Releases

Release notes for aterm, newest first. Each entry links its tag; the current download is on /aterm, and every release with its assets and .sha256 sidecars is on github.com/alabsystems/aterm/releases.

v0.147.02026-10-30

aterm v0.147.0

2026-10-30 · 320 changes since v0.146.0

Fixes

gui: no hwkey key answers a confirmation, whatever window it names
keeper: harden socket/log symlink and ownership checks and fence companion refusals per request
accounts: exclude renewal bookkeeping from login enrollment
accounts: fence explicit renewal against vanished login files
search, sixel, bootstrap-verify: guard empty column spans, sixel param slots, and nsswitch/group checks
secrets, uds: a vault holder ends its registrations before the Mac sleeps
secrets: rounds while the Mac sleeps never take alab-secrets unprobed at the wake
secrets: a server that cannot hear this Mac's sleep says so
secrets: a sleep thread that failed is not logged as a timeout
wayland: guard OwnedFd fds, serial wraparound, v1 output done, late offers, and bind versions
grapheme, pty, update-core: harden line\_break marks, child env upsert, and private-dir/lock bounds
toolchain, control, session: harden deadlines, pipe bounds, RFC 8259 strings, and reply landing hooks
gui: a confirmation fences the key queue as it opens, so no queued hwkey key answers it
gui: the key fence holds the Windowed proof before it asks AppKit for the app
db: move a directory at the claims ring state aside, so claims go on (F19)
db: a rebuilt claims ring state keeps its floor and finds every old table (F19)
db: a clock back from running ahead reads its peers again at once (F19)
db: the catalog's tables leave the claims ring its storage slots (F19)
db: a clock behind its claims floor records no claim (F19 review)
secrets: a Mac left in to carry on and then removed never strands the Undo
secrets: Macs let in through the remover's entrants never acknowledge its acts
secrets: removing the remover contests its acts instead of acknowledging them
secrets: a bare m\<N\> that is also a host name names every Mac it matches
secrets: an Undo names the incarnation of the remover that has removals to undo
secrets: revoke sends a Mac the log does not seat to the admin's revoke
secrets: a Mac the log lets back in loses the deny rows its removal wrote
agent: survey\_facts names deny rows' labels without aterm-secrets off unix

Tests

accounts: reject checkpoint-only login enrollment and recovery
accounts: give the completed-init fixture a provider profile
agent: this crate's tests read no host names
two live turns wait the hang detector for their submit, not the verb's 2 s window
fabric: three bus reads wait the harness's IO bound, not the product's 3 s
worker\_spawn: wait for the roster's placement columns before judging them
secrets: a POST after a torn tail, and one that makes a full store drop a record, write the file whole
secrets: a will-sleep through the server's own listener wiring ends its registration until the wake
census: the denied node\_key census test names this Mac m1 from a scratch aterm.toml
date initial account input before wrong-account holds
prepare lab worlds under short scratch roots
handoff: v0.146.0's producer fixtures, written by its own cut
census: main's node-key deny test names this Mac m1 from a scratch aterm.toml, not the host's name
lift must-answer waits off product budgets in link, atpkg, http, release, update
lift must-answer waits off product budgets in aterm-db and aterm-secrets
lift must-answer waits off product budgets in aterm-gui and aterm-pty
format the hang-detector lifts in aterm-db, aterm-secrets, aterm-gui and aterm-pty
close the hang-detector gaps a hostile review of the lifts found
aterm-secrets' own envelope reads wait the hang detector

Docs

secrets: say when a refused member resends its store, and every case a records file is written whole
vitals: clarify macOS free memory excludes speculative pages
db: say only what the claims-ring fixes back (F19 review)

Other

Add preserved two-host Commons startup fixtures
Record physical ordinary-startup Commons convergence
secrets: bound publish\_local\_node\_key locks and enforce log recipient exclusions in observe\_commons
db: use read-only Journal::read\_existing in runtime pending poll and observe\_contacts
fleet: a test of the binary sets a join's wait for its issuer through a dev seam
ctl: a test sets a discovery probe's wait through a dev seam
ctl: redial tests lift the probe cap for a server that serves
fleet: init tests whose listener serves wait the hang detector for its proof
net: fleet test listeners give an in-process dialer the hang detector
style: format …'s after\_host\_gone and …'s serves\_new\_key look
ctl: a test sets a connect's accept patience, on its thread or through a dev seam
upgrade: the roster-aside tests read their fakes under the hang detector
fleet: a leave whose every peer serves in process reads them under the hang detector
ctl: with\_accept\_within is a unix tests' setter
net: the descriptor-scan test's drain control reuses one pair until it drains
ctl: the dev-seams feature's comment names both seams it turns on
Format with trustfmt
secrets: read settled control journal lock-free in writer\_here
ctl: the last two redial tests lift the probe cap for a server that serves
secrets: a server's store with no genesis takes records only with the genesis that roots them
secrets: a join flood takes the newest fresh row, never one that asked again
secrets: a publish lets the state lock go before its PUTs
secrets: a records POST copies no record's bytes and appends what it adds
style: trustfmt server.rs
secrets: a full desk takes a row of the most crowded sources, never a newcomer's first
Preserve ordinary host run output and identify instance followers
agent: detect\_machine\_id reads no host name and no real home in its crate's tests
agent,docs: a test reaches the pool's host-name fallback again; census and R8 text say what is true
Remove redundant inner unsafe block around safe offer destroy wrappers
secrets: preserve log audience exclusions across overlay/publish and accept followed signers in prepare\_account\_decision
style(secrets): the wiring test names its handler type for tippy's type\_complexity
secrets: overlay log Commons membership on unstamped envelopes and filter Commons hosts
secrets: include unproved founders and \[everyone\] exclusions in roster labels and revoke repair
secrets: filter denied 64-hex node\_keys and merge branch node\_keys in reconcile\_merged\_metadata
db: enforce log audience exclusions in check\_log\_witness and verify\_peer\_against\_local\_log
lab: make the prepared-world tests' parent under /tmp, not $TMPDIR
Add expiry boundary regressions for account wall advice
Use supported ordering in the planning model
Resume retained quota walls after their recorded expiry
harness: the quiet upgrade tells an agent whose own work holds its move
harness: the window's old break door forwards to the guarded one
harness: the quiet tell promises only a move aterm can make
harness: the shared move plan names its result and goes by value
supervise: a break tells its host a task landed under Land, tested
harness: the quiet tell's plan gate goes before the build probe
supervise: a tape from before the guarded break door replays the old one
harness: two of main's relaunch tests name the upgrade's tell
secrets,agent: enforce deny-lists in swarm label, pool identity, mail relay, and census
agent: tests pin the machine choices and the Muse goal store that this crate's test arms skip
Correct remote-hold recovery advice for merged fleet membership
accounts: harden the automation on main's design (round 2 of the review)
Ignore future mailbox timestamps before selecting renewal input changes
Keep account admission controls within their clock and platform
agent: bind node\_keys in roster\_identities and census, enforce deny-lists in names\_this\_machine
agent: resolve age1 recipients in census server\_heard and enforce deny-lists in survey\_facts
Keep mapped Unix build outputs while their processes still use them
Exercise complete-but-cut and oversized mapping observations
Name the mapping witness as an explicit pointer read
Keep every possible owner of an ambiguous Linux mapping
Keep mappings visible beside the removers own lock descriptors
secrets: enforce roster deny-lists and log exclusions across steward lease, standby server, and admin checks
Finish merged-book diagnostics and measure sweep progress
Compose sink Landing arg and Watch::enter onto merged origin/main
Use usize::clamp in Sink::drain\_loop
Update trust floor ratchets
Gate Unix-only aterm\_secrets call in survey\_facts::resolve\_machine\_label
secrets,agent,cli: expire denied lease holders and filter stale denied account claims
agent,primer,cli,docs: Cruise and Land answer a park on a go-ahead for the agent's own work (go-ahead@v1)
prism-glass 1 fix: trail-diff fails a light arm on a dark ground
prism-glass 1 fix: the yield's state goes with the light
prism-glass 1 fix: every route that lays the glass again yields it
prism-glass 1 fix: a composed frame's yield reads its own pane
prism-glass 1 fix: the yield keeps the spec's bar, measured on the shipped glass
prism-glass 1 fix: the Settings preview keeps the page law
prism-glass 1 fix: the dark pin's glass reads are wired through the app
prism-glass 1 fix: the dump honours page wallpaper and pane themes
prism-glass 1 fix: the light corpus compares the live level with main's paper arm
aterm-release: the proved (calculus) counter reads Trust's VF5 calculus authority
aterm-release: the proved (calculus) counter refuses every line Trust would not write
aterm-release: trust\_credit formatted (verify fmt --fix)
secrets,db,net,gui,agent: enforce deny-lists across toolset peers, Commons enrollment, lease expiry, and copy\_again
secrets,agent: enforce roster deny-lists and node\_key exclusions across log entries, admit, drive grants, and standby stewards
Fix agent lint failures found by the wide networking check
Specify account identity credit for alternate login completion
Distinguish alternate account publication from requested renewal
Collapse the denied-member admission condition
Trail review9 fixes (work in progress): Comet air rows, mono ring latch, cat's wide steps, bolt girth, bar latch, Sparkle pin, combining marks
Trail review9 fixes (work in progress): the companion keeps off a lettered row above, trail-companion reads
settings\_preview: the head-law test builds
settings\_preview: the companion's row bound reads the head law, and the shipped specimen is held to it
kitty\_pet: a bound under a lettered row keeps its head under it, and the sink reads a bound's whole way
cursor\_glow: a pinned colour is Sparkle's paper star too
aterm-effects: a chosen colour lands as itself on paper
aterm-effects, aterm-gui, aterm-render: fit the companion to its row between lettered rows; a chosen colour charges in its own hue
aterm-effects: the console judges the box the head law draws
aterm-gui: the preview reads the head law's fit without a test seam it cannot reach
aterm-effects: the typing-momentum glow wears a chosen colour in its own hue and chroma
aterm-effects: the momentum chosen-colour test judges the glow's own quads, beside Classic too
aterm-effects: Classic's paper wake wears a chosen colour in its own hue and chroma
aterm-effects: a stance's stretch never carries the pet onto the caret's cell
aterm-effects: a departing ghost keeps the edge its body's stretch kept
aterm-effects: the stretch-off-caret test names its row type
aterm-effects: a run off a held landing sets out from the pose on glass
aterm-effects: the head law reads the last row, holds across gaps and looks ahead; a strike's narrow control reverts its girth alone
Themes keeping: a reused list keeps its frame, a press's reveal parts from main no more
Themes keeping: a press that moved the keyboard away holds no place for a status
Themes keeping: R2's chosen-anew rule has a control and a line among the rules
Themes keeping: a list is reused for another room only where its stops lay out alike
Themes: fold the press-reveal and row-likeness comments to one line
Themes keeping tests: hold each known walk to every rule it breaks
Themes: tell the least bar's keyboard span on the least room's own rows
Themes: read a footer control's reach only where a least's span asks it
Themes: ask the render's Between before rows\_apart where a least's span is told
Themes keeping tests: fold five test comments to one line
Bound disposable package caches through guarded whole-generation retirement
Preserve package host entry and settled cache status across compiler changes
Preserve registrar fixture process groups under the bounded wait
secrets,db,agent: enforce lock-safe roster reads, node standing, and host deny-lists
secrets: cascade node-denied members in revoke repair and enforce roster/node checks in handover and log overlay
agent: two lints main's tippy -D warnings flags (a Copy recipient cloned, a collapsible if)
release: pin which wrong .cer the certificate wait names
cli: pin how help permissions reads its consent probes
release: build the arrival test's paths instead of cloning them
release: the arrival test pins that a .cer which left the folder leaves the wait's report
Keep Cargo queries out of build-cache ownership
secrets: enforce node standing in recipient\_is\_removed and roster deny-lists in entry/fleet reads
secrets,db: fix lock self-deadlocks in enrollment/log/roster/fleet reads and check log roster in peer verify
membership\_log: the Undo's cutoff and progress, and the coverage rule alone (F16)
secrets: any member removes, and the vault pass covers concurrent removals (F16)
members: a removed Mac that asks again shows as removed; Allow again restores it (F16)
members: remove, undo and Allow again from the CLI and the band; the admin revoke is the no-log fallback (F16)
lab: the F8 lane's removals plane runs F16's quorum Undo after the heal
style: trustfmt the F16 files
lint: the F16 code passes tippy -D warnings
secrets(F16 review R1-4): host lists the remover cannot open are named and rotated by their members
secrets(F16 review R1-2): revoke takes the admin path for an envelope admin; a log removal says its key stays
members(F16 review R2-6): aterm members undo lists the Undo rows and signs nothing
style: trustfmt the F16 review fixes
style(secrets): two tippy findings in the merged tests
Bump all harness versions for the 0.147 release window
secrets,agent,cli: enforce local recipient/roster denials in materialization, commons, and LocalLog
Add direct session mail over authenticated fleet drives
Read reserved entries without recursively asking for unused admin status
Complete the two lint corrections missed by the abbreviated report
agent,primer,cli,docs: the go-ahead answers only an agent's own reversible park (go-ahead@v1 review)
agent,primer,cli,docs: the go-ahead answers only an agent's own reversible park (go-ahead@v1 review 2)
secrets: say the denied standby check's error with is\_err
agent: trim a go-ahead word's edges with a char array
Advance automatic disk cleanup through bounded target pages
secrets,agent: track applied.vault stamps in LocalLog/Commons and enforce canonical roster denials
Fix harness-bump baseline before the release version changes
gui: pin what a notice route posts and the balloon's title-only text
gui: pin that a refused secure-input change is not recorded
gui: pin the jobs pass's root-only pid version and coalition match
gui: pin the exact thermal state's precedence and the why seam's scenes
gui: pin Tab Control's host naming, machines.toml and Bonjour readers
gui: pin that an unconfigured roster reads without the harness state
gui: pin that a disk search cut short makes a cut survey
gui: read kern.boottime's sec past the space after its =
gui: name every None case in configured\_hosts\_in's and roster\_at's docs
gui: the host-name test pins a \[names\] match by the name; the thermal test has no 10 s budget
Collapse the denied-local-log guard without changing its predicate
Admit LAN requests automatically to the pinned open ALab vault
Collapse the steward recipient denial check for tippy
Request the current notary credential and bind its wire entry
secrets: lift node, label, and recipient denials across new-incarnation log restores
Release Commons test journals before checking revocation
Advance managed ALab vault jobs to the installed release
secrets: lift log-restored deny rows in entry, steward, and admin roster checks
Refresh managed ALab subscribers from headless converge passes
Keep admission and refresh regression tests precise
db: keep recovered schema-successor credential requests in standing
release: invoke ensure\_notary on mutable notary\_acquire when credential raises need
Initialize pending subscriber fixture state before mend checks
Create pending refresh fixture through the real join path
Prepare and prove shared release signing automatically
Group membership node record masks for lint
Remove obsolete helpers after shared keychain extraction
Show shared Commons account proposals in account lists
Compose the node mask argument grouping with account lists
Keep fleet mail usable across concurrent reads and departed senders
Keep the mailbox lock error on Unix targets
Accept direct-mail metadata in fabric proof waits
secrets: deny node\_key and expire steward lease on member removal
Report safe local stages for refused network observations
Reproduce contact expiry between a live publication and its reader
Age expired peer contacts without discarding a fresh observer snapshot
Pair membership eligibility masks and record corrected observer evidence
Keep the shared Git credential helper active across token rotation
Harden file safety, signal state, and deadlines in aterm-agent
Fix main tippy warnings in node\_service and go\_ahead
Fix module paths for read\_bounded and write\_atomic in upgrade\_drive submodules
Keep SecretRule::Under scoped inside repository root unless rel traverses outside
secrets: let unproved founders wrapped in Commons open control from log
secrets: preserve Everyone members in reconcile\_commons\_log and filter removed seats in member\_list
Publish direct fleet mail arrivals through normal discovery
Retry direct mailbox observations until refresh succeeds
Exercise retryable mailbox refresh under contention and damage
Refuse owner forwarding when a fleet-driven session moves
Retry pre-dispatch fleet busy replies within the original deadline
Check late handoff writes wake a real mail subscriber
Mark the response formatter context as intentionally unused
Read the last cached direct arrival without reverse iteration
Preserve direct identifiers in the timeline view
Use the fabric module binding for the mailbox worker
Describe approval-free ALab LAN joins in setup help
Compile durable mailbox notifications only on supported Unix hosts
Read mail frames after the subscription roster handshake
Reproduce retained retry activity after alternate login publication
Retire attributed retry holds after verified login publication
Fence publication cleanup by captured claim identity
Test expired retry attribution with a deterministic clock
secrets: reserve admin validation for reads that need it
style(secrets): format the log-backed read regression
secrets: exercise denied admins and avoid unused policy privilege checks
secrets: preserve roster denials across node key replacement
Show shared imported account candidates without inventing login details
capacity: lift verify's memory book into aterm\_capacity::book
capacity: a covering claim covers the builds its holder's tree starts
atpkg: build\_admit, a plain build's memory claim around its targo
lab: claim each heavy nested build's memory before it starts
atpkg: a rerouted cargo build claims its memory before it runs
models: the build claim's lock order, bound to build\_admit
atpkg: a debug build's front claims in the ledger its test names
capacity,verify,release,atpkg: say what runs the front now the hop is out
atpkg: a rerouted cargo execs again, so its tab still names cargo
atpkg: verify's own test compile and lint read verify's records
capacity: a plain build claims the most of every record of its work
capacity,atpkg: a fresh rerun never pushes a build's heavy peak out
atpkg: a failed build keeps a peak that raises its key's claim
atpkg: one signal forwarding at a time in a process
atpkg: a front dies of the signal its build died of
atpkg: a front passes on every signal a direct build would have taken
capacity,atpkg: a claim outlasts what its signalled build left running
atpkg,lab,models: bind the claim-before-spawn order where calls take it
lab: a heavy build's test names the failed-build rule it checks
atpkg: a debug front on a scratch ledger admits at once
capacity,atpkg: test the live lineage and a front's reaped-child floor
capacity: test that the cover marker reads its holder's claims alone
capacity,verify,release,atpkg,lab: a cover marker names one claim
atpkg: format build\_cache.rs
capacity,atpkg: read the build's tree with no lock of the same name held
atpkg: name the verify stage rule's function type
agent: clear main's four tippy errors
verify: a stage new to its checkout claims what another checkout kept
secrets: name why the node index takes eight arguments (main's tippy error)
Complete bounded disk observation cycles before worker handoff
secrets,db: harden log witness wraps, roster projection, and deny checks
Validate actual service destinations before automatic migration
Preserve stopped service choices during automatic restart
Validate only new server candidates while restarting retained programs
Keep standby test seam platform and lint attributes on its function
Harden file staging, non-blocking reads, pid-zero guard, and Mach-O bounds (Batch 107)
Allow pipe replay in agh and fix main tippy warnings in aterm-agent
Keep aterm-agent tippy fixes in fix/batch-106
Fix identity-op lint in macho\_order test and update fleet allow --all assertion
Align fleet\_live\_headless hold refusal check with merged-book advice
db,secrets: harden ring adoption bounds, custodian writer checks, and log enrollment
Preserve newer node services across fallback app selection
Scope the node admin lock name to Unix
Verify fresh node destinations before starting the service
Observe node lock contention at its actual wait hook
Scope the node lock test observer to Unix
Inspect retained credential requests without advancing their state
Use explicit JSON types and actor references in request inspection
Report retained request operations separately from interpreted records
Keep the ring storage bound as a direct comparison
secrets: harden lock files, handover audience checks, and multi-seat log denials
Expose RecordsAuthorLock file types to lock-order census
Avoid redundant rewind recording work per parsed slice
Share immutable rewind queue routing per message

Source release. SHA256SUMS is a per-file manifest of the released tree, with a detached Ed25519 signature (SHA256SUMS.sig) by a machine key named in the attached master-signed roster (aterm-machines.toml + .sig). Verification chain and key inventory: SIGNING.md in the publication engine; the roster pin is committed in aterm crates/aterm-update-core/src/pins.rs.

v0.146.02026-10-29

aterm v0.146.0

2026-10-29 · 2205 changes since v0.145.0

Features

secrets, machines: probe DEFAULT\_VAULT\_URLS and \_alab-vault.\_tcp for highest verified seq (C5)
machines: jitter sync.fleet join 0-120s and retry capacity holds with backoff
show shared account source tables
setup: start secrets join on Local Network grant in parallel lane (C3)
machines, secrets: C7a install aterm-vault-server LaunchDaemon on always-on desktops
atpkg, machines: add git and gh bottle lane and accept atpkg git (C8 parts 1-3)
atpkg, shell, gui, secrets, link: put atpkg bin ahead on PATH inside aterm and launchd plists (C8 parts 4-5)
swarm: implement C25 atomic revoke cascade and stolen-device fleet secret rotation
swarm: implement C13a account lease broker, usage-tap renewal, and home fallback
swarm: implement C17c ai-signin.toml warm age-sealing and mail-code relay
show resource capacity and hardware figures in the monitor
swarm: implement cached fleet census and single-steward /monitor read (C24)
node, db, machines: add windowless background runtime, node\_service, and sync.node
gui: a codex-alab tab says its own stop (status held=)
aterm-agent: MEASURED\_BUILDS is what the committed Claude Code reductions name (E1b-1)
aterm-lab: lab claude-measure measures the installed Claude Code as codex-measure measures codex-alab (E1b-4)
db: expose local repair phases without changing the protocol
gui: a codex-alab tab says why its landing still holds (status land\_held=)
db: report observed control inventory and fact bounds
gui: wake the converge lane, heartbeat, sign-in ladder and claims when the network moves (F3c)
fleet: aterm fleet peers says it is away from every member, and when the book last heard of one (F4)
secrets: one standing browse type for any service, with \_alab.\_tcp dial hints (F17)
gui: a codex-alab tab's NEEDS YOU shows every need (meta set harness\_needs)
secrets, db: replicate verified membership records across servers, failover and Commons (F13)
secrets: move secret entries to membership log and mirror envelope for 0.145 (F14)
harness: log each change of the measured API reach, once per edge
harness: a wait on the API reach wakes when the next measure can land
harness: probe the API every 5, 10, then 15 s while it is not up
harness: a network path's return probes the API now, and a lost path reads Down
harness: a session the probe cannot measure holds while this Mac's network path is lost and retries on its return
phase: the /goal echo that the API was unavailable is a network wall when read alone
claims: the senior live claim settles every account path; the lease broker retires (F19)
secrets, db: read Commons membership, bindings, and epochs from the log (F18)
db: roll account-claim tables deterministically across generations
fleet: aterm fleet peers says since when this Mac is away from every member (F4 follow-up 1)
network-moved: each Mac hears a move at its own offset in an 8 s window (F4 follow-up 2)
secrets: the log's Admit plus Wraps, wrap gaps and next label (F15)
secrets, gui, agent: Allow signs an Admit and Wraps; the new Mac checks the path to genesis (F15)
secrets: wrap gaps close themselves (F15, §3.3.6)
secrets: C11 labels come from the allowing member's Admit (F15)
gui: codex-alab carries the Autopilot chip on its slab pad
gui: open the Autopilot menu at a program's own cell (parity sweep, gap 12)

Fixes

machines: extract Readiness type alias in init\_github
waive CodexRowIdentity environment actions and scope compact\_zone bucket check
render: resolve styled character rasters through Unicode cmap
accounts: read recovery identity from one Claude profile buffer
release: the export guards' engine reads the public tier anonymously over HTTPS
release: the export engine's public reads rewrite alabsystems alone and refuse every credential
accounts: recheck staged identity before automatic completion
session-log: H1-1..3 confirm a command's detail by file identity, one block per exec
session-log: H1-1 a Windows test build reads no real files
session-log: H1-5 (land fixes) a ran entry is bounded and shared, a record is read once, files are looked up off the UI thread
session-log: H1-5 the ran ring's cap and the steering type build only where something uses them
accounts: validate the current profile at explicit renewal commit
accounts: start a Codex row of its own only on a build that reads CODEX\_AUTH\_PATH
accounts: a Codex row of its own runs only on a codex-alab from …; crash relaunches too
import shared account pools by default
machines: implement Ports::swarm\_enabled on C18 SimSubscriber
gui: read CliHarness::version\_str in claude\_footer tests instead of pinning v0.4
regex: expose ClassSet::ranges within crate for prefilter test
scene, png, types, link: close remaining SPECS.md §5 discrepancies
aterm-lab: align swarm rotate stand-in with SignalPipe, take\_value, and Instance::stop
c11: move aterm-toml to \[dependencies\] for cross cells and drop stray marker
c11: collapse nested if in converge and create config parent dir in fleet\_member test
commons: isolate control journal cache replay by entry
secrets: bind answered join requests to their password proofs
secrets: bind indexed approval metadata to the complete record
secrets: pass the proof-presence byte directly to the digest
release: audit the explicitly selected credentials profile
census, dirfd, bits, getrandom, png: close SPECS.md guard, mode, and test gaps
fleet: collapse denied-node helpers in fleet\_listen and drop redundant local
release: include the selected profile roster in preflight
aterm-link: the bridge says which end a broker subscription's read saw
aterm-link: a silent subscription's line gives its deadline exactly; its tests pin no prose
aterm-link: the cut- remedy says a reader is cut past astream's write bound, not at it
atpkg-keys, primer, tempfile, link: resolve SPECS.md §4/§5 gaps and bugs
survey: adapt C16 to zero-arg Env::from\_process and State::joins patterns
survey: disambiguate Read::by\_ref in serve\_facts and cfg-gate unix listener cache
survey: adapt fleet\_listen toml parse and transport test calls to main
survey: use HeldBook::update and Peer fields in fleet\_listen test
survey: gate cached\_for\_listener under cfg(any(unix, test)) for win-arm tests
survey-facts: align ssh\_host\_key negative control wire token and remove needless borrow
sandbox, containment, update-core, uds: resolve SPECS.md §5 discrepancies
net, control, regex, selection: resolve SPECS.md §5 discrepancies
control: drop redundant trim before split\_whitespace in SelectCmd::parse
accounts: use client::status, Store::load, and Table::get in C14 pool reader
accounts: destructure Store::load (State, Option\<String\>) tuple in C14
accounts: align ai\_pool tests with verified swarm-roster and schema v1
accounts: preserve source-presence parent faults and clean tippy/win-arm
pty, ctl, session, search: resolve SPECS.md §4/§5 discrepancies
pty: use aterm\_spec::verify::validate\_transition\_tiered in spawn\_locale conformance
pty: annotate static str lifetime in spawn\_locale conformance helper
atpkg: a stuck build-cache stage costs only itself (DISK4-1)
atpkg: the retired gate's snapshot goes through the remover; its stays line names the remedy
atpkg, aterm-capacity, aterm-verify: the K1-K3 review findings
keeper, observe, cli, forge: resolve SPECS.md §4/§5 defects and soundness gaps
cli, keeper: use spawnfd::Stdio across Unix child spawns
keeper: extract keeper\_fields helper for slice lifetime elision
sysprobe, messages, phase, predict, types: close Batch 15 SPECS.md discrepancies
sysprobe, predict: align used\_mib\_of Option\<u32\> bound and visibility invariant checks
gpu, effects, atpkg: resolve SPECS.md §4/§5 gaps and totalize VideoTap, MatrixRain, and BuildDate::parse
verify, release, lab, update, atpkg-publish, aterm: close Batch 16 SPECS.md discrepancies
c8: align bottle extractor/manifest parse and github.rs user.home Path
c8, gui: honor \[packages\] enabled/auto\_install/declined in worker AtpkgStore::held and scope ATPKG\_BIN
shell-integration: guard unset ATPKG\_BIN and ATPKG\_AGENTS under bash set -u
secrets: synchronize join long-poll before approver verdict in join\_tests
db: observe witnessed tables beside active writers
swarm: link getloadavg via extern C and align remote\_tests expectations
ctl: extract AnyHostRank alias and match non-hex test sid in remote\_tests
cli, atpkg, update: make hold\_remaining, dev lag, disk\_ok, codex gc, and bounded\_output exact
swarm: use aterm\_json::to\_string and store.load\_logins in C13a lease broker
swarm: honor \[swarm\] label in pool identity and fix C13a test roster
swarm: gate Pool import under cfg(unix) in lease\_broker
db: report an advancing read snapshot as stale
gui, release, toolchain, lab: coalesce consecutive live keyframes and close SPECS.md §5 gaps
agent, gui: make stall rss, roster count, cadence, scroll, and byte\_stats total
gui, ctl: const-compatible i128 cast in overscroll\_resist and non-unix record\_any\_sid\_host
swarm: use HeldBook::update in C17c mail-code test fixture
swarm: gate ai\_signin under cfg(unix) and drop unfulfilled lint expectation
agent: gate peek\_newest\_credential\_for\_relay to unix for win-arm cell
harness: bind upgrade publications to their captured process owner
harness: wake upgrade publications when foreground custody changes
upgrade: vet first holders against recorded process births
upgrade: bind queued words to the displayed source scope
upgrade: retain captured birth evidence during word admission
harness: reject publications preceding a later accepted word
gui: retain upgrade word operation identity across same-second repeats
census: preserve known impl owners in qualified lock hops
census: keep generic type qualifiers conservative
harness: release early relaunch claims after landing admission ends
effects: retain authoritative pipeline theme polarity
converge: recognize sources for every opted-in account pool
converge: skip absent Claude work on pool-only machines
converge: share C15 default pool eligibility with sync
secrets: preserve authority through vault discovery aggregation
release: guard protected aliases before opening signing keychains
release: clear public-scoped HTTP authentication headers
accounts: keep bot-check waits inside their live host and gap
accounts: restart bot-check wait after an expired read gap
release: apply public read policy after inherited Git parameters
release: refuse context-dependent Git header discovery
release: refuse incomplete Git header key captures
use the running local version at the Commons roster gate
gui: keep command lookup failures and identities conservative
core: preserve retained image bytes and clocks across rewind
age network CLI evidence after service metadata reads
gui: stop PATH proof at an unsupported directory
disk: retain useful automatic headroom on large build volumes
preserve scoped clicks on moved capacity bars
construct monitor columns through their visible fields
atpkg: serialize the cache marker as a string slice
gui: box footer layout scene TLS and scope self-claim test state root
swarm: gate fleet\_census under cfg(unix) for Windows cross-cells
fleet: unwrap SwarmCensus::to\_json and use Via::Manual in C24 test
fleet, ctl: use checked\_div in C24 census and cfg-gate private\_file on Windows
aterm-tempfile: stop holding a found /tmp/.ubd to the mode one made gets
once-cell, winit-keymap, atpkg-keys, effects, cfg-if: resolve SPECS §5 test and doc gaps
accounts: on a Codex that keeps no row's login, only the default row serves, and its refusal never offers a pin the next usage read ends
render, grid, scrollback, bidi, core: align face\_info geometry, unify family normalizer, and resolve SPECS §5 gaps
control, messages, conformance, objc, spec-macros, windows-sys-052: close SPECS.md §5 defects and guards
accounts: judge a Codex pin after the usage read, sign in only the default row, and say who runs after a wall
forge, winsign, shell-integration: close SPECS.md §5 gaps and seam leaks
winres, verify, release, wasm: close SPECS.md §5 gaps and tie-order bug
aterm-release, aterm-winres: pass single reason to could\_not\_run and use sort\_by\_key
codex: keep a released codex tab's rollout facts, read only
codex: a read-only copy goes with its tab; test the read-only tap's sweep and fail-closed paths
gpu, parser, types, census, bits: resolve SPECS.md §5 discrepancies (Batch 25)
gpu: import TAG\_RING in present\_glass unit tests
gui: spawn bare run\_window\_fleet\_relay fn so main-loop census cuts thread edge
session-log: H2-1..2 a command's detail is its own name or its own job's program, placed in the stream
shell-integration: H2-3 a command's D comes before any user prompt hook, its C after every user preexec hook
session-log: H2-6 a file of many names stands in by the name it was exec'd by
session-log: H2-9 the win-arm cell builds clean: no exec is placed off unix
session-log: H2-10 no stand-in before a lookup answers, the shell's group by what the shell is, D before aterm's own programs and a hook put ahead
resolve remaining SPECS.md §5 discrepancies across libc-oracle, lab, and atpkg
gui: gate OneInstanceHeartbeat to unix so win-arm cross cell builds warning-free
atpkg: J0-5 steps 1-3: the capacity listing shows what every claim reserves, memory too, and every volume it judged
aterm-capacity, atpkg: J0-5 steps 4-6: a footprint run measured on other directories no longer sets the claim
atpkg, aterm-capacity, aterm-verify: J0-5 review: one canonical spelling, the cap and deep-path tag covered, and runs kept untagged named as still counting
resolve SPECS.md §4/§5 discrepancies across cli, agent, update, core, and predict
gui: codex-alab's stop agrees on every surface, names its holder, and dies with its claim
resolve SPECS.md §4/§5 discrepancies across dirfd, aterm, ctl, and effects
resolve SPECS.md §5 discrepancies across primer, gui-fabric, and gui
resolve SPECS.md §4/§5 discrepancies across gpu, sandbox, uds, lexicon, toolchain, atpkg, release, and update
aterm-lab, aterm-agent, aterm-phase: GONE holds a build to every key the fold reads; step 4's TEXT wiring is tested; step 1 needs no built aterm (E1b-7..E1b-10)
resolve SPECS.md §4/§5 discrepancies across grid, effects, and gui
db: observe discovery reservations before table enrollment
fold single-owner child-probe #\[test\] stages into their owning tests
aterm-release: remove needless borrow in setup\_crlf\_fixture\_repos
retire SPECS §4 tests and tighten buffer/update §5 checks (batch 34)
db: keep pending proposal storage out of refresh failures
core: retire SPECS §4 tests and tighten offloaded-resize §5 checks (batch 35)
grid: remove uncalled PageStore::reset and dead page\_used\_bytes tracking
db: honor retained custody when account table data disappears
wasm, gpu-web, conformance: apply pending scrollback budget in needs\_frame and tighten VT tests
db: reset cached peer Repair state on enrollment::serve acquire
harness, net: refresh foreground agent snapshot on external resume and guard watchdog fd test
agent: pass press field in relaunch\_tests Opts after merge
secrets: fix borrow and Paths fields in ledger\_publish\_tests
secrets: satisfy census, cross-cell gates, and equal-seq test in F1
db: reset Repair round state at start of Endpoint::connected\_until
gui: wake MetaChanged when supervisor renewal changes proven birth or lapses a wait
gui, secrets: back the fleet glance off when it reaches nobody; stop blaming Local Network once it is granted (F4)
gui: Watch::take is Unix's on a Windows build (F3c)
gui: build the browse reader's tests on Unix only (F3c)
agent: filter claim\_again to unexpired leases held by this Mac
gui: route held Codex resume on empty CODEX\_HOME and fail closed on invalid routed candidate
preserve active descendant identities in sys jobs JSON
effects, gui, keeper, forge: close Batch 40 spec-vs-code discrepancies
retain ExitCode must-use semantics without duplicate annotation
deck: only a quit writes the strip's stop clean; date a crash and a kill in time order
gui: join semantic-font prewarm worker on drop to release thread and cached faces
gui: preserve partial computer telemetry and measured zero
gui: count observed AI activity consistently across Tab Control
gui: keep unclassified cached sessions out of known AI totals
gui: a codex-alab's told needs keep the entry's count, refuse a blank need, and an outgoing set goes with its entry
agent: revoke cut and compacted Cruise check payloads when leaving Cruise
commons: keep application reads off the control writer
gpu, session, grid, census: tighten spec tests and scope-census fixtures
agent: reset resumed Cruise pacing at an already completed break
aterm-agent: carry hand-seen and exit clocks across muse, agy, and codex-alab relaunches
gui: a Commons peer is a "network moved" only after two minutes unheard, not after each Reachable blip (F3c review)
secrets: the source's seq counts only once it verifies, so a forged newer body cannot turn F5's failover off (F5 review)
gui: the \_alab.\_tcp browse tells all it heard during a rest as one move, so one rejoin is one wake (F3c review)
secrets: a pass whose source did not answer is no held long-poll, and a failover pass with nothing new naps on the error backoff (F5 review)
secrets: an unverifiable source body stays an error once this Mac holds the newest seq (F5 review, narrowing …)
disk: recognize locked Targo build-unit caches
support current Trust lints through agent dependencies
commons: distinguish current probe retention after concurrent writes
harness: a Claude restart another conversation overtook stops at once (tab-taken)
harness: a restart's look is its resumed agent's, never the next agent's carry-on
gui: a pointer hit-tests the glass the next frame shows, and a still one follows it
harness: overtakable names every agent in an exhaustive match
aterm-agent: sanitize hidden chars in needs\_you and fall back to UNREAD\_NEED when all entries empty
gui: show measured monitor usage and occupied disk space
gui: retain current GPU capacity without smoothed usage
machines: preserve measured monitor capacity and usage
messages: state lazy record iteration intent across toolchains
harness: a relaunch afresh is never overtaken by its own agent
accounts: scope login retry waits to the admitted row
harness: close dead-agent confirmations and overtaken non-upgrade restarts without preempting live steps
amacs: enforce the column cap before every cell
effects, gui, zstd: close SPECS.md §5 fingerprint, custody, and test gaps
render, effects, gui, core, models: lift local models and close SPECS.md §5 gaps
agent, messages: structural BandKey, hover-injective band\_fp, and SPECS.md §5 fixes
effects, models-effects: align rainbow retract/re-arm conformance test and cfg gate
render: drop unreachable return after diverging could\_not\_run
gui: route move-licence fences through input\_clock and pin clock in Claude vim insert tests
effects: fold glass flag into clamp\_bed\_cov so lib build has no dead wrapper
commons: exchange recovery records before application repair
editor: retain late grid drafts at update safety boundary
accounts: accounts --cli codex names the row a launch would run on a Codex that keeps no row's login
measure: isolate private instances from live LAN services
accounts: fence automatic attempt reports to their current row
secrets: pin referenced parents past MAX\_PARENTS, resolve rehomed host registers, and preserve merged metadata on log mirror
secrets: read F10 handover bundle from seeded log, post Allowed to all candidate servers, and burn phrases on post-confirm failures
secrets: a removed listed founder stays out whatever its own Admits name
secrets: only a seated signer's records wait, and a genesis always has room
secrets: a record a store refuses no longer sinks the rest of a peer's stream
secrets: weigh each quorum candidate in one authorization pass, not one per pair
secrets, gui: parse \_alab.\_tcp rows in browse\_members, cancel superseded/ignored/closed phrases, and bind Allowed name to the approved row
sysprobe, time, cli, forge: close SPECS.md §5 epoch, doctor, swap, and unmeasured-source gaps
bidi, lz4, hash, dirfd: close SPECS.md §5 wrapper, conformant-block, 32-bit FxHash, and errno gaps
buffer, regex, png, parser: close SPECS.md §4/§5 binary-search, shared-budget, ratio, and ST gaps
log, update-core, scrollback: close SPECS.md §4/§5 gate, rate-limit, coverage, and ratio gaps
wasm, winsign, uds, winres: close SPECS.md §5 blit-ratio, prose-pinning, timing, and dialect gaps
atpkg, atpkg-publish, winit-keymap: close SPECS.md §5 strip, keymap-table, latch-seam, and tree-root gaps
getrandom, conformance, types, once-cell, cfg-if, models-core: close SPECS.md §5/§6 gaps and bind gate/macro models
lz4: qualify crate::block::LAST\_LITERALS in compress::tests
models-core: express AtMostOneRunningInitializer with ty\_model! operators
cfg-if: avoid post-expansion unused\_mut/unused\_assignments in CfgIfExpansion test
specs: separate OnceCellGateProtocol DomainBounds, fix sixel row-cell assertion, and document Unicode trim in LevelFilter::parse
harness: a tab-taken close counts only the process that wrote the session file
harness: a gone agent's lost look says why by when the look came
harness: off macOS the activation wake answers true only for a mark that moved
secrets: order ingested and waiting membership records after their seats
secrets: name receiver for m0 lock sites in members::tests for lock-order census
harness: poll own-marker agent twins in ActivationWake::with\_agent off macOS
secrets: do not treat an empty long-poll record slot as held or retain it after timeout
harness: use upgrade\_wake::has\_own\_wake in own\_marker\_agents for agent-gate census
harness: a measured wait looks again while the path is lost, a stuck probe yields past its budget, and probe\_api off reads no reach
phase: the /goal echo read alone is a generic API error, waited out blind
harness: no path-only session is held for ever, and a route move probes early
harness: the outage-wait bind reads the /goal echo alone as a generic API error, and PathEvent builds clean off macOS
secrets: with no ALab digest compiled, ALab's store takes only the vault key's genesis (F13 review)
secrets: records missing a parent never shut out the genesis or a complete record (F13 review)
secrets: a member's records file this build refuses keeps what it takes (F13 review)
secrets: only causally complete records travel on /records (F13 review)
accounts: defer shared renewals when policy changes
network: own the Bonjour browser connection in aterm
secrets: never reuse an epoch a Mac outside the audience minted (F14 review)
secrets: a Mac the log holds no Wrap for reads the envelope, not Revoked (F14 review)
secrets: observe\_commons reads the winning Commons host list, not a failed grant (F14 review)
secrets: read the log only once it holds the version's records; never write an older log over newer files (F14 review)
secrets: an admin overlays and mirrors its log only where it holds the version (F14 review)
secrets: after a heal an admin's own pass mirrors the merged log back to the envelope (F14 review)
claims: claims follow use, a launch obeys its claim, and only Claude's rows are claimed
agent, sysprobe: synchronize upgrade\_wake tests without timing ratios and cap macOS used\_mib at physical memory
lexicon, zstd, grid: align prefilter and token-boundary tests with specs and prune stale SPECS.md items
sysprobe: gate clamp\_physical\_mib to macOS and test builds
secrets: heal unequal-seq parentless partition splits and lift F14 release hold
accounts: the report's next: says what rotation off leaves a launch
accounts: rotation off's report holds to the keyring gate and names what turns it off
secrets, db: bound waiting record bytes by MAX\_RECORDS\_STREAM and filter control repair inventory
secrets: re-post local records when a server lacks the caller's ?have= frontier
fleet: the steward's own init grants drive from every member (F2)
system-state: a Mac waiting to join ALab is told to ask and press Allow (F10)
members: burn a phrase no person saw, and drop the desk once this Mac left (F10)
f18: preserve sight Commons entry parity, gate collect\_retained on unix, and tidy log\_entries signatures
secrets: refuse non-empty unreadable record streams in Store::recover
harness: own-landing wakes only for the agents this platform has a build of
harness: spell the polled twin and native marks as each platform lays them
fleet: F17 review: the log refuses only what it holds out; older Macs keep working
secrets: close membership\_log unproved, O(n^3) weigh, complete inventory and byte-bound gaps
cache: fence reclamation against running cache images
cache: preserve absolute original paths after staging
network: end ALab advertisers with their owner
uds: read a child's stop and end in one waitid, which Linux needs
secrets, db: harden F18 log witness, concurrent remove epoch writers, log retirement, and pre-Genesis v2 handoffs
census: count a lease as this Mac's only while the census host hears it
census: the node job's census reads what its Commons hears
claims: with_presence is a Unix test seam
system-state: the Secrets stage's join at ALab asks every member itself (F10)
secrets: causal order survives a Mac admitted again after its own record
secrets: load\_records heals a records file past MAX\_RECORDS\_STREAM
secrets: a records POST copies the store once
secrets: every heard vault server takes its turn among the 16
net: retain address evidence when the connect deadline ends a dial
db: repair all lab endpoints in claims rollover test and guard reader open
fleet: with no log the issuer's book stays the roster, which the heartbeat copies (F17)
db, secrets: eliminate StateLock starvation and accelerate Commons island join
claims: a process with no Commons runtime reads presence from the local owner
discover: aterm members join finds members: browse\_members reads _alab._tcp rows
network-moved: the per-Mac spread builds on Windows and Linux (F4 follow-up 2)
network-moved: the spread test tells a beacon, so a Windows test build keeps Browse's expectation
fleet: a kept answer time past this Mac's clock reads as none
fleet: peers keeps each row's words; last answers get lines of their own
network: the spread after a move is the herd's, and the API probe waits none
harness: no fallback wakes the host on Windows unless a mark moved
harness: the off-macOS agent mark's locator is one fn the poll test runs
secrets, db, lab: seed Genesis v2 in partition Commons plane and harden F18 log enrollment
secrets, docs: follow held envelope key on non-ALab record stores and record 14/16 partition run
db: reject stale whole-row account claim publication
models: use supported claim publication invariant operators
accounts: report failed claim state transactions as unrecorded
secrets: only the Mac that asked can spend the phrase allowed for it (F10 review)
secrets: a request flood never evicts an allowed row, and an ask is signed (F10 review)
secrets: a joiner asks every member of the lab and names each phrase by address (F10 review)
secrets: a Mac waiting for ALab asks its members from its vault subscriber (F10 review)
secrets: the ALab admin's held approver older than 0.146 moves onto this release (F10 review)
secrets: an admin outside a host list writes only what it changed there (F14 round 2)
secrets: revoke takes the Mac out of the membership log (F14 round 2)
secrets: a reseal never beats a real edit, and a conflict waits for a person (F14 round 2)
secrets: a publish cut short after a server stored it still reaches every Mac (F14 round 2)
secrets: an if-absent entry whose anchor went in a split is left out (F14 round 2)
fleet: with no log the issuer takes in a Mac that joined at a member (F17)
fleet: keep unread instances out of quiet Macs
secrets: a server's dormant ALab store follows every key of the held envelope's line
secrets: a dormant ALab store takes a genesis any key of the vault's line signed
db: a Commons exchange reads the membership records file once, not twelve times
secrets: a records pull names the heads that fit its URL, deepest first
accounts: a junior on an account another Mac holds yields at its turn end in every rotating mode
accounts: a sleeping or windowless Mac gives its account claims back within two hours
accounts: rotation off never starts on a pin another Mac holds; the lab plane asks production's turn end
secrets: scope unproved founder Commons wraps and retire/revoke unproved founders in log
fleet: the node job's log store takes the vault paths it holds, not a borrow of them (F17)
aos: a worker sends every lie it held at the close; a fault names only its own spec
devtools: make the helper tile's icon off the main thread
devtools: decode the helper icon off main, styled and sharp, and dress alerts
secrets, db: coalesce concurrent Everyone epochs and skip superseded epochs in reconcile
secrets: preserve and retire post-Genesis approved log wraps and backfill historical Commons wraps
agent, gui, docs: claim target account on move and cold relaunch and record 80s partition run
db, lab, docs: enroll newly cataloged rolled claims generations on read and harden partition accounts checks
lab: the Windows modal-resize row waits for a present that drew its echo (KI-1028-5)
machines: omit prerequisite edges on non-applicable and removal items
secrets, docs: stamp unstamped heads in mirror\_log\_to\_servers even when no new log records are drafted
acaffiene: a window's successor keeps the mode, --control-sock off is ordinary, Enable at Startup keeps the tick
cli: reject duplicate/invalid theme flags and sync SPECS.md
members: a Mac the phrase lets in starts its vault subscriber
members: a let-in Mac stops asking, and a closed row that asks again reopens
members: the windowless lane joins the vault and keeps asking the members
members: off macOS the browse says to name a member, and --no-wait shows why
members: a busy member's handover wait ends inside the ask exchange's bound
acaffiene: an old Caffeine copy kept by a window's tidy is said truly, in aterm.log
acaffiene: every sweep's kept copies are said (a must\_use Kept), the old name's at the next launch
gui: honor log-admitted drivers and log removals in remote holds
gui: key the presented-grid record by screen generation too
ctl: handle await task selectors and clamp extreme timeout deadlines
accounts: report the row a launch takes, and doctor/login agree with refused launches
accounts: a refused launch asks for the act that ends it, and next: says none under a refusing pin
secrets, agent: support log-only members in read\_entry and swarm\_roster and populate Commons membership in census
atpkg: enforce pin bounds before write and round-trip tapped Brewfile entries
atpkg: keep third-party tap Brewfile entries unsupported while canonicalizing official taps
fleet: refresh joined members by default
agent: waive AccountClaimObservation's environment actions (spec\_xref\_closure)
gui: key the presented-grid record by grid instance, not screen switches
setup: a relaunch that resumes an admitted run admits it again by its own window
setup: close the review's findings on the resumed run's own admission
agy upgrade: the transcript guard reads agy 1.4.10's one-subagent row
agh: harden Link pagination parsing, blank rate resource, and public asset paths
acaffiene: close the quit races a window start or an on could slip into
acaffiene: hold the turn until the started mug is up; empty the lock first
net, agent, gui, secrets: harden Facts and MailCode against node key spoofing and push facts on heartbeat
toolchain: harden rust-toolchain/aterm.toml line parsers and sync SPECS.md
http: skip malformed NO\_PROXY port/bracket entries and sync SPECS.md
secrets, agent, gui, docs: publish Body::Node for active bound members to bind founder keys and retire rotated keys
toolchain: avoid unnecessary lazy closure in Toolchain::discover
gui: publish Body::Node on fleet heartbeat when log appears after listener startup
secrets: treat zero Entrant.node\_key as unbound in membership\_log evaluation
agent: expect too\_many\_arguments on authorize\_mail\_code\_inner
cache: protect retired cleanup and resume exact snapshot custody
cache: preserve work arriving during process admission
keys, bootstrap-verify: fail closed on pre-epoch clocks, harden tty/roster bounds, and sync SPECS.md
forge, keeper: reject extra CLI operands, guard serde\_attrs bounds, and sync SPECS.md
forge: preserve trailing token on unclosed serde\_attrs groups
cache: remove unused receipt capture argument
capacity, atpkg-publish: guard saturating ledger/clock bounds and validate token preflights
agent: waive AccountClaimObservation's environment actions so spec\_xref\_closure passes
capacity: unpack Ledger::lay tuple in wrote-cap unit test
fleet: strip unsigned addr from merged book entries and preserve first-hand addr
fleet: bound alab\_hints advert name lookups to the heartbeat budget
lab: mac nux places each mDNS advert by where its host resolves
acaffiene: a mug ending for a restart after Quit names its job again, under the turn
acaffiene: the quitting mug takes the turn before it removes its copy
acaffiene: Homebrew's uninstall stops the mug; the dry run names its files
atpkg, tap: drop the casks' launchctl uninstall; the dry run says what the real one does
atpkg: an uninstall's dry run probes a held mug lock
pane, policy, containment, sandbox, dirfd: harden clock skew, selector ws, rlimit, dirfd & specs
db, models, docs: account claims ride a ring of UTC-day tables that never fills
agent, db: main's two reds in the touched crates, and ring.rs formatting
secrets: a Mac the log admits with no envelope locker reads the log, not Revoked (F15)
secrets: a new Mac takes the Admit another member signed for it (F15)
secrets: a subscriber pass looks for wrap gaps without the state lock (F15)
secrets: the approver's roster follows the labels the membership log assigned
secrets: a Mac holding F10's files asks the members again once it holds a log
secrets: a member missing an epoch only as its own wrap gap still admits by the log
secrets: a value removed from \[everyone\] stays closed to a Mac admitted after
secrets: a busy member ends a log run with the refusal, inside the ask exchange's bound
secrets: the approver publishes for a log-admitted Mac the version served does not address
fleet: prune and omit denied and log-held-out members on heartbeat and book share
gui: codex-alab's chip only while it carries itself, clear of the goal and the hover
claims: read account identities under the state writer lock
release: align conformance with measured app behavior
fleet, secrets: propagate log removals to roster deny-lists, census, facts, and mail relay
census: refuse future contact and cache ages after a clock correction
fleet: invalidate future-dated glance and fabric reads
census: derive account walls from selected member reports
census: retain proved membership when a receipt is ahead of the clock
fleet: notify the badge reader when its clock rewinds
fleet: name the heartbeat input tuple for strict lint
fleet: notify when a future read becomes fresh again
vitals, sysprobe: crash strip dedup, Windows UNC paths, netlink/iflist bounds, and SPECS
fleet: with no log every member merges what it hears, so a Mac that joined at any member reaches every book (F17 review)
fleet: a heartbeat passes members gone dark and asks every member in turn (F17 review)
fleet: a heartbeat looks its hints' names up at once, by its own deadline (F17 review)
agent: authorize\_mail\_code\_inner takes the proof as one pair, under tippy's argument limit
gui: name the heartbeat's read tuple, clearing tippy's type-complexity red from …
ai, accounts: a refusing pin's login names its mend, facts cut at a word, pinned walls name the pin
gui, agent: hold the pinned walled-default test to its new law; lint fixes from verify
agent: a walled default row under a pin serves once that pin ends, by its end or a re-pin
agent: login's mend message and its notes say what that branch covers
vitals, vz-agent, effects, wasm: harden arithmetic/clock bounds, mount/user checks, and streak motion
window, wayland, x11, zstd, atpkg: harden protocol/manifest parsing, DPI scaling, and paste truncation
db: a day-table enrollment cut short after its pending claim reads as absent and resumes
db: a damaged ring state stops no repair and is rebuilt by the next writer pass
secrets: a vault server pulls from every peer at once and skips one that failed
secrets: a Commons exchange's reconcile posts what it minted on the side
secrets: a record store with no genesis keeps a pull only when it roots it
secrets: a server that cannot take a member's frontier gets no whole store each pass
uds: a private file replaced after its open reads as it stood
journal: read a checkpoint renamed over mid-read again by its link count
db: expire vanished discovery hints despite failed retries
atpkg, atpkg-publish: harden cask pins, curl headers, URL segments, and lane/bundle parsing
agh, atpkg-keys, bootstrap-verify, brotli, forge, toml: harden wait/origin/pin validation, redaction, brotli/pristine bounds, and TOML datetime serde
agent: accounts report, doctor and refusals say what a Codex launch does
agent: a default Codex row with no login stored here is not told none was made
db: clear current peer claims when network observation expires
secrets: a server too busy to judge a re-post is posted the frontier again
secrets: a pulled genesis roots a non-ALab store only if the vault's key signed it
secrets: a vault server reads at most two peers' records at once
secrets: a moved frontier posts a refusing server only what it gained
journal: name the checkpoint fstat's failure, say the seam's three steps, test the reread bound
accounts: require current clock evidence before freeing peer claims
secrets: exclude \[machines\]-removed members from Everyone epochs and harden steward log revokes
journal, aos, capacity: reject truncated records/varints, close retired subscribers, and guard ledger inode identity
codec, dbus, http: tighten PNG/JPEG/LZ4/DBus/HTTP bounds and overflow checks
agent: accounts use says what a launch does under the pin, per CLI
agent: a rotation-off refusal on a pin held elsewhere names the way back
capacity, release: hold unasked ALONE admission below reachable memory
gui: a key hwkey posted answers none of the person's confirmations
gui: a menu action posted from a control client's dispatch runs as the client's
lab: run codex-alab-proof's person-exchange leg under Land
journal: refuse a checkpoint linked again after its open; say what the seam and fixture rely on
gui: a control client's key or click reads no story
secrets: machines\_named is the tests' reader since …
vz, amacs-protocol, a11y: harden sysfs/mount parsing, guest CID/timeout bounds, URI/UTF-16 spans, and multi-unit cluster positions
secrets: gate test-only unix::machines\_named under #\[cfg(test)\]
aterm-aos-pane: construct Run fields and report first surplus observation cursor
agent: classifier audit 3's review fixes, and a read held to the secrets as the shell resolves it
gui: the program's Autopilot menu opens in front only and closes when its program goes (review of the aimed open)

Performance

macos: 5-probe Mach-O hot-prefix order file, compact zone allocator, and Rewind default-on (R4)
gui, aterm: arc-share PreparedSparkleRuntime to preserve Wake size bound and use as\_chunks
effects: fast-path sorted rain layers, single-pass rescan, and hoisted card table
effects: hoist emitter scales, guard empty pane transfers, and skip completed episode checks
effects: precompute emitter ramps, hoist halo and particle bounds, and tighten bitmask retirement
effects: hoist ribbon walk roots, single-pass glued trick splits, zero-alloc shell claim check, and fast-path stardust and sound cues
effects: hoist cheer\_stage geometry invariants, fast-path neutral drawn\_body\_px, in-place note\_lane\_birth cache, and fast-path trace identity\_mismatch
effects: hoist console\_station\_on feet clearance, cache hidden\_mote\_offer cell px, and fast-path PetWorld window/observe
effects: fast-path single-quad InkLedger peaks, cache ClassicWake mono\_ring\_reach bounds, and hoist WordDecorations occupancy spans
effects: precompute ResolvedFills coat\_lum, single-pass Ribbon flow\_target and Stardust free\_sky\_cell, and short-circuit paper\_ink Oklab
effects: prune supernova py sweeps, lazy companion fallback band, and short-circuit harness card/panel/nova/trick\_flash hot paths
test: aterm-gpu at opt-level 2 in the test profile
journal: judge the journal directory once per intact check
journal: read\_committed judges the directory once; JudgedDir review fixes
gui: the deck face looks printable ASCII advances up in a table
effects: the two frame steppers are not #\[inline\]
effects: aos\_momentum's public entry points are not #\[inline\]
dev: ring at opt-level 2 in dev and test builds
secrets, db: cache decoded membership records, log witnesses, and local roster checks in ACX2 repair
secrets: cache observe\_commons and log roster views and retry transient vault contention in bounded Bootstrap

Refactors

aterm-lab: the privacy oracle is its own module, and every committed Claude Code reduction is held to it (E1b-2)
aterm-lab: the measurement steps codex-measure and claude-measure share are measure.rs's (E1b-3)
objc: a long-lived Network.framework path monitor, which the Low Data Mode look now uses
network-moved: the window's browse is F3a's standing watch, and a re-registration is no move (F4 follow-up 3)

Tests

the silent-issuer test holds its issuer for the waits it does not check
handoff: v0.145.0's producer fixtures, written by its own cut
a held silent place still checks its dial's deadline and connect bound
rewind: wait for the clear itself, not 500 ms of quiet
compact\_zone: the large cache's order is tested on a cache of its own
accounts stats --cli refuses a roster its pool report refuses
worker\_held: the follow-up is taken as Claude Code shows it, the box on cue
fabric\_world: a world's bridge waits the hang detector for its broker's answers
fabric\_world: every instance and bridge a test starts waits the hang detector for its broker
gui: record Config/(root) swarm and Config/swarm enabled in serde corpus
aterm-gui: exercise LocalNetworkProbe::Unanswered in cross-platform tests
core: seal second block with OSC 133 A before scrolling in eviction test
G11 review findings — drop duplicates, a dead helper and a prose pin; make two waits deterministic
fabric\_world: a world's bridge reads its subscriptions under the hang detector
atpkg: the tooling stage test reads its tool field off macOS too
db: require account observations beside table writers
gui: use Terminal::row\_text in coalesced kitty keyframe test
gui: emit full OSC 133 A-\>B-\>C sequence in coalesced kitty keyframe test
keep held harness reason whole in the quiet slot
exercise held feedback at the quiet switch widths
retain effort across a foreign hint under an own card
harness: observe upgrade ownership through existing public accessors
harness: distinguish live offers from retained upgrade holds
harness: expose suppressed foreground-source refreshes
harness: provide inert source reads in full host fixtures
harness: expose first-holder admission of an old process record
harness: give row-priority status its actual foreground owner
upgrade: reject queued words after a source build changes
upgrade: isolate source scope from process birth
footer: publish the held arrow fixtures foreground owner
harness: expose equal-second accepted-word publication rollback
gui: expose same-second upgrade word round-trip rollback
census: expose qualified associated call name collisions
census: expose generic qualifiers shadowing concrete impl names
harness: expose relaunch claims retained after landing-read cancellation
gui: align private gallery with quiet held arrows
effects: expose pipeline polarity drift at mid-gray
converge: cover an applicable non-Claude pool at the live probe
converge: require a pool-only resync to reach current
converge: cover rosterless default Codex source read and apply
census: expose external parser names borrowing lazy wrappers
secrets: retain discovery provenance in negative-cache controls
release: refuse protected keychain aliases during signing
release: expose inherited public HTTP authentication
release: retain broad authentication on private origins
release: borrow unsupported header fixture keys
accounts: retain bot-check gap expiry at reappearance
accounts: restart a bot-check clock when its host changes
release: expose inherited Git parameter authentication
release: expose conditional Git header discovery gaps
release: bound scratch Git waits with hang detectors
release: expose truncated Git header key discovery
compose fleet simulation with installed-app handoff ports
distinguish local version from peer hearing at roster gate
gui: expose command lookup failure and identity gaps
core: cover retained image bytes, loose bounds and animation clocks
core: import the terminal clock through its public module
core: give quiet replay animation an explicit first-frame gap
cover network CLI expiry during service metadata reads
gui: reject PATH proof past an unsupported directory
disk: expose missed pressure on a nearly full build volume
require visible monitor capacity and honest GPU memory figures
cover CLI capacities and exclude unclassified RAM from available
require capacity figures in normal-width monitor drawing
distinguish reserved disk blocks and sparse memory readings
keep scoped bar clicks and single GPU identity with visible capacities
locate nested scope fills within the drawn bar bounds
release the memory lens fixture before GPU mutation
recognize unavailable disk capacity in amount ladders
bidi: use two RTL paragraphs in multi-paragraph L2 disjointness test
conformance: scan empty frames before moving TakeContext into malformed\_ctx
objc: register unit ivar on ATermSubstitutingClusterBase
aterm-tempfile, aterm-verify: hold the link and found-folder cases on scratch roots
fabric\_world: H2-5 the presence witness and leg 7 run what they name inside their blocks
session-log: H2-11 main's PATH-proof tests read H2's stand-in, never the word
converge: distinguish subscriber trigger from installed runner network
aterm-agent: r27 H1 - drop duplicate account-identity tests, fix a vacuous Kimi quota test and two latency budgets
gui: align deep-unscroll rekey byte interval and sixel row count
r27 H4: run commons\_probe's tests, fold duplicates, drop dead custody/hint/open\_within code
r27 H6: drop duplicate tests and the unread selector alias table
atpkg, atpkg-publish: r27 H3 test review: two deletions, two merges, one shrink, three fixes
r27 H5, drop duplicate and vacuous test checks in lab, link, machines, net and release
db: prove automatic table repair across LAN permission changes
gui: Settings paging tests whose walks render the same frames share one walk
wasm, gpu-web: assert store line eviction and applied budget on needs\_frame
drop an unused import from the ported vim press-path test
secrets: assert symmetric revocation+admission merge on equal-seq split
gui: date the move's glance read apart from the read before it (F4)
deck: prove the probe waits past a failed post before the quit stops it
aterm-agent: read a holder's descriptors once it is past its start-up
amacs: build the fuzz's ranges without a one-range vec! (clippy single\_range\_in\_vec\_init)
the stopped spinners spawn bash itself and bound their stop by MUST\_HAPPEN
one bounded stop poll in aterm-uds; the spinners drop BASH\_ENV
gui: import the public vitals trend type
uds: establish continued state before the timeout control
commons: compose membership recovery with entry-log validation
editor: cover late cell drafts over journaled edits
one stopped spinner in aterm-uds, run with an empty environment
accounts: an old Codex's report agrees with its launch in every default-row condition
accounts: exercise the anchored attempt projection directly
accounts: bind the request fixture to its roster path
accounts: give vault fixtures distinct login directories
read the spinner's CPU at the kernel's tick rate, and kill a hung stand-in's group
hold kernel\_timebase to hw.tbfrequency, and end a stand-in whose parent died (tree …)
harness: pin the clauses that keep a restart from closing as tab-taken
harness: a sweep's pick names the live act before a look whose agent ended
harness: pin the owner's /goal network outage of 2026-10-26 as a measured fixture and two tests
harness: the route filter test builds no Woke::Browse on Windows
secrets: name the member lock receiver
accounts: name the Codex report condition type
choose the timebase in a pure fn checked on Rosetta's inputs, and say what a stopped spinner's orphaning does (tree …)
the composer-boundary press-path tests run on one test clock
fleet\_live\_headless's seam comment says which peers the hang-detector waits reach
foreign@0's one-worker run gets the past-the-run hello and proves its refusal
the typed/pasted turn test proves the key licence and reads no wall-clock window
open\_files\_are\_lsof\_s's holder writes its proof line with no redirection
db: unreadable membership records are ones custody refuses
db: model-step fan-outs run on the file system lane's three workers
accounts: name the codex-next condition table's row type
core, http, gpu, effects: resolve Batch 57 SPECS.md §5 gaps
gui: eliminate sleep windows, cover render give-up heal, and sync SPECS.md
policy, update: cover CSI ? h selector parsing/matching and sync SPECS.md
containment: use spawnfd::command and aterm\_tempfile in enforcement and plist tests
agent: the seed matrix fans out on the file system lane's three workers
effects: the guard's share test stops a control once it misread a cell
harness: the press test's leftover-birth precondition compares squashed spellings
db: cover concurrent offline edits through automatic repair
db: compare offline proposal email as a string
secrets: alternate Sybil admit and remove cutoffs in quorum-flood test
vz-agent: a boot that was over is Ready after every empty Booting tick
vz-agent: bound every wait for Ready by the one-minute hang detector
prism-glass: the census reads four sweep pages that tell the lip-forward rules apart
prism-glass: hold every lip-forward lip to its bar and pin what the lip-forward rules lay
prism-glass: tie each census page's walk caret to the lip it ships with
gui: the split vim test runs on the shared test clock again
db: verify automatic repair across independent process owners
fleet: peers' "since" and last-answer line must say the answer's time
gui: name the evented tab's tuple and read the act's row from the back (tippy, gap 19)
gui: a specimen's glyph ink is kept per face, size and theme
gui: the account identity models' steps run on the file system lane
fleet: the two tests the merge of main's F4 browse rules left behind (F17)
db: retain bounded diagnostics when island repair stalls
db: include durable inventories in island timeout reports
gui: the member desk's tests sign each ask, from its own address (F10 review)
cursor-trail: build the lift law's glow by struct update
aos: close-lie, a causal lie the shutdown drain alone reads, replaces post-lie
secrets: a re-pinned Mac's load\_records misses the cache of the old pin's store
gui: a mixed frame after a terminal one clears the presented-grid record
gui: the short-window sweep walks the light theme only on pages it changes
uds: end the adopted job by SIGKILL, not by closing its FIFO gate
acaffiene: the successor's autostart decision and env read are tested; CHANGELOG wording
cli: import OsStringExt for non-UTF-8 flag value tests
cli: assert --name=--name=mine preserves literal prefix
acaffiene: the first-exec-hang test asserts what its sweep kept
ctl: expect baseline + 20s leg in driven @s-a1:0 await task test
acaffiene: the settle wait looks for the mug again, told apart from the job pid
acaffiene: the real let\_go reads under the verbs' turn
atpkg: the dry run's lock probe answers as the cleanup hold does
atpkg: a dry run with a helper lists removals past a held lock
secrets: F15 negative controls name the assert each one breaks
secrets: a LAN and a laptop each admit a Mac and both stay in after the heal (F15)
gui: the goal leaves codex-alab's chip its cells under Land's worded face too
harness: hold both clocks through takeover deadline fixtures
commons: exercise log-backed ordinary startup
commons: require startup to obtain absent membership history
gui: codex-alab's chip tests build on Windows and pass tippy
gui: the click test's two helpers are unix-only beside it (win-arm cell: dead code)
commons: verify fresh generic tables through ordinary startup
census: keep input ordering and cache expiry boundaries under a clock correction
fleet: the no-log heartbeat test's book entries are heard now, which main's prune at the real clock keeps
census: main's denied-member census test names this Mac m1 from a scratch aterm.toml, not the host's name
agent: a fact of whole words is never cut inside one, whatever TMPDIR is
fleet: the holder lifts its own hold where F17's merge undoes the issuer's rm
secrets: the silent-peer test fails, not hangs, when the peer is never asked
db: the retired-member replica test signs its genesis with the vault's key
aos-pane: check zero-width CellPx refusal and DECRSPS uncarried partial
fleet: the ambiguous --host read waits the hang detector for the issuer's book
slog: pin that untaken rollout turns stay off the carry (KI-1029-1 R5)
census: the node\_key deny census test names this Mac m1 from a scratch aterm.toml
gui: the release-under-the-card test is macOS-only, as tap is (linux-arm cell)

Docs

accounts: one label per §5 lab, and cite Kimi's sign-in fixture, not a lab gate (c)
harness: pool\_line's comment says why the host types no pooled Codex line
accounts: Settings help moves no Codex session; review's identity, wall and sign-in lines
list the F1-ready specs as VF5's first targets
SPECS and CHANGELOG say what the third review's fixes do
Claude's effort hint goes where the session's facts name an effort
the label's hover, a held ⬆️'s whys and the handoff-policy gate's errors say what the code does
session-log: H1-4 the detail's law is file identity; which sources confirm and which steer
no Grok renewal in the background, said everywhere it was not
pty: update SPECS.md test count after main's r25 cleanup
release, atpkg, lab: record Batch 18 SPECS.md §1/§5 resolutions and scope configured\_nudge to \[render\]
atpkg: align SPECS.md with exact disk\_ok, codex staging\_assets, and withheld\_summary
upgrade: qualify row vetting by recorded-birth admission
release: describe noncanonical header port refusals
disk: describe the large-volume automatic reserve
an escalation ends with its box or question; the act lands on it (E3-3, E2E-3)
accounts: a pin on a row of its own is set; what runs under it is refused, and the walled refusal's true words
session-log: H2-7 the detail's own name, its stand-in and what each platform misses
MEASURED\_BUILDS's source, what a measured build adds, and lab claude-measure (E1b-5)
name what the composer scene runs of …, … and …
harness\_land: say what the chip reads, every refusal, and that codex-alab's half is its own
deck: say the stop is clean only at a quit, and name the three stops that still misdraw
fluid-swarm: F17 as built and what it leaves open; C19 and C23 superseded; the fleet-book spec is every member's book
harness\_needs: help, manual, SPECS self-claim-needs, CHANGELOG and design §14.3.4
commons: verify fresh LAN delivery in both directions
specs: close test-mapping gaps across 11 crates (batch 65)
specs: map post-audit modules and tests in alloc, buffer, codec, parser, predict, scrollback
specs: map post-audit specs and tests in search, tempfile, grapheme, and dirfd
node-serve: the node job serves no Lease
fleet-listen: the census is recomputed on the fleet issuer, not a lease holder
aos: drop the removed post-lie test's bullet; name the signal tests' deadlines
manual: name aCaffiene's menu rows as they read, its about line first
network: members\_here says which consumers wait the herd's share
messages, pty: reconcile SPECS.md with current main
harness: name the agent wake's marks as each platform has them
specs: reconcile 11 crate SPECS.md tables and counts with main
specs: reconcile SPECS.md tables and test maps across 11 crates (batch 69)
secrets: a waiting ALab join's subscriber asks the members; the phrase stays with members join
secrets: the revoke test and its F14 round-2 line say what F18 covers
aos: the signal tests' one-minute waits; post-lie's lie is no shutdown-drain fault
specs: sync stale statements, test refs, and §1 histograms (batch 71)
tests: the aos detector spans a local run; a peers read's aterm may run nowhere
specs: reconcile gap histograms, kinds, and §6.3 sets across 7 crates
the suspend fix's fence geometry, the stub's inked cells, the landing paths driven
say which grids start a clock over, not which sequences
codex-alab's Autopilot chip in the manual, SPECS, CHANGELOG and §14
the codex-alab chip shows where codex-alab leaves its pad blank
codex-alab's chip shows only where codex-alab carries itself; the menu's real rows
fleet: describe unknown ages at the current clock
changelog: a leased pin is not where every worker starts; the keyring refusal's reason
network: record composed validation and format the fleet probe
say codex turns between two sweeps are logged at their engine edges, and narrow ATERM-KI-1029-1
stock-label note answers the branch review; label stable.rs's stable row
capacity: decide and Alone say ALONE stops below what can ever be available

Other

fabric on's proof waits a hang bound; x5 and the journal test drop their races
commons: an open vault's only admin founds its Commons by itself (sync.shared-data)
commons: the founding by default honours agent off, reads a busy lock as busy
R5: aterm fabric warns of what the broker's retention gave up
R5: say plainly that a new bridge resets lane\_faults and not the node's gap count
R5 review: one loss is one range, in the count and in the warning
rewind: pack shed history into 256 KiB slabs and return freed pages to the OS
vitals: narrow VitalsHost::cpu\_policy\_generation to macOS
Relay live network observations between local aterm processes
Use canonical duration rounding expression for connector lint
Express relay readiness wait directly as a while-let loop
Keep native CPU policy generation state in macOS builds
Distinguish unverified account reads from denied membership
harness: read Claude Code's cached free credit offers; a worker line may drive the person's Chrome
harness: claim the free credits Claude Code offers, through a worker in the person's own Chrome
style: format the credit claim act with trustfmt
harness: name the claim act's agent gate by an exhaustive match (census agent-gate)
harness card: the line links alab.systems under every Autopilot mode
aterm-phase: read Claude Code's startup announcement slot under the card
harness card: ALab's banner over Claude Code's startup announcement
harness card: review fixes for the line link and the announcement banner
harness: fence the credit claim worker (claim-worker@v1) and end its task on Land's defense
harness: the claim worker starts fenced with every box raised and stops after 30 minutes
style: format the card merge's test resolutions with trustfmt
style(gui): borrow the one-key try as a slice, not a clone
Align ledger and hover-test helpers with their platform callers
Show sign-in failures for the current Claude account
aterm-effects, aterm-lab: cursor-trail looks9 (Q1-Q11) and trail-companion
aterm-render: the letter guard's control drops the flat ribbon's paper Enter
aterm-effects: the cat at the margin rides the line; a run beside wide glyphs keeps off the caret
aterm-effects: looks9 round 2 -- the cat runs down wide writing, comet's plume fans and its tail takes its depth, the rail dips past short glyphs, water's foam varies, a strike stays in its pane
aterm-effects: the foam test's rail colour in even hex groups
aterm-effects: looks9 round 3 — laser crackle dropped at an edge, comet plume scatters in one row of air, water foam rides a body
aterm-effects: Water's body of water takes its depth only over air
aterm-effects: the comet's split plume settles clear of the pane's end
aterm-effects: looks9 round 3 review fixes (split pane, star latch, comet tail, spark test, pinned shower)
aterm-effects: a split pane's column bound is its grid's width, not its widest row
Idle memory: decode the trick vocabulary at build time, box three large thread-locals
aterm-lexicon: trustfmt tricks\_alloc.rs
Lead blocked Claude recovery with the current sign-in blocker
Preserve narrow recovery blockers and expire stale network claims
agent, uds: fix rollout-sample, ai-look and sqlite\_read allocation regressions
gui: gate unix-only credit-claim ledger and banner-test helpers on Windows
gui: gate unix-only MEASURED constant in claude\_card\_banner\_tests
G1-1 (privacy, PRIV2-1..5, PLAT2-1): a command's detail names only a program that ran
G1-2 (docs): the detail's law is the kernel's, and an amend can carry it
G1-3 (leg 7): the privacy sweep plants an array, a comment and a lone directory
G1-4 (cells): the ran ring's cap builds only where something fills it
G1-5 (review fixes): a link, a script and a stand-in name the program that ran
G1-6 (docs): the detail's sources, its window's end and its one amend, as built
G1-7 (land fixes): the cells build clean, and the r13 witness runs as its name
aterm-link notify (C02): one full flush a page, on the media before its command; none for a record that pages nothing
aterm-link notify (C02): an owed cursor falls due by the clock even while marks arrive; a flush tally seam and the bench's need leg
fabric bench (C02): the person pager tells its flushes too; both pagers read the tally once it counts the cursor's last write
aterm-link notify (C02): CURSOR\_EVERY's doc names persist\_due, which writes a cursor owed for it
aterm-link notify (C02 review): a verdict is written ahead of what it spends or counts, and a restart finishes the one a kill cut short
aterm-link notify (C02 review): the page-flush law tested where it was claimed, and the docs say what the code does
aterm-link notify (C02 review): the page-flush test names its case type (tippy type\_complexity)
Report ambiguous account aliases as sync conflicts
fleet: name only the peers rm that lifts a remote hold, as the grant there stands
ctl: an await task whose peer took its grant back ends with its rows, exit 1
fleet: a head of this machine's id another peer shares is ambiguous to every verb
fleet: every grant remedy and help page names allow drive --all
ctl: survey --host refused for a silent issuer exits 2, as ctl --host does
ctl: only a refusal no grant admits ends a driven await as a grant taken back
fleet: the static hold lifts name a peers rm here only where no "\*" grant stands
Test authenticated contacts through retained network state
cursor trail: vim's INSERT read waits for the reader and finds shell mode's box
Show bounded network history as partial
machines, agent: read TCC.db natively in-process and scope survey rate\_limits to codex
Clarify Network State warning meanings
harness: \[harness\] accounts = "off" turns every automatic accounts sync off
secrets: machines let in by password open at a terminal join Commons
Expose service read failures and complete Network State explanations
Keep selected Network State services visible in short windows
aterm-link: a successor's run fence and first floor raise admitted by a proof on the media (R6)
aterm-link: R6's specs, docs, the handoff test's no-proof control, and found seeds the proof moved
R6: measured — the successor's start and first floor raise write nothing; the barrier start's proof by the incarnation
R6 docs: a copy of the state dir that keeps its hard links is outside the proof's argument; CHANGELOG wording
Check proof identity without pinning prose and retain the pin fence durability dependency
aterm-effects: precompute cat\_baker fixed eye luminance & inline kitty hot paths
aterm-effects: hoist luminance LUT and unscaled ring targets in cursor\_rainbow
Reproduce ANSI restore loss of margin and origin pending wraps
Restore deferred wraps through origin and margin state without replacing cursor saves
Carry erased saved edges and reset charset before final wrap placement
Borrow the existing saved cursor while testing wrap recovery
Expose active full-edge wraps after the saved glyph was erased
Fall through to the saved wrap after an erased edge cannot be reprinted
Expose rectangle-blanked pending wraps with no saved cursor
Rearm rectangle-erased blank edges without creating a saved cursor
Expose pending wraps under rectangle-copied wide glyphs without a saved cursor
Restore pending cursor state with standard DECRSPS without drawing or saves
Position the alternate paint control explicitly after its saved wrap
Make the cursor restore value packet explicitly Copy
Make pointer control reach the resource header
SPECS: state what the F1-ready functions do; give the overflow rows their requires
prism-glass 1.2: LightLatch and its model
Report control-journal contention without claiming membership
Refuse contradictory Codex users at stored credential admission
Exclude failed default logins during account fallback
Keep model environment references as separate source-closure probes
Preserve active account guards and rotation bounds during fallback
Format the generation-aware preparation fixture
Fence account fallback against post-poll and recovery races
SPECS: menu-requires-terminal states the set, not a false equivalence; pet-width panic site
Bind broker fixtures to generated serving policy and current bus
Borrow the expected broker table in the command policy assertion
fleet: keep vault admin locker holders at facts on sync join (C19a)
aterm-effects: optimize letter\_guard/ink\_ledger/bed/ribbon hot paths & inline helpers
secrets: an admin Mac away while another lets a Mac in and out shows no ghost
Show local sign-in activity without changing recovery policy
aterm-effects: optimize classic\_wake/trick\_flash/cursor\_momentum/light\_latch hot paths
occupancy 2.9: a declared wake's fact rides the one fact slot
occupancy 2.9: the idle-point rider (a wake rides the policy's act under prompt)
occupancy 2.9: conformance walks Type at the idle point (door 2) on real code
occupancy 2.9: tests for the point door's guards, gates and give-backs (review follow-up)
occupancy 2.9: the give-back test names its case table's spoiler type
occupancy 2.9: the ride tests meet main's continuing points and refused-request retry
Stop displaying elapsed account deadlines as future events
Fleet tests: a test's default port is none an aterm here serves
aterm-effects: optimize up\_ring/spawn/raster/rainbow\_kitty\_v2 & inline custody/trail\_sound
aterm-effects: inline harness\_card/aos\_momentum & optimize typed\_tricks/sound\_policy
Expose complete account recovery details through explicit copy
Name the account configuration-folder action accurately
Explain retained account wait reasons in plain language
Keep unknown account recovery timing visible in short menus
accounts: read report rotation from config, name running sessions, and stop upkeep when off (C17a)
fabric: renew an absent broker when on's service job is installed
fmt: format enable.rs at edition 2021
fabric\_world: wait for B's wall chip after approval drops in owner\_ask
install.sh: run aterm secrets join --no-wait on windowless lanes (C6)
aterm-effects: hoist invariants and ground/theme LUT math across kitty/card/ribbon/cli\_marks
secrets: carry vault, signer, seq, and head in \_alab-vault.\_tcp TXT (C4)
Clarify the Commons account catalog scope in Network State
harness version: a CLI core of empty parts is no version; a revision under one core is offered
bottom rule: the Σ says no unread count it does not know
upgrade rows: the person's Now keeps the off asides; a Skip names a build that parses
harness switch: the knob is laid round the font's words, never under them
harness switch: the dark gem knob rests in no olive, its warm stops lifted
release gates: a predecessor no release shipped is refused under the asking gate's name
lights: the off chips read as words do, 4.5:1
top rule: the ⬆️ holds where nothing moves its tab, and its words say so whole
top rule: codex-alab's label names the build its image runs
specs and changelog: the held ⬆️, its whole words, the knob round the words
top rule: the label's fit-by-words helper is the tests' alone
harness version: formatted as trustfmt lays it
top rule: a control-click on the ⬆️ or the switch asks nothing, as a right-click
phase: offer a build under one core only when it is later
effects: the dark knob's warm stops read as copper and amber, the pearl stays one grey
gui: every button on the harness label goes nowhere
gui: the arrow's words never move the switch or cut a word; a held press says why on the messages row
harness: Claude's effort hint stays on the mode row while ◆ names no effort
harness: a Skip of a Muse Code revision holds that same revision again
gui: an upgrade row shows its ⬆️ only on its own program's rule
gui: an asked move's hover keeps saying it is under way
gui: a worded Autopilot chip is set apart from the mode chip by the rule
effects: Land's knob runs garnet to rose, and every finished knob pixel holds the floor
render: a little ⬆️, drawn small on the rule's stroke inside a ring that clears it
release gates: the handoff-policy gate refuses an unshipped predecessor under its own name
top rule: an asked move's ◐ wears no ring and keeps one blank either side
top rule: the short gap's comments name the ink it takes, not a ring
lights: a control-click on the switch or the ⬆️ calls no menu it cannot open
lights: the harness label is the glass's for the pointer, as for its presses
specs: the label's hover takes the first whole-build form that fits its own cells
footer: Claude's own effort hint fills an effort the facts leave open
survey: codex-alab's build rides its own slot, so a tab with no rollout keeps its screen read
specs: the usage text row says the rule's grain names no unread count it does not know
release gates: the unshipped-predecessor tests compose the refusal, not pin its prose
lights tests: a held press's messages row is held to the HELD words, not pinned prose
footer: an effort hint read off the holder's row is kept for it, facts in or not
bottom rule: an account watch that knows nothing lays no ⧗ Accounts unknown
mode row: a cut last item that can only be a key hint leaves with the hints
top rule: a short gap between the lockup and the harness ramps again
footer: a relaunch of the same conversation keeps the effort its rule showed, frame or not
lights tests: a cut key hint goes with the hints; a cut job still stands
footer: Claude's effort hint is read off the live screen at each output, so a launch no frame watched names its effort
footer tests: an unwatched landing of a launch with no turn names its new process's effort
Expose observed session account recovery through control
aterm-effects: hoist ground linear/luminance math in meteor/ribbon/stardust/light\_body/cursor\_fx
Bind named Codex rows to credential identity snapshots
SPECS: pointer-grammar says what parse\_pointer takes now
aterm-effects, aterm-gui: carry light\_vivid in Aos MomentumConfig and keep vivid ink across attach (ATERM-KI-1024-5)
prism-glass P0 tail: the slow-worker test waits out its drain grace
prism-glass P0 tail: a kept trail-diff base checks out without recursing
prism-glass P0 tail: trail-diff's closure refusal asks for the split
prism-glass P0 tail: the pipeline's carry-over is in the state words (H)
prism-glass P0 tail: the App's shed latch is in the state words (H)
prism-glass P0 tail: occurrences and novas are hashed whole (H)
prism-glass P0 tail: the pet's console resident and stroke detector are hashed (H)
prism-glass P0 tail: the occurrence cases are a named type (H)
Convert keychain-path git configs to vault helper and add secrets git-credential (C8a)
G2-1: aterm-slog declares the needs a fold raises as observed
G2-2: a node's will of either word makes its sessions node-gone in the brief
G2-3: notify pages each observed need rise exactly once
G2-4: docs say what notify --on need pages now
G2-5: the observed-need sweep holds records and snapshots apart
G2-6: notify keeps every need a fold names and pages an owed need again
aterm-effects: hoist shower palette/grid checks in emit & optimize panel/tenure/pet motes
aterm-effects: hoist luminance LUT in word\_decorations & optimize output\_streak/cursor\_trail
aterm-effects: hoist luminance LUT in companion & optimize pet\_world/cat\_baker
Read the notary profile from release-notary, on release Macs with the tools only
Describe notary marker failures with the existing subscriber suppression policy
Clarify handled-entry digests without claiming keychain content equality
Test Apple documented DEVELOPER\_DIR application bundle selection
Resolve selected Xcode bundles before the inert notary-tool preflight
Enable default Codex account pool sync without roster file (C15)
aterm-effects: hoist luminance LUT in nova/matrix\_rain/stardust & optimize pane/comet
Keep Network State worker locks off the UI thread
aterm-gui: queue CLT Install… press behind active permission dialog (C2)
Keep local observation relay reads nonblocking
aterm-capacity: a disk waiter no claim's end can admit reserves no disk
aterm-capacity: the public docs name reservations without linking the private fn
aterm-capacity: an overtaken unservable waiter is relieved again; only its wait line says it waits for space
atpkg: doctor's toolset row weighs the one default set, vendor CLIs included
atpkg, aterm-machines: format the default-set tests (verify fmt --fix)
atpkg: one vendor half of the default set; doctor counts only the set and judges it before the index
harness card: the announcement's banner outlasts the card over the slot's rows
aterm-effects: precompute rain ramps, deduplicate tone n-grams & optimize probe/mlp/synth/rainbow\_kitty
aterm-effects: optimize bed, ink\_ledger, spawn, emit, momentum & stardust hot paths
pinned\_dir: an identity probe names its errno; a snapshot's .done is the writer's last act
app\_introspect: trustfmt's layout of the snapshot marker match
pinned\_dir: a symlink or a non-directory at a retained name is still a mismatch; the marker's entry is synced
aterm-gui: the pane cache's kept-announcement read is scrolled\_announcement
aterm-net: every test binary's fleet default port is none an aterm here serves
Recheck staged login identity before recovery publication
aterm-journal: read the committed prefix without the writer lock; bound a writer's wait
aterm-secrets: Commons reads take no journal writer; custody and writers wait a second
aterm-db: read Commons control history beside its writers; busy is not failure
aterm-secrets: test the barrier behind a settled Commons observation
Simplify deadline receive loop in discover.rs to while-let
Rank --host resolution across 7 tiers and resolve leading machine labels
Guard remove and drop\_copied\_grant against cross-tier peer mismatch
Preserve target-only host:port matching on resolved peers in C12
Fix Claude Vim trail admission across delayed mode repaints
Record final Vim trail validation and lint cleanup
Keep armed window-close plans honest: re-check at the ready edge, drop stale ones
Window close plans: reopen every frozen document, tell jobs apart, weigh batches, defer behind a handoff
Window close plans: a real shell's replaced job drops the close
Window close consent: read the command count through term\_lock
Window close plans: the ready edge freezes no document it does not save
Document closes: a queued leaf close follows its tab to another window
Window close plans: a close an update handoff holds counts as gone, and its replay asks again
Window close plans: a close a Quit replaced behind an update handoff is disarmed
CHANGELOG and SPECS: what the window-close plan fixes now hold
aterm-gui: a close an update handoff deferred replays as whoever asked for it
aterm-gui: a sync that leaves the front as it was lets a selection drag go on
SPECS drag-follows-front; CHANGELOG: a selection drag goes on when another tab changes
aterm-gui: a selection drag still ends when its pane is re-laid
SPECS drag-follows-front and CHANGELOG: the drag also ends when its pane is re-laid
Give finish\_update\_handoff back its doc line; space the two changelog entries
Windows build: the handoff-only close helpers are unix code paths
Reserve supervisor commit-stop outside claim guards and isolate test turn IDs
Preserve safe vault sync failure categories in account recovery
lab: codex-alab proof checks the worker after the hold-timed legs (E6-3, CXP-3)
lab: up --fabric stands the lab's own bus, --tab-strip its row; claude --by-name types claude as a person does (E6-1, E6-2, E2E-13, E2E-14)
lab: down takes an up --fabric lab's bus keys, the broker is a jailed root, the commit is timed to the ms (E6 review)
ship provision: import the Developer ID pair into aterm's own release keychain
aterm-effects: optimize kitty\_pet, light\_body, companion, raster, meteor, ribbon, stardust, wake, rainbow, up\_ring, output\_streak, trail\_sound, trick\_flash, typed\_tricks, kitty\_sing, pet\_world, kitty\_cursor, tone\_infer, genome, nova & supernova hot paths
aterm-verify: a stand-in is a symlink to its text's one file, so macOS never ends it as malware
aterm-verify: standin's note says how macOS names a hard-linked file, as measured
aterm-verify: stand-ins share one quiet cache, so no test process leaves a folder behind
aterm-verify: the stand-in cache's tests hold it to one file across processes and to the user's own folder
A busy codex tab reads busy on the Overview, Settings and its hover
codex's own word on every Settings row, one driver rule, a settled revision test
autopilot::carried names every program in an exhaustive match
Fix fresh Commons admission and crossed LAN repair channels
End failed journal try-lock result before the blocking fallback
Expose automatic probe ownership before a coordinated LAN write
Read the published vault format in the source-rebind fixture
Bound the callback regression wait for its required application report
Keep authenticated source context off the observation enum stack
Update the Bootstrap fixture for boxed source configuration
Stats deck: an update's handoff is drawn as a restart, not "aterm crash"
aterm-link sim: eighteen stale witnesses moved to the seeds that show them now
aterm-effects: optimize ripple, matrix\_rain, cli\_marks, harness\_card, comet, momentum, word\_decorations & pet\_baker hot paths
Stats deck: VoiceOver reads the strain dial first, as it draws it
accounts: a sign-in Cloudflare's bot check stops is named on record
accounts: a bot check ends Grok's ladder too, and its reloads keep one wait
accounts: the bot-check tests say is\_multiple\_of
acaffiene: retire what the old aterm caffeine name left — its login job no longer runs every 10 s
aterm-effects: optimize color\_math, companion, pet\_world, cat\_baker, kitty\_pet and cursor\_glow hot paths
atpkg capacity: a waiting claim says what it reserves, and an unservable one is marked
atpkg capacity: judge each claim on its own volume, and test reservations below the need
lab: a child's descriptors past stdio are its own in the open-paths test
Renew pinned Commons accounts automatically through checked root preparations
aterm-agent, aterm-gui: align codex\_alab::is\_tui\_argv with codex-alab and use it for Codex relaunch/restore
Format two upstream files flagged by the composed-tree check
aterm-slog: a run's identity amend lives and dies with its open (H4, GATE3-7)
aterm-slog: the carry cut steps one victim at a time again (H4, U30)
aterm-slog: the amend the fold keeps rides its open, in batch, cut, snap and model (H4, GATE3-7)
Fleet default port: pin that only a test binary holds one
prism-glass 1.6: the wedge emitter (ribbon\_wedge\_into), unreachable until 1.7
Stats deck: a live peer's strip checkpoint is not a crash, and only one aterm writes it
Cover network-history ownership across checkpoint compaction
aterm-effects: optimize console\_life, cursor\_momentum, classic\_wake, cursor\_beam, cursor\_glow, harness\_card and nova hot paths
aterm-agent: align needs cut\_instruction and land\_open failed\_proof with codex-alab
Clarify which local account catalog storage is missing
aterm-agent: align repo\_work with codex-alab (canonical\_outside guard and unread-directory status warning)
Advance changed harness versions for the 0.146 release candidate
aterm-effects: optimize ribbon, meteor, witness, kitty\_pet, console\_life and pet\_world hot paths
aterm-agent: ignore cut harness instructions on any row or mid-line in needs reader
aterm-release: the signing deadline test waits out no minute
aterm-capacity: a run's peak claims no more than its cold budget
aterm-capacity, atpkg: a disk claim says why its figure is what it is
aterm-capacity: need()'s doc says the next run's whole write is held to the cold budget
Carry Kitty image store, virtual placements, numbers and pending chunks across replay
rewind: carry inline, scrolled, relative, and floating images across keyframes
aterm-core: factor image carry helpers under clippy line limits
aterm-effects: optimize word\_decorations, kitty\_cursor, companions, trail\_sound, int\_bag\_mlp, spec and aos\_momentum hot paths
commons: lift the roster cap to 255 behind a mixed-version gate (C26)
commons: hold the C26 gate and silent leaving to what this Mac really heard
db: check the discovery room for a full roster at compile time
Keep private release preparation on the unverified build lane
aterm-agent: harden codex\_alab argv edge cases and cut\_instruction closing marks
aterm-db: its test binary flushes plainly; four conformance sweeps run on every core
aterm-effects: optimize spectrum, nuke, output\_streak, up\_ring, trick\_flash, harness\_card, cli\_marks, nova, supernova and tone hot paths
window: let the parser answer or refuse before aCaffiene and Commons start
style: format the incoming relaunch and restore expressions
aterm-effects: optimize console\_life, kitty\_pet, companion\_look, pet\_world, kitty\_sing and kitty\_registry hot paths
Expire stale peer reachability independently of observer refresh
Keep network observation and contact ages monotonic across cache and relay
aterm-bench: the effects harness draws its terminals in the rig's theme
verify perf: re-record effects and both trail composer lanes on themed terminals
Say a codex tab's context left in its hover and log
commons: test the refresh's deferral and its 63-member stop (C26)
aterm-db: catalog subscription and proposal evidence sweeps run each world once, on every core
release: move shared release ring to \~/.aterm/release-ring/ (C9b)
aterm-conformance: check rendered companion height bounds in measure paint
aterm-conformance: fold temporal before reading replay\_checks status
Preserve service observation age through cached reads
acaffiene: remove the state temporaries cut-short saves left
Recheck Codex credential identity before sign-in publication
aterm-gui: the harness label tests read each harness's version
aterm-effects: optimize effect\_util, word\_decorations, rainbow\_kitty, kitty\_cursor and cursor\_glow hot paths
Keep the network observer reason visible in short overviews
System State: one gesture at a time for a control verb's page; every door records the revision's page
System State: a control verb's now page counts once its asker's page is up; the debugger step waits for a landing tab
SPECS (aterm-gui): four rows name the tests and code that exist
System State: round 6 fixes to the control verb's now page (recorded; superseded on main by the permission walk)
SPECS (aterm-gui): preview-header-whole-words says what header\_first\_line and header\_in do
System State: an older aterm still reads fda-pane-opened; Show it with no revision is tested; doctor's doc says what stops it
claude\_footer tests read the harness version, not v0.4
accounts: Codex rows sync from the vault by default (swarm C15)
accounts: init sees a due Codex sync; an unlisted Mac's upkeep stays quiet
accounts: a Mac that left Codex's pool stays out; init reports Codex's own failure
accounts: a Mac that left Codex's pool is CliSync::Left, naming the row
accounts: the symlinked-config sync test runs on unix only; tippy fix
aterm-agent: align codex\_alab symlink refusal with atpkg and harden worker -c key parsing
rewind, aterm-core, aterm-aos-pane: fork Kitty images and record animation ticks
aterm-core, aterm-aos-pane, aterm-gui: fix test helpers and KNOWN\_ISSUES note
accounts: one verb signs a pool row in, and Grok's is accounts login
help: a Grok renewal stops at accounts.x.ai's block page; accounts login signs it in
ai login: the bare usage lists every name the verb takes
accounts stats --cli: claim recorded walls only for a CLI whose walls are measured
help: rewrap the accounts browser --cli paragraph to the help's width
grok: no step promises a Grok sign-in by itself; one ask per due login
aterm-lab aos\_workers: runs share the host's cores; only expiry tests wait a ten-second lease
Match network observer descriptions to transport availability
help: harness.accounts says a Codex launch under a row of its own needs a codex-alab that keeps it apart
aterm-gui: three slow lib sweeps run on every core, none checks less
aterm-secrets: a recipient's low-order check compares a table instead of running a ladder
aterm-secrets: low-order docs name u-coordinates, and the 256 below 2^255
aterm: the binary's own unit tests flush plainly, as its integration suites do
aterm-agent: align twin\_binary and exec\_target launcher validation with codex-alab
Enroll local Kimi accounts and record measured quota
Refresh Kimi quota through a temporary terminal
Allow account sign-out without a terminal
Report account readiness beside fleet assignment
Format no-terminal sign-out guard
Fix shared upkeep quota fixture
Align account and harness tests with current behavior
Name the shared account table row type
Cover every default pool in sync expectations
acaffiene: sweep the cut-short writes of the bridge and the old name too
acaffiene: say "1 temporary" in the autostart's sweep line
Validate current staging and custody at plain login commit
aos: aos-search --verify judges a grid-credited bundle's grid search on every core
aterm-lab: the two drain-by-acks tests wait for acks under the hang detector; §11.7 says what the process tests run
secrets: a founding by default waits for an approver that shares the root
secrets: a founding held for an old approver waits, and says what a hand founding costs
secrets: the approver hold test builds its played programs without a complex tuple type
aterm-core, aterm-aos-pane, aterm-gui: carry kitty\_media\_admitted across replay and remove closed ATERM-KI-1027-2
aterm-core, aterm-aos-pane, aterm-gui: resync live keyframe on host IO reads without leaking host paths or clipboard
Show source observation time in the Network State overview
accounts: a pool row whose renewal met a bot check waits 6 h, not 15 min
accounts: a bot check on record holds a pool row across a restart
build cache: one entry that will not go no longer strands a whole stage
install\_sh: the ACL test's folder holds a deny entry only within one call
admit\_disk tests: main's overtaken-waiter test spells the pass with its stayed notes
aterm-dirfd: fstatat, fchmodat, a stat's owner and blocks, a mode word from its bits
build cache remover: walk by descriptor, never following a link at any depth
build cache readers: tests check what stayed as facts, not sentences
retired verify gate: its cells lane and lock go through the build cache's remover
build cache remover: change nothing by name that is not the entry judged
Keep remembered machine counts visible while network observation waits
G4-1: notify backs off from a refused state-dir write instead of exiting
G4-2: SPECS and CHANGELOG for notify's refused-write backoff
G4-3: notify judges no record behind an unwritten part, and no cursor passes one
Reject changed identities at pooled account admission
accounts: the window starts no Grok renewal in the background
accounts: the Grok gate answers after the store check, as every CLI's start does
fact menu: a Grok row with an email offers no automatic sign-in
accounts: the JSON listing and stats agree with the text for a Grok row
digest: a Grok wrong-account entry names its sign-in, not a renewal
accounts: the upkeep reads no Grok renewal candidates
Fix init permission and Messages sign-out waits
Stats deck: a killed run is dated by its last checkpoint, not its launch
aterm-agent: the launch-policy sweep runs its steps on every core
Stats deck: a kill before the killed run's first checkpoint is dated by its launch
Stats deck: an unseen kill draws no earlier stop older than the strips' six hours
Fix selection floor assert, EventLog ring reallocation, shell-integration CR/Cmd, and search test parity
Implement \[swarm\] enabled = false master switch across all swarm lanes
aterm-db: record post-ingest retained count and use 60s test admission
aterm-gui: gate macOS-only LocalNetworkProbe variants for cross cells
aterm-gpu: glow ramp parity scenes run on every core, and streak\_bed drops the comet slab's scenes
text --json carries the title; a drawing reply never makes an upgrade lag
text --json's title: test its hold, build clean on Windows, say what the guard leaves
aterm-bench: effects\_harness feeds the cursor family what a window does
verify perf: re-record effects and both trail composer lanes once, on a quiet machine
verify: the ceiling leaves out a check's wait for a core, and clamps QoS only at the desk
verify: judge a check's wait for a core over its last 10 s of reads
Reject changed Claude account identities before live rotation
Reject zero and fast-path OOB LZ4 match offsets and tighten RLE/regex/bits checks
Fix UTF-8 lead gate, sixel partial-band cap, GPU border/span saturation, and bidi continuation bounds
aterm-gui tests: r25 G01 prune (duplicates, vacuous checks, wall-clock budgets)
aterm-gui: pin the host clock in the curtain tests on every target
Fix DECSCA row Display, partial-region extras shift, vibrancy alpha, and scroll-band saturation
acaffiene: sweep the cut-short writes of its job plists too
aterm-effects: precompute matrix rain ramps and hoist hot-loop invariants
aterm-agent: the fleet race test's Busy runs wait none for a book they cannot get, and each race makes its issuers at once
aterm-lab: add lab swarm rotate usage-tap rotation proof (C17b)
aterm-lab: use SCRIPT\_SHELLS agents/claude shim and fast timers in swarm rotate
aterm-lab: drive second turn on swarm-b after account\_asked latches
aterm-lab: emit Claude worked done-row on served stand-in turns
aterm-lab: canonicalize tempdir before O\_NOFOLLOW login write in swarm unit test
json, toml, hash, serde, zstd: resolve SPECS.md §4/§5/§7 test and doc gaps
alloc, log, once\_cell, time, codec: resolve SPECS.md §4/§5 gaps and tests
aterm-cli SPECS §4: credit argv0 routing to aterm-cli's front\_door, not aterm's main
aterm-effects: cache ribbon wipe state per cell and skip expired meteor sparks
aterm-effects: reuse star age in deadline cadence and skip ordered ribbon sorts
Stats deck: a strip lock holder that restored a crash checkpoints it at once
Stats deck: say which starts write the strip at once, and test the clean start that does not
aterm-gpu: a glow ramp scene that fails no longer hides the other scenes' summary lines
aterm-agent: the launch-policy sweep says why its steps may run on other threads
aterm-slog: a partial transcript opens the turn the screen missed and ends only its own (E1-1, E2E-1)
aterm-slog: a step its turn's close cut off takes the transcript's result (E1-2, E2E-7)
aterm-slog: every observed step outcome keeps its close against a strong amend (E1-2 review, E2E-7)
aterm-agent: journal::log\_words, what an app log may keep of a loop line (E4-1, E2E-11)
aterm-gui: aterm.log keeps the harness's words, never a session's text (E4-2, E2E-11)
aterm-lab: codex-alab-proof reads its parked lane from the drive journal (E4-3)
fabric\_world: LEG 7H, the harness's review reaches aterm.log only as words (E4-4, E2E-11)
aterm-gui: the task-exited line is tested at the act the product runs (E4-6, E2E-11)
secrets, converge: add unmaterialized swarm roster, m\<N\> label assignment, and sync.identity (C11)
aterm-agent: honor top-level swarm = false in broken aterm.toml
aterm-machines: script initial launchctl print sequence in vault-server test
aterm-log, aterm-toml: what aterm.log may keep of a text (6E7-1)
aterm-gui: aterm.log keeps words, kinds, ids and numbers app-wide (6E7-2)
atpkg, aterm-update-core: hosted notices keep aterm.toml's values by length (6E7-3)
fabric world, design, changelog: aterm.log keeps words app-wide (6E7-4)
fabric: on by default on every Mac, a person's off recorded and honoured
steward: the ALab admin Mac forms and publishes the default fleet by itself
fabric: the broker survives an app update, and a broker that does not answer is brought back
converge: a failed row keeps its error in the log line, and the journal records the failure
fabric: the renewal reads launchd and systemd fail-closed, and puts a plist back only where launchd holds none
powers: review fixes for the ALab steward and the fabric on by default
steward: publish only the fleet the steward formed, checked under the fleet book's lock
fabric: a person's off is kept beside aterm.toml too, so deleting the fabric root keeps it off
aterm-release: aterm-slog's Trust floor ratchets to 623/7759 (E1, U30)
Install Grok Build and Kimi Code with the default set; a spawn installs nothing
A spawn installs any agent atpkg's store lacks; a landed grok's pending stub keeps the gate
atpkg: gated\_shim names the landed shim; the exec stays at its call site
Compose the present copy by a draw; read procargs without zero-fill
Prove the footprint reading on fresh anonymous pages
Warm the compose copy's blit row for a bloom window's first frames
Hand the tray present hook its format and tray as one pair
Keep procargs' zero-filled read: it saved no measurable memory
Idle memory, window pass: measured note, KI-1027-1, design and changelog
Judge the idle row on ps RSS again, as main closed R4 on it
Refuse a compose rect past the offscreen; pin the compose's alpha
Read the footprint test's numbers in a child that runs it alone
Map the two new compose tests in aterm-gpu's SPECS; format the test
aterm-effects: hoist station terms and mote bounds in kitty\_pet
fleet: heartbeat re-register, 14d/90d expiry, silent-first eviction and roster deny-list (C19)
Resolve SPECS.md discrepancies in phase, policy, lexicon, provenance, and sixel
aterm-effects: defer peek geometry and burst centers until active
aterm-vitals, aterm-gui: drop the stats deck's dead feeders and the tests that held only them (r25 G06)
aterm-vitals: delete the two memory tests G06 rewrote into duplicates (r25 G06 review)
aterm-vitals: the expectation table and its model replay run their scenarios on every core
aterm-gui: place\_key searches an item's spans only where the header keys it
aterm-gui: the every-width stats sweep and the scene's jump-knob audit run their items on every core
aterm-gui: three Settings sweeps run their items on the module's workers
r25 G10: prune gpu/predict/render/scene/sixel/window/wayland/xkb tests and the dead code they held up
r25 G10 review: Trust floors for the deleted proof padding, and aterm-window's SPECS counts
Test review r25 G13: drop vacuous and duplicate tests, dead test seams and helpers
grok signin: skip the automatic rung where xAI's page blocks the headless browser
grok signin: test the gate where the headless browser is installed; review nits
aterm-effects: skip inactive reaction waves and reuse water bed lit probes
verify perf, docs: the cursor lanes' figures are a 650 ms trail's, and a default window's read the same
verify perf: the effects baseline names the episode and scroll emit regression, aterm-effects …
aterm-primer: codex-alab gets aterm's six skills where codex reads skills
aterm-primer: a shared skills folder settles, the window keeps \~/.codex, the old prompt goes from \~/.codex
window: let aCaffiene's autostart log once the window's logger is up
r25 G09: delete dead adapters and duplicate tests, fix two weak test oracles
aterm-effects: defer eviction chrome probes and reuse chrome row signatures
prism-glass 1.1: P0.1, GlowConfig's Default and the frame structs' constructors
prism-glass 1.1: the Light field, with no reader
atpkg, atpkg-publish: prune and fix 12 test-review findings (r25 G07)
aterm-effects: fast-reject pet reading cache and single-pass pet cursor fold
survey: carry swarm facts, 1m listener cache, and 3m lease-holder push (C16)
aterm-agent: r25 G04 test review: drop dead features and vacuous or duplicate tests
aterm-agent: Accounts doc no longer claims it holds wall phrases
aterm-effects: cache star arms and fast-path supernova shade and output comet emission
init: base.pkg.toolset installs the whole default set, every agent CLI included
init: base.pkg.toolset honours Automatic updates off and defers the flip as the window does
init: the usage keeps its 27 lines with the toolset clause
r25 G08: prune duplicate and prose-pinning tests, fix a host-state flake, drop a registry and an unused codec
aterm-verify: cover a header whose selection pulls a check and cells together
Keep mismatched Claude account landings pending
aterm-agent: three accounts tests refuse a lock they hold at the first take, not after the ladder
aterm-agent: the agy usage fetch's bounded-whole test reads within a one-second budget
aterm-agent: fleet tests hold their unserved listeners silent instead of waiting out handshakes
harness: under Land a person's message is theirs only where it opens the session
harness: the Land model carries a person's exchange after work; Tier-1 checks the opening one
aterm-vz: the lifecycle walk replays each depth's checks four at a time, over one base
Stats deck: a kill after an old stop draws its pause, and the first reading's marks checkpoint at once
Stats deck: say when the strip's first reading writes, and how the restore draws an old stop
agent(accounts): ai-pool.toml reader, held\_by retention, and lease-gated selection (C14)
aterm-effects: reuse console station stand rect and walk row and fast-path pet ink and tail queries
aterm-gui: format 6E7-2's unparsed-aterm.toml test (6E7-5)
trust: aterm-log, aterm-toml and aterm-update-core rows re-measured on E7's tree (6E7-6, U30)
aterm-effects: share stride trig in cursor cat and fast-path glow, wake, and rain emission
aterm-gui: a wait is no await task news, lapses with its self-claim, and never hides an ask
aterm-gui: a claimant's wait lapses with its connection too, a tag means a wait, v3 claims count
aterm-agent: result full reads a codex worker's rollout, and a codex report missed at its landing is read again
aterm-agent: a codex landing that knew no conversation is found by the worker's claim at the next result
aterm-primer: supervise-agent skill v18 (result full reads a rollout too)
aterm-gui: the app's key reads task=theirs only where it opens the session
r25 G14: delete floor-padding dead code and duplicate tests; fix three tests onto live code
aterm-once-cell SPECS.md: correct the test counts the r25 G14 change left stale
window: log the Commons runtime's early warnings once the logger is up
aterm-effects: fast-path stardust, meteor, ribbon, comet, beam, and pet world hot paths
Correct what the slow-test round-two commits claim (review follow-up)
aterm-vz walk: stop a depth at its first failure; a slot wait that names no wrong cause
aterm-phase: read Claude Code 2.1.312's 5-hour limit words; leave the press path's as they are
aterm-phase, aterm-agent: read 2.1.312's 5-hour limit in the usage warning, the credits start and a review's wall
aterm-phase vendor\_drift: owe the session limit reset phrases through 2.1.311; check the effort auto notice's parts
aterm-phase: correct 2.1.312 fixture offsets, say what spares the quoted-words control, drop a restating assertion
atpkg, aterm-capacity: a disk claim is measured again after its relief, and relieved again only when sized for more
Stats deck: a gridline at every band's start again, where neighbouring bands share a box width
Stats deck gridlines: the 6 min strips' line in the gallery, the CHANGELOG fix entry and the SPECS row's test
aterm-lab forever: Claude Code 2.1.312's wall words name the 5-hour limit
sync.peers: a pending ALab join says it waits for the vault's approver
secrets: bound what an open admission reads, keep a let-go Mac out under its name, move held snapshots onto the update
secrets: take the approved key by slice in the open-admission test
secrets: drop the open-admission bound; a held approver moves only once it cannot read the locker
secrets: mend\_held's doc names locker\_skew::first\_reader without a private doc link
secrets: format the held-job test as trustfmt has it
secrets: drop the let-go name hold; a new Mac under a let-go name is let in
secrets: a held move re-reads the job under its decision lock, and a failed one waits for the next launch
secrets: held\_pass names its result type, the move test's install says its error type, and move\_held's doc links no private type
secrets: the mend starts no user server beside the system LaunchDaemon, and takes no server lock where no repair is due
secrets: format the daemon and lock tests; DESIGN-secrets §9 says the mend leaves a server the LaunchDaemon serves
aterm-gui tests: r25 G02 review findings (delete, merge, shrink, fix)
harness banner: Claude's news with its bar off, and under a warning, is ALab's too
harness card: the line keeps its alab.systems link wherever the link fits
An update notice its reader refuses is never the announcement slot
Only an announcement's inks wear ALab's banner; warnings open on a status glyph
A refused slot clears the entry's banner; the slot is read under blocks of warnings
Announcement docs say what the reader reads
aterm-lab aos tests: the late workers' drain waits out its grace too
harness-bump: write under the \[Unreleased\] heading, not the preamble's mention of it
aterm-gui footer tests: read the harness version, not v0.4
aterm-gui footer tests: trustfmt the version reads
announcement: read bar-off news fullscreen, in paragraphs and under the tip
claude card: the bar-off news banner keeps off a hook's row and a tip in the pane's ink
aterm-phase: rows at the indent under a hook's message never join the slot
claude card: the tip in the pane's ink only where faint draws at full ink
claude card: the faint tip is told by its ink, not by faint\_opacity being 1
aterm-phase: a stop row keeps the scan only under a blank row
atpkg: a --version that answers gets the hang detector, not 100 ms
atpkg: drop this branch's copy of main's hang-detector fix
aterm-gui: lapse late waits across new claims and track all open claim connections
aterm-gui: guard close\_connection wait lapse with live\_claim and remaining connections
aterm-gui: clear recorded proof on a connection when an unproven holder claims on it
aterm-lab: match alphabetical header order in flat\_headers saturation test
System State says Permissions are set up where no ALab vault answers
System State waits for an unanswered ALab vault only on a Join you typed
System State's vault row survives a relaunch and waits only while a password is held
The vault row reads a kept Secrets try only on the network it ran on
Outside ALab the repositories read as their stage runs them; what was heard holds per network and holder
The vault row holds its network through address churn; only a holder takes its join mark away
aterm-phase, aterm-agent: the reset press path reads Claude Code 2.1.312's 5-hour words
aterm-phase: a reset confirmation names only limits a build draws; qe()'s type-first reading written down
codex rollout tap: read unmeasured builds partial, and claim codex-alab turns from OSC 7501
codex claim turns: a late rollout names them, a stopped tap hands them back, a rest ends them
aterm-slog, aterm-gui, aterm-lab: a codex rollout read partial follows fix E1
G3-1: aterm fabric tail merges a node cap's faces by offset, so a resume with --from misses none
G3-2: aterm fabric status counts the held asks past their deadline it cannot judge
G3-3: the bus-offset refusal tests check the flag and the value, not the sentence
G3 review: doctor fixes the unjudged-asks warning; the tail's merge pins its hold and bounds its fetch link like a stream
style(swarm): format C13a lease broker
aterm-gui tests: prune G03 duplicates, vacuous checks and two flaky setups
aterm-effects: effect\_util's colour mixes and edge fades lose …'s early returns
docs, aterm-bench: light-cost review wording, and effects\_harness's --theme takes =NAME and fails bare
prism-glass 1.1: H: the dump prints each frame's light
Check Claude response identity inside the account writer
atpkg-publish: relocate git wrapper at final depth and rpath in-stage libs
aterm-cli: guard Pace::network retention with same\_routes and preserve in record
atpkg: every ALab harness is in the default set; D24's producer refusal goes
atpkg: Macs in a fleet share toolset downloads over the LAN by default
atpkg: LAN sharing keeps the person's off, a pace and a bounded store
window: say a forgotten stray descriptor limit once the logger is up
aterm-slog: record partial interrupts on E1 turns and settle interrupted TxState::On claims
Prune G12 tests: agh, aterm-link, aterm-machines, aterm-secrets, aterm-http
aterm-effects: fast-path witness, rainbow, momentum, cursor\_fx, supernova, and nova hot paths
style: rustfmt Batch 20
aterm(secrets, agent, ctl): harden swarm revoke cascade, pool leases, and --host any driving
aterm-effects: fast-path trail blink, phaser/droplet emission, word\_decorations, and icon\_shade
verify perf: re-record effects after … undid …'s emit regression
style(swarm): format C17c ai-signin and mail-code relay
aterm-effects: r25 G05 test review: delete, merge, shrink and fix 17 findings
Avoid negated PartialOrd comparison in drained\_to
A spawn installs no agent CLI where a person said no to installs; live worlds stay offline
A spawn's no-to-installs note names the real Settings switches; the live check reads the shared words
aterm(secrets, agent, gui, atpkg): harden swarm lease broker, Bonjour m\<N\> matching, and peer HTTP head bounds
lab: claude-rotation-proof's seam, per-credential stub and verb (first cut)
lab: claude-rotation-proof runs R1-R5b and R2 live; a fast move answer and a /login back count
lab: the rotation proof holds each row to its own evidence; the tap reads a tab moved back onto the default login
Bind retained upgrade offers to the image they came from
Make version normalization borrow explicitly from its input
Keep whole version labels within explicit pane and buffer bounds
lab: render explicit synthetic harness footer layouts
lab: leave ordinary frames and pending renderer metrics inert
lab: retain synthetic footer compositions across frames
Validate complete paired build shapes and honor typed skips in action rows
Fix native check findings in typed requests and private gallery
Use a worded Land sample and simplify worker test callback types
Preserve retained effort when a foreign hint changes
Read placed small type in the private gallery control
Describe pending harness work under Unreleased and name its product-version contract
Format the composed product-version regressions
Expose retained upgrade ownership when foreground changes before clear
footer: Claude's effort hint is looked for on the live screen only while a start-up shows it
mode row: a finished jobs' count and the effort hint's /effort leave with the key hints
lights: only the off chips' words floor at 4.5:1; the mode's chip keeps one blank before the Team chip
bottom rule: a hidden fact's stub and the key's ghost read at 4.5:1, quieter than the value
top rule: with a ⬆️ laid, the lockup's name goes before the running build
top rule: hovering a label that leaves out the CLI's build shows it
top rule: the ⬆️'s verb form is offered only where it is shorter than the form before it
top rule: a session name of wide glyphs moves with the tag, the label at the far right
top rule: a held move's arrow is a quiet ↑, never the ⬆️ a press acts on
relaunch: the dropped --effort says why again
harness: a relaunched agent paints under the host's claim
top rule: a line moved from under a still pointer draws no hover title
glass: Claude's cells aterm lays again read at 4.5:1 on a light page
relaunch, changelog: say the effort ruling without the export's forbidden word
secrets: commons init records an open vault's machines as Open, not Manual
accounts: sync.accounts reads the resync's own rule, so a windowless Mac resyncs
converge: hand a held copy's pass to the app, start the window lane in every setup outcome, keep a turn-off through the converge join, log refusals, pin the lock and the lane
converge: the window lane's trigger words are unix-only, as aterm\_secrets::converge is
Resolve proved external free calls in the lazy census
Keep the scope-free census fixture adapter test-only
Collapse the lazy initializer reference guard
Exercise unknown lazy export proof boundaries
Keep unknown borrowed lazy exports conservative
Clarify best-effort persistence after a snapshot marker is visible
Name the vault probe cacheability test case type
Measure codex-alab client build 13766 with the E6 workflow
style(release): format bounded key capture fixture
Require observed Kimi quota and preserve agent sign-out guards
Keep monitor capacity beside causes and stable scope bars
Label physical monitor amounts as used
wip(disk): checkpoint fresh-cache ownership before fd-safe composition
Track fresh explicit build caches and retire them under owner and Cargo locks
Retain cache authority for configured targets and repeated interrupted stages
Expose build cache registration capability for contained producers
Validate already recorded cache owners without sandbox write authority
Bind read-only cache validation to the requested root
Require explicit cache ownership acknowledgement for marked producers
Bind conservative cache acknowledgement to the requested root
Hold automatic System State vault work behind the swarm master switch
Recheck swarm authority after setup waits and retain independent access steps
Force the post-wait master-Off checkpoint in the C3 control
Bound the group-usage test process-state probe
Read the text baseline in monitor row assertions
Read only the typed task header when logging an exited record
Return account events from the Kimi fixture transaction
Keep pool source controls aligned with default imports
Exercise account Off at the automatic read boundary
Keep monitor histories below visible capacity facts
Follow resource bar geometry in monitor controls
Require the calm forecast where the layout has Details
Bound resource controls to real rows and feasible ink clearance
Clarify the under-bar minimum height and clearance target
Recognize the typed compact pressure state in owner scenes
Bound live monitor patches by the actual history footprint
Show CPU core capacity beside the narrow Full gauge
Keep CPU capacity visible when usage is unreadable
Keep sparse-memory coverage on the active formatter
Read default Kimi admission through the automatic converge boundary
Keep the held-worker fixture on its owned Claude stand-in
Place database CLI tests after production items
Normalize formatting in the relocated database test module
Initialize the capacity fixture with its volume
Apply the workspace formatter findings to three source files
Close the interpreter argument code span
Finish registered cache stages after the sweep API change
Keep the unmeasured rollout fixture product version explicit
Keep scale gridlines through captioned resource histories
harness: show and count codex-alab's proven self-claim acts as its own
harness: light and count codex-alab's plan and policy answers; lock its ledger booking against the cut
aterm(agent, net): harden mail-code steward check, alias deny-list, and fleet reply line bounds
style(fleet): format C24 after origin/main merge
verify perf: the effects baseline names two floors that fell below every earlier reading
Fence account completion by its observed process context
acaffiene: say a span ends in forever, and keep it so when its save fails
aterm-agent, aterm-gui: settle empty Claude ai-pool resyncs and reset standing\_self\_act on holder change
aterm-effects: fast-path cursor\_glow text range spans, bed taper, sound/thermal/spawn, and rainbow\_kitty
aterm-agent: hold AuthLock (auth.json.lock) across Codex OAuth refresh and sign-in writes
spawn help: name a no to unattended installs among what keeps an absent agent off
aterm-secrets: refuse an AI CLI's login file as a vault entry
Codex login: lock the refresh, journal its answer, and say a refused login is signed out
accounts: Codex, Grok and Kimi pools say what they do, and their launches hold, skip signed-out rows and route a cold restore
Format the merged account pool and Codex login changes (verify fmt --fix)
Codex refresh: anchor CodexRefreshResult on refresh\_admitted; box Refreshed::Done; align a progress fixture
accounts and vault: settle the hostile review of the Codex pool lane
Format the review fixes (trustfmt), name the menu test's account types once, and keep Reading::SignedOut's public doc from linking a private constant
codex login: test that one refusal the second ask does not repeat leaves the login signed in
task\_launch test: sign the default Codex row in where main's codex-alab test pins it
Codex pool lane: settle the re-review's four minors
aterm-slog, aterm-gui: the supervisor's escalation is its box's and ends with it (E3-1, E2E-3)
aterm-slog, aterm-agent: the harness's escalate act is logged when it escalates, on the box (E3-2, E2E-3)
aterm-gui: a box closed unanswered keeps the supervisor's ask when it comes back (E3-1 review, E2E-3)
aterm-release: aterm-slog's Trust floor ratchets to 626/7807 (E3, U30)
aterm-lab: aos\_workers holds each coordinator phase and judges a stall on the run's own core wait
aterm-lab aos\_workers: a stall is the machine's only if the run waited longer than it ran, through its end
aterm-sysprobe: hold own QoS classes to the CPU time within a factor, not below it
Credential requests: a Mac asks the lab for what it lacks, or says why nobody can
Credential requests: the configured vault sets the policy, and a TOTP never travels alone
Credential requests: bind each attestation to its request, derive request ids from the requester, and end the requests that waited for good
Credential requests: supersede a request no need stands for, and give the TOTP test a publication to leak into
Credential requests: say truly what fulfils a by-hand need, and pass tippy -D warnings
Credential requests: keep the need ledger's callers on unix, where the vault runs
Credential requests: give main's simulated fleet subscriber the requests ports
lab mac nux: read setup= from the first session ctl ls lists
lab mac nux: a first present that reads 0 is not measured yet
aterm(agent, gui): harden swarm census tie-breaking, local steward book, and canonical host stem matching
fabric: on, off and the renewal take one switch lock; the broker steps act on what they read
converge: turn the fabric on by default only where the broker's program stays
steward: a vault pass applying now defers the step; a code an admin removed stays removed
machines: the agent's change journal records each item that failed
harness: a fresh program opens its own session; an older build's LEFT after work is carried
ctl: write the --host any record only where private files exist, so win-arm type-checks again
aterm(machines, secrets): fix sync.requests read-back and credential need settle/decided guards
aterm(secrets, docs): retire entry:\<cli\_login\> needs never-copied and close ATERM-KI-1027-12
accounts: make the Grok/bot-check/sync words true of main, and test the bot-check hold's edges
accounts: hold the unrecorded bot check by its kept staging, retitle the sync entry
accounts(test): give the stats test's default Codex home its login file
lab mac: the person and FDA grants read macOS 27's implicit requirement
aterm(gui): ring host on release line withdrawal and fold across read-only copies

_Truncated to fit GitHub's release-body limit — the complete note is release-notes/v0.146.0.md in this release's source tree._

v0.145.02026-10-27

aterm v0.145.0

2026-10-27 · 956 changes since v0.144.0

Features

abrew: plain cask uninstall runs trash/rmdir stanza directives (r144)
abrew: info HEAD/Options/Analytics, cask Requirements/Languages/Caveats, DeprecateDisable messages (r145)
abrew: home opens homepages, info --github, brew unavailable errors (r146)
abrew: brew resolution/not-installed errors across commands (r147)
abrew: install unknown-name search flow (r148)
abrew: brew Invalid-usage errors, command aliases, unknown-command text (r149)
abrew: info --installed, brew disk-usage math, link/list forms (r150)
abrew: tap-aware search and tap-info --json/--installed (r151)
add vault foundation and notary provisioning
converge the default ALab fleet
abrew: info --verbose (keg details, binaries, full analytics, bottle sizes) (r152)
abrew: assembled formula caveats + local-bottle info parity (r153)
abrew: brew-identical help under the brew reroute (r155)
abrew: terminal styling — brew colors, status glyphs, ls columns (r156)
release: ship pin-verifier --from-release, bound to the signed appcast
rewind: carry transient engine state, policy, schemes, and cell\_px across pane checks (ATERM-KI-1026-2)

Fixes

harness: retain account controls through restart admission
accounts: check shared authority under the account writer
accounts: recheck recovery evidence under each writer
accounts: require vendor login files at recovery publication
accounts: bind Kimi recovery checkpoints to their region
accounts: retain the writer through renewal snapshot handoff
accounts: recheck staged credentials at publication
supervise: a tape answers a word-carrying wait by the bare wait it recorded
route fleet publish and sync
terminate fleet command reports
preserve fleet leave and settings behavior
abrew: quiet SIGPIPE, sibling keg rows in info, scheme ordering (r154)
windows: wire JobsReader and process\_path on Win32; escape Agy history.jsonl workspace paths (ATERM-KI-1023-3)
tests, docs: escape Path JSON fixtures for Windows; retire closed ATERM-KI-1023-2
trail: keep the hand at a generic boundary in an agent's composer
abrew: brew two-line upgrade message, more tty headings (r157)
agent, verify, lab, uds: close adversarial review gaps and verify linux regressions
agent, verify, lab: preserve literal '+' in RFC 3986 callback queries, BSD chmod operands, and compile-failure accounting
abrew: outdated verbose on a terminal, search name styling (r158)
services: fseventsd memory is early detection plus one-press repair; no prevention exists
services: hold the watch's lock on Windows too
abrew: keep tty unit tests PTY-independent and drop duplicate ==\> in upgrade pinned header
abrew: bold doctor preamble, ohai cleanup summary (r160)
cache: keep uncertain lock scans from authorizing target removal
abrew: global switches, leading -v rotation, desc styling (r161)
abrew: bundled short switches expand like OptionParser (r162)
atpkg: refuse an index that breaks the publisher's pin and repo rules
atpkg: hold a repo switch to every target cell, and never rewind the succession record
release: pin-verifier --from-release honours the channel's floor and the client chain
abrew: deps --graph opens GraphvizOnline natively (r164)
abrew: kind-switch conflicts are brew usage errors; flagged pin/unpin (r165)
abrew: named list --pinned, remaining list conflicts (r166)
harness, uds: harden foreign\_db, sqlite\_read, asleep, and codex OAuth edge cases
abrew: link/unlink kind switches and cask resolution shapes (r167)
tests: no wall-clock budget on a wait that must happen; two load races fixed in product
trail: typing in Claude's vim INSERT again lights the trail
gui: boundary-guard handoff error compiles off-unix
abrew: log kind switches, cask-aware install records (r168)
abrew: list/search both-kind-switch semantics match brew (r169)
abrew: cat shows core source without its bottle block (r171)
abrew: formula install narration in brew 7's order (r172)
clt\_shim: non-Unix exec arm avoids the disallowed std::process::Command
clt\_shim: gate the gui Path import to Unix (win cells clean)
abrew: install confirmation prompt, ask mode default (r173)
abrew: upgrade narration phases and prompt (r174)

Performance

effects: eliminate Cell memos, precompute droplet bands, and share luminance tables (Batches 271-274)
effects: eliminate status/report allocations and inline momentum/baker helpers

Tests

creation: the refusing fake server owns its answers without to\_vec
distinguish lock admission from diagnostic paths
handoff: v0.144.0's producer fixtures, written by its own cut
the Linux lane runs aterm, aterm-agent and shell-integration tests as Linux behaves
accounts: isolate renewal generation changes
hang detectors that wait on progress, a qos read of a parked worker, scratches that always go
accounts: verify shared checkpoint failure recovery
supervise: the usage-wall and account-rotation walks hold the resume to the cleared line
aterm: the live weekly-wall resumes submit the cleared line
cache: retain an obsolete target with a directory at a cargo-lock pathname
kitty: the footer seat law also judges a mode row with no job, and the cat never sits on the words
hold what the wall-clock budgets stood for, and the busy detach's other end
a wait for what must happen is a hang detector, not a latency budget
keep what …'s waits discriminated, with no latency budget
the waits left out of the hang-detector sweep are deterministic now

Docs

say what is true of the wgpu-oracle lane after GW6
ORACLE-ADAPTER's comments say what holds the untwinned frames
the needle's frames at the effect lane's real intervals, pinned by a test
the owed relaunch in the changelog and the upgrade help
record the second real switch run; date the runs by the Mac's clock

Other

aterm-lab: windows uia records what a UIA client sees of aterm-gui
aterm-a11y: the UIA provider is hand-written COM on aterm-win32
stats: dedicated Network lens, immediate hot load bloom, and wake coalescing
aterm-secrets: alab\_role is Unix-only, as the server module it reads
aterm-spec-macros: an anchor's record goes in its fn's body
aterm-secrets: Retired::names and three cli tests are Unix-only
stats, secrets, changelog: thermal core ramp in lens/sill, win ALAB\_VAULT fix, and release notes
abrew: commands mirrors brew's inventory; tap-info speaks brew (r133)
init: repositories by default without init.toml or gh; aterm init on Linux (INIT-7, INIT-9)
init review: a clone the read-back cannot verify stays missing; at most four staging dirs; Linux help (INIT-7, INIT-9)
init on Linux: an unreachable vault host is no vault here at once, not macOS's question (INIT-9)
init review: the Repositories label says your own repositories; Linux comments (INIT-7, INIT-9)
Fence quota observations to their captured account policy
cells(win): fix Windows proc-macro anchor placement and Unix-only secrets cfg gates
abrew: doctor speaks brew findings; cleanup prunes broken links (r134)
atpkg: abrew doctor asks the platform layer whether a prefix dir is writable
aterm-effects: the shared evaluator judges each pair once; the grid search runs on threads
WIP: unfinished fixer work, cut off by an API overload (not reviewed)
aterm-gui: an open completion list packs only as tight as the file needs
aterm-effects: the memo's own test holds a threaded judgment to a fresh serial one
aterm-gui: the editor layout spec row says how an open list packs
aterm-effects: the memo's test holds a replaced scenario to a fresh judgment too
abrew: search gains brew's MissingFormula and regex footnotes (r135)
abrew: info --json matches brew's API-mode to\_hash (r136)
Bind transcript and tap usage to captured account sources
Include the account directory in usage writer failures
Settings rows: a choice's default mark never moves its row
Settings rows: the line a row keeps for its state says Default at rest
Settings status: a press's status is weighed wherever the dock rule would put it
Settings rows: a stacked row's second line comes after its control
Settings: Tab reads a status over the list where it stands
Settings rows: a stacked row's second line comes before its Reset's line
Settings rows: a row split across stops keeps its Reset's line after its words
Settings rows: where a row's state goes is weighed by every value it offers
Settings: a press on the list's last screen, or on a split segment, holds its place
Bind transcript quota reads to the captured process
Keep the drawing-delay fixture within one process lifetime
Use a match guard for brew placeholder strings
Vault join: a Mac waiting on a vault at a path names the approve that works
init: a join that fails after saving the vault still installs the subscriber
init: only a save of the chosen vault counts as the failed join's
harness: a submodule checkout that only lags its record is no uncommitted work
harness upgrade help: name what a quiet move can still type
abrew: collapse placeholder guard into match (lint)
Normalize observations with the snapshot's kernel image reader
Format the process observation regressions
Keep a quota fixture's process start fixed as its clock advances
sysprobe, vitals-host, effects, atpkg: hostile-review edge fixes and win cell
cells(win): gate Unix-only vault approve\_command test in aterm-secrets
Secrets server: the ALab role builds off unix and needs a follower Mac
service: the launchd-only helpers build only where install\_launchd does
sim B05: the simulated broker retains and cuts its log by astream's own planner
sim B05: the worlds cut their broker's log by astream's planner, and the bridge reads a record back before it publishes again past a cut
aterm-link B05: a pin keeps the head it was made at, so a retry never takes a sender's earlier post of the same words for its own
aterm-link B05: the sim's broker reads a told reader's fetch as astream's does
aterm-link B05: a read back that hits a subject's floor reads again told, so a held record is found
aterm-link B05: the worlds draw an older build's open; astream keeps the newest stamp
aterm-link B05: a move before an auto mirror's hello drops the pinned batch on disk
aterm-link B05 review: heads out of every strict text form, claims, the fork, the mirror's drop and wait
vendor/astream bf2e951: B05 landed in astream; the sim follows astream's broker times and stats; the review's controls find their seeds
abrew: uses learns brew's tag filters and expand cache (r137)
supervise: test a live upgrade moving a continued job at its turn end
Bind account decisions and move completion to observed processes
Keep synthetic account snapshots consistent with their environments
Format account process observation regressions
Verify account refusals preserve durable images
B12: tell a session what retention gave up under the bridge's own reads of its lane
B12: tests, negative controls and docs for the scoped give-up
B12: trustfmt the new tests, and the two lints tippy named (a manual Option::map, a cloned slice)
B12 review: keep a session's lane give-up apart from the node's
B12 review: the deadline sweep does tell a session with no seen watermark
sim: scope a told link gap as aterm does, so a lane's give-up covers only its session
harness: a lagging submodule is one at a commit its repository recorded before
Vault creation: a first version the vault refuses retires the attempt
Vault transport: only macOS reads no route to a LAN host as its gate
Vault creation: a refusal after an unheard attempt keeps the creation
Waive UsageSource's case-selection actions so spec\_xref\_closure passes
abrew: deps rebuilt on the shared expander (r138)
abrew: linkage skips weak-loaded dylibs like brew (r139)
aterm-link: the held-back take's test reads its instant and wait as of before the take
effects, vitals: close coalesced space+word/margin-box wrap gaps and strip history invariants
spec anchors: the proc macros record inside the fn body, so a trait impl method takes one
aterm-gui: waiver carriers go before the test module
aterm-gui: four more waiver carriers go before the test module
prism-glass P0.8: pin GPU parity for a ramp row whose ends differ in opacity
Retain delayed account completions until durable publication
cursor trail looks8: letters, clears, rails and the widened gallery
cursor trail looks8 K9: the in-row rail is laid whole under a held row
cursor trail looks8 K9: the in-row rail is a foot rail, parted round descenders
aterm-lab trail-gallery: a split's frames are judged on the caret's pane
cursor trail looks8: the letter under the caret reads; a clear counts from home
aterm-effects: trails and companions, looks8 round 2's must-fix items
aterm-effects: the paper crown changes only its olive hues; a test for the train's olive
aterm-effects: the cat reads an Enter from its echo, springs off the wall at once, perches only off the caret's row
aterm-effects: a cat over the line's last letters at the Enter watches from the line
aterm-effects: the paper Return's stick steps from gold to green at a hard edge
aterm-agent: a release build has Store::bounded\_by, which the host's roster read calls
aterm-effects: the letter guard keeps Classic's paper face to the letter bar
aterm-effects: the dark landing ring passes under the letters
aterm-effects: the dark ring's rim runs on under the letters at a fifth of its light
aterm-effects: name the window box the companion's slice keep-out note takes
kitty pet: the burst never lays the cat on its letters (looks8 round 3, K1)
kitty pet: the first keys read the letter map; the burst replay runs to the landing
cursor glow: the dark landing ring shows as a ring or not at all (looks8 round 3)
cursor glow: dark Comet shows its nucleus and dust, dark Water its drops (looks8 round 3, K4)
kitty pet: the first keys' spring leads without looking back or flying back (looks8 round 3, K1)
settings preview: a mote of the submitted line's dust is no sweep along the prompt's row
kitty pet: a short pane's wrap bound waits on the line's top (looks8 round 3, K1 split)
companion\_off\_letters: the survey reads the split's burst too
trail looks8: fix the round-3 review's findings
trail looks8: the move-up companion keeps off NORMAL; dark Comet's dust stays whole at the grid's edge
verify: keep managed test and stage pools within their CPU grant
ai: the usage tap's --settings keeps a relaunched Claude Code's level
ai: --resume's value is optional, and a relaunch's allow flag names no level
Record rotation initiation before restart and share durable completion
prism-glass P0.7: light hosts, every trail law family also reads on light
abrew: fetch bottle manifests; quiet curl off-tty (r140)
Resume Codex after clean shutdown removes its writer lock
abrew: deps --include-requirements; cask deps are requirements (r141)
aterm-gpu: hold every arm's frames to a record of wgpu's
aterm-verify, aterm-lab: gpu-oracle holds the frame record; no --wgpu-oracle
aterm-gpu: delete wgpu, its oracle and the facades only it held
aterm-lab: the Windows copy prunes the folders its removals empty
aterm-verify: run gpu-oracle on the test run's build
aterm-gpu: record wgpu's video take, EDR, blit and crown frames before it goes
stats lens & trail sound: fix link bit-rate units, trace rule collisions, compact totals, and sample-rate DC filter
stats\_lens & rainbow\_kitty\_v2: format edition 2024 and pass SEED to TrailSynth::new
trail\_sound: set DC\_BLOCK\_HZ to 40 Hz to preserve ramp-settling time constant
permissions: one walk through macOS's grants; doctor and init hand theirs to it (PERM-2, PERM-3)
permission walk: hand debugger access to System State's step, never the row's press door
permissions walk: build off macOS (Linux and Windows cells)
permission walk review: the start reads its markers last and once, holds back a Not now, waits out another gesture; clients check the walk names their pages
permission walk: the debugger only while System State's step is to come, named or not; the design doc says what the review changed
permission walk: a list reading that comes back after its page turned ticks no other page
Fence account rotation writes with their observed policy
Record account policy verification results
prism-glass P0.10: the owner's relayout shape and tall cohorts, pinned at HEAD
prism-glass P0.12: the trail-dark-composer and trail-light-composer perf lanes
prism-glass P0.12: record the trail composer lanes' baselines from main
Bound Apple provisioning helper commands
harness: a lagging submodule is one this checkout's HEAD recorded as it moved
aterm-window: delete the opt-in rwh\_06 handles; raw-window-handle leaves the lock
F5/C7 (ROBUST-1, ROBUST-2): the journal holds its pause under the free floor, and only a landed write notes records journaled
F5/C13 (ROBUST-3): a session log cursor can name its log (base=), and one naming another log resets
F5 review (C7, C13): a take marks its records journaled and a failed write gives them back without the lock; an uncarried adoption takes its base from the allocator
F5 review: format the uncarried adoption's epoch pin (targo verify fmt --fix)
fleet: one resolver names a peer's word across the book and its copy, for every verb
fleet allow drive: every refusal comes from what the grant reads under the book's lock
aterm ctl --host await task: a peer that stops answering is asked until the timeout, and named
fleet: a word names every peer fleet peers lists, a hand entry elsewhere among them
fleet allow drive: a read made under what the lock finds moved is made again
aterm ctl --host await task: a peer silent past the baseline is asked again too, and a wait with no timeout ends
Keep deferred account work in its originating context
prism-glass P0.13: lab trail-census, the layer-by-layer census of a trail frame
Spec anchors: the proc macros and the macro\_rules! attributes take the same items and book the same records
abrew: native zap and uninstall --zap for file-only stanzas (r142)
fabric endpoint: the log clock is astream-wire's LogIdentity, not a string (B21)
fab-log-lineage: a session between was= and the clock keeps below f too (B21 review)
fabric test: the between-case label fits one formatted line
prism-glass P0.3: state-word seams and the arm report (debug only)
harness: bind account replies to their observed move
harness: fence session attribution by the observed local process
prism-glass P0.11: re-ground the marks evidence and the §10.3 dark pin list
kitty: the cat leaves the margin when the line has wrapped, never on a guess
kitty: the margin is taken by the hand's writing, not only its rhythm
aterm-effects SPECS: the margin's rules after r23 K6
kitty: a hop the writing's wrap overtakes comes down on its seat
kitty: the margin's rest seat holds two rows under and reaches two over
aterm-effects SPECS: looks8's early leave went with the leap ahead
atpkg: a zap stanza's parent is checked by the platform's writability probe
Let the cursor kitty cross words in front of them one leg in three
Show nag mode's mascot on the menu-bar button, crazier per need
Deal a front pass only while nothing is being written
Show active descendants of quiet agent calls
Validate generations before crediting descendant activity
harness upgrade status: a phase-less document is no unreadable record
Waive AccountResponse's and AccountSessionAttribution's staged environment so spec\_xref\_closure passes
aterm-release: the publisher fence reads its boot through astream-sys
Cargo.lock: aterm-release depends on astream-sys directly
aterm-release: trustfmt the boot round-trip test
aterm-release: a fence naming its boot by id is fence-format 3 (B24 review)
boot ids: aterm-agent, aterm-caffeine and aterm-link write them with astream's boot\_id\_text
aterm-release: the format test reads the fence this binary writes, not a constant
Settings lists: no screen draws nothing; a stop taller than the room is stepped through
Themes: the chooser's frame gives way, and its toolbar scrolls away where no rung fits a row
Settings Messages: entries fit the least windows, or are held a part at a time
Settings: a choice glossed in parentheses shows its value alone where the gloss does not fit
Settings: the toolbar a short window's list leads with spans the window, as it does pinned
Themes: the open Community section keeps its name over its rows in narrow windows
Settings status: a press's status never sheds the chrome or stands over the page
Settings lists: the least-window sweep keeps a named record per control; a tall entry's stops end by <
Settings Messages: where no day's heading can stand over an entry, each entry's time says its day
Themes: a filter listed with the rows is one stop of the list for the arrows and page keys
Settings Messages: the wheel and the page keys step through the keyboard's entry
Settings lists: a control taller than the room starts its group bare, its caption on the landing before
Settings: a choice whose words would stand taller than its list takes its short words
Settings lists: no step through a tall stop shows only a sliver more
Settings status: a dock takes its height over the toolbar it stands in, the icon toolbar too
Settings Messages: each entry's time takes the fewest words that hold its line
Settings Messages: no part of an entry taller than the room is a sliver
Bind account move receipts to the full captured process context
Waive AccountProcessContext's case selection so spec\_xref\_closure passes
autopilot: Cruise never parks (owner ruling 2026-10-26)
Commit account fallback only for the current local context
Make account return model environment steps explicit
Claude Code's permission pill reads yolo or nag mode
fabric bench: the ask scenario, what agents and people wait on (B11)
fabric README and bench doc: what the ask scenario runs and what its numbers mean (B11)
fabric bench ask: a task reply is awaited as the note it is delivered as; the idle leg's census per post with its flushes
fabric bench ask: the asked and deadline tables read at every leg's start
fabric bench ask: the person leg without and with its pager; the grace and tables read from aterm-link (B11 review)
fabric ledger + README: the ask set re-taken with the pager split out, -185..-192 (B11 review)
Guard local account bookkeeping with its captured authentication context
System State: look for the ALab vault per reason; an absent vault never holds Repositories; a code join waits 0 s (SECR-5, SECR-6)
System State: the ALab watch's focus and network wakes look only when they can show something new; a Mac with no token waits for the vault's (SECR-5/6 review)
aterm-effects: OldPath::ALL only where its test seam is built
status item: a test reads every nag stage as an icon for the bar
ship provision: release.engine-reach lists the engine's addresses for aterm
Preserve current account advice through stale results and busy retries
aterm-vitals: the multi-scale spec reads newest first, now at x = 0
stats deck planner: the % column between the well and the strip, header mirrored
stats deck painter: now at the left, the fine band slides right time-true
stats deck words: newest first, now at the left, in every word that said the right
stats deck header: the beat ring clears "now", the line clears the well
stats deck live edge: Full glides a slot from the reading, evenly; no frame draws nothing new
stats deck docs: record the 2 pt slide as a ruling; FOLD\_SLOT\_S is no lever
stats lens: the Cells legend's one line reads from live now
stats deck: stop cutting one-second cells nothing draws
stats live docs: what a glide frame carries, exactly
stats deck: every % draws its scope bar, under the figure where no column fits
stats deck: every scope shows its own ink in the bar under the %
stats deck: the bar under the % shows every scope above zero, equal shares too
stats deck: the bar under the % keeps its gap below the digits at 1x
stats lens: How to read says the line under each % is the bar
stats plan: Rows::under says the painter may draw its line shorter
aterm-gpu: hold the frame record's arm to its CPU twins on any adapter
aterm-verify: gpu-oracle runs the twin test and names its verdict
aterm-gpu: the frame record's half-float destination is no dead code on GL
effects: replace iterator and try\_from overhead in aos\_momentum, cursor\_glow, and pet\_world
aterm-link: an inbox commit rides the bridge's next write (critic item B08)
aterm-link: wrap B08's three doc lines past the 100-column measure
aterm-link: hold the inbox commit only while one is due, and not across bus items (B08 review)
aterm-link: IDLE\_ACK\_GRACE's doc names the held inbox commit it also bounds (B08)
Make a new secrets vault open: its admin's subscriber lets in every machine that asks
Build password-admission tests on a password vault now that create opens one
Say how the finished vault admits after create, and close the review's gaps
stats gauge: cut the lit arc, its glow and the print on a fixed lattice
stats deck: the dial's needle rides its own critically damped spring
stats deck: needle frames in the live gallery, and a bench of what a live frame costs
stats deck: satisfy tippy's is\_multiple\_of in the needle test, and say the needle's cost exactly
stats deck: a window never draws the needle back where it stood
measure spin: the pet row bounds the dial's needle lane too
stats dial: the glow is stacked arcs, so it neither beads nor pops in
tray raster: an arc skips the pixels off its annulus before its angle
deck\_frame\_cost: time a cool needle under a soaked bezel and with the lens open
tray raster: an arc visits only its rows' runs beside the ring's hole
tray raster: clip both of an arc's row runs to the region
stats deck: App::deck\_live and Needle::frame\_at are the tests' own
aterm-effects: the letter guard follows what moved and weighs a cell for less
aterm-effects: a test holds the guard mask's near-dim reuse to a fresh reading
aterm-effects: format the near-dim reuse test
abrew: the writable-directory reads use the platform's one
Fence snapshot publication by captured state and account generation
aterm-effects: promote const fn helpers and inline char-slice tone classification and loop paths (batch 254)
aterm-effects: inline hot loops, eliminate temp Vecs, and promote const fns (Batches 255-256)
measure spin: the pet row bounds the dial's needle at 20 frames, as measured at the desk
verify: a dev run's lint checks one cross cell per other OS the change builds in
init: another account's Rust docs are read from that account's own folders
fleet: on Linux a stopped aterm is named as stopped
amacs: the command prompt leaves the document where it was scrolled
aterm-gui: Settings and native pages fit Linux's faces; tests hold each platform's metrics
atpkg: abrew's writable-parent test builds on Windows again
aterm-gui: the stats deck's unix-only test helpers are unix-only
aterm-effects: promote letter\_guard and caret\_letter helpers to const fn and inline hot loops
aterm-effects: promote night\_ground and state\_words helpers to const fn and eliminate night\_palette allocation
verify, shell-integration: detach piped test shells from /dev/tty and scope ENOSPC attribution
aterm-effects: eliminate state\_words heap allocations and inline Option combinators
aterm-effects: promote hue-path helpers, dark\_mark, StarCall, glow\_ramps, and ink\_ledger helpers to const fn
fleet: a peer word gets one answer from every verb, copy of the issuer's book or none
ctl: an await leg ctl's --timeout cuts unserved ends as unanswered (75)
net: a drive's deadline hang-up reads as that deadline, never as the peer's cut
fleet: a word naming the issuer is read over its book afresh, old copy or none
net: the watchdog's fired is built only where its one caller is
F6/C10 (LOOP-5, LOOP-4): a post the bridge retires is logged with the reason its client was told
F6/C6 (PRIV-3): the brief tier test feeds raw bodies through the real ingest, and the text brief's mark line has its own test
F6 lander (LOOP-5 review): aterm's own retirements are pinned by=aterm, and help post's reasons are read from its quoted replies
Bind account restarts to selected process and target identity
Stage simulated account exits after restart admission
aterm-effects: promote letter\_guard helpers to const fn and hoist ramp mask-cut channel setup
lab mac nux: an init that exits nonzero names the rows it left open
tray\_raster: a ring rasters only its band, and a clear ink nothing
tray\_raster: format the ring test's clear-ink assertion
Rewind R1 review fixes: export scrub, the write grant, split characters, restore paint
Serialize verifier stages that open desktop windows
Stop a fresh approver showing Macs an open vault let go as asking to join
Begin the code-only seed once per approver record, not at each start
Seed from keys newly named code-only, and name a let-go key on every vault
Exempt only a Mac shown at the version just before, and bound the record by the vault's size
stats deck: the live now box takes the strip's own inks, never the accent's
Nag mode's mascot: the unhinged scold from every kitchen and review
lab mac nux: a --check run's planned rows are the ones it left open
fabric bench: each latency round trip waits for its inbox commit itself
fabric bench: hold each commit to the head read before the next post, and poll the head, not the log lock
fabric bench docs: a next-record check cannot fail on a carried commit, the pin, and the head gate's tier
aterm-effects: promote hot-path closures across emitters and utilities to const fn
aterm-effects: promote bed, momentum, harness\_card, console\_life, and stardust helpers to const fn
Refuse shallow history when numbering publications
aterm-effects: promote probe, scroll, letter\_guard, witness, and spec helpers to const fn
rustup: one finder, the TOOLS row; verify provision places a pinned copy, never the keg
rustup, closed: SPECS rows, the acceptance record, design §8 and S9, CONTRIBUTING, CHANGELOG
rustup row: installs never self-update into CARGO\_HOME; PATH skips non-executables
rustup, closed: the review's measurements, and docs that say what the row does
aterm-vz: V5, the helper's lifetime as a model bound to the code; the helper holds its connections
vz V5: the review's fixes (a finished bake's seal, Connect only once Ready, the hard stop's timeout, the late wrong hello, every detector bound)
harness: read ps's terminal as a device number, not a devname(3) scan
spare FIFO: the release's wake is close-on-fork, so a fork cannot hold the shell from its end
harness host tests: the ring count owns its conversation; the gate waits for the run
handoff test: the stopped candidate is stopped by the test, not by its own script
deflake: hand back a resumed job's death no edge saw; read fabric status as one moment
deflake review: a hang detector that a spin trips, missed edges judged by their rule, ps's tdev
linux lane: the Orca rows have Mutter's frames client on the registry before aterm-gui starts
linux lane: the Orca rows' frames wait comes before Orca too, and the primer is shown closed
atpkg-publish: a pack declares the smallest window that holds its tar
atpkg-publish: pin the fitted window under 2^27; two docs name the fitted frame
install\_sh tests: Scratch::path allows dead code off macOS (linux-arm cell warning)
verify: admit an absent first-run records directory
Prepare commit-aware fabric benchmark census
prism-glass P0.4: the dump's rig, a headless App at an injected clock
prism-glass P0.4: the dump, aterm-gui's trail\_dump example (H)
aterm-effects: promote cat\_glyphs\_codegen and aos\_momentum helpers to const fn and while loops
Mark a key let go from a closed vault as let go, never as code only
acaffiene: keep the Mac awake in every aterm build
aterm-release: ship trust run takes --reason, as trust judge does
aterm-release: aterm-phase's Trust floor 810/4577 -\> 1186/6472, aterm-agent-names' first 2/10
aterm-release: a re-base onto a prover with no ceiling is not withheld for its floor's
aterm-release: aterm-dbus's Trust floor re-based onto …, 141/422 -\> 136/535
doctor and init wait for the install pass; launch sets stale leftovers aside (DOC-5)
DOC-5 review: wait for the pass only when a repair needs the store; launch repairs leave the store lock free
control: await idle|seq|gone|agent take autopilot=\<word\> (slice 10a, server)
Land's instruction waits no back-off (v6 §14.10, slice 10a: policy and model)
supervise: a switch of the Autopilot word wakes the loop at rest, and Land's instruction waits no back-off (v6 §14.10, slice 10a)
supervise: the word edge asks no read of its own (slice 10a, integration)
supervise: a switch made while the agent works is seen at its point (slice 10a)
F7/C12 (BUS-1): aterm fabric status reads the in lanes told, so an ask retention holds below their oldest is listed overdue
F7/C12 review (BUS-1): status judges a held ask only on the verdicts the bus keeps, so an answered ask whose answer retention gave up is not listed overdue
aterm-containment: keep Seatbelt scratch HOME outside /tmp and $TMPDIR
harness: an owed relaunch line is held only by keys typed after aterm's own end
harness host: a restart carry held by keys is tried again once they let go
harness upgrade: a conversation someone else resumed closes as theirs, never adopted
aterm-models-harness: an end aterm made is relaunched or adopted
harness: the owed relaunch line waits on its end's own gate; review fixes
harness: owed relaunch lines keep their stop's grace in every lane and follow a moved shell
Format the owed-relaunch tests as verify fmt --fix leaves them
harness: a moved shell whose line cannot take a cd waits for it, never ends the relaunch
Reserve cold verifier disk from the current measured footprint
Give mirror fixture I/O the standard hang bound
Keep mirror fixture formatting at the crate edition
fabric\_bench: compare the arms' broker options by reference
upgrade\_status test: the word's time is bounded by the call, not by five seconds
Require retained PNG frames in the Linux proof
disk ask: read the disk worker's rise from its claim's free figure
holders: a debug build's disk scans can read only its lab jail's processes
lab disk-ask: --scenario worker runs aterm's disk worker end to end
lab disk-ask: wait for a tab's whole rm before reading its target/
lab disk-ask: a borrowed slice in the stub test, as tippy asks
aterm-agent: decline a disk worker's unprovable read with its real reason, and have it run pwd first
lab disk-ask: prove the worker writes its own snapshot, the verb's root fence, an exact rise and one worker
aterm-agent: a refusal holding exactly the decline's text is the decline's, whatever its words
aterm-agent: decline a disk worker's verb drawn on two rows with that reason and a one-row remedy
lab disk-ask: the worker frees the outside paths whole (declined, two rows), then under \~ on one row
aterm-effects: promote emit/bed/aos\_momentum helpers to const fn and remove per-frame allocations
Recheck Commons repair policy after opening the control session
Recognize the measured Codex 13764 session logs
harness versions: one line per harness, 0.4 for all six, a release gate and ship harness-bump
top rule: lay the harness from the rule's right end, label it "alab \<cli\> harness"
harness switch: the capsule sprite (Quiet glass, gem knob) under the top rule's words
top rule: a ⬆️ for a newer Claude Code build, pressed for the tab menu's Upgrade Now
mode row: Claude's jobs alone at column 0, yolo on the bottom rule's lights
bottom rule: no words for a value it does not know, and no upgrade note
bottom rule: the account shows its email's name alone at rest (J1)
bottom rule: the plan is off the rule at rest (J2)
bottom rule: Σ shows the runtime alone, its tokens in the hover (J3)
specs and changelog: the harness at the top rule's right end, the quiet rules
top rule: name Claude's top-effort tag by the primer's key, not its word
top rule: TopCli::from\_timeline, TopUp::target\_core, for the census and lint
top rule: rename TopCli's constructor itself to from\_timeline
upgrade view: set\_writer only where the ⬆️'s tests build (unix)
aterm-effects: add const asin\_f32 and remove remaining libm calls and hot-path closures (batch 267)
Verify offline shared renewal against real root authority
lab: give each Codex proof model its own usage window
spare: a verification's escape-scan window ends at its listing (RECHECK-2)
Require creation receipts before driving Lima resources
Guard the owned guest cleanup operand
Exercise guest cleanup with a symlinked ownership marker
Refuse linked guest roots and markers explicitly
Durably publish Lima ownership receipts through the selected API
aterm-link F3: a read of one offset refused below its filter's oldest is read again told, never as no rows
aterm-link F3: a fetch of a record held below its lane's oldest answers the record, the told dial judged as the read, SPECS rows
aterm-link sim: two stale witnesses moved to seed 14 (stale on main too)
aterm-link F3 review: the told read is its own connection's, never the link's; lane reads below the oldest read told
aterm-link F3 review: the attach peeks the queue after its drain; the TellNoGap witness moved to seed 230
aterm-link F3 review: no peek after the attach's drain; the held read back's attach drops once, as above the oldest
muse weekly: read it from the host's usage refresh, no card needed
muse account: its own login in the account menu, never Claude's pool
cruise: done checks rotate concrete audit missions, never repeat
muse footer: model, effort and folder start off, not repeated
muse facts: exhaustive program matches and format
secrets: close the review's gaps in the ghost fix
secrets: a revoked Mac stays out when its old password comes back
aterm-effects: promote switch, card, comet, pet, and kitty helpers to const fn and hypot\_f32/atan2\_f32
Fence contested mailbox labels throughout discovery and lookup
prism-glass P0.5: lab trail-diff, the dark proof's differential (H)
Apply mailbox conflict context to explicit overrides
stats deck: the meters other than the dial say plain facts
review fixes: a band's row walk with slack and no overflow; a pwd remedy that cannot loop
tray\_raster: the past-any-column test passes its one prim by slice::from\_ref, as tippy asks
aterm-effects: replace hot-path closure helpers in streak, flash, tricks, glow, and ribbon
Define read-only network and service observation projection
Observe shared account and secrets availability off the UI thread
Render native Network State cells below System Resources
Retain local authenticated network observations and bounded unverified presence
Only redraw visible network projections on observer updates
Show shared service observation age and revision in network details
Enable Network State Copy before resource sampling starts
Bound opaque presence and distinguish fresh authentication from repair success
Connect native Network State to background peer and service observations
Require active observation before painting a peer reachable
Expire stalled network observations before drawing current presence
Keep repair independent of observation storage and expose a read-only handle
Read network observations through the immutable observer interface
Keep passive account observation out of catalog enrollment
Scope observer preservation regression to application storage
Measure peer freshness from authentication rather than repair completion
Exercise private unfinished catalog storage in observer regression
Match Network State typography and label spacing to resource rows
Mark peer history unavailable when no observer can restore it
Report a missing retained network projection as a completed unavailable read
Use saturating contact time and keep observation helpers before tests
Reserve the complete deck in layout fixtures and cover network lens cycling
Extend keyboard and accessibility expectations to network cells
Test network state distinctions without pinning explanatory prose
System State: the page's 250 ms tick wakes the loop only while a run walks (SCR-3 fallback, §5.6)
Add read-only account progress projection contract
Observe attributed sign-in workers and retry clocks without running policy
Show observed account recovery progress in Claude composer facts
Distinguish busy login observation without blocking the GUI
Test account recovery notes independently of auto-rotation policy
Document busy observation and simplify route test input
Keep every footer fact clickable beside account recovery status
Keep limit recognition explicit and bound compact recovery labels
Keep recovery evidence when harness controls exhaust rule space
Exercise recovery visibility with crowded harness controls
Prioritize alternate sign-in findings over routine exclusions
Keep healthy account inventory compact without pending recovery wording
Keep the watching stage available in account details
Publish process-bound account recovery observations to the Claude footer
Add opt-in App capture gallery for account recovery fixtures
Attest snapshot process identity before publishing its birth
Keep recovery observations current across identity and policy changes
Display absolute account recovery event times instead of frozen countdowns
Label automatic account selection as permission rather than activity
Keep projected recovery wording consistent with observed work
Skip recovery reads when the captured process cannot be attested
Keep account observation exhaustive across agent variants
Expose pending human sign-in steps in account progress
Use the public account CLI type for sign-in instructions
Centralize opt-in file flush refusal policy
Guard file-flush opt-in against invalid stage opens
Cover portable storage-full file flush failures
Import the file-flush policy into its unit controls
supervise: a resume past a system message types one line (slice 12a, WIP)
supervise: blind tries of a limit's resume say it may have cleared (slice 12a, WIP tests)
supervise: a resume past a usage limit is one line (slice 12a)
lab: forever --mode switch and Land at once, judged (slice 10a's acceptance)
lab: test the switch mode's chains and the at-once fold
aterm-uds: lift PrivateLock, open\_private\_rw and read\_owned\_into; BookLock wraps PrivateLock (agh M2 WP0a, plan §4.3.1-§4.3.4)
amacs-protocol: move edit.rs and uri.rs out of amacs; aterm-ctl links no editor engine (agh M2 WP0a, plan §4.2, §4.3.5)
aterm-models-agh: AghEnsureOnce and AghGitGrant with their tier-0 suites (agh M2 WP0a, plan §4.4)
aterm-uds, amacs-protocol: WP0a review fixes (agh M2 WP0a, plan §4.3)
aterm-uds: private files made exactly 0600 under any umask; WP0a review round 2 (agh M2 WP0a, plan §4.3)
agh: the frozen M2 signatures, stubs and liveness root (agh M2 WP0b, plan §4.5, §4.6.0–§4.6.18)
census, models, astream README: agh M2's spawn rows, closure roots and journal row (agh M2 WP0b, plan §4.1 items 8–9, §4.9.2)
agh M2 WP0b: review fixes (journal why redacted, need keys refused, intent ids by step)
agh: restore main's one-line with\_router doc; plan notes main's split private\_file import
aos: fold trace checks and segment judgements without retaining frame quads
fabric bench: the attach world's backlog (B09), every session's refill watermark trailing the head
aterm-link: an attach refills its sessions in one read of the node's inbox (B09)
fabric ledger + README (B09): the attach backlog before the lever, the lever, and A B B A after it, -210..-217
aterm-link: the attach's shared refill hands its sessions on when it carries more than it saves, and reads a lane below the inbox's oldest only up to it (B09 review)
fabric ledger + README (B09 review): the fixed lever A' C C A', -221..-224, and the section's corrections
aterm-link (B09): the below-the-oldest lane read is a sim rule now; the bound counts the page
aterm-effects: promote search/geometry helpers to const fn and inline hot-loop closures (batch 270)
Keep a transcript limit visible while account advice is still idle
Describe an unprocessed transcript limit as waiting for advice
rainbow kitty: a drag over a path keeps the composer's trail lit
Resolve mailbox source precedence before deriving credential aliases
Account for repair policy fixture selectors in source closure
Format final waiting-state copy and record verification
Show retained network and service observations as absolute UTC times
Retain agent Off transitions until a matching host pass
aterm-win32-oracle: fetch when the frozen resolution fails, not when no source is unpacked
muse footer: an unrelated facts entry is not a mask choice
db repair policy: waive the three environment actions
db repair policy: drop duplicate environment waivers
secrets: every vault member joins Commons by default
fleet: an init's or join's wait counts only its own node's proof as served
fleet: ERR halted and a bound node's join refusal name the node whole
fleet: a loose word for an unread issuer is refused before any count
fleet: a cut await, a rotated issuer's denial and a short code say true figures
fleet: a cut await names a longer --timeout's wait only where it ends the wait
fleet: a held listen place says the aterm's own fleet= word
fleet: a member's peers rm tells its unread issuer only under the fleet it read
Keep explicitly addressed mailbox secrets scoped to their email
Expire service access observations independently of network reachability
Keep visible network details polling while the terminal is idle
Invalidate resource strip cache when service freshness changes
Stop network view wakes while its window is occluded
init: wait for macOS's local-network answer only on the transport's LocalNetworkPending
aterm-libc-oracle: fetch the locked graph once when the cache lost it
Verify healthy table convergence beside a damaged replica
prism-glass P0.6: the trail-diff script corpus (H)
agh: adopt the vault's tokens with no agh.toml, and let agents provision
aterm-models-agh: AghRouteWall holds the wall over vault adoption's rows
agh: vault adoption review fixes (one-shot learn, vault = true, dropped slots, own record lock)
agh: vault adoption review round two (one-login fail-closed, pinned tokens, plain auth add dev)
agh: vault adoption review round three (crossed files, damaged record, migration, remedies)
Start service observation independently of the network runtime
setup: a ledger that resumes once and parks, kept keys, staging sweep (RUN-1)
setup: gate Kept::applied behind cfg(test) (read only by the model/record tests)
Honor required details on the approved provider identity
Rewind R3: canonical checkpoint and config encoding, and the pane as an Aos task (aterm-aos-pane)
Rewind R3 (WIP): the GUI records replies, configs and witness digests, and rewind check replays each chain as the pane task
Rewind R3: encode main's DECSC resized flag, SPECS, KI, the design's as-built entry, and tests of the check line and framing
Rewind R3: the corpus's faithful rate in the as-built entry, a reply-reach check in the live test, and lint fixes
Cargo.lock: aterm-aos-pane at the workspace's 0.145.0
aterm-libc-oracle: a fetch that fails stops the run with its own reason
muse usage: fetch off the footer resolver thread
Expose scoped directory flush faults for durability controls
Report directory flush failures after updater transactions land
aterm-effects: hoist pet\_world span buffers, share luminance tables, and promote const/inline helpers
Retain saved machine observations when network runtime startup fails
Do not attest a current observer from a saved incarnation
verify: a run whose checkout moved mid-run could not run
verify: read the moved-checkout HEAD before the selection, and test the wiring
accounts: the vault's sheet outranks aterm's own \~/.secrets copy, judged by the vault's record
kitty: a hide behind the host's words is never dealt, and a turned-back play is given up
kitty: a walk the console turns back hops the chrome, and the law of the legs clears legit walking
aterm-effects: fast-path empty live motes in note\_lane\_birth and single-quad additive peak
font, render: apply OpenType GPOS positioning and stack layered COLR emoji
Use the admitted account trigger for recovery eligibility
Stats deck: the axis in blocks of 1 s, 10 s, 1 min, 10 min and 1 h, with six hours of history
Stats deck tests: the raster slide and the glide bound on the owner's 1 s boxes
SPECS: the live edge's clock states the glide bound on 1 s boxes as the owner's axis draws them
Read account menu choices off the GUI thread with owner-fenced completions
Publish the account menu before dispatching its first read
Inject held readers explicitly and surface unavailable completion delivery
Discard account read completion after its window is removed
Classify account menu completions as window UI wakes
Preserve keyboard menu selection while account choices load
muse usage: complete a partial mint from the last read
Preserve newer Codex credentials during token refresh
Report landed fleet edits and best effort journal flush failures
Check fleet edit state without pinning its prose
Collapse account completion guards for the lint check
aterm-durable: file flushes' refusal through astream-sys, and a failing arm on the seam
aterm-update: each record's, the swap's and the boot sentinel's folder flush has a policy
atpkg: a refused file flush is read by astream-sys, Darwin's ENOTSUP included
atpkg: each store step's folder flush has a policy; a reinstall's swap waits for its unmark
aterm fabric on/off: a \[fabric\] edit in effect is ok beside a WARNING, not FAILED
aterm fleet: a \[fleet\] edit in effect is said, with its unflushed folder, and the verb finishes
aterm-gui: the crash and session-log journals' folder flushes have a policy
aterm-update: linux.rs's required folder flush through aterm\_durable::durable\_dir
aterm-update: durable::finish is the macOS records' alone
aterm-update-core: a failed arm takes its record back; the seam injects the platform's own errors
oracles: review fixes for the fetch-on-miss commits
setup page: hold the walk's wake off the typing path (§5.6)
aterm-effects: cache bed high-pass filter, add fast-path guards, and inline hot helpers (Batches 283-284)
Format completion guards and clarify native fixture wait
Manage a macOS service that holds the Mac's memory: read it, name it, restart fseventsd
Keep aterm's build and test churn out of fseventsd: .ubd folders by construction
Fix what the quiet TMPDIR broke in verify's test stage
Service memory: carry an episode across a relaunch, gate agents' restart, follow the shim's cache root
control\_listener: count a rebind before its fresh accept thread can serve
aterm-effects: inline hot-path emitters, guard empty spark retention, and hoist wake color state (Batches 285-286)
aterm-core: seal the Kitty medium resolver and the notification callbacks behind capability tokens (P4)
Keep Codex workspace and login identity stable across refresh
Strengthen refresh ownership retention tests and satisfy lint
Record refresh identity verification and format its test
harness switch: words alone on the rule, no capsule
harness switch: format (verify fmt --fix)
harness switch: review fixes (screen-reader hint, changelog hover, High Contrast ink)
Publish local network identity only after current custody verification
init(scope): ALab signal is only an In membership; every Mac syncs the base plan (SYNC-1 parts 1-2)
init(types, gui): Subject::Sync(SyncKind) stub riding Secrets (SYNC-1 part 6a)
init(secrets): one discovery record, keyed by the gateway, not the subnet (SYNC-1 part 3)
init(access): collapse the grant-forget into a let-chain (clippy)
init(scope): fix probe\_vault doc — it still linked the removed vault\_here\_now
aterm-secrets: remove reserved-name files an older build wrote
aterm-agent: fleet sync keeps the person's grant and fleet
aterm-agent, aterm-secrets: review fixes for fleet sync and reserved-file take-back
Respect saved Codex OAuth authority during refresh
Stop package mutations when required directory ordering fails
Judge directory failure controls by structured outcomes
Replace Brew help script with an offline Trust generator
lab mac nux: prove round 9's init in single guests — setup-driven waits, a dialog census, in-guest latency, and the fault rows
aterm-lab: include Network State headroom in stats Deck check and settle prompt before AT-SPI walks
prism-glass P0.9: the host unreachability pin through the real frame path
aterm-link F4: the sim asks with deadlines and follows topics; three bridge bugs it found
aterm-link F4: twelve controls; a wide search's four more bugs in the hand-off and the deadline table
aterm-link F4: the ask's deadline draw as a plain if (tippy obfuscated\_if\_else)
aterm-link F4 review: a held ask's retry arms no settled deadline; only its own answer waits
aterm-link F4 review: the topic law's own correction pinned; the controls on the merged tree
aterm-effects: fast-path up\_ring SDF/raster, hoist bed luminance table, and inline hot helpers (batch 287)
Distinguish account proposals from deleted and unresolved shared records
Bind native Codex logins to fresh ownership and coherent claims
atpkg: make the Trust toolchain usable far sooner at first launch
Return the credential snapshot published by Codex refresh
Preserve rotated Codex credentials when a merged record grows
muse usage: a mid-flight forget keeps the landed mint
codex refresh publication: name selectors where closure collects them
messages tests: the words-move bound knows midnight
codex refresh identity: name its selector where closure collects it
codex refresh authority: name its selector where closure collects it
codex login publication: name its selector where closure collects it
F8-1 (LOOP-6 follow mode, ruling 2026-10-26(a)): aterm link notify --on need\[:\<word\>\] wakes a program when a session's folded need rises
F8-2 (LOOP-6 tail half, ruling 2026-10-26(a)): aterm fabric tail --json prints one object per record for a program
F8-3 (F2 leftover): the bridge builds every link mirror line from MirrorState and a closed MirrorReason
F8-4 (F2 leftover): fabric post re= and fabric tail --from read a bus offset with the shared parse\_bus\_offset
F8-5 (F4 leftover, ruling (3)): aterm fabric --help lists the brief's JSON keys from the one declaration session\_json writes
F8-2 review: aterm fabric --help says where tail --json's gap line comes from in plain words
F8-1 review (LOOP-6, ruling 2026-10-26(a)): notify --on need judges only a seeded fold, pages a session's exit once in either order, and judges a held record before a reconnect warms
Kitty media: an adopted spare's taint resolver goes unless the setting allows the real one
Kitty media: a contained spare installs no taint resolver either
DEC 2048: a report the program provokes passes the reply gates
aterm-effects: eliminate AdmissionRecord::line allocations and inline seam, baker, and state\_words helpers
Link Codex refresh-result coverage into the whole-source model check
Explain shared-vault blockers through the existing guarded readiness read
Box successful vault observations without changing legacy return types
Rewind R4 (default still off): one writer, spares that record, a memory pool, Forget
Rewind R4: a recording's queue holds at most its budget in bytes, and the pool counts it
Stats deck: the hot dial steams on the beat's frames
aterm-effects: precompute GridProposer/SETS\_V1 bytes and avoid codegen/aos\_momentum allocations
harness: the log wait carries the session's word, so a mid-turn switch is seen at once
aterm-gui: reflow take\_autopilot's doc to the file's width
gui: account progress wakes the window when it moves, not once a second
lab: a tasked chain's mark is its record's first read
agent: CodexRefreshPublication's waivers stand beside its anchor, not in a test module
lab: END wants no Land hold on same-land, whose person lifts it
Serialize fseventsd restart transactions per account
aterm-uds: fix Linux /proc/net/route and /proc/net/arp gateway parsing and enable unit test across hosts
DEC 2048 test: show the report a policy drops was held, not sent
accounts: Grok Build reads the vault sheet's x column
accounts: pin that a note's x names no vendor; x beside grok is ambiguous
aterm-restore: plant the look-alike tail into a region the real writer built
keeper boot recovery: metrics reads its HELLO and admission, a seam plants the worst case
verify perf: the measured lanes' bench build is one module, bench\_build
restore bench: a crashed window's tabs back, end to end, for N sessions
verify perf restore-e2e: the restore bench as a measured lane
plant: say what a refused plant left behind
restore bench: read the load through aterm\_uds::spawnfd, not std's Command
aterm-restore: build plant in every profile, so resync\_walk builds under cargo's bench profile
restore lane: keep the seam's own work off B's clocks, read placement and imports on B's own clock, probe the fence every 2 ms, and refuse a round whose arm did not take
verify perf restore-e2e: say what the lane reads now, not the look-alike tail as the worst case
docs/measured/restore: what the lane reads now, and what the ablation could not see
rewind: carry live transient state across replay keyframes (ATERM-KI-1024-4)
Separate Codex credential file capacity from individual OAuth responses
stats deck: back to the original colour scheme
stats deck: the scope ledger replaces the this Mac / aterm / Tab blocks
stats deck: the ledger's lint fixes
stats deck: the time series takes the row, one reading at the bar's end
stats deck: verify's fmt and lint findings on the merged tree
Stats deck: the strip keeps its share, the bar takes the rest, one reading where it fits
Stats deck: the Network run keeps its maximum where the peak word does not fit
atpkg: release the arrival on a fetch panic in the stage-as-it-arrives pass
Refuse conflicting account-sheet rows before pool sync
aterm-core: the response cap's test drives a writer no rate limit meters
aterm-effects: pre-size aos\_momentum Enc/Vec buffers and inline helpers
Console host: one alternate-screen leave in flight, not one per screen
Resolve bare Muse and agy launches on the supervised PATH
Rewind R1 review fixes (worker), WIP: live keyframes are instants with their slice's command bit; empty slices and dropped sync instants
Rewind R1 review fixes (worker): whole-cell search, cancellable searches, chunked judge, warm across chains
Rewind R1 review fixes (worker): rewind status says whether the view's thread is busy, and the tests a mutant run showed weak
Rewind R1 review fixes (worker): the warm carries on from a pass that stopped short of its fork
aterm-effects: pre-size MLP/tone buffers, avoid diag\_line/corpus Vec allocs, inline helpers
P1: measure launchd's user-domain verbs from inside the profile; name the residual
aterm-grid: a resize keeps the cursor's next write, so no printed glyph is lost
aterm-grid: next\_write's tables report every case that goes wrong, not the first
Resize keeps the next write: aterm-core tests, SPECS and CHANGELOG
vt\_oracle: width resizes join the differential VT oracle
aterm-grid: an edge wrap keeps the cursor on the row of the glyph it follows
Lint: placed() folds its two same-valued arms, Row::is\_empty for a zero length, and a Case alias for the resize table
vt\_oracle: the subset check sees what a resize keeps out
aterm-grid: a rewrap carries the cursor's cell, so its next write opens a row rather than taking the next line's
Resize: a saved slot past a full row opens a row of its own; restore paint and Terminal tests pin the next write
vt\_oracle: the fold clamps a cut-off cursor as aterm does; reach counts only width changes; the slot exclusion says what differs
SPECS and CHANGELOG: the next write keeps its offset in its line; a saved slot past a full row gets a row
aterm-core: name the narrowing case tuple (tippy type\_complexity)
aterm-update: first\_launch install posture plan + setup eligibility (RUN-3 §6.8)
aterm-gui: boundary guard + bounded update handoff wait; gate setup to Installed (RUN-3 §6.7/§6.8)
Align Muse and Codex tool subcommands with current CLIs
Refuse terminal relaunch for Claude --desktop launches
Require original session membership in restore readings
Keep the existing keeper-copy witness control without duplicates
Require observed restore experiments and refuse overflowing damage
Keep outcome controls without mirroring counter initialization
aterm-release: a blank --reason is refused, and one that lowers nothing is said
aterm-release: aterm-dbus's memory row needs 2.3 GiB, its measured peak
aterm-release: 22 Trust floors re-based from … onto …
aterm-release: 14 more Trust floors re-based from … onto …
aterm-release: 7 heavier Trust floors re-based from … onto …
aterm-release: aterm-effects, atpkg and aterm-verify's Trust floors onto …
aterm-release: aterm-font's Trust cost row from its … run
containment,uds: read TCC.db Developer Tools list natively in memory
kitty: the glass the footer blanks is the pet's free ground, and the cat rests by the words
spec closure: link every anchored crate, and name a test-only anchor at census
census closure-anchor: read a cfg\_attr predicate as census reads cfg, and name binaries
census closure-anchor: hold the finding to naming its machine, not to its wording
aterm-link mailbox (C01): an inbox item waits behind events at most INBOX\_WAIT\_MAX, and records queued together take one turn
Carry inbox fairness budget across refilled snapshot turns
Retain the actual readback successor seed and remove its search probe
Replay the observed readback witness in its exact plain world
Format the retained simulation witness with its crate edition
Rewind R4 as built: the rows on release builds; the default stays off (ATERM-KI-1027-1)
Add raw PTY echo to the private resize fixture
Combine equivalent next-write cursor placement conditions
Use the row emptiness query in resize reach accounting
Name the next-write test case tuple
Add ordinary cursor cutoff controls beside the matching fold
Qualify resize corollaries for deliberate cursor positions and clipping
Carry attached Muse short-option values on relaunch
F9-1 (F1 lead (a), privacy): a nameless program word never promotes an argument
F9-2 (F5 leftover): the seamless take's note\_handoff call has a test of its own
F9-4 (F9 review, MEASURE): the shells' expanded 633;E for a history designator is a test
F9-5 (F9 review, privacy): a word is an assignment only where its reader takes it for one
F9-6 (F9 review): the note\_handoff test carries three epochs, the highest in the middle
aterm-machines: sync.rs, the converge pass after an update (C4)
aterm init --converge: the converge pass's runner and live ports (C5)
sync: review fixes for the converge pass's base record, accounts writer and checks
fabric\_world: the journal test waits for the segment the writer coalesces
fleet: one helper decides which grant admits a node, so allow drive --all lets members drive
fleet: fleet-off has one lifecycle under the lock, and §5 documents sync, publish and fleet-off
fleet: a leave names each Mac its hold read could not check
fleet: a peers header and a join quote the fleet= word aterm ctl status shows now
fleet: an ambiguity refusal names each peer by its whole node id
fleet: survey --host never dials a node id no book binds, and an answered row says the issuer was silent
fleet: a grant from an unconfirmed copy of the issuer's book says so
fleet: a drive refusal names the dialled Mac's copy only where it holds one
fleet: peers rm says when the running aterm lifts the holds of the node it undrives
fleet: sync's writes go under the write rule, and §5 says what main's sync builds
fleet: an open drive is cut once the keyring binds its node no more, under "\*" too
fleet: peers rm names every node it leaves driving this Mac no more
fleet: a leave that cannot write fleet-off where a join could removes nothing
fleet: a test pins the whole node ids of the hand-entry ambiguity refusal
fleet: a cut drive's client names this Mac taken out of the driven Mac's books
aterm-conformance: the idle Rewind row judges what recording adds, not the app
aterm-conformance: the idle Rewind row holds a recording-by-default bundle to the 25 MB target
Console host: one leave client per session at a time; docs say what was measured
Carry attached Claude short-option values on relaunch
aterm-sysprobe: the socket-count test holds a floor of its own sockets instead of a before/after difference
Parse bundled Claude short options on relaunch
Rewind R1 review fixes: effects pause, export, live and past, band rows
keeper link: the worker reads the keeper's answers as they arrive (K1)
keeper link: a quiet seam, and the live lane's K1 check that a recovered window is served once its keeper answers
headless: the restore pass runs at the first park, so a plain headless instance places every session it recovers
Retry interrupted keeper wake writes and require original recovered sessions
keeper link, live lane: trustfmt
Qualify quiet keeper recovery coverage and historical readings
aterm-effects: eliminate Ribbon overflow obligation and inline rainbow\_kitty helpers for Trust verification
lab trail-keys: real Claude Code guards the composer's trail custody
temporal: record post-seed host mutations on the replay and aos-pane spine
aterm-link mailbox (C01): an inbox turn takes up to 64, as many as an event run
aterm-link SPECS (C01): mailbox-priority-order names the turn cap the code has, 64
init: git-and-friends shim before the Command Line Tools (design §6.3, RUN-4)
init: clt\_shim compiles on Windows and drops a redundant closure (RUN-4 review)
aterm-link mailbox (C01 review): only a taken event starts the inbox turn budget again
prism-glass P0 fix: trail-diff's closure holds the rig and its frame reads; held frames compare state
prism-glass P0 fix: a press on the cat is stamped at its own instant
prism-glass P0 fix: H: the dump's press on the cat changes it, and a paced run dumps the same words
prism-glass P0 fix: a headless window can present live onto the scripted surface
prism-glass P0 fix: whole test samples of GlowConfig and SoundEvent
prism-glass P0 fix: H: the dump draws through the live present
prism-glass P0 fix: the capture seam and the scripted outcome leave the dump's build clean
prism-glass P0 fix: H: the dump hashes named words of every effect stream, both deadlines and its cues
prism-glass P0 fix: the light-fork pin holds a tab's and a pane's caret fill to its dark twin
prism-glass P0 fix: the corpus test says what it checks: each pass has a run
prism-glass P0 fix: the live-present seam names its glass and builds in every test build
prism-glass P0 fix: H: the rig names its pet record
prism-glass P0 fix: H: the frame reads' test reads the pet's and the word latch's deadlines
lab trail-keys: every boundary proven, every key judged alone, exit 3 when it cannot run
lab trail-keys: Escape and Ctrl-C interrupting a streaming turn
harness,gui: fix non-Claude pool\_advice attribution, wall point, and Codex thread sample
aterm-link: hold astream's fixtures of the broker aterm runs to aterm's own (C06)
aterm-census: export-includes, an exported file compiles in only what the export carries
aterm-link: astream\_fixture\_tests is an integration test the export withholds with its files
Skip Codex many-values in TUI and resume reads
font: legacy kern, AAT kerx+ankr, fallback mark positioning, and CGJ/ZWNJ skipping
aterm-aos-pane: carry split DECRQSS and XTGETTCAP queries across slices
aterm-grid, aterm-core: five wide-glyph fixes the differential VT oracle found
vt\_oracle: East Asian wide glyphs join the differential VT oracle
vt\_oracle: italic, blink, concealed and crossed-out join the differential VT oracle
vt\_oracle: 24-bit colour joins the differential VT oracle
aterm-grid: DCH's straddling-lead test reads rb \> src\_start (tippy int\_plus\_one)
aterm-grid: a wide glyph unpaired at a DECSLRM margin drops its marks
vt\_oracle: follow astream main's wide-cell model, and compare every code point's width
ai: resolve pooled CLI serving login across facts, state, and review
abrew: brew 7 reinstall narration
gui, docs: align harness.accounts and multi-cli pool notes with shipped behavior
converge: start the pass from the subscriber, the window and the Secrets stage (C6)
converge: renew a broker on a replaced build with fabric on's broker step (C7)
converge: sync.peers joins the open ALab vault from the window's pass (C8)
converge: review fixes for the triggers, the broker renewal and sync.peers (C6-C8)
Claude Code sessions report their usage; disk hogs say when they were last built
Expose worker scheduling observations beside idle performance cores
Read target scheduling flags and reject unmeasured CPU intervals
Keep why trends pending when core counters do not advance
Select the CPU subject in held-counter why control
Report native CPU hardware evidence and preserve bounded anomaly diagnostics
Preserve CPU sample ordering and validate adopted parent ages
Make CPU diagnostic reports self-contained and state exact underuse thresholds
Fix native loader boundary and preserve historical CPU diagnostics
Teach native SDK prototype controls the C int spelling
Declare and validate native online processor records
Exercise held CPU counters through the live model in rendering controls
Keep the held-counter recovery control on the CPU subject
Observe adopted job CPU after the existing progress phase
Collect bounded CPU policy diagnostics through native authorization
Use checked fixed-size frequency table chunks
Mutate diagnostic negative controls through the JSON object API
Complete CPU policy routing and drain failed collectors safely
Compare persisted CPU policy reports as JSON objects
paint: bound the tall and underline bodies' reach above the typed row
supervise: WaitKind::Outage, the kind of an outage wall's wait (slice 12b interface)
supervise: WaitKind::Outage names its outage (Outage: words, status word)
supervise: RULE\_OUTAGE\_RESUME, the outage wait's resume (slice 12b interface)
supervise: an outage wall is waited out, never typed into (slice 12b policy)
models: SupervisorOutageWait replaces SupervisorNetworkWall (slice 12b)
supervise\_conformance\_outage\_wait: the wait's minutes need no conversion
supervise: an outage's resume keeps a person's exchange theirs, seeds Land and resumes a cut measured down (slice 12b review)
models: SupervisorOutageWait's word law has content; the conformance walk holds the words
harness: an outage wait is a quiet waiting: on the tab's state line (slice 12b, window)
harness: say WorkerIdle::waiting's no-wait arm as a match, which trustfmt keeps on its lines
harness: drop the outage-wait App test's assertion that nothing could fail
harness: state\_line's doc names the stop between the outage wait and the need
lab forever: outage-land and outage-cruise, an overload judged as a silent wait (12b)
scn: c3-wall waits for the outage's one resume at its first rung
lab outage: tries timed from their own wall, an overload's resume blind, the state line read
slice 12b: the lab's ladder and line are the policy's own; changelog and the land run's record
lab outage: three-eighths rungs past the take window; a hold judged only in the outage and on the resume's answer
lab outage: a try's wall is the outage's first reading or the wait past the act's take window
slice 12b: the books carry a wall read while the route was measured down
slice 12b: a person's own turn of work ends an outage's ladder
slice 12b: Land's instruction typed under a resume's rule begins Land's hold
SPECS (aterm-agent): the outage tests as they are named now
prism-glass P0 fix: H: the pet's state words name its held stands, kept reactions and poses
prism-glass P0 fix: H: stardust's state words name the aurora's veil
prism-glass P0 fix: H: Sparkle Words' state words name its reservations, witness, trick flash and births
Shim the whole Command Line Tools stub set
Frame CPU policy replies with the shared JSON protocol
Accept sys caller metadata and fix CPU diagnostic sudo arguments
abrew: brew 7 cask download-queue narration
Keep native processor readers clean under tippy
Observe askpass ticket cancellation while awaiting the sheet
Initialize resource test snapshots without reassignment
Resolve remaining resource and authorization lint findings
Use the byte-string form in the collector pipe control
Respect provider realms during additive account sync
Strengthen provider-realm conformance after design review
Record final model composition and format its incoming GUI change
abrew: brew 7 cask uninstall narration
vitals\_host: gate cpu\_policy\_generation to macOS, where it is read
measure paint: the companion plane is drawn by its own job, after the shell started it
measure paint: a plane miss alone reads the whole screen, and the plane outlives the take
measure paint: the scanner sees the first keys' spring, and a Pet row needs the pet on every frame

v0.144.02026-10-26

aterm v0.144.0

2026-10-26 · 129 changes since v0.143.0

Fixes

vitals, gui: guard redacted pcblist64, dedup Folded hardware totals, and surface Folded network state

Tests

keep restore and package-stub checks portable
keep short-turn replay on the scripted monotonic clock
fabric-live: s\_a opts into the backlog's topic past the backlog, not before it
handoff: v0.143.0's producer fixtures, written by its own cut
gui: create shared test roots exclusively, never by a clock

Other

db: bind account review plans to transitive contact proposals
aterm secrets sync: the first line counts failed files; the ladder reads a partial apply
aterm secrets sync: the comment says what the harness reads of its first line
aterm-secrets: a job is pointed only at a program that starts as aterm
firstrun NUX-4/5: setup waits on events, not a minute's timer; setup= in status
F3/C3 (LOOP-2): a moved mail count makes a bus snapshot due
F3/C5 (PRIV-4, PLAN2-3): leg 7 sweeps the restore store at rest and every reader
F3-land/C3 (LOOP-2): a held-back mail count says when it is due; a closed tail waits for its last counts
F3-land/C5 (PRIV-4): leg 7 reads the crash journal while A runs; the broker's log allows no post key
abrew: leaves counts cask dependents and possible names
secrets: authenticate materialized entries before signed reads
abrew: cask upgrade prints brew's summary and headlines
aterm-uds: tether a spawned child to its parent (PDEATHSIG on Linux, a kqueue watcher on Darwin)
aterm: serve the tether verb first and test a killed parent's helpers
aterm-gui: tether the window's long-lived helpers
aterm-ctl: name a tether's watcher in the census, not an orphan or a window
aterm-gui: tether only run\_bounded's capped reads, not the bus verbs
aterm-uds: say a tether's given pid is not its parent, not that it is gone
aterm: test the tether's parent check with a live pid that is not its parent
stats\_deck, vitals, sysprobe: multi-scale timeline, live glow, 3-scope bars & net/hw telemetry
gui: fall back to capture\_restore\_manifest on non-Unix in app\_restore\_tests
atpkg: gate unix-only lasting test imports in stub
accounts: bind preparation to retained root decisions
abrew: cask pin/unpin in brew's pinned\_casks, pinned everywhere
aterm-agent: bidirectional CODEX\_AUTH\_PATH token reload, endpoint guards, and upfront sqlite schema check
aterm-forge: attest fetches the pristine copy OB-7 diffs against
Vault: fixes from a review of the Local Network record and the --program check
aterm-link: one post journal in place of a file per reservation and per in-flight record
aterm-link: a stop hands the journal's records to the files an older build reads; tests follow the journal
aterm-link sim: a torn append may keep its length; the controls the journal moved find their seeds again
aterm-link: the journal's bound has a test; the lease control's witness moves past the rare search
aterm-link: lever A, the retirements of what landed ride the next peek; one quarantine copy per record
aterm-link SPECS: lever A's three retirement rules and their controls
aterm-link: trustfmt
aterm-link: a retired record is noted once its copy is durable, before its file's unlink
aterm-link: lever A's first stage parked, not shipped
aterm-link: a moved generation's offset resets come back as a named struct
aterm-link B19 review: the journal's refused removals, held files, stale journals, salvage and hand-back
SPECS: the reader-alone sweep's simulation search, B19 review
aterm-link B19 review: the journal's salvage is a while-let loop and its search past damage is bounded
accounts: consume root grants for guarded local Claude renewal
accounts: parse shared-renew options as fixed-size pairs
System State: only the ALab vault makes a Mac ALab's
aterm-lab windows: the window smoke drives dead keys, AltGr, a held modal resize and an OLE drop
aterm-window, aterm-gpu, aterm-gui: a Win32 window hands over its HWND through aterm\_types::native\_window; raw-window-handle leaves win and win-arm
aterm-lab windows: the window smoke awaits its echoes as written and reports each window's style words and DWM state
aterm-window: the Windows window attributes no aterm crate sets are folded into the backend's creation
aterm-window: the Windows window controls, extensions, custom cursors and video modes no aterm crate calls are cut
aterm-window: the Windows backend registers for raw input no more
aterm-window: the last shared calls Windows does not make compile off Windows, and their Windows half goes
aterm-win32: regenerated for the carved Windows backend, 880 -\> 746 declarations
aterm-window: the public handles' auto traits are proved by the library item SPECS.md names, and the notes lose the cut types
aterm-lab windows: an awaited echo is one word on the control wire
aterm-lab windows: the launch rows hold the window's style words and DWM state recorded before the carve
aterm-win32-oracle: the packing plant moves to IMAGE\_DOS\_HEADER, DWM's blur struct having left the closure
aterm-window, aterm-gpu, aterm-gui: trustfmt the step's files
aterm-lab windows: a CPU hold leaves out the client pixels on no monitor, not just those past the virtual screen
aterm-gui: the retry-floor test seam compiles where its tests do, macOS
aterm-release: aterm-win32's Trust floor 16/197 -\> 15/170
aterm-window: the two windows-sys features the carve left without a caller are not asked
aterm-lab windows: the drop is released on aterm's Copy under the cursor, and the close row quotes input percentiles
stats-deck, sysprobe, vitals: polish multi-scale live geometry, network state, hardware totals, and Linux TCP RTT
editor: paint, count and expose only the rows the body shows whole
editor: a completion list takes only the room the file can spare
find bar: every well shows its edge, whether or not a rail can be drawn
aos\_momentum: the pool-outcome test runs sixteen subsets that reach every end
settings tests: the narrow short window's room checks ride its stops' walks
settings tests: every page's sweep skips a source that lays the page out alike
SPECS: the editor's whole rows, the list's room and the find well's one edge rule
consent\_state: the retry-floor test helper is macOS-only, as its callers are
editor: the window scrolls sideways no further than the caret's line needs
editor: a config error's status never takes the file's floor
CHANGELOG, SPECS: a config error keeps the file's floor; no sideways scroll while the line fits
editor: under a list, an edit ticket's header row gives way last
aterm-secrets: the reason test's Local Network assert compiles where the client does, unix
doctor: one verdict line and only what needs you; cheaper probes (DOC-3, DOC-4)
doctor review: an Xcode update retires the kept cc verdict; kept answers keyed by question; help permissions names whose FDA it reads
atpkg: one defaults read answers both Universal Control switches
doctor: a packages line names its fix once
doctor: a person who left Rust in Spotlight unchecked keeps the rust-docs
atpkg probe\_cache: readings live in the running account's state root
doctor review: trustfmt
doctor: setup records it cannot read keep the rust-docs
atpkg stub tests: the unix-only imports are unix-only
aterm-update: the ledger's skipped count saturates
abrew: list --pinned and outdated --verbose see cask pins
vitals, vitals-host: persist 1-hour strip history across restarts and crashes
Vault at a path: keep a pin when plain text replaces it; put a rewritten file back once
abrew: list and uses lay out in brew's terminal columns
kitty: a caret at rest sends a far cat once to its seat
kitty: the writing's wrap is a brisk bound
aterm-effects: the wrap law's takes are a named type
kitty: the brisk bound flies the big arc, and the leap ahead of a wrap stays quiet
kitty: the word a composer's wrap carries down keeps the wrap's bound brisk
kitty: a wrap the hand typed is the writing's, its rhythm open or not
harness, restore: validate self-claimed Codex resume records on restore and relaunch
Reject consumed shared renewals before staging allocation
Reserve approved provider identity before shared login
Enforce required browser routes before shared account sign-in
aterm-gui: capture-refusal tests read a hold before the stamp, a release after it
disk-free: name the asked tab's own build when another tab's is larger
aterm-lab: disk-ask --scenario clear|partial|unanswered
aterm-lab: drop disk-ask's unused Received::got
aterm-lab: disk-ask waits on aterm's disk worker where revision 2 starts one
aterm-lab: pass disk-ask's line tag to the stub rule by value
aterm-lab: disk-ask --scenario exhausted, and the disk worker never in a tab
abrew: search matches like brew — aliases, DidYouMean fuzzy, sections
fleet: a level's write holds the book's lock as a leave does
fleet: one sentence says why nothing listens here, and an aterm counts only where it answers
fleet: a spawn refusal a driving Mac reads names the Mac asked, never here
fleet: a stopped aterm's bound listener is told as stopped, and a proved listener outweighs a bogus allow
Keep shared account selections from blocking ordinary renewals
aterm-link: an earlier boot's sessions' files go at the next boot's start, and an unlinked file leaves the clean stop's set (B20)
fabric\_world handoff\_cost: the session helper passes its world as it holds it (tippy needless\_borrow)
aterm-link: an attach of this boot holds an earlier boot's sweep back (B20 review)
F4/C2 (LOOP-1, PLAN1-1, PLAN1-2, PLAN1-3 b c): the fabric chip keeps a wall's reset and drops a no-close need; the docs say the fabric is one machine's bus
F4/C14 (PLAN1-3 a e, RULES-5, RULES-6): DESIGN §10 records 6C-2's and 6B-3's deviations, the corpus line counts nothing by hand, and a duplicate ledger test goes
Harden Codex auth.json reads and pre-deadline loopback PKCE checks
abrew: named desc prints in brew's sorted order
Vault server: the ALab name and the ALab pin belong to ALab's server alone
Fence signed-out answers against replacement logins
secrets: long-poll the join queue, wake on a network change, ordered writes, join line, SSH jobs (SECR-2, SECR-4)
secrets review: join-queue versions per run, expiry moves them, one key stretch, resting approvers read nothing

v0.143.02026-10-26

aterm v0.143.0

2026-10-26 · 188 changes since v0.142.0

Fixes

accounts: snapshot manual renewal scheduling
accounts: guard sign-in opening and browser observations
init: preserve unreadable automatic retry evidence
harness: resolve post-merge tippy lints and CODEX\_AUTH\_PATH test expectations
harness: align TRAIL\_LAWS\_FULL pool conformance tests and win dead\_code attr
models-harness: evaluate LoginComesFromSnapshot mutant over pre-state in AccountLaunchRead
accounts: keep browser observations after command start
accounts: recognize alias identities during default rediscovery
core: observe working-directory host changes
fleet: init/join/rotate/leave closings follow what their own wait saw
effects: clear stale parked-caret state on composer submit
gui: refresh permission evidence for new setup approvals

Performance

effects: replace hot-path iterator combinators and closures with direct slice loops (batch 252)

Tests

init: protect automatic passes from unreadable retry evidence
init: cover deferred wake and queued Stop boundaries
init: observe Dock retry effects without catalog aliases
init: retain a completed Restore through later setup read errors
init: cover independent stage outcomes and withdrawn offer choices
init: assert unfinished stages in a restored legacy plan
fleet: boot\_world's Command hook carries its disallowed\_types expect
fleet: each off-loopback listen starts from listening; an unguarded control retries
harness: the wrap test's negative controls say what each mutant did
harness: main's disk-worker test reads Cruise's angled check and its own repository ask
scope the styled-instance helper to its macOS caller
match consent retry-floor helper to its macOS callers
handoff: v0.142.0's producer fixtures, written by its own cut

Docs

name the reap credit's over-counts and the third review's gaps
gui: describe verified grant fallback accurately

Other

effects, gui: eliminate low-frequency hum in typing sound
aterm-font: i16\_bound is a plain fn so Trust 0.11.0 compiles its contract
aterm-release: a check is starved by its threads' share of their runnable time, and its verdict names what decides it
aterm-release: ship trust run's help says how a run is judged starved
aterm-dbus: header\_len and pad\_to are plain fns so Trust 0.11.0 compiles their contracts
secrets: refill a deleted vault file, put back after a rollback on any pass, keep join waits bounded
abrew: install --dry-run prints brew's grouped plan summary
harness: native codex-alab auth/goal alignment and pure-Rust SQLite/OAuth readers
aterm-effects: a waking pet's held stretch and a hidden pop sleep at the offer
Keep tab-menu session commands on their original terminal pane
Retain terminal owners in trail diagnostics
Remove the obsolete tab SID wrapper and project cached clause expectations
disk-free: revision 2 design (reviewed) and the projection's first cut
WIP: the ask's projection records, settle rule, windows, worker step and owner check
disk-free: aterm harness disk free <path>..., the worker's one fenced removal
WIP: the window reads the fill ring, steps the worker and says the filling disk
disk-free worker: the fence (RULE\_DISK\_WORKER), Land's repository leg, --permission-mode
disk-free: the DiskFreeWorker model, its conformance and the worker's unit tests
disk-free: the projected hold's model, its conformance, and a projected line within its cap
style(disk): trustfmt the projected ask's files
disk-free: name the task-record read the worker step takes (TaskRead), as tippy's type\_complexity asks
disk-free: the filling entry takes its worker's words as they are
abrew: brew's already-installed notices; cask install upgrades
First-launch setup starts at once, no countdown (NUX-2+3, design revision 4)
System State: a press on a waiting offer answers it with the whole shown plan
abrew: info --json matches brew's to\_hash key set
init: wake deferred retries and honor queued Stop immediately
aterm-machines: name an agent by aterm-agent-names, not aterm-phase
aterm-forge: an added licence text's OB-7 notice is NOTICE naming it
aterm-window: the recorded sctk-adwaita shadow says aterm added it
aterm-forge: SPECS states OB-7's added-licence exemption; OB-5 shares is\_licence\_text
aterm-phase: SPECS and design docs point at aterm-agent-names for the name table
abrew: cask info --json matches brew's shape, reads bundle versions
Settings status: a press's status takes the place that moves nothing
Settings rows: what a row may say takes room in lines it draws either way
Settings tests: the Undo place test checks the switch and the Undo again
Settings rows: a row with a note says Changed on the note, its name whole
Settings: a segment pressed stays where it was pressed
Settings: a press holds the list only until the person moves on
aterm-verify: the arena lanes' bench box is rule zero's M4 Max, one rule for every lane
aterm-verify: the ghostty pin names its per-commit dmg, which the rolling tip no longer serves
aterm-verify: the scroll lane quotes each window by n\_present and its percentiles
aterm-verify: cat and vte run their aterm in a private HOME and XDG tree
aterm-verify: the scroll lane says n\_present=0 for a window no output reached
aterm-verify: the vte lane's benchmarks wait for the grid their terminal was asked for
aterm-bench: the crash-restore tail tap ratio is the median of 49 interleaved pairs, not 9
aterm-verify: a perf trend row names the tree its run started on, dirty when it changed under the run
aterm-verify: the effects lane rates the flowing card's emit by its mean frame
aterm-verify: the resize lane trends its passes' median worsts and fences pump steps
aterm-bench: the crash-restore report counts the tail tap's pairs
aterm-verify: vte's grid wait names the wait it was given
aterm-verify: the arena caches a ghostty download only once it hashes to the pin
aterm-verify: the scroll lane reads the jump once its frame has rendered
aterm-bench: the resize harness's deep summary says what each figure is, not who judges it
db: diagnose typed contact references in account details
F2/C4 (RULES-1, RULES-2, PLAN2-1, RULES-3, PRIV-2): help status and help log say what aterm writes
F2/C8 (PLAN2-4, RULES-4, PLAN2-2, PRIV-2, CRIT-1, CRIT-2): Settings, the man page and the CHANGELOG say what the session log does
F2/C9 (LOOP-3, LOOP-4, LOOP-6): the fabric reference, the agent brief and the skills name the session log on the bus
F2/C4 review: codex\_rollout\_tap::answer::ALL is test-only
F2/C9 review: the drive-aterm skill's mirror paragraph wraps like the rest
F2/C4 land: status rollout= prints a closed word, so its help test cannot miss one
F2/C8 land: the man page puts the secret with the program name, and no doc names a refused log form
F2/C9 land: the fabric page and skills say what the bus carries, mirror= is one vocabulary, and ctl post takes re=@\<off\>
aterm-window: a lost X11 display has no monitors, not the cached list
init: keep Restore completion when a later setup read fails
aterm-gui: a tab nobody chose is never synced to the front (H1, H2)
aterm-gui: replay\_deferred\_handoff\_view\_close's doc names its one exception
accounts browser fetches its own pinned Chrome for Testing; the Grok need names it only where it opens a window
accounts browser review fixes: the window route reads the desk and curl, a failure is read for an hour, a placed tree is never moved
secrets: a moved aterm.app no longer stops the vault server for good; mend runs during an unfinished setup; asks end with their approver
secrets: stamp the service program's start path; skip a foreign home's server; bind asks to the approver's start
db: refuse ambiguous identity columns before private imports
Retain init stage outcomes and admit fresh manual choices
accounts: reject ambiguous live spreadsheet columns
aterm-sysprobe: read P\_NOCLDWAIT of every process, not only one that has reaped
aterm-vitals: a freed hold whose parent's row reads unread is held again there
aterm-gui: a tab takes its least pane's key after the shared-pane dedup
lab: claude-login-proof runs the Claude Code login E2E; roster writes wake the host; CLEARED names aterm's back-out
lab: claude-login-proof tells the add's wake from the host's look; fenced first prompts; --keep judges; CLEARED names the hand-off back-out
fleet: a debug build's ATERM\_DEBUG\_LOOPBACK\_ONLY=1 keeps a drive on the loopback
spawn: a grok worker is refused as grok before this Mac's harness is asked
hold: a sid written with @ in its argument gets the bare-sid form
fleet: the loopback guard skips what leaves, as the kind check does
fleet leave: the own-listener probe gets peers' 3 s, and its test a hang detector
spin: a windowed row bounds a sleeping cursor pet's lane at 0 wakes
verify, PROCESS: --no-windows leaves out spin's window rows, plural
kitty: the host's chrome rides the rows it was painted on
kitty: a cat at rest by a hosted composer is seated where the typing walks
kitty: a seat lost to the words is left on foot
kitty: the escort's tail sends no one out to its stand
kitty: the writing brings the stand to a cat ahead of it
kitty: one seat for the whole line under the chips
kitty: the line holds through a pause
Name the inert workstation test callback type
Settings rows: a fact no choice of the row brings keeps no room
aterm-gui: input follows the window and the find field the person sees
accounts: validate complete fleet machine assignments
secrets: a revoked Mac is no Mac asking to join; a second admin enters Commons control
secrets: the approver rests with two requests under one name; a Mac behind the version that brings it in is told to sync
secrets: a request judged anew starts no pass when a sibling under its name stays answered
abrew: cask install/uninstall speak brew's headlines
palette: the search field's rim is the control edge, 3:1 on the card
bands: a text field whose fill stands under 3:1 off its ground draws its edge
editor: the chrome sheds by measure so the file keeps its rows
fonts: the bold role draws the family's designed Bold; its name says what draws
handoff: the hang-up race test admits its dialer at the same-uid floor
aos\_momentum: the skipping-spread laws run over the six-plan file
settings tests: the text-size keeping test settles on the lab it left
editor: an edit ticket's header row stands for the toolbar when the file is short
settings tests: the text-size keeping test walks the keyboard off the list once
editor: the help palette's doc names the shell's floor
bands: a faint text field's edge is the control rim, not the words' ink
find bar: a composition over the well's edge is marked in the words' ink
accounts: preserve source priority through unreadable entries
aterm-conformance: a pet spin take that is not a focused window's sleeping pet refuses
harness, lab: a stopped Autopilot says so (v6 slice 3a, §14.3)
lab: same-land's person's turn is theirs from their first key, in plain words
aterm tests: the live hold test reads the journal's held= arm
aterm-lab: same-land's chip may say theirs from its person's turn on
aterm-lab: re-record the captures manifest with same-land on four harnesses
harness(autopilot): 3a's review round: a wall's hold stays quiet, each arm worded once, the redraw's guards pinned, a stopped worker's tip, the held extras shot
harness(autopilot): 3a's windowed read: a development build's chrome prints the chip's and the band's screen-reader nodes, and the lab wants them to say the stop
aterm-lab: re-record the captures manifest with same-land shot on Claude Code, agy and Muse Code
harness: harden native Codex OAuth, SQLite reader, rollout wakes, and real-package proofs
harness(cruise): ask a new kind of work at each done claim (v6 §14.5, slice 5a)
Cruise's repository suffix asks only for the agent's own work; the count wraps in turn
accounts: retry unchanged local sources after failed refreshes
accounts: resolve source paths from captured context
System State: a fleet Mac's first join waits for the Local Network answer
abrew: formula installs narrate like brew, summary is the keg abv
permissions: FDA brings Developer Tools in the same run; an update's successor reads FDA once settled; Settings opens unwaited; notices asked quietly (PERM-1, PERM-4)
permissions review: the grant's Developer Tools read survives a read just before it; every queued step lists ahead; the settled look reads afresh (PERM-1, PERM-4)
abrew: substitute text placeholders in every native bottle pour
abrew: relativize build-prefix symlinks at pour, like brew
accounts: apply worker selection to the inherited environment
effects: close rainbow cursor trail blackout and border gaps across composer wraps
System State: keep what the let-through join heard of Local Network
gui: unify harness version label and two-state segmented on/off switch
aterm-secrets: approver fixes from the round-3 audit (two names, a refused publish)
lab mac nux: vault-local reads the join password at a terminal, as SECR-1+3 now requires
measure: paint's first take in a process is a warm-up that decides nothing
init: no fixed sleeps or repeated reads, Messages/FaceTime sign-out in one run, CLT on every Mac (INIT-4, INIT-5, INIT-6)
aterm-machines: the admin check reads the group's members with contains (tippy manual\_contains)
init sign-out: the Automation question reaches System Events, the first click waits for the app to come forward; the account and responsible-app reads are macOS's alone
aterm-vitals: a process spawned as a sweep listed counts from its birth
aterm-vitals: the reused-pid split test's claude is older than a process the sweep read
harness(needs), messages(presence): stopped work first in Needs you, the pressing session and next need (§14.7, slice 7a)
presence, status item: the +N and other aterms' reports keep stopped work first (7a review)
Exercise permission refresh across approvals and failed history saves
Format permission refresh regression fixtures
accounts: keep relative auth files out of managed rotation
abrew: uses answers over the full dependency graph
install.sh: a disk node no stat reads vouches for nothing, and refuses no other volume
accounts: reject stale policy snapshots before preparing a move
Give About aterm its own native tab application
Keep About keyboard focus visible through reflow
Document dedicated About routing and semantic controls
Traverse offscreen native list controls before wrapping Tab focus
harness: harden native Codex OAuth callback, LoginFile admission, and SQLite reader
aterm-gui: the toolbar drive's icon group names About

v0.142.02026-10-26

aterm v0.142.0

2026-10-26 · 343 changes since v0.141.0

Fixes

init: recover installer ownership with kept terminal children
init: preserve deferred Restore when originals are unavailable
accounts: recover budget state and history together
accounts: choose recovery scope under the writer lock
accounts: journal local login transactions
init: retry refused vault workers independently
init: keep permission declines effective when saves fail
sysprobe: read zombies after every live process
vitals: reap credit owes no debt, keeps its tabs, and says when it missed work
gui: stamp a reading's wall clock before its sweep lists the processes
vitals: date a process with no birth read by its kernel start
accounts: recover GUI roster reads before fallback
accounts: recover and fence account report snapshots
init: preserve Restore originals at shared admission
accounts: snapshot remaining CLI report consumers
rewind: retain the terminal owner of popped timeline rows
init: preserve verified whole-profile completion before its summary
atpkg: compile linkage inspection wrappers only for their tests
atpkg: iterate linkage formula keys directly
accounts: capture upgrade evidence and tap policy together
atpkg: compile linkage fixture helpers only in tests
atpkg: iterate linkage dependency keys directly
init: retain verified stages and deferred widget work
accounts: retain one recovered sync report for CLI and setup
accounts: render dashboard from the admitted report projection
init: preserve retry identity and retire completed activation
accounts: plan renewals from one recovered snapshot
models-harness: evaluate LoginComesFromSnapshot mutant over pre-state in AccountLaunchRead

Performance

effects: eliminate closures and range helpers in console\_life, pipeline, and rainbow\_kitty
effects: inline hot-path closures, range checks, and slice loops in rainbow\_kitty and bakers
effects: eliminate dyn closures, float duration checks, and iterators in cursor\_glow
effects: replace iterator loops in matrix\_rain and rainbow\_kitty meteor/ribbon
effects: replace non-test iterator for loops with indexed while loops in rainbow\_kitty (Batch 249)

Tests

init: reproduce installer custody lost on keeper recovery
init: reproduce lost deferred Restore after backup damage
accounts: exercise a real binding edit in recovery coverage
fabric\_world: the journal test waits for the census's amend of the start
accounts: retain setup receipts in journal fault fixtures
init: expose refused vault worker starts
init: retain permission answers across failed writes
harness: align failed claim coverage with atomic history
vitals: bind CountedOnce in the reap credit's conformance run
init: expose admission and launch-measurement gaps
init: reproduce repeated sign-out after interrupted completion
harness: a claim whose publication stopped after its save lets no second reset run
accounts: borrow the launch image comparison
init: reproduce forgotten deferred work and repeated automatic sign-out
init: derive workstation scope for the narrowed control
release: the CRLF probe's hang detector is a minute without progress
init: cover retry identity and fulfilled activation debt
init: retain deferred work through unreadable run identity
handoff: v0.141.0's producer fixtures, written by its own cut

Other

harness(look): a look from another app is no look (v6 slice 11a, §14.11)
occupancy: a granted wake claim carries the figures its line types
occupancy: a due wake's line is typed at a break under prompt alone
occupancy: a worker's wake claim is judged by its book under prompt alone
occupancy: a wake claim is given back by the door that holds it (2.8 review follow-up)
aterm-effects: fuse tone hidden-layer loops and hoist luminance table in word\_decorations
aterm-effects: replace dynamic Palette trait dispatch with const enum and promote TrailSynth to const fn
aterm-capacity: bound a quiet wait, reserving the machine before it starts
atpkg: show a quiet claim's reservation in pkg capacity
aterm-verify: say how a timed stage's quiet claim started
aterm-conformance: name a rewind step miss on a starved take COULD NOT RUN
aterm-capacity: the interrupt test reads the stand-in's wait line whole
aterm-capacity: the reservation test's stand-in looks once and ends with its test
aterm-capacity: drop the reservation's kin arm that counted already covers
aterm-capacity: a waiter whose claim file is removed ends its wait, writing its grant once
aterm-verify: --admit's help says a quiet wait is bounded
aterm-lab: the windowed verbs' help says a quiet wait is bounded
aterm-conformance: the rewind step row's standing leaves out the take's wall
aterm-capacity: the removed-claim-file test runs on unix only
Remove handoff retirement entries omitted by the v0.140 producer
aterm-link: hold B07's narrowed start to a law: once an attach is admitted, a power cut never reads the clean stop (B07r)
fabric\_world: handoff\_cost times what ships, and measures the start B07 still orders (B07r)
fabric\_world: the earlier-boot start test refuses a record whose boot is not 32 hex digits, rather than rewriting it to one no reader parses
aterm-link: the admission law's rename fault fails an ordered start too, and the law checks it did (B07r)
aterm-link: LastRun and begin\_run state the start's tier with every condition open\_tier keeps (B07r)
fabric\_world: handoff\_cost names astream's test mark, removes it, and fails on a timed line that took plain fsyncs (B07r)
Name each strip tab's own theme to screen readers past native and mixed tabs
Fingerprint the tab strip by its canonical active tab everywhere
aterm-http: a .local name Linux cannot resolve says what resolves one
stats deck: a Folded strip slides a cell a reading, on slots between the readings
Commit sign-in observations with their audit history
Bind the policy model to the shared snapshot validator
disk-free@v1: a draft at a background break gives the pick back, and a shared checkout's builds are said shared
disk-free@v1: a draft that stood at a break holds its tab through the agent's own wake
Settings rail: every row reaches a screen reader, and ScrollIntoView scrolls the rail
Native controls: a resting control's rim holds 3:1 against its ground
Harness: opening a Timer moves nothing already whole on the screen
settings\_preview tests: the jump-knob test compares cards by runs and plays the scene in order
Cursor rings: Ring on jumps draws a ring on dark and on paper
Cursor rings: the rim finds the caret's cell as the veils now do
Lint: System State's list needs no mut; apart\_by reads pixels as arrays
Harness: showing all of Decided for you re-lays none of the rows shown
aterm-phase: measure Claude Code 2.1.310's /login and lost logins; readers hold on both builds
Read Claude Code's fullscreen /login panel and make roster edits news
Bound and gate the roster watch; leave the fullscreen /login pick to a person
abrew: fetch prints brew's headings and per-download confirmations
Only a person at the Mac's console changes it (SAFE-1)
SAFE-1 review: no vault look, no read for nobody, a switched-away screen
aterm-secrets: creation tests write a private import file, whatever the umask
sysprobe: read reaped-children CPU and a zombie's final CPU; sweep parents first
vitals: reap credit — a tab's CPU is its members' live and reaped time
models: ReapCredit, bound to the ledger by a window that dips
Reap credit: the words, the designs and the measurements
vitals: a member gone with its parent leaves its pending one reading only
vitals: format the ledger's listed-but-unread test
Keep pane shortcuts in their receiving window
aterm-capacity: grant cores as a fair share of the room, not the idle cores
aterm-capacity: name a grant's parties as claims of cores not yet admitted; hold a NaN load to the load unread
abrew: upgrade prints brew's summaries and says nothing when current
secrets: a second admin is for good; the Linux hint survives the transport cap
DECRC puts a saved wrap back wherever the column lands; two vt\_oracle exclusions retire
A saved wrap a resize left mid-line takes the next column, not the next row
Format the review fixes and keep the slot's wire flags newtypes
Fleet: a reset at connect is a listener between generations; ai::cli tests read no host PATH
Keep native UI and tab-move shortcuts in their receiving window
machines: keep unrelated fact reads off live device search
fleet test: bound peers are survey's first host tier
fleet test: trustfmt the merged ambiguity block
Keep the front tab in front when a mixed tab's terminal projection grows or a restore stages
Restore staging lifts only a tab it built; a reopened aterm.toml leaf gets a view of its own
Stage a reopened config-editor leaf in a new tab, beside a plain aterm.toml too
harness(look): only the OS's key window is a look, never a ctl focus report (v6 slice 11a, round 2)
doctor: the report first, on stdout, reading only what the words name (DOC-1, DOC-2)
doctor: the packages read is in before the develop rows; Enter is read only in the foreground
doctor: the Developer Tools hand-over waits for a person at the Mac's console (SAFE-1's presence)
abrew: fetch --deps also downloads build dependencies
Recover live login observations with their history
Read recovered account snapshots under one writer lock
Keep ordinary account reads side-effect free
Borrow the lifecycle fixture row without cloning
aterm-effects: precompute Duration constants and unroll hot loops in kitty\_pet, pet\_world, rainbow\_kitty, host, and cursor\_glow/custody
sim B02: the simulated broker answers astream's conditional retire
aterm-link B02: give a departed session's subjects back with astream's conditional retire
aterm-link B02: a session's exit owes the reclaim however it left
B02: a fabric world gives a closed session's subjects back; the budget's texts say so
sim B02: the reclaim scenario's exits reach the bridge on the push lane first
aterm-link B02: a reclaim read the ring refuses keeps the link up
fabric\_world B02: wait for the reclaim's end state, not a budget read between retires
SPECS B02: the subject-budget row names the narrow ring's latch and its test
aterm-link B02 review: no address routes to a sid its node does not advertise live; the reclaim looks for another node's departures, holds a row behind a moot retire, drops pins it left, and latches only a refusal for good
B02 review: the budget's texts say what goes back and what stays
aterm-link B02 review: the reclaim's read of its lanes is a method whose test seam returns early
secrets: one-fetch join, a refused join password re-asked at once, one-click admin approval (SECR-1, SECR-3)
secrets: read a join verdict before each long-poll, keep a join's proof before its POST, password new only at a terminal
secrets: format the review fixes
init: a join password an admin Mac refuses is asked again at its verdict, not at the 6 s window's end (SECR-3's init hook)
Retain source content for window-creating shortcuts
Recover tap roster publications before selecting login paths
doctor, init: time every row and phase (LAB-1)
lab: mac nux, the first-run rows in macOS guests (LAB-2)
lab mac nux: a log record's newline (U+FFFD in aterm.log) reads as a space in a cell
lab mac nux: the rows and cells the brief asked for, each run's own phases
build cache: a nested targo drops the OUT\_DIR cargo run set for its parent
aterm-effects: unroll hot loops and inline helpers across cursor\_glow shading, bed, probe, and ink\_ledger
disk-free@v1: credit the session whose cleanup clears the volume
disk watch: a development seam for a lab window on a volume of its own
lab: disk-ask, the disk-free@v1 ask end to end with real Claude Code
lab disk-ask: hold the lane's geometry at compile time; tippy's lints
disk-free@v1: the volume's name gives way before the asked tab's own build
lab: a home image comes down only with its scratch
lab disk-ask: read every transcript, require the tab's own mark, prove the cooldown
kitty: a late seat starts its rest from the seat; a wake keeps its seat
kitty: a cat waiting for the writing to reach it waits at rest
kitty: seats near the writing for the head law; rest beside the composer line
kitty: a flight follows the caret's rows; the cat rides its box down
kitty: a program's hand-off of the caret is waited out before a flight
kitty: the paste test walks its draft by byte index
kitty: chrome laid while the cat flies or rests is landed clear of or hopped off
kitty: a row change behind the flight is taken, its column kept
kitty: a row hop's gather stands up when its row came to it
kitty: a cat seated under the writing stays seated
kitty: a veil already lifting lifts on as the cat leaves
kitty: a coil a lone jump's settle will hold is whole from its first tick
kitty: the first key takes a flight's landing to the escort's row
kitty: the typing tests read the harness's rest by main's host-line law
kitty: only the writing or a settled caret seats the cat under the box
kitty: a sleeper an edit sends home goes back to its sleep there
kitty: no slide to the far margin while the caret is on the move
kitty: rows that carry the cat are ridden, not hopped off
kitty: tests for the walked caret's reach and the rule that carries the cat
kitty: a rest seat goes with its caret
kitty: the seat under the footer rides the composer down
kitty: a gather whose target came back near stands up
aterm-ctl: ctl's --timeout is one deadline over a driven await task's legs
aterm-agent: every fleet init and join waits for this machine's listener to serve its key
fleet join: a refusal whose cause is on the joining machine names its remedy there
aterm-ctl: a survey --sid whose peer did not answer says why first
drive gate: usage lines name what spawn admits, and a bare unhosted sid gets the no-session answer
fleet: a refusal that reaches another Mac names machines, never "here" or "this Mac"
hold: a selector gets the form hold takes, not a bare ERR denied
ctl help: exit 2 is told apart by its cause, not by words exit 1 shares
aterm-ctl: a survey --fleet --sid that missed a peer leads with that peer's cause
fleet: an init or a join waits for the listener of an aterm running here
fleet join: a join the issuer's leave ended names the leave's remedy
drive gate: a hold under a selector gets the form hold takes
await task over a drive: the last leg's rows are the peer's, and an unserved handshake exits 2
SPECS: usage-lines-agree-with-catalog names spawn\_usage, not the removed SPAWN\_USAGE
accounts: Store::bounded\_by in every build, so release builds compile again
aterm-link: the standby bridge takes the state dir the moment the holder lets go (H1)
fabric bench: the handoff's text says the standby is woken by the release (H1)
aterm-uds SPECS: ready::either's row, and exit-moment waits through it (H1)
aterm-uds: asleep, the call a thread of this process sleeps in, as the kernel has it (H1 review)
aterm-link: the standby test reads the take asleep in flock(2) from the kernel (H1 review)
fabric README: B's handoff rows start after its take, so they are read as bounds (H1 review)
aterm-uds asleep: no allocation while the probed thread is suspended
standby tests: hold\_state\_dir's own take is read queued on the bridge lock (H1 review)
aterm-uds asleep: a descriptor's file read by fstat of the number, not a dup closed after
Retain native tab identities across queued callbacks
init: stream rows, one tally line, three lanes, one question, shared setup records (INIT-3, INIT-8)
init review: no question, grants that fail nothing, records held over the Desktop lane (INIT-3, INIT-8)
abrew: autodetect naked cask downloads like brew
Match native tab test compilation to its callers
abrew: GitHub git-checkout casks fetch as raw blobs
fabric bench: the handoff reads the successor's pid file from the quit on, so a take before 'gone' is timed
secrets: an admin publish refuses to strand this Mac's older approver
aterm-effects: promote GlowStyle::jump\_reach and supernova shade probes to const fn, add kitty duration constants, and replace hot-path iterator loops
style(harness): format the repaired claim fixture
aterm-effects: promote kitty\_pet seat/console helpers to const fn and replace hot-path iterator loops (batch 247)
abrew: deps gains brew's runtime warning; pin/unpin take any count
disk tier 3: a dangling installed link fences only the place it names
Keep the person's front tab and pane focus through background closes
CHANGELOG and SPECS for the background-close front and focus fixes
Close a view from behind without syncing it to the front first
Name the close-from-behind route in the background-close row and changelog
Hold the kept front and the person's focus through every close from behind
Check the deferred split close gives the tab back the focus it borrowed
Scope the background-close row to native closes and name the focus it keeps
Give the background-close focus clause its palette exception; scope the changelog to native closes
aterm-durable: Flush::dir\_best\_effort on astream-sys's dir\_flush\_unavailable; atomic\_file reports EIO
Directory flushes: each writer's policy explicit on the one classification
atpkg vendor\_direct: each\_replace\_names\_its\_flush expects Windows's directory note
aterm-uds: ConfigEdit::replace says an edit whose directory flush failed is in effect
Cargo comments, README-astream: astream-sys as os.cordon and this branch have it
aterm-durable: import DirFlushed in tests only where its tests compile (cfg(unix))
aterm-gpu: record wgpu-dx12's frames on WARP before the D3D11 flip
aterm-win32: Direct3D 11, DirectComposition and DXGI 1.2+ slices for GW.5
aterm-win32: LoadLibraryExW and wgpu-dx12's clamp sampler filter for the D3D11 arm
aterm-gpu: first-party Direct3D 11 arm draws armed readback frames, byte-identical to wgpu-dx12 on WARP
aterm-gpu: the armed D3D11 arm composes headless presents and their taps, byte-identical to wgpu-dx12
aterm-gpu: the shared replay fixtures live in a test file by the census's rule
aterm-win32: CloseHandle, WaitForSingleObjectEx, WAIT\_OBJECT\_0, DXGI\_STATUS\_OCCLUDED and DXGI\_USAGE\_SHADER\_INPUT for the D3D11 swap chain
aterm-gpu: the D3D11 arm's window swap chains: flip model, DirectComposition, scRGB, the frame-latency waitable and the removal latch
aterm-gpu: the D3D11 arm's EDR present, half-float identical to wgpu-dx12, and hdr\_gate's laws on it
aterm-gpu: Windows presents on the D3D11 arm; wgpu becomes the wgpu-oracle feature there
aterm-lab windows: a new install's IME capability is checked after the restart that completes it
aterm-lab windows: the plan's tests hold which capability states the two IME steps accept
aterm-gpu: the WARP record drawn again by wgpu-dx12 on the merged tree
aterm-win32: the generated files resealed after the merge with main
aterm-forge: OB-12 reads a patch only an oracle lane uses as live outside the cells, not dead
aterm-gpu: the heat scene's haze gets a blank row to rise through, and the WARP record holds it
aterm-win32-oracle: com-slot-inserted anchors on IDXGIOutput6's GetDesc1 alone
aterm-gpu: GL's effect-layer test draws the shared heat scene, so it compares a live haze
aterm-win32: type ID3D11DeviceContext's VSSetShaderResources slot
aterm-gpu: a removed D3D11 device fails the fx atlas's growth, not the process
aterm-gpu: the D3D11 arm reads B5 round 3's glow item lists
NOTICE: aterm-win32's d3d11.rs and dcomp.rs name their windows 0.62.2 upstreams
docs, aterm-gui: Windows presents on D3D11 in the help, the lane and the design
aterm-gpu: take the WARP record again from wgpu-dx12 after main's knock mask
aterm-gpu: every frame the D3D11 window's wait takes ends in one present
aterm-forge: OB-12's lane-only note says what reaches the patch, not a guess
aterm-release: aterm-win32's Trust floor 13/177 -\> 16/197
Keep tab context-menu preparation in its source window
harness test: a claim refused before admission spends nothing
F1/C1 (PRIV-1): read each wrapper's flags by its own grammar, failing closed
F1/C1 review (PRIV-1): leave redirections and here-documents out, close on a substitution or a quoted env -S string
trust: aterm-render 1790/20905 under …; aterm-gpu's 811 of 812 is the clock's
trust: aterm-gpu meets 812 on the merged tree; the moving row is padded\_row\_bytes
trust: aterm-render keeps main's 1588/20903; 1790 was one high-water run
aterm-render: incoming\_strip subtracts without a guarded overflow assert
trust: TRUST-PROVER's record holds the landing tree's runs and the review's corrections
trust: TRUST-PROVER on main …: aterm-gpu 937/5151, aterm-render undecided
trust: TRUST-PROVER on main …: aterm-render 1638/23568 and aterm-gpu 817/5025, both open
abrew: outdated prints names by default, brew's verbose form on -v
abrew: missing reports brew's recursive gaps, one line per package
init: an unread grant's row reads as one sentence; the INIT-3+8 guest runs recorded
Pet: a tick that ends a sleep starts what it draws there, on every path
Pet tests: typing sweep types like a hand, wider doze sweep, idle cost
Pet: the front seat holds only a body its step landed on; a wake sweep
Pet tests: a run Reduce Motion stops closes its window
Pet tests: witnesses for the console trip and the seat's hair
Pet: a settled body is judged over the letters without its rest rhythm
Pet tests: name the partings fixture's type
Pet: four edges a wider sweep found on the merged tree
aterm-effects: replace slice/range for loops with while loops in word\_decorations
secrets: the server and subscriber survive a full disk, a crash and a join burst
abrew: linkage is brew's LinkageChecker display, test and reverse
aterm-effects: replace slice/range for loops with while loops across bakers, cursor trails, harness card, and tone
Settings: the narrowest window keeps the column its words fit
Settings: a centred label's padding gives way to its widest word
Settings: Messages lists its filters a row at a time in every width
Themes: the chooser pins its filter only over room for its tallest row
Themes tests: one Community heading at the narrowest windows and at 2x
Settings: a short window gives its list the room chrome can shed, never more than its page
Settings tests: the status bar tests stand at 178x348 again
Settings: a field placeholder no first words fit takes its fewest lines
Settings: Packages' hero gives way at narrow widths, its actions say less
Themes: the page's name pins over the chooser only over its tallest row
Settings: a short window's toolbar scrolls away where its row cuts a control
secrets: a repair keeps the subscriber on the aterm its job runs
secrets: member removal follows Commons control, not the custody marker
grok signin: aterm approves the page itself first, and asks a person last
grok signin: hear a stop on every rung, hold the rung to the machine's lock and the row's email
atpkg: abrew's linkage helpers are its tests' alone, and a keys() loop, so tippy passes
aterm-link: set the retention rules with no flush first, and cut test logs as the broker does (B04 B0-B2)
fabric world: the broker's own tick cuts under live traffic and every reader reads on (B04 B3)
fabric world retention\_live: assert the link never moved, and scan for the retire refusals the bridge prints (B04 review)
fabric world retention\_live: name the planted controls as run (B04 review)
init: keep a no-vault look only for another vault's signed answer
install.sh opens the app it installed, so the ALab tools start at once (NUX-1; BUG-1 audited)
install.sh bounds the app's open and keeps the launch line for a run cut before it (review of NUX-1)
aterm-render: a font named at a variable font's instance draws that instance
config editor: the file's name stays whole; the caret's place gives way first
config editor: the help line wraps onto its own rows, as the footer does
Manual reader: the share read counts what the page has shown
aterm-render: automatic styles take a named primary's weight and name what they draw
aterm-gui: a chrome face that finishes loading redraws the native views it would ink
aterm-render: a role name in another style's row draws what it names
Settings preview: the font caption names the display faces it draws over
aterm-gui: installing the chrome fonts redraws the native pages drawn before them
aterm-render: an instance no fvar record names is called by the style it draws
Manual reader: Next is off once the page shows the document's end
config editor: the help line always shows what the setting does whole
aterm-gui: each repaint function keeps its own doc comment
Settings: a style row naming a face of another style says what that face is
config editor: a listed completion's label fits the room its button paints
Settings preview: every text style's caption names the display faces over it
config editor: font\_variation and the dark nudge say a named instance ignores them
atpkg: abrew's linkage helpers left test-only after the classifier rewrite
abrew: autoremove prints brew's headline; specified-name helper
abrew: cleanup honors HOMEBREW\_NO\_CLEANUP\_FORMULAE
Hand only the window an edit tab closed in to its caller's tab
recovery census: the ledger row lands before the node log's prev\_end
abrew: list --full-name and info JSON use brew's specified names
aterm-sysprobe: read P\_NOCLDWAIT and each process's session id
aterm-vitals: reap credit marks what it cannot count, and keeps a tab's id with the tab
aterm-vitals: the shared-pane test spans the share, so ids by pane alone fail it
aterm-vitals: mark the step whose member's tail a live unread parent holds
Reap credit docs: say only what the ledger does, with the second review's measurements
aterm-machines: name an agent by aterm-agent-names, not aterm-phase
Cargo.lock: aterm-agent-names at 0.142.0, the version this release line carries
_1 further change is not itemized in these notes._

v0.141.02026-10-26

aterm v0.141.0

2026-10-26 · 237 changes since v0.140.0

Fixes

pet: the resident cat walks on top of the composer's upper rule, never under it
pet: the stand over the composer's rule is a perch near the caret, never in a rule; a skid and a leg's stand keep their floors
pet: the slide's reach never calls back a cat already standing past the letters; the escort-grace test ends on the perch
stats deck: a Folded strip glides 1 pt a second, so the default window is seen moving
pet: every schedule draws the same pet: a glide lands on home's pixel, a rhythm run asks for frames, a woken tick moves nothing
init: publish setup markers after file preparation

Performance

effects: replace Option closure helpers in ribbon, witness, spine, bed, and ink\_ledger
effects: inline Option/Result/iterator closures and single-pass veil/oracle scans (batch 231)

Tests

pet: the switch replay's off list infers its tuple (tippy type-complexity)
system-state: expect calm cached status after Cancel
read the cursor's glow streams whole, ramps and quads together
pet: the dense sweep holds both hosts' rest clocks together at each edit; changelog says what the pet fix costs
pet: the pet-paced trail laws read copies as the 16 ms host does; the wrap law checks its bound's own landing
handoff: v0.140.0's producer fixtures, written by its own cut
main's two 0.141.0 verify fixes, carried onto its release line

Other

System State: the signals agree with the rows (round 19 fixes)
Keep default-account adoption in owned fleet sources
Gate Unix-only launch-tap test import on Unix
Guard the Unix harness prelude in platform builds
Refuse new account labels that retain local authority
Check provider data isolation around the shared sign-in lock
aterm-db: DbDiscoveryReplacement's waiver host is a public hidden fn, as the other environment hosts are
Acknowledge dispatched pointer actions when frame readback fails
aterm-gui: the deck's live edge after review: a scale at the default window, at most 4 live frames a second, a live line that outranks the stalled one
aterm-gui: the live-edge merge's lint findings
Fence additive account sync against retained labels and active sign-ins
harness: a wall's answer is asked per agent; Grok Build is an aterm ai connection, off where nobody installed it
disk-free@v1: deliver at background breaks, hold for lasting withholds, credit aterm's own passes to aterm
disk-free@v1: judge the background-break line on a fresh status read, keep the awaited act, keep a wall's withhold at background breaks
machines: git runs that change a ref start no automatic maintenance
setup: a stop during the Command Line Tools install still ends the run, and an unasked tab's failure stays quiet
setup: tie the install tab's quiet failure to the tick's own ask; a fixture commit starts no maintenance
aterm-gpu: a video take's finish never waits on its conversions, which run optimized and side by side
aterm-gui: a headless window takes the size resize px asks for, both forms resize with Settings in front, and a tab brought to the front is laid out
aterm-gui: a native page's focus and scroll keys are timed to the present of the pixels they changed
aterm-gui: a quit nobody started at a window is not held by a Settings draft nobody can answer
aterm-gui: an aterm that is not its account's own reads no fleet, and lists its own tabs
aterm-gui: one missed probe keeps a host's last address, SSH banner and round trip
aterm-gui settings: Tab Control's live rows keep the height they were laid out at while the person reads
aterm-gui settings: pin that a computer listed above the screen moves nothing on it
aterm-gui: move\_native\_focus calls focus\_native\_control as main now spells it
aterm-gui settings: Tab Control keeps each live block's room under its own words, so no line in a row moves
aterm-gui: the cluster's new tests check what a resize answers and that the page says why, not their exact words
Hold sign-in admission through checkpoint recovery
aterm-effects: promote stardust centre pricing to const fn and inline hot-path Option/bool closures (batch 220)
Expose every recovery mutation to the specification sweep
Capture the fleet test listener key before spawning
secrets: a vault path in a missing folder names the folder
aterm-effects: reuse icon\_scratch and inline Option/iterator closures (Batch 221)
aterm-effects: inline Option/iterator closures in rainbow\_kitty witness and ribbon (Batch 222)
System State: settle every ALab widen Apply; a Cancel after a Restore holds like any Cancel
System State docs: a Stop holds off the ALab review for the run it stopped
System State: the newer page's Local Network row reads unknown, tested as drawn
Preserve account authority through local relabeling
harness: spawn agent=grok names Grok Build as a worker, refused until its turn end is read
harness: name the Grok sign-in gate's type; fix two Grok tests' compile errors
Keep cancelled launch reviews calm after immediate reopen
Recover interrupted account syncs from durable admitted images
Schedule interrupted account commits before unchanged or offline sources
Keep sync auxiliary output away from account authority
Require roster preservation after auxiliary sync failure
Keep failed saves editable and align palette Copy ownership
Retain failed-save evidence while documents remain editable
render: a glow stream carries ramps beside its quads (card-engine B5)
render, gpu: draw a glow stream's ramps natively
effects: Rainbow Kitty's ribbon and meteor trains lay ramps, the guard reads them
gui, web, bench: every glow-stream reader takes the ramps
gpu tests: Rainbow Kitty's ramps draw their quads on every arm
render: a ramp runs on only below its last row, at its span, with nothing laid between
effects tests: read the glow streams as quads through a fold seam
gpu: a glow stream whose light adds draws its quads as glow instances
effects: the streaks' beds and ink bodies lay ramps
effects: comet slabs lay ramps, each core one light as tall as its rows
effects: a ramp's run keeps its ends once
effects: ramp readers walk the kept rows, not every pixel row
style: format the ramp readers as trustfmt lays them
lint: hold the ramp code to tippy's warnings
gpu: the heat shimmer reads the additive stream's ramps
core, effects: a ramp's damage words carry its run, its place and its kept ends
effects tests: the v2 frame-cost gate times the ramps a shipped build lays
render: each\_laid walks a stream as Lights, not a Result
effects: the particles stop where their stream's lights fill it, its ramps counted
effects tests: clear the frame-cost drivers' scratch as two statements
effects: the letter guard reads a ramp's rows as the quads they stand for
bench: the effects harness reports means and the ramps' lights and rows
glow ramps: a run rides a ramp only where its lights pay
spill: the band reads glow ramps without expanding them
icon shade: word icons shade glow ramps without flattening them
gpu: ramps open the fx stream only where their lights repay it
render ramps: a band reads only the ramp rows that meet it
letter guard: ramps cost the quad path nothing they do not use
rainbow kitty: name the test's RampCost by path
effects harness: an icons scene and the shares of ramp and fx frames
glow ramps: the measured break-even and fx opening costs
verify browser: hold the cursor glow's ramps to their quads through cell.glsl
bloom: an item list draws the extract set with no ramp row expanded
gpu: the bloom and its crowns read the glow ramps as an item list
gpu: a ramp stream keeps its order where adds round on store
verify browser: the comet's additive ramps through the bloom and its crown
gpu-web: the lane's crown field lives in the wasm dev build alone
ramps: a band's rows convert without a cast; trustfmt over the lane
spill test: the run's middle rows read as one range
ramps: a dark light stays its quad whatever the cost
ramps: GlowRamps::open and extend\_last are test seams
icon shade: a ramp stream nothing reaches costs no copy
effects harness: the glow ramps' sweep knobs reach the release build
aterm-gpu: one fx gate for every frame, art included, measured per arm
aterm-render: lay a beam's runs on their ramps directly, no fold after
aterm-gpu: parity beside fx art on every arm; unmeasured arms draw instances
browser lane: the glow's ramps beside fx art, through cell.glsl in Firefox
aterm-gpu: the routing comment names what the gate weighs
B5 round 3: the cost sweep's points, and Metal's art term fitted from them
aterm-gpu: the wgpu oracle's Metal backend gets its own measured route costs
effects harness: the glow host's pipeline stays in its owner's field
B5 round 3: verify fmt --fix
B5 round 3: laws for the guard's rails and the pet's veil over ramps
B5 round 3: the rails law passes lint; verify fmt --fix
aterm-effects: promote const fn helpers and inline hot Option/bool branches (Batches 223-225)
Keep explicit account aliases and authority across fleet relabels
Stop System State review countdown on empty menu edits
init: ask about a secrets vault only where one answers; a vault join never holds init
init review: a look only where the workstation layer runs; Ctrl-C at the trust question stops; --vault refuses a pin the vault does not answer to
init: --vault refuses a flag as its value (aterm init --vault --plan names no vault)
init: say what the vault look overlaps (reading the Mac, not the base layer)
Recognize the guarded native menu interaction boundary
Settings status: a status too long for the dock's row scrolls there, nothing pressed moves
Settings: the reload warning wraps as every status does, in its bar and in the dock
Settings fields: a field too narrow for its hint's words marks itself with a dot
Settings: Page Down before a page's first frame steps by that page
Settings tests: the wheel test reads a short status docked, taking no room
Settings: a page key lays out only a list no render has laid out
Settings tests: the wheel test reads a long path's status docked too
Settings lists: a screen under a status's bar ends on the next card's peek
Settings lists: the list's end leaves no row cut to nothing under its caption
Settings lists: Tab reaches a looping preview listed with the rows
Settings lists: the end rule reads a row's name beside its control
Settings lists: a looping preview is a Tab key of its stop, not its layout
Settings tests: the reload warning test asserts its fit failures
Settings: a page key waits for a layout at the window and text size it acts in
Settings tests: the 220x12 Tab sweep focuses the search as main's focus call now asks
Settings tests: the 220x12 Tab sweep names the view main's focus call now checks
Settings status: a bar stops over the control the person pressed
Settings toolbar: the keyboard on Search's Cancel keeps the search open
Settings status: a bar held over a press keeps its room for its status's life
Settings lists: a last screen gives up a stop it would draw nothing of
Settings lists: a list's Tab stops are the page's, one rule for both
Register the menu interaction fence at the permission input boundary
aterm ctl --host turn: read its timeout= with the verb's own option reader
drive gate: a hold's refusal names the bare sid a hold takes
aterm ctl --host survey: refuse survey words that name their own machines
aterm ctl survey: ctl's own --timeout bounds each fleet peer's read
fleet join: a code that reaches a member says so, not that the issuer refused
aterm ctl: one exit code per cause; a drive refused while its issuer is silent exits 2
aterm ctl --host: exit 2 means one cause, a handshake no aterm sent, at the issuer and the peer alike
fleet join: the issuer's refusal of its own node is worded for the joiner
turn help: a leading -- ends only the leading options, so option-like text needs -- --
aterm-effects: promote const fn helpers and inline closure combinators in cursor\_glow and cursor effects (batches 226-229)
ai login: over SSH a CLI's own sign-in runs off this machine's desk; a Codex wall under the host is nobody's, pinned
ai login: the no-desk sandbox is macOS's, as the doc now says
ai login tests: formatted
Refuse account rows that inherit another login directory
Expose directory model bookkeeping through the public account module
Fix three mixed-tab route-parity defects: move, close hold, bloom clip
Keep each close's line in the resize ledger; name Collapse's real sites
Take the ledger's last resize row with rfind (tippy double\_ended\_iterator\_last, filter\_next)
aterm-verify: the GUI smoke ends its instance's whole process group
aterm-conformance: an instance's drop ends the helpers it started
aterm-verify: the GUI smoke's group reads no terminal and is recorded as it spawns
System State waits for a live tools installer before opening another tab
aterm-capacity: refuse a memory need at or above physical less wired
atpkg: aterm pkg capacity prints the memory that can ever be available
aterm-release: the Trust plan refuses a claim not below what can ever be available
aterm-lab: a VM boot above what the Mac can ever have available is NOT RUN at once
aterm-release: hold the Trust launch gate to the plan's bound
aterm-capacity: give the NEVER-REACHABLE test's admission wait a hang detector
atpkg: the capacity memory line says --admit now still starts a claim
grok sign-in gate: one sandboxed, deduplicated Grok sign-in per machine before any Grok TUI starts under aterm
grok sign-in gate: harness-repos D22 and aterm help pkg say how a Grok launch signs in
needs: read Grok's machine sign-in through an exhaustive Program match (census agent-gate)
grok sign-in gate: fix the review's problems at their root
atpkg SPECS: the twin-prelude row states the grok sign-in block; its two tests map to it
atpkg: the grok hand-off test names each ATERM\_NO\_HARNESS reader, and never reaches a real aterm
grok worker floor: a login grok refused starts no worker (grok\_signin::login\_accepted)
aterm-link: fabric on --dry-run judges the secret as the real run will; a bare --secret-file is named as given; help, SPECS and CHANGELOG say what is refused
aterm-uds: a directory open by its mode and by an access list is refused, not narrowed
aterm-link: the secret-file-private row gives each directory clause its real kind; mint and broker help name the whole rule
aterm-uds: the mode-first mutant's comment names what it really breaks
aterm-link: mint help says an access-list ALLOW entry is refused; a deny entry passes
Keep close recovery and rename commands with their input owner
disk-free@v1: credit a seat only with its own checkout's builds, and never say a listed holder is none
disk-free@v1: a seat whose directory is gone holds no checkout's builds, and pin the clipped holder
aterm-effects: promote const fns and eliminate closure/iterator overhead in hot paths
sim B01r: the model is aterm's retained broker, and each drift B01 fixed has a control
sim B01r: the headers a prune cut, the LAST\_PAGE\_MAX page, and the SPECS row
Bind the installer identity guard to standard paths
Recover account renewal publication with durable commit receipts
Keep model fixture anchors distinct on stock compilers
Format renewal recovery regression fixtures
Assert atomic renewal admission in ledger failure tests
Match test helper availability to their platform callers
Limit Grok sign-in fixtures to their supported test platforms
harness: review fixes for grok-alab contract v3 (live-build twin hand-off, scoped claims keep the needs)
aterm-effects: promote const fn helpers and replace ribbon/witness/stardust iterator closures
B13 WIP (parked after a usage-limit stop): oracle widening and aterm engine fixes in progress, not reviewed
Preserve cursor input ownership across window focus changes
Cover focus report ingress and preserve measured before and after trails
sim B01r review: a seeded world serves unretained too, and each found bug is reached again
sim B01r review: the journal replays every tier with the mirror off, retained and unretained
sim B01r review: every drift B01 fixed has a committed control, and the headers say what the code does
sim B01r review: Opts::seed's retention bit by is\_multiple\_of (tippy manual\_is\_multiple\_of)
Keep editor buffer selection and Find Copy with their resolved target
init: a repository clone leaves the disk watch's floor free
System State: the repositories row says when the disk has no room for the rest
init: a first-launch pass that leaves repositories for room keeps the reason
harness: admit a Grok worker sign-in first; refusals name their cause
harness: the slog why tiers name the launcher's two words; the install test's mark reads what it holds
Recover interrupted account commits at operational pool reads
Use range patterns in account recovery fixtures
aterm-gui: an image job boxes its metadata, so no platform needs a large\_enum\_variant expectation
Commit pool decisions and their ledger through durable receipts
Keep custom worker login classification independent of pool budgets
verify cells: a cell whose std no toolchain carries names verify provision as its fix
init: no clone below the floor for an unsized repository; first launch names its own remedy
aterm-effects: promote harness\_card helpers to const fn and hoist luminance tables
aterm-effects: promote clip\_quad and near\_word\_icon to const fn and hoist droplet luminance
gui: keep a seamless handoff's files for the lab's carry sweep (6I-4, A11, B23)
lab: seamless's privacy leg sweeps the carry an update writes (6I-4, A11, B23)
lab: the carry leg reads the waiting post, the typed line and every listed name (6I-4, A11, B23)
lab: the carry fixture's mail line in the encoder's order, so gitleaks reads no key (6I-4, A11, B23)
Commit explicit account selections against current policy
Record fenced selection semantics and design review
Align launch and CLI regressions with durable account reads
Keep diagnostic navigation and Settings recovery with their input owners
Recheck queued login intent and preserve deferred selections
Keep the original login parent through fallback admission
aterm-gui: drop the five Gemini retirement exceptions 0.140.0's producer made stale, on 0.141.0's line
aterm-gui test: the debugger step's stand-in reading stays fresh for the hang detector, not five seconds

v0.140.02026-10-25

aterm v0.140.0

2026-10-25 · 274 changes since v0.139.0

Features

supervise: a development seam on the wait past a wall's reset (6I-4, B21)

Fixes

harness: refresh missing passive Codex restart snapshots
harness: exhaustively gate passive snapshot repairs
notify: read queued delivery policy at submission
agent: a session the endpoint hosts rides the endpoint's token under any spelling (6I-4, B21; U4)
slog: a whole bus view counts mail from its newest snapshot (6I-4, B21; U23(d), D4)
harness: a relaunch into its shell's own directory needs no cd, and bash reports the one that does (6I-4, B21)
link: the bridge's state files are the owner's alone (6I-4, B21)
aterm: the review's widening is macOS code, tests included (6I-5, B21)

Performance

effects: replace iterator chains and divisions across word\_decorations, cat\_baker, and kitty\_cursor
effects: replace iterator/closure chains in cli\_marks, companion\_look, nova, supernova, and harness\_card
effects: promote aos\_momentum helpers to const fn and inline hot loops
effects: inline hot-path Option closures in rainbow\_kitty and cursor\_glow (batch 218)

Refactors

notify: expose the delivery queue to host tests

Tests

harness: cover passive Codex snapshot recovery
notify: cover settings changed behind transport setup
fabric\_world: the owner's ask, end to end, on private instances (6I-4, B21; U33, U36)
fabric\_world: the owner's ask holds each leg to what the plan says (6I-4, B21)
harness: a bash line that changes directory opens with the trap's simple command (6I-4, B21)
handoff: v0.139.0's producer fixtures, written by its own cut
three races 0.140.0's release verify lost under load

Docs

say what the default verify cells checks now

Other

aterm-keeper: code\_dir\_in names the keeper-code folder under a given home
aterm keeper tests: start the keeper's one-minute wait once its copy ran, and keep an unrun copy
harness: back out of aterm's own /login over a roster row and wait on its sign-in
harness: Esc again at a dialog still drawn, back out late, discover before /login
test alerts: reproduce resolved notice after authorization wait
test alerts: cover queued intent lifecycle cancellation
Revoke queued desktop alerts when their intent ends
disk-free@v1: hold a walled or boxed session out of the round, keep an ended host's nominee for its successor, say when no line went
disk-free@v1: a held pick goes back to the episode once, the board dates a wall by the loop's reset, a held record ends with its episode
aterm-gui: a scope's first sys disk is owed roots, not zero
aterm-conformance: the spin gate bounds every loop wake, and a window row runs AppKit's loop
aterm-lab: a daemon that exited and is not yet reaped is gone, not foreign
aterm-lab: say observe\_daemon also preserves an unreadable pid, and note the exit window
Retain account binding publication evidence and refuse lost snapshots
aterm-gui: a mixed tab steps the cursor companions it feeds
aterm-gui: a mixed tab's link caption follows output under a still pointer
aterm-gui: a native front lowers the scroll-pill latch
aterm-gui: a mixed tab charges the GPU's acquire wait to the shed latch
aterm-gui: a mixed tab's untitled terminal titles the window by its cwd
aterm-gui: a mixed tab arms no prediction it cannot paint
aterm-gui: route-parity review fixes: native-focus song, hover key, sharper tests
aterm-gui: the mixed pet test reaches the settled pet's effect-lane deadline
aterm-effects: replace iterator chains and promote helpers in kitty\_sing, pet\_baker, trick\_flash, dog\_cameo, and typed\_tricks
aterm-effects: promote momentum admission/halo helpers to const fn and replace closure chains (batch 201)
aterm-grapheme: a name breaks after its hyphens and keeps its extension
aterm-gui: a preview header says a whole statement or none, in a band that grows with its type
aterm-gui: a stacked bar button says a whole form on one line before it wraps
aterm-grapheme: a hyphen starts a line only to save a word no syllable can split
aterm-grapheme: a word too wide for its line breaks at a syllable before it is cut
aterm-gui: the cursor preview's floor holds its prompt row at any text size
Preserve pane recovery after deferred document saves
aterm-gui: the automatic font size is the font size's default
WIP: unfinished fixer work, cut off by a usage limit (not reviewed)
aterm-render: a variable styled face draws its role's instance, not its fvar default
aterm-gui: Top Settings rows say Changed and offer Reset, as every page does
aterm-gui: a slider row takes an exact value typed into it
aterm-gpu: a prepared face keeps the weight it was prepared at
aterm-gui: the preview names the number it draws, not a refused draft
aterm-gui: one row anatomy, no one-form RowForm; the design says a slider takes an exact value
Route native split scrolling to the pane under the pointer
Keep the dispatcher bypass mutant on the sanctioned caller
aterm-vitals, aterm-gui: a disk balance that leaves out an unmeasured root reads as a bound or unavailable, never a bare zero
fleet listener: a \[fleet\] change cuts only what it takes away, and a grant drives once written
fleet drive: a granted node the copy does not bind is checked against the issuer's book
fleet --host: one deadline covers the issuer's book read and the dial, and says when the issuer is silent
fleet words: may keep the secret, another secret by role, own node refused, turn waits that work
fleet listener: a change made while a connection is admitted refuses it or cuts it
fleet drive: a granted node proving another key than its grant is refused with no read
fleet --host, allow drive --from: a silent issuer leaves the host its share, and only it says try again
aterm-effects: promote m4/m6/tone/int\_bag\_mlp helpers to const fn and unroll iterator chains
Bind login observations to the current account before recording readiness
Enumerate every login observation fault for the model checkers
Check retained usage with its recorded source and timestamps
Keep Claude login aliases distinct from provider identity
Refuse unchecked Claude login with an explicit identity expectation
Match account menu usage to the canonical provider identity
Preserve an unlisted default account login alias during sync
Check roster key refusal without pinning diagnostic prose
Guard Claude renewal publication with current roster policy
Complete renewal policy fixture setup and record verification
Fix advertised editor buffer focus through live keyed activation
Keep the editor control event import in its test module
effects: const-promote spec colorway parsers, trail\_sound lane allocators, and streamline trick/pipeline loops (batch 204)
aterm keeper tests: judge the keeper's start in two waits and keep every unrun copy
Stage plain account logins and recover only under current policy
Drop the obsolete pre-recovery roster snapshot
Exercise recovery fixtures with explicit uninitialized profiles
Read persisted rosters in synchronization tests
Read the published roster in login synchronization fixtures
System State: spent retries stay spent, no for-good kind, a token look instead of a minute's reread
effects: const-promote MatrixRain::tile and OutputStreak row/comet helpers, and streamline rain/streak/pet\_world loops (batch 205)
Fence pooled usage publication and launch against changed policy
Carry a coherent pool snapshot through usage polling and launch
Assert safe refusal independently of usage error wording
aterm-verify: read the release aos step's refusal as the bundle's client prints it
aterm-conformance, aterm-verify: a row the subject has no answer to is named, and fails only HEAD's build
aterm-conformance: a subject that books no rewind-shown sample has no answer to the step row
aterm-verify: the measuring decision's spec row and verify list name what the code reads
aterm-effects: streamline cursor bodies, classic wake, and pet stroke/baker
aterm-effects: a dozing pet's offer skips the steps of z's the ink hides
Test consent notice cancellation across authorization waits
Revoke queued consent notices when their conditions end
Qualify the consent fixture owner type
Bind pooled usage cache freshness to its login context
setup: first launch opens a tab that installs Apple's Command Line Tools
setup: the Command Line Tools tab waits for a quiet pass, and an interrupted install cleans up
Align accessibility focus and Rewind Copy availability
Editor: preserve pointer IME focus and report prompt capabilities
System State: a revision's page the record says came up stays down
atpkg: page markers are replaced whole, never truncated in place
System State: judge Developer Tools as it opens; Full Disk Access keeps its revision's step
atpkg: a flush the volume refuses no longer drops a page marker
System State: an ask the window's own step carried is judged when the step is refused
atpkg: a failed flush keeps the page marker; a refused one falls back to fsync
aterm-gui SPECS: the waiting step carries the ask it holds in its place
System State: the control verb's ask that rides the step keeps its own quiet moment
System State: a page with no revision leaves the revision's step waiting; riders keep their run
System State: a page wait no nearer look shortens; a late marker holds the step
devtools\_helper: came\_up's doc names which lane's marker comes late
System State: the access record falls back to fsync where full flushes are refused
aterm-effects: streamline cursor\_glow hot-path loops and option dispatch (batch 207)
Editor: expect reverse Tab to skip blocked prompt commands
consent markers: an ordered marker falls back to fsync where full flushes are refused
Remove Gemini CLI support: agy replaces it
aterm-gui: a zoomed mixed tab draws its terminal leaf instead of panicking
aterm-gui: a mixed tab's busy terminal is not closed unasked
aterm-gui: a mixed tab's scheduler wakes for what its frames draw
aterm-gui: a glassless mixed tab's native leaf takes the pointer
aterm-gui: a headless capture prepares the message band for every front
System State: the first-launch review says what Apply does, a newer aterm reads, each thing once
Attribute System State presses to the pane reached by routing
Keep native left-press capture ahead of an older terminal button
Retain a token refresh when its observation worker cannot start
Keep Command Line Tools requests bound to their setup revision
Separate installer run eligibility from carried access approval
Inspect countdown descriptions in review interaction tests
aterm-toolchain: a wait for a named lock is marked where a ceiling reads it
aterm-capacity: a waiter marks its wait until it is admitted
aterm-lab: keep ATERM\_WAITS so a ceiling sees the lab's waits
aterm-release: an interrupt at the Trust launch gate names the wait
aterm-verify: the per-check ceiling times a check's work, its waits left out
aterm-verify: an interrupt leaves a waiting child to its handler and still names the wait
aterm-verify: say why the measuring matrices' waits are left out of the ceiling
aterm-release: an interrupt names the launch gate's wait only while the gate holds the check back
aterm-verify: SPECS rows for the run and the ceiling say what the work ceiling does
Persist renewal generations independently of labels and time
aterm-effects: streamline kitty\_pet and console\_life math and loops
disk-free@v1 round 5: wait sentence, take-over before the pass, hold and draft held, DiskLow only when short
disk-free: keep a successor's held records through its pass, name what holds a tab
aterm-effects: streamline kitty\_cursor, pet\_world, and word\_decorations
aterm-agent: the newer account models' scenario and case-picking actions are waived, and Fresh is bound
Merge origin/main onto the account-model waivers
aterm reads Grok Build's own OSC 7501 report; its screens wait on a measurement
A carried Grok Build report restores as Grok Build's
a11y: a mixed tab publishes its terminal leaf beside its native leaves
a11y: the spec row says when a mixed tab's tree is the composite; placement is checked both ways
aterm-effects: streamline word\_decorations, dog\_cameo, and kitty\_sing (batch 210)
System State: a Cancel holds, a close is not this launch, ALab widens only by review
Bind interrupted account recovery to its durable parent generation
Invalidate recovery parents on non-renewal binding changes
Import the retired-worker refusal in Windows spawn tests
Record recovery model and native verification results
Refuse renewal publication without a bound login directory
Recheck setup installer readiness before its tab takes focus
Fence sign-in result publication against replacement login generations
Stop superseded authentication retries and bind summaries to their attempts
Capture each batch renewal and route probe independently
occupancy: the wake's fact kind, its need latch on the wire, the heard row, a declared hold
occupancy: the loop reads the book under observe: wake@v1 decided, ranked, would rows, heard
gui: the loop's read of the book hosts the session; a met wake reads its session ready
aterm-slog: append wake@v1 to the closed fact\_rule words
aterm-slog: format the fact\_rule words assert
occupancy: hear every answer in a hosted session, by the screen read's wall; told wakes stay the book's
atpkg-publish: pin no harness while an older client reads the index; pack one only from its repo's main
atpkg-publish: the harness pin gate names the releases as they stand (v0.135.0 lacks the rule, v0.136.0 has it)
aterm-gui: the gained-rows test stops saying the 150 % launch's band was those rows
effects: streamline nova, supernova, cursor styles, and pipeline helpers (batch 211)
aterm-render: the knock mask holds the share it cuts; re-record the ABI replay
aterm-effects: Trail length reaches Fire's leaps, and the engine says where it stops
aterm-effects: a light Comet jump's ink is as long as the path it laid
aterm-gui: the cursor scene's completion is a leap, and its header reads the engine's reach
aterm-gui: a custom node's painter datum is never what a screen reader hears
aterm-gui: a Recovery page's blank lines are not spoken
aterm-gui: Settings search decides its reach once per query and what it reads
aterm-gui: the preview-copy spec row names today's header verdicts and tests
aterm-effects: emit\_dark\_bed keeps its own doc and too-many-arguments allow
codex tap: compare client versions only; a package names one only where both its versions name one build
subscribe: a content read that pushes nothing opens no pace window (first key echo 20 ms -\> read at its ring)
descriptor limit: a cold launch makes room for the tabs it opens (0.138.0 refused its 30th tab at launchd's 256)
Recheck selected account policy for every vendor sign-in
Model policy admission across successful and failed sign-in outcomes
Format the expanded sign-in policy conformance cases
Make every sign-in policy mutation discoverable by the verifier
a11y: a native tab publishes the window chrome it paints
aterm-effects: a pet changes what it draws only at the edges it offers
aterm-effects: branchless math and const polish in cursor\_glow (batch 212)
Back out of aterm's own /login dialog nobody needs instead of asking a person
Judge a login back elsewhere alike at the picker and the hand-off; narrow the close-dialog claims
Gemini CLI removal: refuse an older lab's gemini tab, sweep the retired command
aterm-primer: format the retired-command test (trustfmt)
System State: a cancelled scenario, the page after the first launch's review is cancelled
effects(rainbow\_kitty): use const float math and pattern matching across spine, stardust, meteor, ribbon, and witness
Keep System State quiet across installer and review lifetimes
aterm-gui: a key's echo is timed from its write, and an echo that beats the arm is caught
Editor: preserve toolbar text carets and gate modal actions
Keep the quiet editor text anchor in the accessibility focus regression
Retire retained document scenes when conflict and recovery state changes
A Grok Build tab showing its own report is not filed as a Codex; D24 decides the measurement route
Give AccountRenewalGeneration's AllowedPublishes a mutant: a renewal refused under a clock set back
Format the AllowedPublishes control (trustfmt)
aterm-effects: inline Option predicates, constify helpers, and avoid libm transcendentals in hot paths
editor: a reload from disk keeps the caret, mark and scroll on their text
editor: a change of the rows the viewport shows is not a document change
markdown reader: lay out, scroll and paint with one measure at every text size
config editor: the footer paints its whole diagnostic and the header measures
markdown reader: the wide outline fits its column by its rows' heights
markdown reader: a block the preview cuts keeps its panel open at the cut
config editor: the footer keeps the diagnostic's message whole at 32 columns
markdown reader: the outline test borrows its runtime
Fix Commons rediscovery after repeated listener restarts
aterm-gui SPECS: chunk notes name the machine-status row, not the retired card
aterm-gui: the one-draft Discard button is named for what it does
aterm-gui: staged security postures keep the host's one privacy gate
aterm-gui: the t=t deletion rule takes its temporary directories
aterm-gui SPECS: chunk 20's count note says the doc comment was removed
aterm-gui: the posture catalog stages \[privacy\] check = false too
aterm-gui: the stand-in press test compares the row, not its age
aterm-toolchain: interrupt::Watch ends a wait on SIGINT, SIGTERM or SIGHUP
aterm-toolchain: an interrupt ends a wait for a named lock
aterm-capacity: an interrupt ends every wait for capacity, each tool's NOT RUN
aterm-toolchain: a second interrupt after a wait took one is sent again
atpkg: an interrupt while a run is measured ends its disk claim
aterm-capacity: interrupt stand-ins die with a failed test
aterm-verify: one interrupt in a timed stage's quiet wait ends the run
aterm-lab: a run that is ending waits for no further claim
fleet allow: a grant says every member reads at content, and its take-back names the level the Mac had
aterm ctl --host: --timeout bounds the drive's handshake, and a handshake that never comes exits 2
survey --fleet: a read that dials no other machine says why on stderr
fleet peers add: refuse an IPv6 address but ::1, as init and join refuse that --host
fleet join: a --port that is the issuer's own is named as that
survey --host: a word read as a host keeps that dial's whole reason after the issuer's silence
fleet: every verb that takes a node word refuses this machine's own place as this machine itself
fleet allow content: a take-back that leaves content says every member still reads it there
aterm ctl --help: reflow exit 2's paragraph after the --host sentence
aterm ctl --host: a reply cut at a shorter --timeout is said as that --timeout's, not the peer's
fleet: a book that lists no peer says that, one copy, not that no member has joined
fleet allow content: "still reads it at content" only where the members read it there before
Revalidate prepared account moves before returning relaunch commands
aterm-gui: re-bless v0.139.0's carried-state/layout corpus answer
setup: the Command Line Tools tab waits for quiet keys, Ctrl-\\ stops cleanly, and a want withdraws at once
setup: the Command Line Tools tab's landing recheck waits out typing too
aterm-effects: constify trail\_sound and cursor\_momentum helpers and avoid libm in synthesis
aterm-verify: verify cells checks every forge cell but this machine's own
Exercise supervisor text in the fabric privacy sweep
harness: a no-response retry is cut only when its try crossed the sleep; 2.1.310 retry rows measured; 3 s re-probe after a wake
harness: refuse an uncarried no-response row before the reach check
aterm-phase: the no-route fixture's scratch path names no agent scratch uid
Revalidate prepared account launch environments
aterm-effects: inline Option closures and mutate scroll/row state in place (Batch 216)
aterm-db: DbDiscoveryReplacement's waiver host exists only where its waivers do
Check Claude identity when adopting an aliased default login
Native press: a press's time is an input, so the double-click test states its interval
Every run of presses measures its interval by the press's time
Double-click tests: a press on the switch's on button and a strip press from a Settings page
aterm-gui: the Label-in-Name count check exists only where its debug caller does
aterm-effects: mutate kitty/word timestamps in place and inline Option closures
harness(tap): a fixed-size carry value, a recorded drop, a footer that asks for room, and launch taps through the managed twin (R-14)
harness(upgrade): name the parsed-options type (clippy::type\_complexity on walked)
scroll: a mixed tab's glide and bounce ask for frames only when a row moves
scroll: a glide step asks for its frame against the offset last drawn
harness contract v3: the roster, scoped claims and grok-alab as the Grok tab's program
aterm-gui: the claim literals main added since carry scoped: None

v0.139.02026-10-25

aterm v0.139.0

2026-10-25 · 187 changes since v0.138.0

Fixes

aos: R2 review fixes: a key aterm does not see echoed stops the recording

Performance

effects: promote raster/reading helpers to const fn and precompute forge luminances
effects: borrow cached star pieces and bitmask stardust ceiling quads
effects: memoize meteor station and burst inks and hoist ribbon table lookups
effects: replace iterator chains in rainbow\_kitty meteor and witness
effects: replace iterator chains and add const fn helpers in pet\_world, companion, kitty\_pet, kitty\_registry, and host

Tests

host\_live: a notice typed into a starved agent lands whole and upgrades it
host\_live: a starved agent's notice tail outlasts the host's echo settle, and its controls match the old budget
control: a starved program's wait spans several looks, and a paste past the cap is waited for
handoff: v0.138.0's producer fixtures, written by its own cut

Docs

describe the restore re-grid that waits for the size a show brings

Other

aterm-effects: precompute exact Duration constants and optimize witness/keep\_out/scroll passes (batches 175-176)
aterm-wasm: re-record the ABI replay for the effects batches' rounding
System State setup records: Stops hold through damage, newer records are left alone
aterm-effects: const fn custody/spellings helpers and dyadic Duration thresholds (Batch 177)
Add read-only account reference diagnostics
aterm-effects: hoist reciprocals and dyadic Durations in emit/spawn/cursor\_glow (Batch 178)
db: reserve pinned resource shares through Commons
Ignore obsolete save completions before host bookkeeping
aterm-capacity: import GIB only where Reading::of\_gib is built
aterm-release: the Trust lane's memory model follows the prover and each check claims its peak
aterm-capacity: a memory need of all the RAM can never be admitted
aterm-release: a Trust lane claim the gate can never admit is refused or starts at once
System State: one signal for a failure, a waiting Restore leaves the page live
System State docs: digest-only setup facts, retries wait, a waiting Restore yields
System State: format the round-16 fixes (trustfmt, whitespace only)
System State: a reading that failed while the run retries says what comes next
System State: a launch's setup aterm retries is headlined as waiting
aterm-effects: the pet keeps its console reading of a screen that did not change
aterm-effects: the pet keeps its reading across a refill that re-extracted no row
Make fleet leave and fleet allow say only what their write ended
Give a hold-off for a Mac out of reach one conditional, never "stands until"
Read the issuer's book afresh before a member refuses a --host word
Judge a turn into a program with no command blocks by its screen
Say in turn-submit-verification how a press with no block is verified
Read the issuer's book for a survey --host within the survey's --timeout
Say which allow writes cut no drive, and why leave may not name the issuer
Keep the no-integration turn test from riding on a 2 s echo
aterm-capacity: a claim's measured writes, relief before a wait, and run footprints
atpkg: a heavy run's disk is claimed, relieved and waited for before it starts
atpkg: machine cache plans, and machine apply removes, the retired verify gate's leftovers
aterm-verify: a run that builds claims its disk before it starts
aterm-capacity: a footprint under a GiB is said in MiB
atpkg: a short volume is reclaimed for only when the build cache is on it
aterm-release: a trust run claims its target root's disk before its checks start
aterm-lab: a Linux or Windows lane VM boot claims its disk until its run ends
atpkg: name the relief's parts' types, and format admit\_disk
aterm-lab: name the boot claim's admitter type, and format it
aterm-capacity: a claim made inside held work waits for no claim of its ancestors
aterm-capacity: a kind never measured claims its cold budget less what its directories hold
aterm-lab: a VM boot claims its disk before it waits for the lane, and takes --admit
aterm-release: ship trust run --admit now takes its disk claim at once
atpkg: a disk wait names only the run's and the build cache's directories
atpkg: the gate's snapshot goes by one git worktree remove --force
aterm-lab: admit\_flag's comment says what it returns
aterm-effects: promote spend\_crossfade to const fn and precompute pet Durations
accounts: verify Codex identities and preserve explicit login aliases
aterm-gui: a restore owes its re-grid only for a size still to land, and pays it with every tab
aterm-gui: a carried full screen's re-grid waits for its own size, timed from its entry
aterm-gui SPECS: restore-close-regrid states the full-screen commit and entry laws
aterm-effects: promote spec/pipeline/word\_decorations helpers to const fn and precompute durations (Batch 181-182)
Focus the matched editor when reopening a restored document
disk-free@v1: find a session's fitness at every turn break, record a lost line before resting, adopt a barred pick
disk-free@v1: find a session once per decided turn break, drop what it was once it works, bar a managed worker by its record
Rewind R0b review fixes: folds name their view, no Claude glass or writes over the past, sleep-counting ticks, colours-only folds
aterm-capacity: a need's memory margin is asked of the room, never reserved
aterm-capacity: a need can name the checkout it runs for
aterm-lab: a lane VM's boot is admitted, a dead run's VM is stopped, guest jobs follow the grant
aterm-capacity: a claim is credited with its VM's processes, and a caller can stop its wait
atpkg: capacity shows the processes a claim is credited with
aterm-lab: an interrupt ends a VM's wait for capacity, and a booted VM's processes are credited to its claim
aterm-lab: a booter record names the boot it describes
Restore the cancellable first-launch setup review
Keep accessibility review actions explicit before Apply
Keep newer setup records terminal across startup recovery retries
Expect quiet retirement when Stop covers a bring-forward error
Retain the first setup click when interaction stops its countdown
aterm-effects: precompute phaser/card constants and bitmask matrix rain/card indices
Accounts: a roster row's sign-in menu and another CLI's wrong account ask no one
Accounts: a sign-in menu after a move is the moved-to login's own, and the move's relaunch is made at it
db: persist resource intent before single-attempt adapter dispatch
Settings pickers: a caption names the rows under it, and no screen ends on a band
WIP: unfinished fixer work, cut off by a usage limit (not reviewed)
Settings pickers: a caption names the rows under it; what follows fades in
Themes chooser: every stop stands on whole rows, so its end meets the list's edge
Themes chooser: the open Community section repeats its caption like every section
Settings lists: the last screen never seats a band of blank over its rows
Themes chooser: wrap the grid's doc comment to the page width
Themes chooser: Follow system's name stands over its switch where it would wrap beside it
Settings lists: the last screen draws no band over its rows, its run's caption over whole ones
Themes chooser: the open Community disclosure heads its rows, COMMUNITY repeats past them
aterm-effects: replace power-of-two modulos in trail\_sound and supernova
db: check Commons enrollment eligibility before challenges
aterm-effects: precompute eye reflection spans and tighten baker/look helpers
db: inspect cached Commons authority without initializing state
aterm-effects: precompute pet TTL Durations and hoist mote reciprocals
Cells: build each macOS- or Unix-only test helper only where its tests run
Select the original tab when reopening a closed pane
Preserve the front input owner during background pane recovery
upgrade: a pressed notice waits out a starved agent's echoes as a hang, never a render budget
turn: a typed turn's wait for its program gives its time back, and a guarded submit waits for its last key
turn: a guarded submit's tail is drawn once its cursor row matches the guard, the caret left in place
turn: a hand comes back from its own turn with the time it had left
accounts: preserve unreadable state and withhold unsafe choices
accounts: let Result carry the menu read-use warning
accounts: give the login fixture a known state directory
aterm-capacity: a quiet claim covers its holder's descendants; the quiet bound is per core
aterm-conformance: the paint bench runs in aterm.app's band; the matrices start on a quiet machine
aterm-verify: timed stages and perf lanes wait for a quiet machine; each time line carries the machine
aterm-lab: a windowed instance and the Linux lane's GUI rows start on a quiet machine
aterm-capacity: the quiet bound is 2.0 a core, measured with verify measure
aterm-verify: a run holds one quiet claim from its first timed stage to its last
aterm-verify: the arena and fabric lanes pass over --admit
aterm-conformance: the matrices' quiet claim lives beside the shared runner
aterm-capacity: a quiet holder's child is admitted under its claim on a busy machine, through the ledger
aterm-lab: one --admit admits a run's quiet and disk claims
aterm-verify: a run's --admit now reaches the Linux lane's lab
System State: admit an unreadable-vault startup Join without the Join; say Join refusals calmly; show a waited Restore restoring; read a newer aterm's setup beside a damaged record as newer
aterm-effects: precompute dyadic hint Durations and avoid TypedStamps array copies
kitty: a touchdown, and a seat a caret move deals again, hold their pose
kitty: a hop never hands back a wake's stretch with no time left
kitty: a jump along the row never cuts the wake's stretch
kitty: a landing's skid ends on the stand as it is at touchdown
kitty: a program's burst of caret moves is one flight, to where it settles
kitty: a mid-line insert wraps in one flight, from the next line
render: under-text sprites sit on the under-glyph light, both renderers
kitty: writing that runs past a landing touches down
kitty: a flight goes on to the row the caret moved to
render: a companion stands in front of the light under the words, both renderers
kitty: comments state the behaviour, not the day it was found
render: the knock-out cuts the body back to what lies under it
render: the knock cut never reads a glyph plan kept from another frame
render: a letter's change repaints the cut it makes in the body above its row
kitty: the landing comment says the skid ends on the stand at touchdown
kitty: the caret's coil holds through a repaint that arms the stream watch
render: the knock cut blits each glyph's ring once, built once per glyph
render: a body's knock cut is kept for its art's content, not its address
kitty tests: a type alias for the generating take's flights, is\_multiple\_of in the regrid test
render tests: the trail judge's note says the knock-out cuts the body round a letter
Retain evidence when account state snapshots go missing
aterm-core: a chrome row over a scrolled-back viewport is undone, so an unchanged frame refills scoped
aterm-core, aterm-gui SPECS: test the live Shift undo; the retention row states the scrolled arm
System State: classify every setup failure as transient, needs-you or for good
System State: format the failure-kind change and bind the sign-in test to GitHub's read
aterm-effects: streamline ink\_ledger, letter\_guard, icon\_shade, and bed loops
Check account records before starting sign-in work
Serialize legacy Claude sign-ins with the shared machine lock
Keep the front input owner during closed-tab recovery
aterm-effects: promote coil helpers to const fn and streamline pet/word\_decorations loops
Stats Deck: the refined glance where Details shows (prototype)
Stats Deck: the strain gauge in the cores block's slot (prototype)
Stats Deck: T-G2 holds the gauge's box to the layout
Stats Deck gauge: the needle's taper is straight, as the sketch's path
Stats Deck glance: Full wide and mid at every width, and nowhere else
Stats Deck prototype: "now" beside the live dot in Full wide and mid; the bezel draws soak^1.36
Stats Deck prototype: Full mid says the glance's amount before a state word
Stats Deck prototype: the Folded deck draws the gauge at its top left and says the glance
End cancelled setup attempts and consume accepted vault passwords
Recognize the native key interaction handler in the consent fence
Keep macOS event proxy clones from waking an idle loop
Keep the post-save account claim fault fixture readable
WIP rewind R1: forks of tiered replay engines, a bounded replay restore, the hand-back and shell auth carried
WIP rewind R1: steps by second and command, past scrollback, copy and find over the past, changed-cell search, track, export, a11y slider, effects pause
WIP rewind R1 tests: command, second and sync steps, changed-cell search, scrollback, drag copy, review fixes 5/6/11/13, a11y slider, export
WIP rewind R1: tab menu timeline rows, verb catalog, help topic, rewind measure bench
WIP rewind R1: fork cache tests, save-panel export keeps the folder's mode, step-to-shown metric, SPECS and docs
rewind R1: the bench reads metrics percentiles; As built (R1) in §14.5 with the bench, red and windowed numbers; gallery paced
rewind R1: forks carry the hand-back with cast\_drift's control restored; marks test on the fixture clock; Done::Shown boxed
aterm-effects: promote Ribbon::slabs\_for to const fn and streamline rainbow\_kitty loops
Refuse redirected account locks and keep release anchors portable
aterm-window: a unit test holds a macOS proxy clone to no wake and a shared retain
aterm-win32: the scRGB tag's two swap-chain slots held to DXGI on a live chain
aterm-gpu: dx12\_swap\_chain's SAFETY note states every precondition again
aterm-win32: scrgb\_live says its HDR10 answers are DXGI's, measured on WARP
aterm-gui: the occupancy wakes' unix- and macOS-only pieces are gated where they are used, so the Windows cells lint clean
aterm: the bound setup review asks macos\_doctor about a newer setup on macOS alone
aterm-gui: the Rewind R2 review tests' key count is unix-only, like the two tests that read it
aterm: one newer\_setup check for the setup steps, macos\_doctor's on macOS and never elsewhere
aterm-effects: streamline ribbon, meteor, and stardust hot loops and bitmasks
Complete Markdown editor handoffs on open failure
Document Markdown editor completion and validation
effects(cursor\_glow): inline emit slab bounds, hoist luminance LUTs, and simplify poof/ellipse scans
Hold managed worker launches when account selection is refused
Exercise pin release after a newly observed limit
Retire closed setup reviews before reopening System State
Correct init help for the first-launch review
aterm-agent: the account models' scenario actions are waived and StatsOnly is bound

v0.138.02026-10-25

aterm v0.138.0

2026-10-25 · 283 changes since v0.137.0

Fixes

keep handed claims and policy stable through the Commit write
mark supervisor stops under the final Commit guards
agent: bound agy's footer usage fetch whole; prove the version probe's scripts ran
effects: retain partial trail identities when typed echo returns
atpkg: keep brew compatibility native without Homebrew fallback
atpkg: fence legacy brew backends and normalize recovery commands

Performance

effects: hoist reciprocal multiplications across cursor\_glow, thermal, spawn, ribbon, spine, and companion
effects: hoist reciprocal multiplications across rainbow\_kitty meteor and stardust
effects: hoist reciprocal multiplications and const Durations in kitty\_pet
effects: precompute baker aspects, promote bed/ribbon helpers to const fn, and hoist reciprocals
effects: precompute const Durations and reciprocals in rainbow\_kitty and cursor\_glow

Tests

fence acknowledged alert clears at the handoff Commit write
call the exported metadata handler in the handoff witness
keep an adopted told box from posting a second program notification
agent: prove agy's usage stand-ins ran before the bounded fetch meets them
handoff: v0.137.0's producer fixtures, written by its own cut

Other

aterm-effects: precompute head-feather knots and promote cursor\_glow helpers to const fn
Scan fragmented control replies incrementally
Keep a missing requested rainbow inconclusive in trail galleries
aterm: the refused-answer Stop test reads its revision without racing the Stop's save
aterm-effects: O(1) exclusion\_span fast path, const COMA\_PETAL\_UNIT, and const fn meteor/stardust helpers (Batch 149)
aterm-capacity: one reader of the machine and one ledger of claims on it
aterm-agent: the disk watch reads its lines from aterm\_capacity::floor
atpkg: aterm pkg capacity, the machine's capacity and every claim on it
Cargo.lock: aterm-capacity at the workspace's 0.136.0
aterm-capacity: credit a holder's process tree once across its claims
aterm-capacity: the volume's floor is the one the window's disk watch holds
aterm-capacity: name a held ledger lock, read the account's own files, test figures
Take every drive grant out wherever the fleet level drops below drive
Keep a displaced node and its remedy inside a survey row's reason
Name the node that refused a drive at its recorded place
Name an unusable fleet.key's remedy once, as the join that replaces it
Say a listen place another node holds is one this listener cannot bind
Cut every peers column to its width, its ellipsis included
Say what an aterm running here does, true when none runs
Keep read\_fleet\_key unix-only beside the held-place line
Write no grant a read finds backed, and name why the rest go below drive
Print a peer's address and version whole in fleet peers again
Keep a readdressed node and its remedy in a reason beside an IPv6 place
Name no rotate a member cannot tell from its issuer's leave and init
Count a wildcard listen as another node's place only on Linux
Drop the asserts that pin one phrasing of what an aterm running here does
aterm-vz: a helper an earlier build started is asked to Stop, not read as no helper
aterm-cli: drop the System State status reader nothing calls
aterm-effects: const fn deadline solver & squared reach in kitty\_pet
Rewind R2: effects history, repair off the main thread, code=safe, the watcher, privacy, aos ls/export/check
Rewind R2: pin Safe's frame wake against Shipped's, and name the vivid tests' outcome
Rewind R2: one-sentence item docs, and the measure row's result in As built
aterm-effects: precompute SETTLE\_STEP\_FACTOR and promote KittyLook::for\_app and PetBrain arc helpers to const fn
System State: a retry waits, a Check is a note, no dead Turn On…
System State: the projection test's brand node reads as VoiceOver speaks it
aterm-agent: a session record counts only while the process that wrote it runs
aterm-uds: SPECS.md says what the scans and the output drain now do
System State: preserve newer Local Network observations
System State: retain local changes made during the last retry
aterm-uds: the set-user-ID top tests kill top when they fail
aterm-vz: a real-kernel test holds the detached Start's wait to may\_run
effects: precompute dog\_cameo/comet/beam/streak/tone constants and hoist reciprocals
Use propagation for the Commit suspension reservations
Keep deferred setup actions behind the current recovery rule
Preserve queued box receipts across Native handoff
Keep old output checkpoint coverage explicit about local episodes
Exercise inherited box receipt at first unhonoured sweep
Keep held-pane fixture free of box receipts
Retire inherited box receipts with their gated projection
aterm-effects: promote int\_bag\_mlp::check and matrix\_rain/pipeline helpers to const fn
Rewind R0b: a read-only past view of a recording pane (design §14.4.2, §14.8 R0b)
Rewind R0b: a frame with no open view builds no extra plan; paste withheld before its sheet; the render test's border and ragged rows; the spin row's two arms
Rewind R0b: no capture draws the pet, words or streaks over a rewound pane (D13)
lab codex-measure: measure a new codex-alab build in one command
lab codex-measure: read the step testdata as HEAD holds it, undo on every exit
Scope the synthetic Full Disk Access recovery test to Unix
Discover and subscribe to Commons tables by default
Refresh the account audit against live readiness and current login tasks
Keep Unix-only test imports and stand-in labels out of Windows builds
aterm-effects: promote cat color context, baker slot, and flash helpers to const fn
Keep Close shortcuts and terminal Find controls in their owning scope
Make portable test fixtures compile on Windows
Scope Unix export-test imports and record command validation
Match banner handoff methods to their Unix callers
Compose parallel platform-fixture corrections
Scope the Rewind tooltip to native menu consumers
Keep Rewind socket-test imports with their Unix callers
aterm-agent: a question key or policy text the worker has not drawn is not sent again or handed over
aterm-sysprobe: the start and thread-handle tests hold a translated child to Rosetta's facts
aterm: host\_live's upgrade probe and relaunch read wait on what the product records
System State: preserve retry evidence through unreadable inputs
System State: an unreadable vault config holds no setup; Restore waits for a short lock
System State: what aterm heals by itself is calm, and no press is dropped
aterm-toolchain: a lock file that names its holder, and a wait on it
aterm-lab: a held Linux or Windows lane waits for its holder and names it
aterm-release: a second trust run on a held target root waits for the first
aterm-toolchain: a lock's record says since it was had, and never fails the take
aterm-lab: an interrupted lane wait is NOT RUN naming its holder
aterm-release: a trust run that waited for its root resolves its prover again
aterm-verify: a held Linux lane is waited for, not a NOT RUN cause
aterm-agent: a line that types a store binary carries its shim's env
aterm-agent: a store binary's long line drops the survey switch, never the updater switch
aterm-effects: precompute droplet phase tables and promote nuke/word\_decorations helpers to const fn
harness: the usage tap's reading reaches the accounts store mid-turn
SPECS: the busy tap's row counts and silent-mark wording, from review
v6 6b: This Mac says landing for a held Land, and the Overview says landed once
v6 6b: verify appkit reads This Mac off a real status item's menu
v6 6b review: L7's This Mac want never passes on -; the wait order is tested; the drive reads here\_line
effects: simplify luminance lookups and hoist reciprocal divisions (batch 156)
System State: a read that met a write keeps the page and the window's own admission
aterm-effects: precompute FLAME\_LEVEL\_LIGHTS and promote flame and park helpers to const fn
Rewind R0a review fixes: witness coverage by seq, byte-free edges, batch-clock limits, chain-scoped refunds
Cells: build the startup retry only on macOS, where it and its one test run
Measure codex-alab 0.165.0-dev.13665 with lab codex-measure
aterm-cli: an observation of the setup records that met a write is taken again
Keep tab shortcuts attached to their receiving window
Remove the obsolete front-window tab selector
Compile the startup retry helper with its macOS callers
disk-free@v1: hold an episode to its recorded floor, and release a done pick
disk-free@v1: review fixes: parked episodes give way, inode margin, one seat rule
harness: read Claude Code's auto-mode offer in panes 35 columns or narrower
harness: read Claude Code's auto-mode offer in panes down to 16 columns
sys jobs: the groups a nested shell runs under wait on its command, a second shell by the block nearest its birth on the probe's clock, a pager by its /dev/tty, the wait channel cut at its clone suffix, an event loop's feeders upstream (review round 30)
Run account and contact proposals on the default Commons database
Preserve proposal request restrictions across retries and control recovery
Model early refusal and both recovery restrictions in replay scenarios
Scope startup retry state to its macOS implementation and tests
Require the new application protocol in both handshake directions
Preserve healthy co-writers through portable control quarantine
Bound proof repair across both retained source pools
Reconcile invalid quarantine evidence without releasing unknown liabilities
disk-free@v1: hold the line for people, keep picks across updates, count every line
disk-free@v1: pass over sessions that are theirs, leave a successor time to adopt, never a third line
harness(land): the open-work reader returns the sentence each word stood in (v6 4a)
harness(land): the open-work reader's phrases quote what held the word (v6 4a, review round)
aterm-release: credit only a run's new backstop stops, and file the clock only for a starved run
aterm-release: an unknown floor run is not an empty one, and a starved run's cancelled checks are the machine's
aterm-release: the clock summary names the credit, not new stops
System State: preserve recovery ownership and run history
Keep Stop ordered with a repaired startup review
Cursor trails: looks7 M1-M11 closed or explained, Solarized Dark in every capture
Cursor trails, looks7 round 2: paper Enter tracer, Solarized beds, pet veil
Cursor trails, looks7 round 2: the pet's veil reads the texel the stamp draws, and feathers no deeper than its cut
aterm-effects: the stamp-coverage law builds its art in 4-byte chunks (tippy)
Cursor trails, looks7 round 2: the pet's veil counts every texel the stamp draws
aterm-effects: name the stamp's texel reader (TexelAt) for tippy's type\_complexity
Cursor trails, looks7 round 3: Solarized rails, gold moons, lit-page air light
Cursor trails, looks7 round 3: tippy fixes
Cursor trails, looks7 round 3 review: a chosen colour keeps its chroma, the pet's veil on composed frames, the paper tracer from below
Import inert account source documents atomically over Commons
repo\_work: PROBE\_LIMIT is each read's hang detector, not the probe's budget
run: REPO UNREAD says what an unread repository probe means
repo\_work tests: starved reads run the probe's own clock, so the guard binds the fix
repo\_work: the probe reads beside the loop, which renews its claim and sees its stop between asks
repo\_work: an unread repository is one its probe could not read, everywhere it is named
aterm-gpu: a headless GL device tries every EGL device before the surfaceless one
aterm-lab: the Linux lane's GPU instance on krunkit (lab linux --gpu)
aterm-lab: a baseline's present line names GPU rendering where a GPU drew
aterm-gpu: a headless device's refusals reach its error, and the fall-through has a test
aterm-gpu, aterm-lab: name the renderer the GL arm's windows draw on
aterm-lab: only the GPU instance syncs before a stop, under the guest's timeout
aterm-lab: the GPU instance's Wayland GL draws on zink, not llvmpipe
aterm-gpu, aterm-lab: trustfmt the review round's fall-through test and renderer reader
aterm-effects: precompute eye ratios, hold Durations, and reciprocal scales (Batch 161)
Exercise queued setup intent at handoff park and Commit
Keep queued setup intent alive until handoff can preserve it
merged\_plan: Disk's unit ladder lives in disk\_grid, so the cells' stable rustc agrees (6I-3, B20)
aterm-gui: the deferred Set up now test follows the retries-by-itself rule (6I-3, B20)
temporal: one expectation on fidelity\_at, none on what it reads, so the cells agree (6I-3, B20)
aterm-gui: the verified-grant recovery test is Unix only, as its seeded verdict is (6I-3, B20)
host\_live: the fake's read that returns no byte is no key; a space is logged as space (6I-3, B20)
Reproduce ribbon identity loss when a key joins a partial redraw
aterm-effects: constify ripple/nova/supernova helpers and hoist reciprocals (Batch 162)
aterm-lab windows: a new install's IME capability is checked after the restart that completes it
aterm-lab windows: the plan's tests hold which capability states the two IME steps accept
System State: a Stop declines a widen, an explicit apply admits its run, a Restore keeps an older pass and a choice after it
System State: a choice after a Restore, a busy lock and Local Network keep the person's answer
Preserve Commons authority across vault signer rotations
lab: decline Codex WebSocket probes before scripted POST replies
Exercise an exact reported median at the seamless baseline bound
lab: compare reported seamless medians in exact units
Borrow owned metric tokens for the exact decimal parser
aterm-effects: promote trail\_sound/rainbow\_kitty\_v2 helpers to const fn and hoist reciprocals
aterm-gui: another user's process keeps its birth from one reading to the next
Explain Commons readiness without inferring network absence
System State: records that keep changing never end the window's own admission
aterm-gui: a live deck frame lays the deck out once and patches only the text over its rects
aterm-gui: a kept deck draws what a fresh layout would, and a deck turned back on lays itself out
aterm-effects: promote harness\_panel/harness\_card helpers to const fn and hoist reciprocals
Retain Commons history across local pin and directory loss
Reuse established Commons lock and history claim files
Preserve surviving Commons evidence and stage empty journal creation
Say a drive whose answer never comes as that peer's, with what may have landed
Refuse an init or a join --host no machine of the fleet dials
Name the holds a join of another fleet strands, and lift them in its words
Offer the address and port form only where it tells the peers apart
Make fleet peers say only what its read just proved
Log every place and level the fleet listener moves to
Say only what the fleet's evidence holds: hold-off words, IPv6 --host, rotate reads
harness page: plain counts in WHAT THE HARNESS DID (v6 slice 6a, §14.6)
harness page: plain counts after the review (v6 slice 6a, §14.6.1)
Keep a repaired setup stopped across relaunch and interrupted writes
Check the staged recovery record before admission
lab: expose empty per-run sample acceptance
lab: require samples in every present run
lab: resolve seamless baseline from the caller
aterm-gui: layout\_work is the Unix live-deck tests' alone, so the Windows cell finds no dead code
WIP: unfinished fixer work, cut off by a usage limit (not reviewed)
Settings: the rail lists every page's row on every page, and a press re-hovers
Settings: every category name is whole, and every category row whole on some screen
Settings: the compact toolbar sizes its controls together and names every page
Settings: a page's heading sits where the window puts it, on every page
Settings: Modified's count and Reset All are on some screen however short the window
Settings: the category sheet counts the Packages badge only while it is drawn
Settings tests: the search field test reports a cut query in one branch
Settings: the nav cluster's comments state their rules, not the bugs they fixed
Settings: Themes' chooser leads with the page's name where nothing names the page
Add a canonical public foundation for Commons control histories
Bind new vaults to their Commons foundation in the first envelope
Publish Commons custody locks with one inode link from birth
Exclude public foundations from historical key repair
Share payload classification across control history consumers
aterm-messages, aterm-gui: a change of view takes the band's shrink at once
aterm-gui, aterm-messages: a config row's narrow band says what is wrong
aterm-gui: rounded panels and rims land on the device-pixel grid
aterm-gui: a fact separator goes with the break, so a word its line holds stays whole
aterm-gui: the narrowest band holds every config short title whole or by its subject
aterm-gui: the status bar's every-word checks read a separator a break took
aterm-gui: the Deck keeps its glide off the device grid
aterm-gui: the settings-file rows' narrow form says what is wrong
aterm-messages: SPECS names view\_changed among the band's operations
aterm-gui: the tab-change band tests switch tabs through switch\_tab\_in
Hoist reciprocals across cursor\_glow and rainbow\_kitty::timing (Batch 166)
harness(land): a landing says only what aterm checked; the probe reads its HEAD (v6 slice 9a)
harness(land): a landing's words hold on every leg; a clean reading names only what it read (v6 slice 9a, review round)
harness(land): the refused-count test writes its newline as a byte string (clippy::byte\_char\_slices)
aterm-release: the credit reader knows Trust's kernel-reference-checked discharge
aterm-phase: rollout\_reduction\_stem builds in release, for the lab that calls it
aterm-effects: promote cursor\_glow helpers to const fn and hoist reciprocals (Batch 167)
Enroll Commons founders with durable astream creation recovery
Preserve Stop across published Progress errors and refresh approval rows
aterm-effects: precompute flight durations, cache witness run searches, and hoist reciprocals (Batch 168)
aterm-gui: a restore's close re-grids every tab to its window
Defer a maximized or full-screen window's restore re-grid to the size the OS brings; reopen a split tab at its panes' sizes
aterm-gui: the reopened-split test opens fresh shells behind a shown strip
Keep Copy available for visible terminal split selections
Accounts: no notice asks a person to sign a roster row in
Accounts: a roster row's lost login never asks a person, in every case the ladder handles
Bound terminal Select All to the focused pane
aterm-uds: nofollow, reads that never follow a link (occupancy 2.6)
occupancy wakes: a lost path ends its wake why=path or why=admit (2.6)
occupancy wakes: serve file atoms (file:, gone:, \~/RE/) in the GUI book (2.6)
occupancy wakes: a watch never blocks on a FIFO, the window never waits on a file read (2.6 review)
occupancy wakes: a restore on the window's thread never waits on a file read (2.6 review)
occupancy wakes: take the files' lock by try\_lock apart from the waiting lock (OB-7)
occupancy wakes: a volume is matched in every spelling, removable media refused, the product's guards tested (2.6 review)
control verbs: wake and waits help name the file atoms and their refusals (2.6 review)
Retain authenticated Commons admission provenance across vault updates
effects(kitty-pet, word-decorations): precompute EDGE\_FADE\_DUR and hoist reciprocals
aterm-models-db: DbFoundationBirth's Progress is an invariant a fault breaks
aterm-effects: hoist reciprocals and precompute Durations in console\_life, dog\_cameo, kitty\_sing, and pipeline
Retry interrupted Restore bring-forward before binding startup
Expect stopped startup to retire before binding its checkpoint
Render shared stderr diagnostics before writing their lines
Retire a cancelled startup after its authorization capture
System State: the access record never repeats a row's latest outcome
aterm-db: the replica tests wait out an exchange as a one-minute hang detector
db: enroll approved Commons devices over the LAN
Prune duplicate application-menu shortcuts while retaining commands
aterm-effects: precompute smoothstep/stride reciprocals and simplify CliMark::for\_app
sys jobs: a group a nested shell sends out of front is a job of its own, a second shell's block by order around its birth, the raw more form by its writer, an event sleeper's feeders whatever its wait, a pager fed from a poll loop (review round 31)
aterm-effects: const MusicNotes::resolve\_age, avoid icon\_shade Arc clone, precompute Durations and masks (batch 174)
Themes strip: one set of facts for its words; a name is never cut
Themes strip: the lead demo leaves room for the strip's first stop, not the whole strip
Theme card: Browse themes and Preview side end where the card's pickers end
Window appearance: Auto says it follows the terminal theme, in one place
Native press: a double-click's second press never takes what its first put under the pointer
Customize: an open palette slot's picker shares a screen with its field
Settings: a control a page draws itself says Changed as every row does
Document the Manual config-editor action
Retire Commons recipients before revoking vault access
aterm-capacity: GIB is imported only where Reading::of\_gib is built
lab: cover selected account identity in usage reads
lab: retain the selected account in quota usage replies
aterm-verify: the release aos step reads bundle's refusal as aterm ctl prints it
aterm-verify: a full disk a passing test simulated no longer reads as the run's
aterm-db: a test's exchange waits a minute, and each wait is its own hang detector

v0.137.02026-10-25

aterm v0.137.0

2026-10-25 · 173 changes since v0.136.0

Fixes

gui: bind clipboard paste to its original input field
lab: keep stalled trail captures from delaying their own release
gui: dereference the boxed window in overlay paste framing
lab: declare the shared control reply bound dependency
harness: validate Codex resume options at flag boundaries
edit: route selection actions to their native input owner
amacs: publish every transaction of a compound editor operation
gui: keep text commands with their visible input owner

Performance

effects: promote ribbon and trick helpers to const fn and cache cohort pruning

Tests

handoff: v0.136.0's producer fixtures, written by its own cut
editor: attach the history fixture through the workspace API
gui: exercise selection owners with valid layout and setup state
gui: reproduce focused Settings Copy and overlay document commands

Other

style(lab): format held trail capture helpers and tests
style: format clipboard ownership transitions and regressions
System State: keep a waiting Restore, resume a choice cut short, hold the ALab upgrade after a Restore, wait for the profile lock, gate the vault mend
aterm-gui: a carried frame no deck sized says nothing of the deck's room
System State: an older aterm's restored setup gets aterm's permissions; FDA follow-up seam
System State: bring a restored setup forward once the account's home resolves
startup\_scope\_tests: formatter's line break
lab: autopilot-captures, Autopilot's scenes on every harness (v6 2b)
lab: autopilot-captures' docs say the typing take wants --baseline, and a scale takes \~40 min
lab: autopilot-captures' same-land reason ends its sentence (census doc-sentence)
lab(autopilot-captures): judge every png, shoot each look from its own launch, whole titles at 400 columns
lab(autopilot-captures): re-record the captures on the merged tree (agy draws its chip under Off)
install.sh: the fourth review of its signal handling, and three older bugs
Persist Commons table replicas with strict acknowledged-prefix recovery
effects: precompute sRGB luminance, ribbon/meteor/stardust, and glow LUTs at compile time
aterm-vitals: strain, the readings a deck glance icon draws (level, over, soak)
aterm-vitals strain: review, two holes closed by tests, one false doc claim fixed
harness: show the agent's active goal on its top line, hover, status and survey
harness goal: compose\_top takes the goal; status and survey pins name goal=
harness switch: keep agy markdown on under Autopilot Off and fix off button face
aterm-uds: a process group the kernel answers EPERM for has no descendant that can hold the pipe
First-launch fixes: what an adversarial review of the two found
First-launch review fixes: what a second review of them found
System State: failures said in the page's words; Set up now only where a rerun helps
System State round 14: format what verify fmt flagged
harness switch: clear top-line hits/goals and turning state when bare while off
effects: compile-time FillsLut, ROM master, OKLab/hue LUTs, and integer RGB lerps (batches 136-139)
aterm-gui SPECS: window-frame-carry states the carry rule the code keeps
System State: settle on an untold Local Network, keep presses on aterm's plan, put back a held widen
System State docs: Local Network's untold reading, presses on aterm's plan, a held widen put back
fleet peers: a row's remedy names what takes it out for its VIA
fleet join: refuse a place another member's listener proves itself at
survey: cut a long name, never the address a read reached
fleet leave: name each tab this machine holds on another Mac
fleet peers: a member's rm of its issuer gives a member's remedy
fleet: allow drive, init and join name the act a key file needs
style: trustfmt the fleet and survey changes, reflow fleet's usage
survey: an unanswered IPv6 peer's line keeps its 160 cap
fleet: a key with no secret names the issuer's own remedy, a grant its path
fleet: name --port only for one machine's place, and drives in peers' words
fleet leave: print only a peer's sid, and promise an issuer no join again
Reproduce scoped Codex resume and primary snapshot failures
Resume managed Codex from its exact proven primary conversation
Bind the positive Codex publication fixture to its primary session
sys jobs: a second shell by the block that ran it, no job control from a shell a program ran, every writer and reader of a pipe, the tab's shell no pager (review round 28)
Share authenticated Commons history with newly admitted machines
Remove redundant borrow from history context hashing
effects: precompute trail-sound shift ratio and promote pitch/card helpers to const fn
Rewind R0a: exact recorder, live witness, release aos verb
aterm-uds: a process that becomes a set-user-ID program mid-scan is outside the scan, not unknown
Refresh System State on focus return and retain a late Stop target
Keep future-run Stop coverage explicit and remove a fixture clone
Order automatic vault repair against current setup choices and Stop
Give the vault repair guard a concrete borrowed adapter
Keep draft vault sources out of automatic System State observations
Let the latest Local Network refusal override an older grant
Repair encrypted Commons tables over the authenticated LAN channel
Preserve completed repair when a peer resets its TCP connection
Abort table repair when membership changes during a network read
aterm-effects: precompute supernova and nova tables and use integer lerp\_rgb (Batch 141)
ctl help: invoke says what a macOS Quit does over the wire
harness: recover live Codex primary from its validated copy
harness: put off Claude Code's auto-mode setup offer with Not now
install.sh: the whole file is one group, and the fifth review's fixes
effects: fast-path ripple glint profile and promote kitty/streak helpers to const fn
Keep authenticated inbound repair cursors across connections
Validate historical epoch uniqueness in its causal past
Use supported comparison forms in the publication model
Cover discarded recovery parents and define safe quarantine
aterm-gui: remove the merged top deck; v2's deck stays as it shipped
aterm-lab: instance --scene and the Linux baseline's deck back to v2 alone
aterm-vitals: remove the merged deck's glance facts, fixtures, inks and words
BandIcon: the need pictograms name no top deck
config: a file that still sets \[sys\] stats\_deck\_style is told the key does nothing
aterm-effects: add const exp/sqrt/hypot and promote rainbow\_kitty and pet helpers to const fn
aterm-gui: hold the deferred Set up now test to the rerun-only rule
aterm-uds: the path-users scan counts a process that became set-user-ID mid-scan as outside it
aterm-agent: a torn Claude session file fails the roster only while this user's process may write it
Keep explicit System State checks when routine refreshes queue
Refuse Restore when a backup omits its original value
Retire native IME compositions across focus round trips
System State: no Set up now beside a failure aterm retries by itself; an unread saved setup is said in its own words
Clarify the host snapshot required by agent restart
aterm-lab: a windowed lab instance runs in a coalition of its own (the app band, its keeper the job's process)
aterm-lab: an app-band window's aterm is its own responsible process; the launcher choice is tested
Lead survey help with supported CLI syntax
aterm-effects: promote pet\_world perch search and kitty\_pet helpers to const fn
System State: a Restore never withdraws aterm's permissions, wherever it is cut short
needs: a codex tab's own blocked report is a need, with one banner per box
needs: name codex's own-box report by an exhaustive match
needs: settle the codex-need review (15 findings)
lab codex-alab-proof: a codex box nobody answers is a need, live
Accounts: sign every row in by itself, by a recorded ladder of routes
Accounts: keep the roster true to this machine's own logins
Accounts: resync only what changed, and keep rows accounts add lists
Accounts: the automatic sign-in keeps its backoff, its words and its off switch true
install.sh: the sixth review's fixes — -w for the refill, a TMPDIR copy for a shut folder, the guard line by layout
aterm-vz: the helper's record names it by start time too, so a record from an earlier boot signals nothing
aterm-lab: lab down signals a saved pid after its TERM only while it is still the process that started then
Quarantine witnessed discarded-branch table evidence
Preserve signed author time in quarantined audit metadata
Close quarantine causal gaps and preserve cutoff consistency
Clarify the transferable cutoff evidence boundary
Close quarantine over indirect forks and missing writer links
aterm-gui: keep the chrome's glyph rasters from one reading to the next
aterm-gui: test the glyph memo's byte bound, and the mutants against this tree
aterm-effects: precompute wince tumble omega and promote ledger/pet helpers to const fn
Reproduce ribbon custody lost after successive partial redraws
Preserve ribbon custody through successive partial redraws
Measure ribbon producer with retained partial redraw custody
Keep the herald looking-owner convenience wrapper in tests
Distinguish manual and automatic setup retries in the queued-action test
Use graph uniqueness for exact cutoff validation
Keep the herald convenience wrapper in its unit tests
Keep account resync tests portable across Windows and Unix
Read each of a turn's rows a bounded number of times in Claude Code's group read
Count a git or PR group row by what a sentence lacks, wherever it stands
Lift the same-reply hold on a person's turn no point saw busy
Say why a lone agent's hinted row is read up to 500 characters
Format this round's tests and name the work-count test's row type
Take an untimed prompt as someone else's turn only after one this loop read
Read a person's untimed turn by what changed since the last point this loop read
Check the untimed person lift in the TurnEnd conformance walk
Pin the punctuation boundary of a git or PR clause row
Replay a lone commit row ending each turn as work
Read the row a full ⏺ line wraps onto as that line's in the group read
Carry the conversation a point read across loops so a person's turn before a takeover lifts the hold
Say in SPECS that Claude Code's prompt is read off its screen and that the walk checks the untimed lift
Format this round's wrap read and point-row note
Restore the 4(b) sentence of turn-end-decision word for word
Take an untimed person's turn only on a submit, never on changed letters
Take a person's submit count as evidence only where the composer reads empty
Replay a person's new Claude Code prompt row lifting a hold with no submit count
Take a person's Enter as a submitted turn only where it drew a new last message
Read the harness's own Enter outside an act as seen, never as a person's turn
Lift the same-reply hold on a person's turn only where a point saw it busy
Take no last message on either read as standing under a person's keys
Read a person's message said again as a turn where its answer drew new words
Pin the person condition of the books-turn arm with a lead agent's prompt
Drop the last-message guard on the unseen-turn rule: it hid a real turn said again
Hold a person's books turn whose tools only an unread history could show
Name a lead's prompt above Claude Code's reply in the same-reply hold's clears
Drop the books-turn arm's dead unseen\_turn conjunct; say why a takeover holds the long report's keys
aterm-gui: move the deferred Set up now test to the retried-by-itself rule
aterm-gui: Rewind's not-yet-read Fidelity and witness ts allow dead code, not expect it
install.sh: the seventh review's fixes — the dry run asks the run's own opens, the NOTE's sudo asks of the file, the guard needs its newline
aterm-uds: on Linux too, a process that becomes a set-user-ID program mid-scan is outside the scan
aterm-gui: deck\_paint is the tests' alone, so the bench-support lint finds no dead code
System State: keep waiting Restore debt through replacement effects
System State: wake parked Secrets after subscriber recovery
System State: recover owed preferences on a verified disk-access grant
Test queued setup actions against the current retry policy
System State: resume repositories on local network changes
sys jobs: a nested shell's commands its block's, a second shell by its birth, a shell's fork and a filter's tty no pager, the poll pager by its descriptors, the upstream set from every pipe sleeper (review round 29)
aterm: hold the first-run gate's scope wiring with a test
Keep refinement anchor symbols distinct across models
Persist and exchange bounded negative table conflict evidence
aterm-uds: a live Linux test holds a set-user-ID exec to Left on the kernel's own /proc
aterm-effects: const witness/cheer/word-decoration helpers and mote LUT
aterm-db: the replica tests wait out an exchange as a one-minute hang detector

v0.136.02026-10-25

aterm v0.136.0

2026-10-25 · 91 changes since v0.135.0

Fixes

gui: keep command palette input with its originating window
gui: refresh accessibility for the palette input owner

Tests

handoff: v0.135.0's producer fixtures, written by its own cut
gui: give palette navigation its accepted search query

Other

harness: ask one agent machine-wide to free disk space (disk-free@v1)
harness: disk-free@v1 seats only sessions that may be asked, and keeps every line counted
disk-free@v1: one disk.low builder, and the lints it raised
supervise: Claude Code's own Settings panel is no dialog the stall canary climbs on
supervise: format the Settings panel canary test
supervise: the dialog canary names Claude Code's Settings panel, not silence
Require native LAN admission for Commons database repair
Compile Commons journal-only helpers on Unix
aterm-effects: promote pet, cursor glow, stardust, and meteor helpers to const fn
harness,gui: enroll walled vendor pool successors and wire menu auto-login across all CLIs
Read context after the last footer anchor
Cruise: a host turn taken ends a person's exchange left to them
aterm-wasm, aterm-gpu-web: one display-row cache in the shared facade
atpkg: program rows for the five ALab harnesses, opt-in and packed to a stricter rule
Preserve vault password composition and retire closed input owners
aos M6 stage D: the lab's learner verbs and session runner (aos-learn, aos-learn-bench)
harness: a login moved off a limit's account resumes the limit at once
harness: the login look matches Program exhaustively and collapses its read
harness: a login moved off a held limit the screen left resumes it
harness: pool single-enrolled fleet rosters, isolate codex app-server sqlite, and rotate child workers
aterm-effects: promote PetBrain and console\_life helpers to const fn
aterm-effects: promote companion, baker, and rainbow\_kitty test helpers to const fn
stats deck: a live edge — the now marker, the beat, the glide left, a time scale
stats plan: tick words test whole minutes with is\_multiple\_of (tippy manual\_is\_multiple\_of)
codex parity: the program's own report in its own column on ls, task and await task
help and skills: wait on a codex by its own report; name the new columns
status glance: a codex tab at rest counts as resting, by the survey's rule
codex parity review: judge a claim by the program now in front; right the clocks and the wait recipe
atpkg: codex-old takes codex's verified tree of the same bytes
atpkg: codex-old's copy matches an extraction or downloads
Bind Commons sockets before connecting and constrain their hop limit
aterm-gui: the first Turn On… for Debugger access asks for the password
aterm: a first-launch offer turned away for want of focus comes back at the next focus
port from origin/rescue/consent-fda-native-alert-2026-09-16: a paste sheet queued behind another sheet still counts as outstanding
harness: a declined act makes a question that act's; kept and choice-dialog grace gaps closed
aterm-effects: promote rainbow\_kitty and cursor\_fx test helpers to const fn
harness: answer a subagent's shell -c rm box Yes without waiting out the person grace
aterm-effects: promote cursor effect, audio, and test helpers to const fn
Preserve setup recovery across startup, tab closure and Stop
Keep terminal authorization refusal compatible and verify first-frame plans
fleet: a local hold off lifts a remote hold once its node no longer answers
fleet: a drive cut before its answer says what cuts one and what may have landed
survey: keep a fleet credit's node and over the fleet whole
fleet: refuse a join that would take the issuer's own address
fleet: a first join its issuer never answers says it kept the node key
fleet: refuse a peers add no read takes, and never read this machine as a peer
fleet: a drive refusal names its peer once
fleet: a join's advice never contradicts the cause it gives
fleet: a key file with a second link is named with the act that fixes it
settings: a \[fleet\] key's refusal names the aterm fleet verb that writes it
fleet: the first init run again changes nothing, and two refusal nits
fleet: a local hold off lifts a remote hold only once its node may drive no more
fleet: a join whose registration got no answer, or met a busy issuer, says so
survey: a fleet credit stays whole within the session line's 110 characters
remote: a cut drive's fallback remedy keeps the session it named
fleet: the peer-named-once test's dial waits with the hang detector
Prepare Commons listeners before accepting connections
aterm-effects: promote tone, int\_bag\_mlp, harness\_card, and pipeline\_native helpers to const fn
Add secrets-backed Commons bootstrap and durable device custody
aos m6 stage E: pin M6\_CHAIN\_V1, the chain v0..v4 on training data alone
harness: test the host door a moved login is read by
install.sh: the third review of its signal handling
Clear named Kitty image placements from retained history
aterm-effects: promote matrix\_rain, word\_decorations, pipeline, and cursor\_glow helpers to const fn / #\[must\_use\]
CPU close-up: keep the lens shell's raster and fold cards by opaque runs
CPU close-up: test the kept shell through the splice, recycle the card buffer, settle the doc
aterm-gui: a cold restore's first window keeps its size
harness switch: alab harness ● on is the whole harness, not Autopilot
harness switch review: agy's lit pill in Off's white, a --no-harness launch names itself, the switch's names say which harness
footer: paint the account, its plan and its weekly budget as one unit
footer: a reason or an upgrade note may still take the plan's room
footer: a narrow aged week keeps its name inside the account unit
harness card: the banner reads as the link it opens; the line names the harness's version
harness banner: a double click opens the link once; Shift and Option presses stay the grid's; a reader can press it
harness chrome: compose the three slices onto main's R-12 weekly words
sys jobs: a full-screen latch the root alone holds, a typed-ahead second shell, a pager by what it reads, Linux's blocked descriptor (review round 27)
lab codex-alab-proof: prove codex's own report on ls/status and the codex wait recipe
Start default LAN Commons control repair for enrolled devices
aterm-effects: promote HSV/spectrum/bed/veil/comet helpers to const fn
aterm-gui: the input watch dates a waiting key against the instant it probes at
Keep setup Stop durable and recovery immediate across admission failures
Keep an upgrade watcher’s confirmed Stop target after write ownership ends
aterm-effects: promote meteor coma stop LUTs and ribbon/sky helpers to const fn
Use secrets-backed table envelopes and scoped historical read keys
Match GUI test helpers to their platform coverage
harness: a moved login is read at a held limit and off the screen, and its resume ends with its turn
harness: a moved login's owed resume keeps its limit's row and login, and ends with an answered prompt