v4.0.7: finish the Phase 1 boundary with a command shell

The terminal command line moves to client::shell: a typed line becomes a core Command or an adapter action (connect, login, register, set-credential, host maintenance). ClientCore loses submit_line and the last TUI-shaped effects (Interactive, SetPrompt, ListHosts, ForgetHost, AnimateRoulette); the adapter animates roulette from the Result view.

Adds forget-login, which drops the stored credential for the pinned key and keeps trust, distinct from logout (session only) and forget-host (trust too).

2 files changed, 29 insertions, 19 deletions

diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index cb0db91..2789b81 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -24,18 +24,25 @@ Breaking wire change, released for client and server together.
 **Gate:** mismatch refused in both directions, `HELLO` required before auth,
 existing game flows unchanged, new tests for version parsing and gating.
 
-## Phase 1 — core boundary and roulette
-
-**In progress.** `Command`/`View` exist and all four games are ported: the
-core builds a typed view, frontends send `Command`, and the TUI renders it.
-Done so far: every game plus `Lobby` and `History` are structured views; the
-client transport (TCP, rustls, TOFU, `HELLO`, auto-login) lives in
-`client::transport` behind a trust callback; login and registration are
-`Command`s, so a GUI form never needs a terminal prompt. The command-line
-editor and key mapping moved to `client::input`; `ClientCore` no longer knows
-keys, the prompt or its history. Remaining: the `Connect` and `Trust` adapter
-screens, and replacing the last TUI-shaped effects (`Interactive`, host
-listing, roulette animation) with commands.
+## Phase 1 — core boundary and roulette (done)
+
+Complete in v4.0.7. Every game plus `Lobby` and `History` are structured views;
+the core builds the view and frontends send `Command`. The client transport
+(TCP, rustls, TOFU, `HELLO`, auto-login) lives in `client::transport` behind a
+trust callback. The command line moved out of the core in two pieces:
+`client::input` owns the editor, history and key mapping, and `client::shell`
+parses a finished line into a core `Command` or an adapter action (connect,
+login, register, set-credential, host maintenance). `ClientCore` no longer
+holds a `Key`, a prompt buffer, or any of the old TUI-shaped effects
+(`Interactive`, `SetPrompt`, `ListHosts`, `ForgetHost`, `AnimateRoulette`); the
+roulette wheel animation is derived from the `Result` view by the adapter.
+"Log out" (`logout`) and "forget saved login" (`forget-login`) are distinct: the
+latter drops the credential for the pinned key and keeps trust.
+
+The `Connect` and `Trust` screens are adapter-owned for now: the terminal asks
+in the transcript, and the GUI will draw them as its own screens over the same
+`client::transport` callback. They are not core state because the core never
+sees a certificate.
 
 - Introduce `Command` and `View`; move terminal-only concerns (prompt editing,
   wheel animation, interactive prompts) into the TUI adapter.
@@ -43,13 +50,14 @@ listing, roulette animation) with commands.
   `History`, `Game`.
 - Port roulette first: `PlaceBet(BetTarget)`, `SetChip`, `ClearBets`, `Spin`,
   and a `FeltView` carrying chips, cursor, and the last result.
-- Add `ForgetLogin` so "log out" and "forget saved login" are distinct in both
+- Add `forget-login` so "log out" and "forget saved login" are distinct in both
   frontends.
 - Auto-login stays: a stored credential for the pinned fingerprint logs in
   automatically after the trust check.
 
-**Gate:** the TUI behaves exactly as today, its tests now assert on `View`
-instead of text where practical, and `ClientCore` contains no terminal types.
+**Gate:** met. The TUI behaves as before (same boards, keys and prompts), its
+tests drive the real adapter path (`shell::parse`, `Editor`, `game_input`), and
+`ClientCore` contains no terminal types.
 
 ## Phase 2 — the other three games
 
diff --git a/docs/adr/0001-testable-client-server-cores.md b/docs/adr/0001-testable-client-server-cores.md
index 2e3cd1e..c19c01a 100644
--- a/docs/adr/0001-testable-client-server-cores.md
+++ b/docs/adr/0001-testable-client-server-cores.md
@@ -16,10 +16,12 @@ exercised from `tests/`.
 - The library (`src/lib.rs`) owns shared logic. `src/bin/client` and
   `src/bin/server` are thin adapters for crossterm, TLS, environment variables,
   and interactive prompts.
-- `client::core::ClientCore` owns input, history, commands, game state, and
-  pending replies. It returns `Effect`s (`Print`, `ReplaceRegion`, `ClearRegion`,
-  `SetPrompt`, `SendLine`, `Interactive`, ...). The binary applies them; the
-  tests apply them to a headless screen.
+- `client::core::ClientCore` owns commands, game state, the current screen, and
+  pending replies. It returns `Effect`s (`Print`, `Render(View)`, `ClearRegion`,
+  `SendLine`, `Disconnect`, `Quit`). The binary applies them; the tests apply
+  them to a headless screen. The prompt buffer, history and key mapping live in
+  `client::input`, and `client::shell` parses a finished line, so the core never
+  sees a `Key` or a raw command line.
 - `server::core::ServerCore` owns message handling and receives an injected
   `Connection`, `GameRegistry`, and bcrypt cost. The binary only owns the TLS
   listener and per-connection thread.