v0.27.0

• Replace help-v1 with a closed-world CLI compiler: one cli-spec-v1 registry is the single source for argv parsing, typed values, legal argument combinations, output contracts, help, and the offline reference, and an invocation runs only when it matches exactly one registered shape
• Answer help in one round trip — --help returns every shape of a command complete with its optional arguments and closed value sets, and the second level --help-combination is gone because all it could omit is what a caller would then never discover
• Name CLI failures in error.code like every other error: eight cli_* codes replace the generic cli_error and its parallel rule, command_path, and argument_names fields
• Make redaction path-aware and policy-consistent: a _secret name marks its whole subtree, a URL fragment goes through the same redactor as the query, plain rendering keeps the suffix until the value is masked, and a boolean flag that merely names a secret is no longer marked sensitive
• Hold the three README promises to their flagship cases: lint reports an unlabelled field as a missing_suffix warning, INI and dotenv edits can no longer save a file that stops parsing, and protocol-v1.schema.json is validated against the implementation event by event
• Make Document::unset idempotent at any path depth: a missing ancestor means the leaf is absent too, so it answers false instead of erroring, while a path no document could satisfy still errors
• Render the offline --docs reference from the registry without tool-specific text, so a consumer's generated CLI reference no longer cites files only agent-first-data ships