Merge master and reconcile skill preparation optimizations

Preserve installed-selection reuse and bundled relocation together with metadata-only package preparation. Retain both cleanup notifications, use the hardened upstream editor test, and regenerate unchanged skill SQL as migration 0414.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

maps/feature-map/agent-chat.md

@@ -25,9 +25,13 @@ Agent access: [companion](../agent-access-map/agent-chat.md).
 
 Open `/chats`, choose an agent, or use `/chats/:agentRef` and its conversation sidebar.
 
+With Coordinator enabled, the composer exposes the shared model/thinking-level picker for supported agents. The agent stays fixed in this control; switching agents remains in the chat header. Choices save as conversation overrides on send, preserving the agent's configuration. A first message creates the conversation before saving settings and submitting through the ordered comments endpoint.
+
+Coordinator answer receipts from this conversation jump to the answer bubble without leaving chat. Answer updates from an execution task link to that source task and its decision context. Compact document links read “Open [document title] in the sidebar”.
+
 ### `project-handoff`
 
-Ask for project work in Agent Chat and follow its created project/task links.
+Ask for project work in Agent Chat and follow its created project/task links. New tasks and accepted task suggestions default to the agent in that conversation. An explicitly requested agent or person takes precedence; no best-fit agent routing is inferred. Ordinary task creation outside chat keeps its existing assignment behavior.
 
 ### `conference-room`
 
@@ -41,6 +45,12 @@ Preconditions: follow the [baseline](./README.md#before-driving-a-journey). Enab
 
 Automated: [chat landing](../../ui/src/pages/AgentChats.test.tsx) checks recent-chat routing; [conversation service](../../server/src/__tests__/agent-conversations.test.ts) covers persisted conversation behavior.
 
+Automated: [composer picker](../../ui/src/components/task-chat/ComposerRunSettingsPicker.test.tsx) covers fixed-agent model/effort selection on desktop and mobile; [composer](../../ui/src/components/task-chat/TaskChatComposer.test.tsx) covers Coordinator gating and settings submission without reassignment. [Task detail](../../ui/src/pages/IssueDetail.test.tsx) verifies canonical first/existing-chat IDs, settings-before-comment ordering, and no comment submission when settings fail to save. These tests mock the API and do not prove provider execution with the chosen model.
+
+Automated: [conversation delivery](../../server/src/__tests__/agent-conversation-delivery.test.ts)
+checks that paused or otherwise non-invokable agents leave comments pending
+without aborting startup recovery, and that a later unpause allows one delivery.
+The test persists queue admissions only; it does not start agents or providers.
 Automated: [historical chat](../../ui/src/pages/AgentChat.test.tsx) keeps an older
 conversation reachable after a cached roster refresh ends in HTTP 429. It checks
 lookup Retry and preserves permission and company boundaries. This is component
@@ -66,6 +76,13 @@ inaccessible saved conversation; verify no cross-user or cross-company history a
 
 Automated: [chat project tools](../../server/src/__tests__/chat-project-tools.test.ts) checks tool contracts; live model choice and UI handoff require a manual run.
 
+Automated: [Coordinator handoffs](../../server/src/__tests__/coordinator-handoff.test.ts)
+checks that a suggested task remains a proposal until acceptance, that its task,
+initial plan and source-chat audience are saved atomically, and that retries do
+not create another task. A conversation is a privacy/provenance source rather
+than a structural task parent. The same tests cover compact canonical decision
+receipts, exact uploaded-artifact bindings, current task access, reset-session
+boundaries, and pagination of older handoffs.
 Explicit live evals: [chat feature journeys](../../tests/runner-e2e/CHAT-FEATURES.md)
 send natural requests to save a backlog task or delegate an announcement. They
 check project/assignee, execution or non-execution, saved output, return to chat,
@@ -75,6 +92,17 @@ task links unless the platform supplied a verified absolute origin.
 
 Manual: Ask the configured agent to create bounded project work, inspect the proposed/created target, and open the resulting task. Verify the request context and intended project survived and the task produces a useful output.
 
+Manual: With the personal Coordinator workspace enabled, discuss a vague request
+until the agent suggests a task. Confirm that no execution task exists before
+acceptance. Accept it, stay in chat, and open the created card on demand. An
+explicit request to create a task may create it directly under normal authority.
+Approve a work product or answer a question in its task or Needs You, then return
+to the originating chat. Its compact update should link to the exact recorded
+decision and reviewed artifact, without needing another coordinator turn.
+Approval of artifact quality alone must not publish it or complete the task.
+
+Coordinator task clarification: create a task with only a description. When material context is missing, native task guidance asks one focused canonical question inside that task. Its actionable form is also projected into Needs You and the originating standing chat; direct user-created tasks appear in the assigned agent’s standing chat. Answer on either surface and verify the pending card/count clear and a compact recorded answer replaces it in chat. This projection is event-refreshed and does not wake another agent merely to repeat the question. Current direct-task questions survive a chat reset; their answered receipts start at the current chat boundary. The task brief remains editable context, not another stored question. Model choice and actual resumed execution still require live verification.
+
 ### `conference-room`
 
 Automated: [board chat gate](../../server/src/__tests__/board-chat-route-feature-flag.test.ts) proves route gating, not a live conversation.
@@ -87,6 +115,8 @@ Manual: Check disabled access first, enable in the disposable instance, then sen
 
 ## Gotchas
 
+- Coordinator Markdown references to a standing agent conversation display “Chat with [agent]” and route to that chat, preserving anchors. Labels resolve once from the existing current-person/current-company chat list and agent roster; no task status glyph or task quicklook is shown for these references. Ordinary task links retain their existing treatment.
+
 - Idle chat is not failed execution.
 - See [steering](./steering.md) for in-flight messages and [questions](./questions-and-approvals.md) for interactions.
 - An API tool test does not prove that every harness will choose the same handoff tool.
@@ -101,3 +131,11 @@ Scope: ui
 Storybook: Conference-room flag disabled, empty/history/reply, busy and explicit failure states.
 Production: Exercise separate BoardChat route gate, local-trusted deployment and authenticated Claude CLI; send/reload real conversation with responding agent attribution.
 Sources: Source: [BoardChat.tsx](../../ui/src/pages/BoardChat.tsx), [board-chat.ts](../../server/src/routes/board-chat.ts). Tests: [BoardChat.test.tsx](../../ui/src/pages/BoardChat.test.tsx), [board-chat-route-feature-flag.test.ts](../../server/src/__tests__/board-chat-route-feature-flag.test.ts)
+
+### Explicit output quality review (Coordinator functional slice)
+
+Accepted suggestions and native explicit task creation may carry `requiredQualityReview` into the task's existing execution policy. The opt-in requirement names output slots and is separate from the existing reviewer eligibility policy. Each slot requires a canonical human verdict bound to an exact current output document revision or attachment identity. Plans, questions, file presence, model completion claims, rejected/deferred verdicts and stale versions do not satisfy it. Only a human may change an existing requirement. Quality approval does not publish or automatically complete the task. Tasks without this optional requirement retain existing completion behavior.
+
+Owning service: `server/src/services/required-quality-review.ts`; enforcement: interaction creation, issue update, native completion feedback/finalization. Focused proof: `server/src/__tests__/required-quality-review.test.ts` plus native arbiter and chat completion delivery tests. Completion updates include bounded canonical output-decision identities for linking existing review, never worker-authored review prose. These tests do not establish unattended live provider reliability.
+
+Attachment approval is for the exact immutable file identity. Removal or a mismatched hash invalidates that target; registering a replacement beside the approved file does not redefine its output slot. A replacement requires a fresh bound review. Document targets additionally track the current revision.

maps/feature-map/documents-artifacts.md

@@ -26,6 +26,14 @@ Agent access: [companion](../agent-access-map/documents-artifacts.md).
 
 Open a document from the task thread or document side panel.
 
+Coordinator decision receipts also open a pinned reviewed revision alongside
+the matching task interaction. Historical tabs retain their revision identity
+independently of the current document tab. Missing revisions are explicit and
+never silently replaced with the latest document.
+When a decision in one task reviews another task's document, the center pane
+keeps the originating conversation while the sidebar opens the document owner's
+exact revision. An inaccessible owner never falls back to the origin task's document.
+
 ### `task-output`
 
 Open an attachment, output card, or file link from a task.
@@ -45,6 +53,11 @@ Preconditions: follow the [baseline](./README.md#before-driving-a-journey). Use
 
 Automated: [documents service](../../server/src/__tests__/documents-service.test.ts), [annotations](../../server/src/__tests__/document-annotations-service.test.ts), and [revision restore](../../server/src/__tests__/issue-document-restore-routes.test.ts) cover server contracts.
 
+[Exact revision panel](../../ui/src/components/task-side-panel/TaskDocumentPanel.test.tsx)
+checks pinned content and missing-revision behavior; this component test does not
+prove end-to-end conversation scrolling. Open a resolved receipt after making a
+new revision and verify the earlier body plus matching interaction in the browser.
+
 Manual: Edit a paragraph, save, reload, and compare revisions. Add an annotation to a specific selection and inspect it after another edit. Resolve it through the supported action. Restore a disposable revision and confirm the new current document and history agree.
 
 ### `task-output`
@@ -67,6 +80,8 @@ Manual: Find the task’s output through search and grouping, open its stack, pa
 
 ## Gotchas
 
+- In Coordinator, saved plan cards use document chronology, so a plan written before its output appears first even when both writes share one native run. Authored issue-document links use the same compact sidebar-link surface and retain revision/annotation targets. Classic run embedding is unchanged. The UI does not remove or deduplicate canonical plan content.
+
 - A local path is not automatically an uploaded artifact accessible to another user.
 - A preview screenshot is not proof that download bytes or revision references are correct.
 - Version conflicts and stale annotations must stay visible rather than silently targeting different content.

maps/feature-map/inbox-search.md

@@ -30,6 +30,26 @@ Use Inbox links or the corresponding task views when the combined list is enable
 
 Open `/decisions`, then a queue at `/decisions/queues/:key` and its source item.
 
+With **Settings → Experimental → Coordinator workspace** enabled, `/decisions`
+is **Needs You**. Pending cards use the existing attention feed and canonical
+resolvers. **Tasks → Needs attention** projects the same feed as distinct tasks.
+Search, filter by agent/project, sort, and group by task/agent/project apply to
+both open decisions and the visible Recent Decisions receipts. Successful
+resolutions resize into compact receipts while the same contained Gather Light
+effect used for task creation runs concurrently. The receipt stays in its card
+position until that treatment finishes, then settles under **Recent Decisions**.
+Motion follows the saved history result; failed saves retain the actionable card,
+reduced motion settles immediately, and revisiting history does not replay it. The initial
+24-hour display window is an experimental assumption, not data deletion.
+Resolving an artifact decision does not itself complete its task. If the task
+remains in review without a maintained reviewer or continuation, its separate
+canonical stalled-review item stays in Needs You and Tasks → Needs attention.
+Coordinator presents the existing recovery actions with **Mark task done** as
+the task-level verdict, distinct from the saved artifact receipt.
+
+Open **Decision history** on this surface for the paginated history sidebar;
+it merges answered questions and confirmations with Decisions-v1 outcomes.
+
 ### `search`
 
 Open `/search` or the navigation search entry.
@@ -82,6 +102,26 @@ Automated: [decision queues](../../server/src/__tests__/decision-queues-routes.t
 
 Manual: Open a pending decision, follow its source, resolve it through the supported control, and reload the queue. Confirm it retires only after the decision persisted and unrelated pending items remain.
 
+Coordinator regression sources: [canonical history](../../server/src/__tests__/decision-history.test.ts)
+exercises real PostgreSQL cross-source pagination, answered-question retention,
+company/private-task isolation, and private v1 targets.
+[Attention service regressions](../../server/src/__tests__/attention-service.test.ts)
+cover pending question forms and confirmations in persistent agent chats, removal
+after an answer with retained history, and company/task-visibility/addressee checks.
+Idle chats without structured requests remain absent. The
+[Needs You component test](../../ui/src/components/coordinator/CoordinatorNeedsYou.test.tsx)
+checks that a chat-sourced canonical question reaches its original resolver and context.
+It also checks simultaneous resize/light and delayed movement to Recent Decisions.
+[Shared card-motion tests](../../ui/src/components/coordinator/CoordinatorTaskCommitment.test.tsx)
+cover reduced-motion settlement and returning to a resolved card without replay.
+The [decision-motion stories](../../ui/storybook/stories/design-proposals/coordinator-decision-motion.stories.tsx)
+exercise real Needs You/resolver components with isolated approval, question, and failed-save responses.
+[Projection helpers](../../ui/src/lib/coordinator-attention.test.ts) cover distinct
+pending task membership and presentation-only recency decay. Browser verification
+must additionally approve copy, approve a visual, and answer a question; confirm
+three retained receipts, task/chat consistency, resize/collapse motion, and exact
+task context on receipt click. Turning the setting off restores the classic surface.
+
 ### `search`
 
 Automated: [search page](../../ui/src/pages/Search.test.tsx) and [company search service](../../server/src/__tests__/company-search-service.test.ts) cover UI and server search separately.
@@ -148,3 +188,5 @@ Scope: ui
 Storybook: Eligible live task toast, explicit mention, quiet unrelated event, own-action/visible-task suppression, dedupe and company/account switch.
 Production: Persisted participation and mentions determine per-viewer socket eligibility; quiet events still refresh caches; reload retains eligibility, unauthorized resources remain denied.
 Sources: Source: [ToastViewport.tsx](../../ui/src/components/ToastViewport.tsx), [ToastContext.tsx](../../ui/src/context/ToastContext.tsx), [LiveUpdatesProvider.tsx](../../ui/src/context/LiveUpdatesProvider.tsx), [task-toast-eligibility.ts](../../server/src/realtime/task-toast-eligibility.ts). Tests: [ToastContext.test.tsx](../../ui/src/context/ToastContext.test.tsx), [ToastViewport.test.tsx](../../ui/src/components/ToastViewport.test.tsx), [LiveUpdatesProvider.hook.test.tsx](../../ui/src/context/LiveUpdatesProvider.hook.test.tsx), [task-toast-eligibility.test.ts](../../server/src/__tests__/task-toast-eligibility.test.ts), [live-events-toast.test.ts](../../server/src/__tests__/live-events-toast.test.ts), [multi-user-authenticated.spec.ts](../../tests/e2e/multi-user-authenticated.spec.ts)
+
+Coordinator navigation counts all outstanding canonical attention items on desktop and phone, using the same complete feed as Needs You. Classic keeps its existing today-oriented badge. Task questions resolve through their original interaction; pending chat projections, counts and recorded receipts invalidate together.

maps/feature-map/navigation-preferences.md

@@ -15,7 +15,7 @@ Agent access: [companion](../agent-access-map/navigation-preferences.md).
 ## Sub-features
 
 - `navigation`: `navigation-preferences/navigation` — use current sidebar links, favorites, recents, and available layout controls.
-- `preferences`: `navigation-preferences/preferences` — persist supported ordering/collapse choices for the intended user/company.
+- `preferences`: `navigation-preferences/preferences` — persist supported ordering/collapse choices for the intended user/company, and the personal experimental workspace choice.
 - `profile`: `navigation-preferences/profile` — edit personal identity and inspect public profile links.
 - `announcements`: `navigation-preferences/announcements` — inspect and dismiss an announcement with its intended instance-wide user scope.
 - `fallbacks`: `navigation-preferences/fallbacks` — handle missing resources and old deep links without presenting another resource as the target.
@@ -99,3 +99,45 @@ IDs per company/account without passive full-detail or workspace inspection.
 Successful omissions remove unavailable entries; failed reads preserve history.
 Verify rename, inbox archive, pause/restart, reload, cross-tab updates and account
 switches. Inbox archive does not remove the task from recent history.
+
+### Personal Coordinator workspace
+
+Settings → Experimental → Coordinator workspace opts the current person into the
+experimental shell; off restores classic. The server saves the choice by user across
+companies, separate from instance feature flags. The local-trusted identity is shared
+Local Board, not evidence of multi-user isolation.
+Agent Chat remains an independent instance prerequisite. When it is off, the
+personal card explains the dependency and links eligible instance administrators
+to the existing Agent Chat control. Hidden or Cloud-managed controls are not
+presented as editable. Disabled Chat routes link back to Experimental settings.
+Enabling the personal workspace never changes the instance capability.
+
+Automated: [preference hook](../../ui/src/hooks/useCoordinatorWorkspaceEnabled.test.tsx),
+[prerequisite settings card](../../ui/src/components/CoordinatorWorkspaceSetting.test.tsx),
+[authorization](../../server/src/__tests__/workspace-preferences-routes.test.ts), and
+[database persistence](../../server/src/__tests__/workspace-preferences.test.ts).
+Manual: toggle on/off, reload, switch companies/accounts, and simulate failed reads
+and saves. Confirm existing work is unchanged and a failed save keeps the current
+choice. The [Settings card story](../../ui/storybook/stories/navigation-preferences/coordinator-workspace-setting.stories.tsx)
+uses the production component with simulated API responses; it does not establish
+real persistence or permission behavior.
+
+Local browser verification (2026-10-26, isolated Coordinator worktree): initially
+off, enabled and persisted across reload, disabled back to classic navigation,
+then enabled back to Chat / Tasks / Needs You. This used `local_trusted`; signed-in
+two-person browser isolation remains unverified.
+
+Coordinator More exposes a pin/unpin button beside every destination. Each flyout
+row highlights as one surface; its pin appears on row hover or keyboard focus.
+Opening the flyout focuses its container so Search is not highlighted before
+interaction. Pinned pages appear beneath More in pinning order and retain the
+existing company-aware routes.
+Unpin from either the flyout or the pinned row. The list is personal to the current
+user in this browser, shared across companies; it does not sync across devices.
+Only known route names are rendered. Storage failures show a save error.
+The [pin hook](../../ui/src/hooks/usePinnedNavigation.ts) owns browser persistence;
+[sidebar tests](../../ui/src/components/CoordinatorSidebar.test.tsx) cover pin/unpin,
+remount persistence, account separation, unknown routes and cross-tab updates.
+Manual: pin with mouse and keyboard, reload, follow a pinned link, unpin from both
+locations, and check the mobile drawer. Local-trusted checks do not prove two-user
+authenticated browser isolation.

maps/feature-map/onboarding.md

@@ -56,6 +56,11 @@ checks the same held state, then completes that record through Connect without
 creating a second agent. Its Docker harness mocks credential verification; live
 provider authentication remains separate evidence.
 
+Name-only setup defers the runner field while the provisional adapter remains
+held in setup. Choosing a provider updates that same setup record with its
+selected runner. The wizard regression covers a saved native choice followed by
+OpenAI Subscription selection; it does not prove provider authentication.
+
 - **Create company and resume.** Start a fresh empty instance and run doctor using
   the [verification skill](../../.agents/skills/verify-paperclip/SKILL.md). Run
   `node .agents/skills/verify-paperclip/scripts/onboarding-smoke.mjs --evidence-dir "$VERIFY_EVIDENCE_DIR"`.

maps/feature-map/questions-and-approvals.md

@@ -216,6 +216,8 @@ unless its actual provider journey was driven.
 
 ## Gotchas
 
+- Canonical question forms show field validation only after Next/Submit (including the keyboard submit shortcut) is attempted. Invalid answers remain unsent and the form stays on the relevant question; correction clears the field warning. Pagination arrows still browse without validation, drafts remain preserved, and uploads/requests in flight still disable submission.
+
 - Dismissing a question does not answer it. Dismissing an app review neither
   grants permission nor resumes the agent. Ordinary comments cannot approve it.
 - A resolved request and a successful tool execution are separate facts.