release(v1.10.0): pi 1.0.0 and pi-atelier v0.13.0, on measured evidence

Renames the unpublished v1.9.5 section to v1.10.0 and adopts the two bumps
that section had deliberately deferred. v1.9.5 was never tagged or published,
so nothing shipped under that name.

A minor, not a patch. v1.9.5 was numbered under the "patch - pi version bumps"
rule, but this release carries a pi MAJOR, a three-minor pi-atelier jump, four
new base packages and a new mailbox feature. The release carrying a 1.0.0
should not be the one numbered as a patch.

pi 0.85.1 -> 1.0.0. v1.9.5 held at 0.87.1 because obsmem's only compatibility
work names Pi 0.87 and no upstream issue mentions 0.99 or 1.0. That reasoning
had a hole worth naming: "no issue mentions 1.0" is an ABSENCE OF A STATEMENT,
not a measurement. So 1.0.0 was measured, against the published npm tarballs
for 0.87.1 and 1.0.0 unpacked side by side:

  - 1.0.0 has NO "### Breaking Changes" section at all. Those belong to 0.87.0,
    0.86.0, 0.84.3, 0.84.0, 0.83.0, 0.80.8, 0.80.7, 0.75.0 - none to anything
    between 0.88 and 1.0.0. The major is a milestone (fullscreen default,
    leaner codemode), not an API break.
  - finishTurn is still in 1.0.0's dist, so the pinned obsmem SHA keeps the API
    it migrated to.
  - All 8 pi.* APIs our extensions call exist in 1.0.0's dist: registerTool,
    registerCommand, registerFlag, getFlag, on, exec, sendMessage,
    sendUserMessage.
  - engines.node >=22.19.0 on both; the image ships 24.x.

The 0.99.2 change that looked fatal and is not: from 0.99.2 the DEFAULT MCP
exposure is `codemode`, so such tools are "neither declared to the model nor
listed" and must be found with searchTools(). That would gut the MemPalace
protocol if MemPalace were a builtin-MCP server. It is not - mempalace.ts and
mcp-loader.ts each run their own MCP client and register tools via
pi.registerTool(), which is why they are named mempalace_search and not
mcp__mempalace__search. Second route: settings.json has neither an mcpServers
block nor an mcp block. Filed upstream under "Changed", not "Breaking", so it
would have been easy to meet the hard way.

pi-atelier v0.10.3 (ed3837b) -> v0.13.0 (34d26f1), closing the gap v1.9.5
flagged as the pi bump's residual risk. peerDependencies are unchanged at pi
>=0.84.0 across v0.10.3/v0.12.1/v0.13.0 - a FLOOR, so not evidence of
anything. What was checked instead: v0.13.0 carries its OWN breaking change
(the entry point no longer exports the internal registry and layout helpers),
which reaches nothing of ours - grepping pi-atelier and registerSidebarPanel
across mempalace-toolkit, pi-devbox, pi-extensions, pi-fork,
pi-observational-memory and pi-studio returns ZERO matches in all six. v0.12.0
removed the showSessionActions setting (0 references here) and moved the
Control Center shortcut Alt+A -> F6 (0 references here, so no doc goes stale).
showSidebarAgent/showSidebarTodos, the only atelier keys README names, are
both still in v0.13.0's README. TuiMainScreen and renderLayoutFrame both still
exist in pi 1.0.0's dist.

PI_ATELIER_VERSION is bumped with PI_ATELIER_REF; it is a separate ARG and the
image label would otherwise have lied.

v0.13.0 is an ANNOTATED tag: `ls-remote --tags` reports the tag object
(dd06971), not the commit (34d26f1). check-doc-drift.sh resolves the commit, so
that is what the CHANGELOG names. The gate caught the wrong SHA on the first
attempt - noted in the CHANGELOG for future bumps.

NOT PROVEN, and stated so acceptance does not mistake it for cleared: grepping
dist shows the SYMBOLS survive, not that their SIGNATURES are unchanged -
necessary, not sufficient. 1.0.0 is four days old and neither obsmem nor
atelier has a commit naming it. Acceptance must prove the obsmem workers CAP
TURNS (peerDeps are *, so a mismatch is silent) and that the atelier sidebar
PAINTS.

User-visible behaviour change, deliberately NOT overridden: 1.0.0 makes the TUI
fullscreen by default, replacing the terminal's normal scrollback.
tuiMode: "regular" restores the old behaviour. No baked default is set, so the
image inherits upstream's choice rather than silently pinning the fleet.

Gates: check-doc-drift 23 OK / 0 DRIFT / 0 SKIP / 0 FAIL; base-hash,
workflow-shell, skill-floor, lint-shell all rc=0.

Dockerfile.variant

@@ -154,21 +154,48 @@ ARG USER_NAME=developer
 # (e7d77dc -> 1529e14 -> 731c3d4 in the nine days to 2026-10-01), so waiting for
 # a tag means holding pi indefinitely. A full SHA keeps the one property
 # `master` does not have: rebuilding this tag later produces the SAME image.
-# SKIPPING 0.99.0/0.99.1/0.99.2 and 1.0.0, which all exist upstream: obsmem's
-# only compatibility work names Pi 0.87 ("fix: support Pi 0.87 agent APIs",
-# 2b1dc1c), and a repo-wide issue/PR search for "0.99" or "1.0" returns ZERO
-# matches. Its peerDependencies are `*`, so nothing would refuse at install
-# time and a 1.0.0 bump would fail silently at RUNTIME. 0.87.1 is the highest
-# version the evidence actually covers; 1.0.0 is a separate round.
-# pi-atelier v0.10.3 is deliberately NOT bumped here: its peerDependencies
-# declare pi >=0.84.0 — a FLOOR, satisfied by 0.87.1 — on both v0.10.3 and the
-# current upstream v0.12.1, so it spans this bump either way. It is the residual
-# risk, because atelier hooks pi TUI internals (the `TuiMainScreen` prototype,
-# `renderLayoutFrame`) that a declared floor does not protect, and a floor is
-# exactly what failed to warn us at pi 0.84. Acceptance must confirm the sidebar
-# still PAINTS — the same two-sided check used at 0.84.4 and 0.85.1, which can
-# tell "loaded" from "silently absent".
-ARG PI_VERSION=0.87.1
+# v1.9.5 SKIPPED 0.99.x and 1.0.0 for lack of evidence. v1.10.0 went and got the
+# evidence instead of waiting for obsmem to mention a version, because "no issue
+# names 1.0" is an absence of a statement, not a measurement.
+#
+# v1.10.0: 0.87.1 -> 1.0.0. MEASURED 2026-10-02 against the published npm
+# tarballs for 0.87.1 and 1.0.0, unpacked side by side:
+#   1. NO `### Breaking Changes` SECTION IN 1.0.0 AT ALL. The changelog's
+#      breaking sections belong to 0.87.0, 0.86.0, 0.84.3, 0.84.0, 0.83.0,
+#      0.80.8, 0.80.7 and 0.75.0 — none to 0.88+..1.0.0. The major is a
+#      milestone (fullscreen default, leaner codemode), not an API break. The
+#      last break that touched us was 0.87.0's `shouldStopAfterTurn` removal,
+#      which v1.9.5 already absorbed.
+#   2. `finishTurn` IS STILL IN 1.0.0's dist, so the obsmem SHA pinned below
+#      keeps the API it migrated to. (`shouldStopAfterTurn`: absent from both
+#      0.87.1 and 1.0.0, as expected after its 0.87.0 removal.)
+#   3. EVERY pi.* API our extensions call exists in 1.0.0's dist — all 8 of
+#      registerTool, registerCommand, registerFlag, getFlag, on, exec,
+#      sendMessage, sendUserMessage, extracted from mempalace.ts, the
+#      pi-extensions tree and obsmem's src/.
+#   4. engines.node is `>=22.19.0` on both; the image ships 24.x.
+# THE 0.99.2 CHANGE THAT LOOKED FATAL AND IS NOT: from 0.99.2 the DEFAULT MCP
+# `exposure` is `codemode`, i.e. such tools are "neither declared to the model
+# nor listed" and must be found with `searchTools()`. That would gut the
+# MemPalace protocol if MemPalace were a builtin-MCP server. It is not: both
+# mempalace.ts and mcp-loader.ts run their OWN MCP client and surface tools via
+# `pi.registerTool()`, which is why they are named `mempalace_search` and not
+# `mcp__mempalace__search`. Confirmed on a second route — settings.json has
+# neither an `mcpServers` block (builtin, exposure-governed) nor an `mcp` block.
+# Extension-registered tools are declared like built-ins, so `exposure` cannot
+# reach them.
+# WHAT IS NOT PROVEN, stated so acceptance does not mistake this for cleared:
+# grepping dist shows the SYMBOLS survive, not that their SIGNATURES are
+# unchanged — necessary, not sufficient. 1.0.0 is also four days of upstream old
+# (published 2026-10-01T19:15Z) and neither obsmem nor atelier has a commit
+# naming it. Acceptance must prove the obsmem workers CAP TURNS (peerDeps are
+# `*`, so a mismatch is silent) and that the atelier sidebar PAINTS.
+# USER-VISIBLE BEHAVIOUR CHANGE, deliberately NOT overridden here: 1.0.0 makes
+# the TUI fullscreen by default, which replaces the terminal's normal
+# scrollback. `tuiMode: "regular"` restores the old behaviour. No baked default
+# is set, so the image inherits upstream's choice rather than silently pinning
+# the fleet to either one.
+ARG PI_VERSION=1.0.0
 ARG PI_TOOLKIT_REF=main
 ARG PI_EXTENSIONS_REF=main
 # Repo URLs default to the canonical gitea origin but are overridable so a
@@ -243,9 +270,35 @@ ARG PI_ATELIER_REPO=https://github.com/michaelmjhhhh/pi-atelier.git
 # the no-`npm install` reasoning above holds) and peerDependencies are still
 # pi >=0.84.0, so it still spans the pinned 0.85.1. 13 commits v0.10.1..v0.10.3,
 # all under src/ tests/ docs/ scripts/ plus metadata; no entry-point move.
-ARG PI_ATELIER_REF=v0.10.3
+#
+# v1.10.0: v0.10.3 -> v0.13.0, closing the two-minor gap v1.9.5 flagged as the
+# residual risk of the pi bump. peerDependencies are UNCHANGED at pi >=0.84.0
+# across v0.10.3, v0.12.1 and v0.13.0 — still a FLOOR, so still not evidence of
+# anything; the floor is satisfied by 1.0.0 either way. What was actually
+# checked, 2026-10-02:
+#   - v0.13.0 CARRIES ITS OWN BREAKING CHANGE, unrelated to pi: "The package
+#     entry point now exports only the sidebar contribution protocol
+#     (`registerSidebarPanel`, guards, size limits, event types). The internal
+#     registry and layout helpers are no longer exported." Harmless HERE only
+#     because nothing of ours imports them: a grep for `pi-atelier` and
+#     `registerSidebarPanel` across mempalace-toolkit, pi-devbox,
+#     pi-extensions, pi-fork, pi-observational-memory and pi-studio returns
+#     ZERO matches in all six. atelier is a leaf here — it registers its own
+#     sidebar and no one consumes its API.
+#   - Settings churn in the gap, checked against our own tree: v0.12.0 REMOVED
+#     the `showSessionActions` setting (0 references here) and migrated the
+#     Control Center shortcut Alt+A -> F6 (0 references here, so no doc goes
+#     stale). `showSidebarAgent` / `showSidebarTodos`, the only atelier keys
+#     README names, are both still documented in v0.13.0's README.
+#   - The TUI internals atelier patches (`TuiMainScreen`, `renderLayoutFrame`)
+#     are both still present in pi 1.0.0's dist, and atelier's changelog shows
+#     it has handled fullscreen vs regular renderers explicitly since 0.84.
+#   - Residual: v0.13.0 is SAME-DAY upstream (2026-10-02). Acceptance proves
+#     the sidebar PAINTS with the two-sided check from 0.84.4/0.85.1 that can
+#     tell "loaded" from "silently absent" — "no crash" is not the test.
+ARG PI_ATELIER_REF=v0.13.0
 # Human-readable tag PI_ATELIER_REF was resolved from; recorded as a label.
-ARG PI_ATELIER_VERSION=v0.10.3
+ARG PI_ATELIER_VERSION=v0.13.0
 
 RUN set -e && \
     # git_fetch_ref: clone-equivalent helper that accepts EITHER a branch name