v4.0.7: finish the Phase 1 boundary with a command shell

The terminal command line moves to client::shell: a typed line becomes a core Command or an adapter action (connect, login, register, set-credential, host maintenance). ClientCore loses submit_line and the last TUI-shaped effects (Interactive, SetPrompt, ListHosts, ForgetHost, AnimateRoulette); the adapter animates roulette from the Result view.

Adds forget-login, which drops the stored credential for the pinned key and keeps trust, distinct from logout (session only) and forget-host (trust too).

1 files changed, 23 insertions, 15 deletions

diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index cb0db91..2789b81 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -24,18 +24,25 @@ Breaking wire change, released for client and server together.
 **Gate:** mismatch refused in both directions, `HELLO` required before auth,
 existing game flows unchanged, new tests for version parsing and gating.
 
-## Phase 1 — core boundary and roulette
-
-**In progress.** `Command`/`View` exist and all four games are ported: the
-core builds a typed view, frontends send `Command`, and the TUI renders it.
-Done so far: every game plus `Lobby` and `History` are structured views; the
-client transport (TCP, rustls, TOFU, `HELLO`, auto-login) lives in
-`client::transport` behind a trust callback; login and registration are
-`Command`s, so a GUI form never needs a terminal prompt. The command-line
-editor and key mapping moved to `client::input`; `ClientCore` no longer knows
-keys, the prompt or its history. Remaining: the `Connect` and `Trust` adapter
-screens, and replacing the last TUI-shaped effects (`Interactive`, host
-listing, roulette animation) with commands.
+## Phase 1 — core boundary and roulette (done)
+
+Complete in v4.0.7. Every game plus `Lobby` and `History` are structured views;
+the core builds the view and frontends send `Command`. The client transport
+(TCP, rustls, TOFU, `HELLO`, auto-login) lives in `client::transport` behind a
+trust callback. The command line moved out of the core in two pieces:
+`client::input` owns the editor, history and key mapping, and `client::shell`
+parses a finished line into a core `Command` or an adapter action (connect,
+login, register, set-credential, host maintenance). `ClientCore` no longer
+holds a `Key`, a prompt buffer, or any of the old TUI-shaped effects
+(`Interactive`, `SetPrompt`, `ListHosts`, `ForgetHost`, `AnimateRoulette`); the
+roulette wheel animation is derived from the `Result` view by the adapter.
+"Log out" (`logout`) and "forget saved login" (`forget-login`) are distinct: the
+latter drops the credential for the pinned key and keeps trust.
+
+The `Connect` and `Trust` screens are adapter-owned for now: the terminal asks
+in the transcript, and the GUI will draw them as its own screens over the same
+`client::transport` callback. They are not core state because the core never
+sees a certificate.
 
 - Introduce `Command` and `View`; move terminal-only concerns (prompt editing,
   wheel animation, interactive prompts) into the TUI adapter.
@@ -43,13 +50,14 @@ listing, roulette animation) with commands.
   `History`, `Game`.
 - Port roulette first: `PlaceBet(BetTarget)`, `SetChip`, `ClearBets`, `Spin`,
   and a `FeltView` carrying chips, cursor, and the last result.
-- Add `ForgetLogin` so "log out" and "forget saved login" are distinct in both
+- Add `forget-login` so "log out" and "forget saved login" are distinct in both
   frontends.
 - Auto-login stays: a stored credential for the pinned fingerprint logs in
   automatically after the trust check.
 
-**Gate:** the TUI behaves exactly as today, its tests now assert on `View`
-instead of text where practical, and `ClientCore` contains no terminal types.
+**Gate:** met. The TUI behaves as before (same boards, keys and prompts), its
+tests drive the real adapter path (`shell::parse`, `Editor`, `game_input`), and
+`ClientCore` contains no terminal types.
 
 ## Phase 2 — the other three games