Move first-run usage disclosure into the native TUI, keep telemetry unarmed until the decision, and order all telemetry writes and delivery against persistent opt-out with fail-closed setup-state handling.
Replace the narrow wide-terminal rail with a responsive full-screen ocean canvas, preserve readable prose measure, and remove per-call padding inside grouped tool activity.
Verified with formatting, clippy, locale/version/budget gates, the 10,120-test TUI library suite, telemetry/config suites, focused UI/PTy coverage, and independent release/UI review. The sandbox-only loopback acceptance rerun remains explicitly environmental.
Agent assistance: Claude and Codex were used for implementation analysis and verification.
Three v0.9.5 benchmark tasks could not launch Codewhale at all:
mteb-leaderboard, mteb-retrieve, and pytorch-model-recovery run older ARM64
images, and the aarch64-unknown-linux-gnu artifact built on ubuntu-24.04-arm
requires GLIBC_2.39.
Release and nightly now build aarch64-unknown-linux-musl on the native ARM
runner, alongside the x64 musl build that has shipped since v0.8.65. Both
gain a static check (no ELF INTERP) plus a launch smoke on the matching
native runner, so a dynamically linked or non-starting binary fails the
build rather than the user's install. docs/INSTALL.md drops the arm64 glibc
floor section and describes the v0.9.6 matrix.
Also reconciles the copy the earlier commits invalidated: setup ratification
text and all 15 locales stop attributing execution doctrine to "mode
prompts", docs/MODES.md states Auto-Review's actual deterministic
allow/deny behavior, and the source-structure, dead-code, and
runtime-contract budgets are re-measured — the last locking down 25
decreased ceilings and the new mode-agnostic prompt-stage digests.
- turn_loop: a mid-stream chunk-timeout now counts toward the stream-error
budget (stall with nothing streamed retries transparently; an exhausted
budget fails the turn with the real reason instead of ending Completed
over a frozen block).
- idle engine: a finished background shell task wakes and starts an ordinary
runtime turn even without an active goal; a dead provider route claims the
completion once and reports where the output lives.
- subagent: over-budget final reports spill to a session artifact and the
truncation footer names the retrieve_tool_result ref; write failures
degrade to the honest no-ref footer. Test-only wrappers marked cfg(test).
- waits: agents/wait and agent action=wait default to 30 s and cap at 120 s
(blocked waits deafen the session; settled children report back as
sentinels). Bash action=wait honors timeout_secs/timeout aliases and
block; result metadata reports the real wait_timeout_ms.
- todo_write canonical naming: constructor is new(); work_update/TodoWrite/
todo stay hidden compat aliases; user-visible copy and docs updated.
- behavioral tips: DurableStateWritten fires on successful remember calls;
enum allow removed. voice.rs and work_surface model use let-chains.
- test: Windows path-separator tolerant artifact footer assertion.
- changelog: 0.9.4 additions (Agent Plugins v1.0.0, send_later, /advisor,
quiet mode, automation forms, resume_from, transport resilience,
durability, zh-Hant, update chip, RLM groundwork, stall/wake/truncation/
wait fixes). Dead-code budget re-baselined to 452.
Remove never-constructed SaveSession path and unused App helpers, delete
stale ops drafts (keep active handoff), and ratchet the dead-code budget
after cargo check + budget pass (449).
#4785 asks for a 481-attribute sweep. This is not that sweep — it is the part
that can land without judgment calls, plus the gate that makes the sweep worth
doing.
The measurements are why the gate comes first:
issue filed 464 attributes / 143 files
2026-07-26 426 / 111
2026-07-28 481 / 155
The sweep was working and the total still rose, because two large landings this
week added state whose accessors only their own tests read. A sweep is a
snapshot; a budget is a direction.
scripts/check-dead-code-budget.py counts `allow(dead_code)` across crates/ and
fails when the total exceeds a committed ceiling. Lowering it is free; raising
it needs `--update` and a sentence in the PR, so growth becomes a visible
decision rather than an accident. On failure it prints per-crate now-vs-budget
and marks which crate grew. Wired into Lint next to the other check-*.py gates.
This covers a real blind spot: CI's clippy runs without `--all-targets`, so it
never lints cfg(test) or integration-test code — and a prior strip-and-check
measured 197 attributes alive *only* because a test references them.
The three zero-risk removals from the issue's cluster list:
- `codew_legacy_shim.rs` -> `codew.rs`. The issue calls this out as a rename,
not a deletion: it is the live `codew` binary and its own docs call it
permanent. Every sweep flags the filename; the binary name is unchanged.
- `clap` dropped from app-server and `thiserror` from lane — no source in
either crate references them. Cargo.lock loses exactly those two edges and no
package versions move.
The budget baseline is recorded at today's 482, not at an aspirational number,
so the gate starts truthful and the sweep can ratchet it down.
CodeWhale Bot