@@ -105,9 +105,9 @@
           "tools": 11
         },
         "full": {
-          "bytes": 78513,
-          "identity_sha256": "1878fd9a724fc9645ff8ef827ad9f2b7124fd511d789e45d97e9d83a0cf866ff",
-          "tokens_est": 19629,
+          "bytes": 79531,
+          "identity_sha256": "1203d192385fd2b02227ef9e4212e5379bc5cbb813a373f12539406b5958aef1",
+          "tokens_est": 19883,
           "tool_names": [
             "Git",
             "Run",
@@ -141,6 +141,8 @@
             "revert_turn",
             "review",
             "send_later",
+            "session_get",
+            "session_search",
             "speech",
             "task_shell_start",
             "task_shell_wait",
@@ -160,14 +162,14 @@
             "workflow",
             "write"
           ],
-          "tools": 50
+          "tools": 52
         }
       },
       "operate": {
         "active": {
-          "bytes": 31438,
+          "bytes": 31453,
           "identity_sha256": "cf523fcd7528ab2e14efffd7fe6b0916a370d6a8b8426d15a159aa823a7b86ce",
-          "tokens_est": 7860,
+          "tokens_est": 7864,
           "tool_names": [
             "agent",
             "bash",
@@ -184,9 +186,9 @@
           "tools": 11
         },
         "full": {
-          "bytes": 78513,
-          "identity_sha256": "1878fd9a724fc9645ff8ef827ad9f2b7124fd511d789e45d97e9d83a0cf866ff",
-          "tokens_est": 19629,
+          "bytes": 79531,
+          "identity_sha256": "1203d192385fd2b02227ef9e4212e5379bc5cbb813a373f12539406b5958aef1",
+          "tokens_est": 19883,
           "tool_names": [
             "Git",
             "Run",
@@ -220,6 +222,8 @@
             "revert_turn",
             "review",
             "send_later",
+            "session_get",
+            "session_search",
             "speech",
             "task_shell_start",
             "task_shell_wait",
@@ -239,14 +243,14 @@
             "workflow",
             "write"
           ],
-          "tools": 50
+          "tools": 52
         }
       },
       "plan": {
         "active": {
-          "bytes": 31438,
+          "bytes": 31453,
           "identity_sha256": "cf523fcd7528ab2e14efffd7fe6b0916a370d6a8b8426d15a159aa823a7b86ce",
-          "tokens_est": 7860,
+          "tokens_est": 7864,
           "tool_names": [
             "agent",
             "bash",
@@ -263,9 +267,9 @@
           "tools": 11
         },
         "full": {
-          "bytes": 50801,
+          "bytes": 50816,
           "identity_sha256": "ac8af1f4988199825be7b00b054c258724a44074b1d4e6de6c92ade7c1cffe63",
-          "tokens_est": 12701,
+          "tokens_est": 12704,
           "tool_names": [
             "Git",
             "Web",