feat: rename CUT3 → Rowl branding

.docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture
 
-CUT3 ships as a shared web app plus an optional Electron desktop shell, backed by a Node.js server that exposes HTTP/WebSocket APIs and routes work to provider-specific runtimes.
+Rowl ships as a shared web app plus an optional Electron desktop shell, backed by a Node.js server that exposes HTTP/WebSocket APIs and routes work to provider-specific runtimes.
 
 ```
 ┌──────────────────────────────┐
@@ -33,4 +33,4 @@ CUT3 ships as a shared web app plus an optional Electron desktop shell, backed b
 - `apps/server` serves the built UI, validates WebSocket requests, owns orchestration, and routes provider-native work through the provider layer.
 - Codex uses `codex app-server` over JSON-RPC stdio.
 - GitHub Copilot, OpenCode, and Kimi Code use ACP-backed runtime managers.
-- Pi uses the embedded `@mariozechner/pi-coding-agent` Node SDK while CUT3 keeps Pi packages, resource discovery, and system-prompt discovery disabled.
+- Pi uses the embedded `@mariozechner/pi-coding-agent` Node SDK while Rowl keeps Pi packages, resource discovery, and system-prompt discovery disabled.

.docs/ci.md

@@ -6,7 +6,7 @@
 - `.github/workflows/release.yml` still builds macOS (`arm64` and `x64`), Linux (`x64`), and Windows (`x64`) desktop artifacts from a single `v*.*.*` tag and publishes one GitHub release.
 - The release workflow preflight reruns the browser suite plus the Linux desktop build/smoke path before the per-platform packaging matrix starts, aligns package versions to the release tag, then archives and uploads the prebuilt `apps/desktop/dist-electron` and `apps/server/dist` bundle so each packaging job can extract it and reuse `--skip-build` instead of rebuilding the JS pipeline four times.
 - Release jobs now cache Bun/Turbo and Electron downloads, upload binary artifacts with `compression-level: 0`, and publish a `SHA256SUMS` manifest after verifying the downloaded release assets.
-- The release workflow still auto-enables signing when Apple or Azure Trusted Signing secrets are present, and it can now be hardened to fail macOS/Windows releases if signing secrets are missing by setting `CUT3_REQUIRE_SIGNING=true` or using the `require_signing` workflow-dispatch input.
+- The release workflow still auto-enables signing when Apple or Azure Trusted Signing secrets are present, and it can now be hardened to fail macOS/Windows releases if signing secrets are missing by setting `ROWL_REQUIRE_SIGNING=true` or using the `require_signing` workflow-dispatch input.
 - The release workflow also supports a non-mutating `workflow_dispatch` dry run via `dry_run=true`; that path builds and validates the full release asset set, uploads a workflow artifact, and skips both GitHub Release publishing and the final version-bump push to `main`.
-- CLI npm publishing is optional and no longer blocks GitHub Releases; enable it with the `publish_cli` workflow-dispatch input or the `CUT3_PUBLISH_CLI=true` repository variable.
+- CLI npm publishing is optional and no longer blocks GitHub Releases; enable it with the `publish_cli` workflow-dispatch input or the `ROWL_PUBLISH_CLI=true` repository variable.
 - See `docs/release.md` for the full release/signing/checksum checklist.

.docs/encyclopedia.md

@@ -1,6 +1,6 @@
 # Encyclopedia
 
-This is a living glossary for CUT3. It explains what common terms mean in this codebase.
+This is a living glossary for Rowl. It explains what common terms mean in this codebase.
 
 ## Table of contents
 
@@ -29,7 +29,7 @@ A Git worktree used as an isolated workspace for a thread. If a thread has a `wo
 
 #### Repo-local skill
 
-A repo-owned instruction artifact discovered from `.cut3/skills/<name>/SKILL.md` and attachable per turn from the composer. Each skill must declare `name` and `description`, and `name` must match the lowercase hyphenated directory name. See [projectWorkspaceMetadata.ts][32] and [ComposerSkillPicker.tsx][33].
+A repo-owned instruction artifact discovered from `.rowl/skills/<name>/SKILL.md` and attachable per turn from the composer. Each skill must declare `name` and `description`, and `name` must match the lowercase hyphenated directory name. See [projectWorkspaceMetadata.ts][32] and [ComposerSkillPicker.tsx][33].
 
 ### Thread timeline
 

.docs/provider-architecture.md

@@ -16,7 +16,7 @@ Current push channels include:
 Request bodies cover more than provider lifecycle calls. The WebSocket surface currently includes:
 
 - orchestration commands and diff/snapshot queries
-- project registry search/write operations, including workspace `AGENTS.md` discovery/drafting, `.cut3/commands/*.md` template discovery, and `.cut3/skills/<name>/SKILL.md` discovery
+- project registry search/write operations, including workspace `AGENTS.md` discovery/drafting, `.rowl/commands/*.md` template discovery, and `.rowl/skills/<name>/SKILL.md` discovery
 - thread collaboration and history operations, including share create/get/revoke/import, compaction, undo, redo, and redo-status queries
 - shell/editor integration
 - git operations
@@ -29,16 +29,16 @@ Provider-native runtime details are hidden behind the server provider layer:
 - **GitHub Copilot**: ACP-backed runtime sessions
 - **OpenCode**: ACP-backed runtime sessions through `opencode acp`
 - **Kimi Code**: ACP-backed runtime sessions, with optional API-key-backed startup
-- **Pi**: embedded `@mariozechner/pi-coding-agent` Node SDK sessions with CUT3-owned approval gating and Pi resource discovery disabled
+- **Pi**: embedded `@mariozechner/pi-coding-agent` Node SDK sessions with Rowl-owned approval gating and Pi resource discovery disabled
 
 Unexpected provider exits are reduced into orchestration session state as stopped sessions that still preserve the runtime exit reason in `thread.session.lastError`, so crashes do not render as silent clean stops in the UI.
 
 When a thread resolves to a workspace root and that workspace contains `AGENTS.md`, the server-side provider reactor wraps each outgoing provider turn with the contents of that file before dispatching the turn to the active provider runtime. This keeps workspace instructions provider-agnostic instead of relying on a provider-specific session bootstrap mechanism.
 
-Pi is the main exception to the repo's usual external-CLI pattern: CUT3 embeds Pi through its Node SDK, reuses Pi auth/models config from `~/.pi/agent`, and keeps Pi packages, AGENTS files, system prompts, extensions, skills, prompt templates, and themes disabled so Pi threads do not double-apply repo instructions that CUT3 already injects.
+Pi is the main exception to the repo's usual external-CLI pattern: Rowl embeds Pi through its Node SDK, reuses Pi auth/models config from `~/.pi/agent`, and keeps Pi packages, AGENTS files, system prompts, extensions, skills, prompt templates, and themes disabled so Pi threads do not double-apply repo instructions that Rowl already injects.
 
 Codex, GitHub Copilot, OpenCode, Kimi Code, and Pi are the currently implemented providers. Gemini is a visible coming-soon entry in the picker, and `claudeCode` plus `cursor` remain unavailable placeholders for future support.
 
-In the current OpenCode phase, CUT3 still treats credential storage and OAuth flows as provider-owned concerns, but it now inspects OpenCode's resolved config paths plus `opencode auth list`, `opencode mcp list`, and `opencode mcp auth list` to surface provider credentials and MCP status in both Settings and `server.getConfig`. CUT3 still launches `opencode acp`, consumes its ACP model/session events, and applies per-session runtime-mode overrides through `OPENCODE_CONFIG_CONTENT` rather than proxying the underlying auth flows itself.
+In the current OpenCode phase, Rowl still treats credential storage and OAuth flows as provider-owned concerns, but it now inspects OpenCode's resolved config paths plus `opencode auth list`, `opencode mcp list`, and `opencode mcp auth list` to surface provider credentials and MCP status in both Settings and `server.getConfig`. Rowl still launches `opencode acp`, consumes its ACP model/session events, and applies per-session runtime-mode overrides through `OPENCODE_CONFIG_CONTENT` rather than proxying the underlying auth flows itself.
 
 For the researched GLM Coding Plan and MiniMax roadmap, see [./glm-minimax-support-plan.md](./glm-minimax-support-plan.md).