docs: truth pass — drop phantom config, dead keys, inverted defaults

Verified each claim against the code before editing:

- [capacity]: the 15-key controller was documented in CONFIGURATION.md
  and config.example.toml but has zero matches anywhere under crates/
  — silently ignored on parse. Removed, along with the link to the
  nonexistent docs/capacity_controller.md and two prose mentions.
- [context] seam keys: verbatim_window_turns, l1/l2/l3_threshold and
  seam_model are all 'Ignored (was: …)' in crates/tui/src/config.rs
  (2036-2048); docs presented them as a live opt-in. Both files now
  document only the live keys (enabled, project_pack) and mark the
  seam keys ignored.
- Settings keys: show_thinking / thinking_default_expanded /
  cost_currency were misfiled in config.example.toml; they belong to
  ~/.codewhale/settings.toml (settings.rs:344,414) and Config has no
  deny_unknown_fields, so users got silently ignored settings.
  Replaced with a pointer comment.
- Hotbar default was inverted in docs: KEYBINDINGS.md and
  config.example.toml claimed fresh configs show the default bar;
  since #3807 a missing hotbar key renders no bar (sidebar.rs:192-195).
- MCP tool naming: docs/MCP.md claimed mcp_deepseek_shell; the rule
  is mcp_{server}_{tool} (mcp.rs:3022) with default server name
  codewhale, i.e. mcp_codewhale_shell.
- MODES.md said 'DeepSeek-TUI'; memory_path bullet described the
  deleted legacy single-file fallback — both fixed for the native
  store (see 1135a1e65).

Evidence: cross-surface-tech-debt-audit-2026-08-03.md findings 74-80;
§11.3 docs-truth row.

config.example.toml

@@ -85,17 +85,9 @@ default_text_model = "deepseek-v4-pro"
 # current tier as a ⚡ chip.
 reasoning_effort = "max"
 
-# Transcript reasoning presentation. `show_thinking` controls visibility;
-# `thinking_default_expanded` changes only the initial fold state. Space still
-# toggles an individual thinking block either way.
-show_thinking = true
-thinking_default_expanded = false
-
-# ─────────────────────────────────────────────────────────────────────────────────
-# Cost Display
-# ─────────────────────────────────────────────────────────────────────────────────
-# Display estimated usage in USD or CNY. Aliases `yuan` and `rmb` normalize to `cny`.
-cost_currency = "usd" # usd | cny
+# NOTE: `show_thinking`, `thinking_default_expanded`, and `cost_currency`
+# live in `~/.codewhale/settings.toml`, not here — `Config` has no such
+# fields and unknown keys are ignored. See crates/tui/src/settings.rs.
 
 # ─────────────────────────────────────────────────────────────────────────────────
 # Startup update check
@@ -110,10 +102,9 @@ check_for_updates = true
 # ─────────────────────────────────────────────────────────────────────────────────
 # Hotbar slots (#2061 / #2064)
 # ─────────────────────────────────────────────────────────────────────────────────
-# Optional 1-8 sidebar hotbar bindings. When no [[hotbar]] tables are present,
-# the TUI uses built-in defaults:
-#   1 voice.toggle      2 session.compact   3 mode.plan        4 mode.agent
-#   5 mode.operate      6 palette.open      7 sidebar.toggle   8 trust.toggle
+# Optional 1-8 sidebar hotbar bindings. Since #3807 a missing `hotbar` key
+# renders NO bar — the Hotbar is hidden until you configure [[hotbar]]
+# tables here (or via `/hotbar`). An explicit `hotbar = []` also disables it.
 #
 # Invalid slots are skipped with a warning, duplicate slots use the last entry,
 # and unknown actions are preserved so the UI can show a disabled entry.
@@ -899,17 +890,9 @@ exponential_base = 2.0
 # `[compaction]` table yet; runtime compaction budgets are chosen by the TUI
 # from the active model/context window.
 
-# Append-only Flash seams (layered context). Opt-in; defaults to off.
-# See `crates/tui/src/seam_manager.rs` for the implementation.
-[context]
-enabled = false
-verbatim_window_turns = 16
-# Thresholds are based on the active request input estimate, not lifetime
-# summed API usage.
-l1_threshold = 192000
-l2_threshold = 384000
-l3_threshold = 576000
-seam_model = "deepseek-v4-flash"
+# [context] supports `enabled` (default false) and `project_pack` (#4781).
+# The old seam-manager keys (verbatim_window_turns, l1/l2/l3_threshold,
+# seam_model) are parsed but ignored — seam_manager.rs no longer exists.
 
 # ─────────────────────────────────────────────────────────────────────────────────
 # Workshop / Large-Output Routing (#548)
@@ -931,26 +914,6 @@ seam_model = "deepseek-v4-flash"
 # grep_files  = 2048
 # web_search  = 8192   # web results can be large; give them more room
 
-# ─────────────────────────────────────────────────────────────────────────────────
-# Capacity Controller (runtime pressure guardrails)
-# ─────────────────────────────────────────────────────────────────────────────────
-[capacity]
-enabled = false
-low_risk_max = 0.50
-medium_risk_max = 0.62
-severe_min_slack = -0.25
-severe_violation_ratio = 0.40
-refresh_cooldown_turns = 6
-replan_cooldown_turns = 5
-max_replay_per_turn = 1
-min_turns_before_guardrail = 4
-profile_window = 8
-deepseek_v3_2_chat_prior = 3.9
-deepseek_v3_2_reasoner_prior = 4.1
-deepseek_v4_pro_prior = 3.5
-deepseek_v4_flash_prior = 4.2
-fallback_default_prior = 3.8
-
 # ─────────────────────────────────────────────────────────────────────────────────
 # Harness Profiles (preview schema; runtime consumption follows later)
 # ─────────────────────────────────────────────────────────────────────────────────

docs/CONFIGURATION.md

@@ -292,7 +292,7 @@ Supported keys in the project overlay (top-level fields only):
 
 The overlay is intentionally narrow — it covers the fields a repo
 maintainer is most likely to want to standardize across contributors.
-Credential, endpoint, provider-selection, MCP config, hooks, skills, capacity,
+Credential, endpoint, provider-selection, MCP config, hooks, skills,
 retry, hotbar bindings, and `instructions = [...]` settings stay user-global.
 If a repo-local config declares `api_key`, `base_url`, `provider`,
 `mcp_config_path`, `hotbar`, `allow_shell = true`, or `instructions`,
@@ -1393,9 +1393,7 @@ For known context-window models, including 1M-class V4 models, replacement
 compaction is enabled by default unless the user explicitly configures
 `auto_compact = false`. It fires at the active model's compaction threshold and
 replays the generated summary through the stable system prompt on the next
-request. Unknown model ids remain opt-in. The Flash seam manager remains opt-in
-(`[context].enabled = false`), and the capacity controller remains disabled
-unless configured.
+request. Unknown model ids remain opt-in.
 
 ### Command Migration Notes
 
@@ -1690,12 +1688,12 @@ If you are upgrading from older releases:
   enables `# foo` quick-capture in the composer, surfaces the `/memory`
   slash command, and registers the `remember` tool. The same toggle is
   available via `DEEPSEEK_MEMORY=on`.
-- `memory_path` (string, optional): defaults to `~/.codewhale/memory.md`, with
-  legacy `~/.deepseek/memory.md` fallback when the Codewhale path is absent.
-  Used by the user-memory feature when enabled — see
-  [`MEMORY.md`](MEMORY.md) for the full feature surface (`# foo`
-  composer prefix, `/memory` slash command, `remember` tool, opt-in
-  toggle).
+- `memory_path` (string, optional): anchors the native memory store. When
+  memory is enabled the store lives in a `memory/` directory beside this
+  path (`memory/global/MEMORY.md` plus workspace-scoped files and a
+  rebuildable SQLite FTS5 index) — see [`MEMORY.md`](MEMORY.md) for the
+  full feature surface (`# foo` composer prefix, `/memory` slash command,
+  `remember` tool, opt-in toggle).
 - `snapshots.*` (optional): side-git workspace snapshots for file rollback:
   - `[snapshots].enabled` (bool, default `true`)
   - `[snapshots].max_age_days` (int, default `7`)
@@ -1703,40 +1701,21 @@ If you are upgrading from older releases:
     `~/.codewhale/snapshots/<project_hash>/<worktree_hash>/.git`, with legacy
     `~/.deepseek/snapshots/...` fallback when only the legacy state exists, and
     never use the workspace's own `.git` directory
-- `context.*` (optional): append-only Fin seam manager, currently opt-in.
-  Fin is the fast `deepseek-v4-flash` path with thinking off used for
-  coordination work such as routing, summaries, and context maintenance.
-  Thresholds use the active request input estimate, not lifetime summed API
-  usage:
+- `context.*` (optional):
   - `[context].enabled` (bool, default `false`)
-  - `[context].verbatim_window_turns` (int, default `16`)
-  - `[context].l1_threshold` (int, default `192000`)
-  - `[context].l2_threshold` (int, default `384000`)
-  - `[context].l3_threshold` (int, default `576000`)
-  - `[context].seam_model` (string, default `deepseek-v4-flash`)
+  - `[context].project_pack` (bool, default `false`): include a deterministic
+    project context pack (a large pretty-printed directory listing) in the
+    stable prompt prefix (#4781). Useful for weak tool-calling models; the
+    model can rebuild the same information with one `File` call.
+  - The former seam-manager keys (`verbatim_window_turns`, `l1_threshold`,
+    `l2_threshold`, `l3_threshold`, `seam_model`) are **ignored** — parsed
+    for backward compatibility but read nowhere since 2026-07-23.
 - `retry.*` (optional): retry/backoff settings for API requests:
   - `[retry].enabled` (bool, default `true`)
   - `[retry].max_retries` (int, default `3`)
   - `[retry].initial_delay` (float seconds, default `1.0`)
   - `[retry].max_delay` (float seconds, default `60.0`)
   - `[retry].exponential_base` (float, default `2.0`)
-- `capacity.*` (optional): runtime context-capacity controller. This is opt-in
-  because its active interventions can rewrite the live transcript.
-  - `[capacity].enabled` (bool, default `false`)
-  - `[capacity].low_risk_max` (float, default `0.50`)
-  - `[capacity].medium_risk_max` (float, default `0.62`)
-  - `[capacity].severe_min_slack` (float, default `-0.25`)
-  - `[capacity].severe_violation_ratio` (float, default `0.40`)
-  - `[capacity].refresh_cooldown_turns` (int, default `6`)
-  - `[capacity].replan_cooldown_turns` (int, default `5`)
-  - `[capacity].max_replay_per_turn` (int, default `1`)
-  - `[capacity].min_turns_before_guardrail` (int, default `4`)
-  - `[capacity].profile_window` (int, default `8`)
-  - `[capacity].deepseek_v3_2_chat_prior` (float, default `3.9`)
-  - `[capacity].deepseek_v3_2_reasoner_prior` (float, default `4.1`)
-  - `[capacity].deepseek_v4_pro_prior` (float, default `3.5`)
-  - `[capacity].deepseek_v4_flash_prior` (float, default `4.2`)
-  - `[capacity].fallback_default_prior` (float, default `3.8`)
 - `[notifications].method` (string, optional): `auto`, `osc9`, `bel`, or
   `off`. Defaults to `auto`. The TUI fires this on completed (successful)
   turns whose elapsed time meets `threshold_secs`; failed and cancelled
@@ -2050,8 +2029,6 @@ allowed_sandbox_modes = ["read-only", "workspace-write"]
 
 If configured values violate requirements, startup fails with a descriptive error.
 
-See `docs/capacity_controller.md` for formulas, intervention behavior, and telemetry.
-
 ## Notes On `codewhale-tui doctor`
 
 `codewhale-tui doctor` follows the same config resolution rules as the rest of the

docs/KEYBINDINGS.md

@@ -91,7 +91,7 @@ Hotbar trigger semantics are intentionally `Alt-1` through `Alt-8` only. On macO
 
 Function keys and `Cmd-1` through `Cmd-8` are not the primary Hotbar chords. Many terminals reserve those keys for tabs, windows, or OS shortcuts, and some never forward them to terminal apps. If a terminal is configured to send `Alt-1` for a custom shortcut, the Hotbar receives the same reliable chord.
 
-Fresh configs resolve to this default bar unless `[[hotbar]]` overrides it or `hotbar = []` disables it:
+Since #3807 a missing `hotbar` key renders **no bar** — fresh configs show no Hotbar until you configure `[[hotbar]]` slots (an explicit `hotbar = []` also disables it). When configured, a bar looks like:
 
 | Slot | Chord   | Default action     | Label     |
 |------|---------|--------------------|-----------|

docs/MCP.md

@@ -348,11 +348,12 @@ correct binary.
 
 ### Tool Naming
 
-Tools from a self-hosted DeepSeek server follow the standard naming convention:
+Tools from an MCP server follow the standard naming convention:
 
-- `mcp_deepseek_<tool>` (if the server is named `codewhale`)
+- `mcp_<server>_<tool>`
 
-For example, the `shell` tool becomes `mcp_deepseek_shell`.
+For example, the `shell` tool from the default server (named `codewhale`)
+becomes `mcp_codewhale_shell`.
 
 ### MCP Server vs HTTP/SSE API vs ACP
 

docs/MODES.md

@@ -239,7 +239,7 @@ Run `codewhale --help` for the canonical list. Common flags:
 
 ## Branching and Rollback
 
-DeepSeek-TUI has three related but intentionally separate recovery paths:
+Codewhale has three related but intentionally separate recovery paths:
 
 - `codewhale fork <ID>` creates a new saved session from an existing saved
   conversation and records the source session id. This is the safe way to