A time in no particular zone, and a preview missing what it previews

The first audit pass: everything from 0.8.1 to 0.9.8 read as a whole rather
than one feature at a time, starting with what a model is actually told.

Four of these had shipped as correct. The date line carried a timezone
variable that resolves to nothing until somebody chooses one -- so every
default account was told times were "in  unless they say otherwise", while
two comments asserted the line disappeared instead. The prompt preview
built its variables without a chat, which is what eleven fragments are
gated on, so the whole agent surface was absent from it whatever was
ticked. Plan mode was instructed to keep its plan current with a tool that
mode withdraws. And knowledge_get returned a document whole where every
sibling reader caps and says so, its description promising exactly that.

The subagent guidance was wrong in both directions at once: it denied a
documented parameter and named seven of twenty-three allowed commands.
Both halves are pinned by tests against the real list and the real schema
now, because prose and a constant drift the moment one is edited alone.

docs/notes/audit-0.9.md carries the findings that are not fixed here, with
why -- the ones whose fix would change what a feature does are the user's
call, not this pass's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -16,6 +16,42 @@ for 1.0.0 have something to be assembled from.
 
 ## Unreleased
 
+## 0.9.9
+
+**The first of five audit passes before 1.0.0** — everything that landed between
+0.8.1 and 0.9.8 read as a whole rather than one feature at a time. This one is
+the main logic, the harness, and every instruction a model is given.
+
+- Fixed: **every model was told the time in a zone with no name.** On any
+  account that had not chosen a timezone — which is the default state of every
+  account — the date line shipped as "Times the person gives you are in
+  unless they say otherwise", on every request. The code claimed in two places
+  that the line disappeared instead. It never had.
+- Fixed: **the prompt preview could not show most of what it previews.** Eleven
+  fragments are gated on things that only exist once there is a real chat, and
+  the preview has none — so the whole agent surface, both scheduling fragments
+  and the helper warning were missing from it whatever you ticked. Editing
+  `tool.agent` and pressing preview showed a system message without `tool.agent`
+  in it, and nothing said so. Two new controls come with the fix: what kind of
+  chat to preview as, and which agent mode.
+- Fixed: **a model in Plan mode was told to use a tool it did not have.**
+  `plan_update` is withdrawn in that mode in favour of `plan_submit`, but its
+  guidance appeared whenever a plan existed — directly under the line saying
+  anything not in your tool list does not exist.
+- Fixed: **reading one knowledge document could fill the whole context window.**
+  Every other reader caps what it returns and says so; this one returned the
+  document whole, and its description said "in full", so it did exactly what it
+  claimed. A long PDF is now cut at 40,000 characters with the model told.
+- Fixed: **the guidance about helpers on a machine was wrong in both
+  directions.** It denied that a helper can write files, which is a documented
+  option of the tool beside it, and it named seven of the twenty-three commands
+  a helper may run — so a model avoided commands it was allowed to use. Both are
+  now checked against the real list and the real schema by tests, because prose
+  and a constant drift the moment one is edited alone.
+- The tool description for delegating no longer claims a helper gets "the same
+  tools". It gets deliberately fewer, and sizing a task against the wrong set is
+  how a whole phase gets planned around something that will refuse it.
+
 - The Updates page notices when the update helper on a host was installed for a
   **different channel** than the page follows. It is declared in two places —
   `lembas.env` and the systemd unit — and only the installer writes both, so