clikae v0.25.0 — a document that names a thing is read instead of the code

Everything here is one shape

v0.24.0 gave the tmux layer the owner its design doc had specified and nobody
wrote. This release is what that owner made visible — and the pattern turned out
to be bigger than tmux.

A document that names a thing is what an auditor reads instead of the code.
When it goes stale it does not merely fail to help. It hides the gap it would
otherwise expose, because the reader now believes the thing exists.

Three defects, found by asking the same question three ways:

the doc said	the code had
clikae_spawn_session holds Rules 1 and 2	no such function, for two years
fleet_mcp_prelaunch is called from switch and run	relay had it too; burn had none
"window-size latest 下最近使用的 client 決定尺寸"	nothing set the option

So there is now a gate for it: scripts/doc-names-exist.sh runs with the tests
and fails when a doc names a function that does not exist. Exemptions need a
written reason. Prose drifts and cannot be checked; a name can.

clikae resume was starting sessions differently from everything else

It called adapter_run directly — the one user-facing command that launched an
engine with no tmux: no wake watcher, no scrollback capture, no roaming. The
board's own resume has always routed through switch, so the same intention
produced two different sessions depending only on how you typed it.

Drift, and the dates say so: _resume_exec is from June, the tmux layer landed
in August touching switch.sh and burn.sh. resume.sh was missed.

It then survived the v0.24.0 audit, which is the part worth keeping. That audit
asked who calls tmux — four sites, all converged. resume.sh could never
appear on that list. Searching for callers finds drift among the sites that
already opted in; it cannot find the site that never did.

The question that finds it is who launches an engine, and it has a definite
answer: one entry per adapter_run call site. Asked that way, five paths, four
already correct — and burn missing its Soul and fleet-MCP links, so a headless
run in a fresh directory executed with no memory nobody had asked to remove.

--ephemeral is the sub-agent primitive, and now it says so

Measured rather than claimed:

transcripts before / after     308 / 308      nothing in `clikae resume`
Soul memory files before/after 436 / 436      the real brain untouched
three parallel cold reads      all rc=0       no residue

cd "$(mktemp -d)" && clikae claude <tank> --ephemeral -- -p "<question>" is a
cold, unattended reader that spends that tank's quota and leaves nothing behind.
AGENTS.md documents the shape now, because none of it was written anywhere.

One sharp edge is gone. The memory slot is keyed on $PWD, so two ephemeral runs
in one directory fought over it — and the second did not merely fail: its
self-heal read the first run's symlink as a crashed leftover and moved the real
memory back out from under a live engine. Now one lock per slot, refusing the
second with an explanation instead of a bare ln: error.

(lockf -k, not lockf. Without -k two processes both get rc=0 on the same
file — a lock that never locks, which is a guard silent on every input.)

Two things that had never worked, and one you could not escape

The waiter could never exit. Its only exit condition was tmux has-session
— and the watcher is a window in that session, so it is the reason the session
is alive. The condition could never become true. When the engine's window closed
and the waiter was the last one left, there was no way out but closing the
terminal.

The board announced a countdown that did not exist. The live row packed
three values into one field joined by spaces, and one of them is "2m ago" —
which has a space in it. So read attached age wake put "ago" into wake, and a
non-empty wake means "a waiter is counting". Every selected live row claimed
one. The render site's own comment forbids exactly that. The unit was right and
tested; the seam around it was not.

K on the board closes a running session. The Live section could see a
session and name it and offered only "enter it". It asks first, and the question
carries the fact that makes it safe: the conversation is a transcript, so
clikae resume brings it back. What ends is the process, not the work.

Honest scope

The scrollback replay has never worked on Linux. On ubuntu tmux 3.4 the capture
file is never created; on macOS it is. Ten CI cycles ruled out the pane being
torn down (probes survive), sequencing (an EXIT trap did not run either), timing,
and -t target resolution — that last one was a real bug and is fixed. The
cause is still unknown.

So the test skips off macOS and points at DESIGN-tmux Rule 2b, which records the
ruled-out list so the next person does not rediscover it. Skipped rather than
deleted: the feature works where it works, the gap is written down, and a skip
carrying a reason invites the fix. Contributions very welcome.

Also fixed on the way: a server born by clikae burn took tmux's 2000-line
scrollback instead of 50000; burn published the caller's whole environment into
the tmux process argv, where ps shows it to every process on the machine; the
global options accumulated one copy per session; and the test suite's own
tmux kill-server could reach the maintainer's live tanks.

scripts/test.sh: 755 passing.