v0.16.0

Added

• Footer status redesign and footer config key ("full" default | "compact" | "off"; editable from /verdict, project-overridable, invalid values warn and fall back to "full"): the footer used to show only auto mode on/auto mode off. "full" now renders Nerd Font powerline blocks — gate state, risky settings (floor off, .omp gate off), the classifier model (↺ inherited session model, ⚠ ↺ configured model unavailable so the session model is used, ↳ <id>·shadow|enforce fallback model), per-session verdict counters (final pipeline verdicts of root-session calls; reset by SessionState.reset(), kept across /verdict saves; subagent calls and calls while the master switch is off are not counted), and info badges (≥N%, autoDeny off, subagent normal|auto); "compact" is one plain text line without counters, also used when the host theme lacks bg/getBgAnsi (e.g. omp). The footer refreshes after every adjudicated tool call, on /verdict saves and on model_select, and never contains command or path text (ADR-0002). Pure renderer exported as renderFooter.
• Live classifier status: while a gray-zone model call runs (the primary classifier or the classifierFallbackModel cascade), the tool_call handler shows one widget row above the editor (ui.setWidget("verdict", …), e.g. 🛡️ verdict: classifying bash via <model>…) and clears it before the verdict is presented, so it never sits next to the confirm dialog; the text is phase + tool name + model id only (never command or path text, ADR-0002), rule-layer verdicts show nothing, root sessions with a UI only (subagent and headless calls never set it), always on with no config key; the pipeline exposes it as the UI-free AdjudicateEnv.onPhase hook.
• Ask dialog mouse clicks: the rich approve dialog now handles left-clicks when the host forwards SGR mouse input (ESC [ < b ; x ; y M) to the focused component — a click highlights an option row, a second click on the same row confirms it, but only if that row was highlighted by the immediately preceding mouse click (the initial Yes highlight and keyboard moves never arm a confirm, so allowing always takes two clicks on Yes). Releases, motion, wheel, non-left buttons, legacy X10 mouse sequences, and clicks outside the option rows are ignored; the row is mapped from the host's children/terminal.rows/viewportTop and clicks are ignored when the host exposes none. The dialog never enables terminal mouse tracking itself, and the key-hint line is unchanged: pi 0.84.3 consumes mouse events before components, so this takes effect only on hosts that forward them.

Fixed

• Windows path matching: the path sensitivity floor (S0–S3) and the in-cwd write allowance now match against a POSIX-form spelling of every canonical path form (backslashes → /, drive letter dropped), so C:\proj\.ssh\id_rsa, C:\proj\.git\hooks\x, and ~\.npmrc hit their S-rules instead of silently passing the floor; the in-cwd base is now path.resolved before dual-form expansion. User allow/deny regexes see the same POSIX form for file-tool path targets on win32 (a ^/proj/ rule matches C:\proj\a.ts), and bash command strings have backslashes unified to / before denyPaths token extraction so cat C:\dir\file is extracted. POSIX hosts are unchanged. The read via project-local symlink to /etc test is skipped on win32 (no /etc to link to).