release(v1.11.0): pi 1.1.0, pi-obsmem 022da5e, pi-atelier v0.15.0, all floating refs at newest

- ARG PI_VERSION 1.0.0 -> 1.1.0. Audited against the npm tarballs: the only
  breaking change in 1.0.1..1.1.0 is 1.0.3's azure-openai-responses -> azure
  rename, which nothing here uses. pi-agent-core's finishTurn handling is
  byte-identical between 1.0.0 and 1.1.0.
- ARG PI_OBSMEM_REF 731c3d4 -> 022da5e (= master): #81 compaction keeps
  unobserved context, #93 prebuilt dist/index.ts. src/agents/ unchanged.
- ARG PI_ATELIER_REF/VERSION v0.13.0 -> v0.15.0. Sidebar Auto/Manual modes,
  Manual by default. README's sidebar section updated.
- SKILLSET_SNAPSHOT_REF e9e45f7 -> 96b840e via vendor-mempalace-skill.sh.
  The vendored bytes are unchanged.
- Dockerfile.base BASE_REBUILD_DATE marker refreshed, at no cost, because the
  base rebuilds anyway (rootfs + entrypoint-user.sh changed in 11e512e).
- CHANGELOG: Unreleased -> v1.11.0 with the audit. The CI bypass of the obsmem
  pin is recorded under Still open.

Exercised before tagging, with pi 1.1.0 from a temp prefix in a real pty
against -ne controls:
- obsmem turn cap: 11 turns uncapped, exactly 3 capped.
- atelier v0.15.0 paints in both renderers (controls 0/3, render-proofed).
- obsmem 022da5e registers /om:status and /om:view.
- All 11 pi-extensions a88fa99 extensions load.

Local gates: check-doc-drift (rc 0, check 9 names every moved component),
lint-shell, check-workflow-shell, test-link-pi-models (13/13),
check-dockerfile-directives, check-skill-floor, check-base-hash.

CHANGELOG.md

@@ -11,15 +11,27 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## Unreleased
+## v1.11.0 — 2026-10-12
 
-### Components that move with the next build
+Minor release. Headlines: **pi 1.1.0**, **secret env values are kept out of
+model context by default** (pi-extensions `secret-guard`), an opt-in **AWS SSO
+keeper** for long Bedrock runs, and **`~/.pi/agent/models.json` linked to a
+mounted shared file** at every start. Everything else moves to its newest
+upstream: pi-observational-memory `022da5e`, pi-atelier `v0.15.0`, pi-studio
+`v0.9.63`. The base image is rebuilt (rootfs and `entrypoint-user.sh` changed),
+so the base tools pinned to `latest` re-resolve too.
 
-| Component | Baked in v1.10.2 | Next build | Why |
+### Components that move with this release
+
+| Component | Baked in v1.10.2 | v1.11.0 | Why |
 |---|---|---|---|
+| **pi** | `1.0.0` | **`1.1.0`** | audited, see *Changed* below |
+| pi-obsmem | `731c3d4` | **`022da5e`** (pinned SHA, = `master`) | #81: compaction never drops unobserved context; #93: pi loads a prebuilt `dist/index.ts` (see *Changed*) |
+| pi-atelier | `v0.13.0` (`34d26f1`) | **`v0.15.0`** (`3befe02`) | v0.14.0 Auto/Manual sidebar modes with auto-collapse; v0.15.0 starts in Manual, recolours panels, simpler Activity rows |
+| skillset snapshot | `e9e45f7` | **`96b840e`** | provenance only: the vendored `SKILL.md` is byte-identical (sha256 `a1db86da…` at both refs) |
 | pi-extensions | `143a214` | **`a88fa99`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` (keeps the Bedrock SSO session alive) and `secret-guard.ts` (keeps secret env values out of model context); both below |
 | pi-toolkit | `9c87ee8` | **`3760d90`** (or later: CI resolves `main` at build time) | `pi-task`: optional model fallback when the primary model fails auth before acting (below) |
-| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only; **not reviewed yet**: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) |
+| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only. Reviewed: browser-editor fixes only (WebKit cursor drift after re-wrap, re-layout after macOS autocorrect) plus `Ctrl+Shift+H` to toggle highlighting; peerDependencies unchanged: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) |
 
 ### Added
 
@@ -135,6 +147,51 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   providers"). Use
   `docker exec -it -u developer -e PI_AWS_SSO_NTFY=… pi-devbox bash -lc pi`.
 
+### Changed
+
+- **pi `1.0.0` → `1.1.0`.** Audited 2026-10-12 against the published npm
+  tarballs, by the same method as the v1.10.2 audit (the full note is above
+  `ARG PI_VERSION` in `Dockerfile.variant`):
+  - The only `### Breaking Changes` section in 1.0.1..1.1.0 is 1.0.3's rename
+    of the `azure-openai-responses` provider to `azure`. Nothing here uses it.
+  - `finishTurn` handling in pi-agent-core is byte-identical between 1.0.0 and
+    1.1.0. The six named `pi.*` APIs our extensions call (`registerTool`,
+    `registerCommand`, `registerFlag`, `getFlag`, `sendMessage`,
+    `sendUserMessage`) appear in the same dist files in both versions, and so do
+    the TUI internals atelier hooks. `engines.node` is unchanged.
+  - User-visible: `Home`/`End` now always move the editor cursor (fullscreen
+    transcript top/bottom moved to `Ctrl+Home`/`Ctrl+End`). Terminals that
+    support OSC 7501 now see pi's working/blocked/done status; set
+    `PI_PROGRAM_STATUS=0` to turn that off.
+  - Exercised before tagging with pi 1.1.0 from a temp prefix, in a real pty,
+    with `--no-extensions` controls:
+    - The obsmem turn cap held on the real 1.1.0 agent loop: uncapped ran 11
+      turns, capped stopped at exactly 3.
+    - atelier v0.15.0 painted in both renderers (controls 0/3, every arm
+      render-proofed).
+    - obsmem `022da5e` registered `/om:status` and `/om:view`.
+    - All 11 pi-extensions `a88fa99` extensions loaded without error.
+- **pi-observational-memory `731c3d4` → `022da5e`**, still a full-SHA pin; no
+  tag newer than 3.1.4 exists.
+  - #81 changes compaction. Entries the observer has not reached yet are no
+    longer cut out of context, and memory workers yield to the session. New
+    settings (`compactionMaxRetainedTokens`, `consolidateWhenIdle`,
+    `piAutoCompactionEnabled`) all have defaults, so nothing needs setting.
+  - #93 makes pi load a committed `dist/index.ts` bundle instead of 32 TS
+    sources, which is faster to start.
+  - `src/agents/` is unchanged between the two SHAs, so the workers'
+    `finishTurn` migration is intact.
+- **pi-atelier `v0.13.0` → `v0.15.0`.** The sidebar now starts in **Manual**
+  mode. `/atelier sidebar auto` collapses it when the terminal is narrow and
+  reopens it when there is room. `showSidebarOnStartup` keeps its key and its
+  default. README's sidebar section describes both modes.
+- **Base rebuilt** (`base-<hash>` changes because `rootfs/` and
+  `entrypoint-user.sh` changed). The base tools pinned to `latest` re-resolve.
+  Upstream on 2026-10-12: uv 0.13.0 (its breaking change makes Python 3.15 the
+  default *download*; mempalace still installs with `uv tool install` on
+  Debian's python3.13, which uv prefers because it is already installed), nvim
+  0.12.6, fzf 0.74.5. `# BASE_REBUILD_DATE:` is updated while it is free.
+
 ### Still open
 
 - `remote` mode end to end (code → push → approve on the phone) is unit-tested and
@@ -148,6 +205,15 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   a login then worked at once.
 - The real fix is administrative: the IdC admin can raise the session length (up to
   90 days), after which the keeper has almost nothing to do.
+- **The pi-obsmem pin does not bind CI builds.** `resolve-versions` in
+  `docker-publish.yml` still resolves `pi-observational-memory` from `master`
+  and passes it as `--build-arg PI_OBSMEM_REF`, which overrides the Dockerfile
+  default. This was verified on both sides with buildx: without the build-arg
+  the pin is baked, with it `master` is. The pin reached v1.9.5, v1.10.2 and
+  this release only because `master` equalled the pin at build time.
+  `check-doc-drift.sh` reads the ARG, so it would not notice a divergence. Fix
+  it by reading the pin from `Dockerfile.variant` in `resolve-versions`, the way
+  pi-atelier's tag already is.
 
 ---