# Changelog

All notable changes to Crewship are documented in this file.

The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
Pre-1.0 releases may introduce breaking changes in minor versions
(`0.x.0`); patch releases (`0.x.y`) are backwards-compatible fixes.

## [Unreleased]

- **Routine run logs show when a step waits for an occupied agent (#5290).** The journal records when waiting begins and whether the agent becomes available, the wait times out, or the run is cancelled. The outcome includes elapsed wait time.

- ⚠️ **Behaviour change: routine budgets include costs reported by every agent attempt.** Reported costs from empty responses, failed attempts, and attempts preceding cancellation during backoff now count toward the run total. A routine close to its configured cost cap can stop earlier.
- ⚠️ **Behaviour change: Claude Code routine attempts use a 20-turn limit.** The routine runner now passes the existing unattended-run limit to Claude Code. Other CLI adapters use the execution timeout.
- **Routine validation rejects unsupported step controls.** Definitions with `permissions` or `max_turns` on a step now identify the offending field during validation.

- **Dependency updates keep the frontend, document editor and Go runtime libraries current (#5280).** Integrates the pending Dependabot updates and refreshes version-scoped license notices for packages that ship no license text. ⚠️ **Behaviour change:** authentication now explicitly requires compact JWE tokens, matching the tokens Crewship issues; JSON-serialized JWE messages are rejected.

- **The CLI says when a profile overrides an exported `CREWSHIP_SERVER` (#5245).** Run outside a directory bound to a profile, a command went to the `server use` default instead of the exported server, and that server's answers looked like faults of the intended one (on crewship-dev, an intermittent `503 Docs are not enabled on this server` from a slot without Docs). The precedence is unchanged; the CLI now prints one warning line on stderr naming the profile and the server it dials. An explicit `--profile` or `CREWSHIP_PROFILE` prints nothing.
- **Canvas cards name mentioned people as the Page does (#5197).** A card resolves a mention through the same reader-scoped people lookup as the Page editor, so it shows a name only for someone who can read the document, and only to its readers; anyone else stays **@Unknown member**. The Canvas no longer uses the workspace member list.
- **Docs presence is one entry per person (#5166).** A person with several tabs on a document is now one peer with a `tabs` count and the caret of the tab that moved last, instead of one caret per tab. A tab also no longer answers a selection update that did not move its caret with an extra heartbeat, and no longer redraws the other people's carets when a reply did not change, so it stays at one heartbeat a second while idle.
- **Docs presence is one entry per person (#5166).** A person with several tabs on a document is now one peer with a `tabs` count and the caret of the tab that moved last, instead of one caret per tab; a tab without a caret (such as `crewship doc presence`) never hides a tab that has one. A tab also no longer answers a selection update that did not move its caret with an extra heartbeat, so it stays at one heartbeat a second while idle.
- **The Design Library shows themes instead of `-dark` swatches (#5145, behind `NEXT_PUBLIC_ARTIFACT_DESIGN_SYSTEM`).** `design-system.json` schema 2 adds `themes`, per-theme colour values with a usage note, `{name}` aliases and type groups; schema 1 files are read unchanged and a newer schema is named instead of shown in part. The Library has a theme switch for swatches and component previews, the WCAG contrast of each swatch, usage notes, grouped text styles and a note when the system carries no font files. The Template Crewship Design System mirror now uses its two real themes.
- **A full storage quota no longer blocks saving a Word or Sheet document for the rest of the session (#5124).** After a refused save the editor keeps the changes and says they are not yet saved on the server; **Uložit znovu** in the alert or Ctrl+S sends them again, and once space is freed they are saved as a new version. Autosave still never retries a quota refusal by itself, and no version is deleted. The status line now tells 95 % (*historie je téměř plná*) and a full history apart from 80 %.
- **Releasing a saved Word or Sheet document no longer shows an unsaved draft (#5089).** A final capture with the exact bytes of the last confirmed save now counts as that version, so the status stays honest, the leave guard releases and no copy waits in the browser to be offered later.
- **Deleting an agent stops its runs whose container is already gone (#5050).** A protected host run in a removed container stayed pending and held on to its work; it now counts as stopped. Any other inspect failure still reports an error.
- ⚠️ **Behaviour change: only OWNER or ADMIN can change the governance model credential (#5024).** PATCH, rotate, escalation answers, OAuth completion and internal token writes refuse a bound credential for narrower roles, and `credential.rotate` no longer reaches it. Binding now needs an active credential.
- **A delayed sign-out no longer removes unsent chat proposals (#5026).** If a tab learns of a sign-out after its person signed back in, it now keeps their chat recovery. A real sign-out still removes it, even when saving drafts fails.

- ⚠️ **Behaviour change: invalid native version reads now return exit code 2 instead of 1 (#4930).** `crewship craft version` classifies non-positive, non-canonical and overflowing version numbers as validation errors before authentication or any HTTP request. Scripts must now expect process exit 2 and `error.exit_code: 2` in machine-readable errors. Negative positional versions are passed after `--` so they reach version validation.

- **A Design comment sent to an agent no longer produces a duplicate version (#4527).** The task prompts from the Design editor, `crewship page design comment --send-to-agent --wait` and the chat bridge told the agent to call `design_snapshot` after `design_apply`. A successful `design_apply` already saves the version and answers the comment, so the agent saved the same canvas twice. The prompts now say not to snapshot afterwards, matching the `crewship-design` skill, and the PRD acceptance test requires exactly one agent version and no `design_snapshot` call.

- **A failed release or handoff in Word and Sheet can be tried again (#5028).** A network error during the transfer used to leave the other person blocked until the holder closed the tab.

- **Accepting an agent proposal in Word no longer goes stale when nothing was edited (#4699).** Word rewrites a document into its normalized form when it opens it, so the save before accepting, handing over or releasing the editor wrote that rewrite as a new version and every proposal over the opened version became stale. The native editor host now passes the engine's revision state right after bootstrap (`loaded.mountedState`). The save coordinator treats an export as the loaded version only when no edit was reported and the engine's own revision is still the bootstrapped one, so a change whose `changed` event arrives late is still saved. Nothing is sent and the action continues on the loaded version, and an untouched final capture no longer leaves a local draft to offer on the next open. Edits and a native Ctrl+S still save. Sheet, whose engine reports no revision state, and hosts that do not pass the state keep the earlier behaviour.
- **A tab whose draft save failed during a sign-out keeps following later sign-outs (#4714).** The sign-out and expiry listeners used a sticky flag, reset by hand on each path where the tab stays. After a failed draft drain followed by a refresh from a still-mounted component, the flag stayed set and every later sign-out or expiry was ignored, so a shared browser kept the previous person's editors open. The listeners now compare against the refresh generation: any newer refresh or settle re-arms them. A sign-out superseded by a refresh during its drain, and an expiry during a re-settle (exactly one navigation), are now covered by tests.
- **Design canvases can be played as prototypes (#4449, default off).** With `NEXT_PUBLIC_ARTIFACTS_DESIGN_PROTOTYPE=true` (on top of `NEXT_PUBLIC_ARTIFACTS_DESIGN`), an editor links a layer to a screen in **Properties → Link to screen**, and anyone who can open the Design clicks **Play** to move between linked screens with mouse or keyboard, **Back** and **Esc**. Playback is local and never changes the canvas; a link to a deleted screen stays inert with a hint. The link is the optional node field `linkTo`, set through the existing live sync, `page design apply` and agent `design_apply`; no new endpoint or migration. The server now accepts `linkTo` (string, at most 128 characters), so deploy the server before enabling the UI variable.
- **A tab that stayed signed in after a sign-out elsewhere still follows later sign-outs (#4705).** When a delayed sign-out message from another tab found the session still live, the tab stayed but then ignored every later sign-out and session expiry, keeping the person's editors open on a shared browser until its next refresh. It now keeps listening.
- **Text typed before the session check answers is no longer wiped (#4706).** Since #4628 every session check that changed the local draft identity remounted the whole app, including the first one after a page load and signing in from a signed-out page, so a Share ID on `/shared-chat`, sign-up fields or the bootstrap step entered meanwhile disappeared. The app now remounts only when it leaves a signed-in person (another person, or signed out), which still retires that person's local draft writers; refreshing the same person never remounts.
- **Normal CLI chat turns can write their enabled memory again.** Each host-authorized turn now owns a fenced work-ledger attempt before execution, using the existing serial capacity limits and rechecking the original human authority at process creation. Ended or stale turns still cannot write; an unknown execution outcome keeps custody until protected exit evidence is recovered (#2762).
- **Memory audit keeps running when a directory cannot be watched (#4568).** A per-directory watch failure (an unreadable directory, or an exhausted `fs.inotify.max_user_watches`) is logged and skipped instead of disabling memory audit until restart, and if the file watcher cannot start the audit continues on polling alone. The audit watcher now applies its documented 30 s poll fallback, which production previously left off, so `memory_versions` and `memory.updated` keep recording writes.
- **Truncated multibyte text stays valid UTF-8 (#4566).** Hook messages and output, HTTP hook errors, the backup flush-hook detail and TUI dashboard cells no longer cut a character in half (shown as U+FFFD and rejected by strict JSON consumers); dashboard cells now count characters rather than bytes.
- **Native Craft agent tasks now respect the workspace agent artifact policy (#4681).** The policy is the ceiling for agent work on artifacts and already gated Projects, Design, Documents and Mooring, but `crewship craft task start` admitted a Word or Sheet task for an agent whose crew was not listed, or under a disabled policy, once the owner gave whole-document consent. Task admission now refuses it (`403`, nothing queued), and every agent write rechecks the policy (a policy change already retired running tasks through the authority generation; the explicit check keeps that independent of the trigger).

- **Accepting a Craft proposal no longer goes stale when a concurrent save repeated the same bytes, and the proposals migration now moves the schema version (#4669).** A save that landed between choosing the acceptance base and publishing, with content identical to the base, used to retire the proposal permanently; acceptance now re-reads the head, retries on it when the content is unchanged and goes stale only when the content really changed. A no-op migration `20261031100000_craft_native_proposals_frontier` is added because `craft_native_proposals` (20261029165715) was numbered below the previous newest migration, so a rollback to the old binary passed the version-skew guard and its backup left out the table. The applied migration is untouched and databases keep all data.
- **Craft access rechecks and native agent edits: four backend fixes (#4670).** The `page.access_recheck` fan-out is now registered as background work, bounded to four running plus 64 waiting fan-outs (further ones are dropped; the 30 s poll covers them) and gives up after 5 s against a hub that stopped draining. A native agent `apply`/`propose` refused at storage admission (`ErrStorageBusy`/quota) no longer burns its request ID, so the same retry runs the engine instead of failing with 422. The lease-renewal goroutine no longer shares its context variable with the request goroutine (data race). Legacy document, Slides and restore writes remain bounded by the SQL storage triggers; the free-disk probe is not on those paths (follow-up).
- **Artifacts docs and agent skills corrected after the #4527 review (#4527).** The `crewship-design` skill (1.0.1) now says that the workspace artifact policy must be enabled and list the agent's crew; the `crewship-craft` skill (1.0.1) states the 32 KiB cell-input limit and that a corrected edit needs a new `request_id`. The embedded `crewship ai` skill notes that Design `restore` takes no `--base-version`. The guides now state that creating an artifact at the page cap answers `422` `pages_limit` (not `413`), that a never-written Dashboard collection is not listed, that "Design capacity is full" also covers a used-up storage budget, and give the Design policy prerequisite, plus smaller corrections to the library, Project, Slides and Docs pages.

- **The page cap is now a setting, and Design / artifact project create at the cap give the real reason (#4664).** Instance administrators read and set the maximum pages per workspace (default 100, range 10-10000; `GET`/`PUT /api/v1/admin/instance/page-limit`, CLI `crewship admin instance page-limit get|set`, audited as `instance.page_limit_set`); lowering it never deletes pages. Every create path now uses one check, and creating a Design or an artifact project at the cap answers `422` `pages_limit` with the limit stated, instead of `413` "Design capacity is full" or `artifact_history_quota`; the new-artifact dialog, the artifact client and the agent artifact tool pass that message on. Mooring, agent Documents and GridCraft create at the cap also answer `422` `pages_limit` (previously `409`). Test items still count toward the cap (follow-up).
- **A retained agent run whose ownership cannot be verified no longer stays RUNNING forever (#4700).** When the controller recovers a run's retained output after a restart and finds its recorded workspace or agent conflicting with the trace's journal start or terminal entries, disagreeing with the agent, missing, or differing from its work attempt, it still projects nothing, but once the execution has verifiably ended it settles the run state to `error` with the reason (`unprojected`) and stops retrying, so the `retained output pending projection` warning no longer repeats every 30 s. For a journal conflict the run's own row in `GET /api/v1/agents/{id}/runs` ends as `FAILED` with "retained run output withheld: its trace has conflicting journal ownership", written only under the workspace and agent that the run state, the agent and the run's own `run.started` all agree on, with no output or exit code; rows of the conflicting owner and work attempts are never written. A run whose own recorded ownership disagrees with its agent, is missing, or differs from its work attempt settles its run state only, and its retained output stays on disk.

- **Craft hands over and releases an unchanged native editor again (#4693).** Taking the Word or Sheet editor and then choosing "Předat uživateli …" or "Uvolnit úpravy" without editing was refused with "Výsledek akce nebyl potvrzen" since unchanged content stopped being saved as a new version (#4657, #4661). The editor now transfers custody when its final capture equals the confirmed server version; edited content is still saved and acknowledged first.
- **Craft no longer saves unchanged content as a new version when a freshly opened editor is released (#4661).** The save coordinator now seeds its confirmed baseline from the loaded server snapshot (version and SHA-256 of the loaded bytes), so after an outage, reload or reopening a release flush or autosave of identical bytes creates no version, in Word and Sheet. A restored local draft, normalized content or any edit hashes differently and is still saved; an explicit Ctrl+S ticket always transmits.
- **Nullable API fields no longer publish unsupported null types in OpenAPI 3.0.** Artifact and Design origins and Page folders retain null values and their existing object constraints using OpenAPI 3.0 nullable alternatives. Arbitrary JSON payload and preference arrays also retain nested null values.
- **Craft no longer saves byte-identical content as a new version on editor release or after a reconciled lost acknowledgement (#4657).** The single-editor save coordinator now records the confirmed baseline for every application (Sheet included, not only Word) and skips the upload of an autosave or a release/transfer flush whose bytes, native state and base version match it. Native Ctrl+S still saves. Versions and quota are no longer spent on a duplicate.
- **Artifact storage budget: configurable limits, counter recompute and a clear refusal in the collaborative editors (#4648).** Instance administrators read and set the workspace limit (default 32 GiB) and instance limit (default 64 GiB) with `crewship admin instance artifact-storage get|set` (`GET`/`PUT /api/v1/admin/instance/artifact-storage`); defaults are unchanged until set, lowering a limit never deletes data, and each change is audited. `crewship admin instance artifact-storage recompute [--dry-run]` (`POST /api/v1/admin/instance/artifact-storage/recompute`) rebuilds the usage counters from the stored artifacts in one transaction and reports the drift per workspace; it is idempotent and writes only the derived counters. A Mooring command write that hits the budget now answers `413` `artifact_storage_quota` instead of "command not confirmed", and a WordCraft collaboration socket is closed with code 4009 before the session ends. Both editors show "Kapacita úložiště neumožňuje další uložení" and keep the unsaved work in the browser.
- **Craft preview rechecks no longer slow grant changes and also follow membership changes (follow-up to #4652).** The `page.access_recheck` signals are sent after the commit from a bounded background goroutine, in batches, and skip suspended and restricted accounts. Removing a workspace member or changing their role sends that member alone an empty `page.access_recheck`, which makes open shared previews re-read at once.

- **A revoked Craft shared preview removes its content within seconds, not up to 30 s (#4652).** When a Read or Comment grant on a Word or Sheet page is removed, the server sends the affected person alone a `page.access_recheck` signal with the page id only (on their own `user:{id}` channel; no content, no other users). The open shared preview repeats its authorised read at once and shows "Sdílený náhled není dostupný" on 403/404. The 30 s poll and the focus/online rereads remain as the fallback, and the PRD row `A.craft.read-revoked` now expects removal within about 5 s.

- **Craft names the editor address when the page is opened on another origin (#4649).** If the browser blocks the editor frame because the page is not on the configured editor origin (`CREWSHIP_PAGE_STUDIO_ORIGIN`), the editor now says at once "Editor je dostupný jen na adrese <origin>. Otevřete stránku tam." with a link, instead of waiting 20 seconds for a generic connection error. The local draft is kept, and the Content-Security-Policy is unchanged.
- **Seven review findings in the CLI, the orchestrator and the PRD harness are fixed (#4667).** `crewship page enable|disable` now serialise on a lock file next to the compiler image record, and `disable` re-reads the record after its confirmation, so an enable that finishes meanwhile is no longer dropped; the record writer refuses to write more than the 64 KiB the server reads (it used to turn Pages Apps off for every version). A legacy run whose container is removed while its stop confirmation is pending now releases admission, capacity, HOME and credential holds. `chat room messages --follow` subscribes before its first read (and before each catch-up), so a message committed in between is printed. `page artifact reconcile` no longer reports "save not applied" for a 404 on a version an Edit user cannot read; it says the outcome is unknown unless the latest version is not newer than the base. Artifact and Design comment lists return the newest 500 comments (oldest first), so `--wait` finds a comment created beyond 500. The PRD acceptance session files are namespaced by origin, output directory and account, so concurrent runs no longer share an identity.

- **Routine saves honor machine output formats.** `routine save --format json|yaml|ndjson` returns the saved routine identity and trigger metadata without progress text; the human receipt stays unchanged (#4621).

- **Chat no longer offers Project creation to an agent whose crew the workspace policy excludes.** The composer asks `GET /api/v1/pages/artifacts/availability?agent_id=...` (CLI: `crewship page artifact availability --agent <id>`), which now returns `can_create` and, when refused, `code` `artifact_crew_not_allowed`. If a send is refused anyway, the chat shows "This agent's crew is not allowed to create artifact projects in this workspace", keeps the typed message and starts no run, instead of "failed to save message".

- **Agent peer-card errors no longer expose server internals.** When reading or deleting an agent's peer cards fails inside the server, the API now answers `Internal server error` and logs the cause, instead of returning database driver text or a host file path.
- **Artifact MCP tools advertise the inputs they accept.** Tool descriptions now name the Slides/data flag dependencies and explain mandate, version conflict and quota behavior; version schemas require the positive values already enforced by the host.

- ⚠️ **Behaviour change: workspace webhook destinations are visible only to channel administrators.** Channel lists omit a workspace webhook URL for roles below ADMIN/OWNER while retaining its metadata and personal destinations owned by the caller. Delivery configuration and signing secrets are unchanged.

- **New artifact can create a blank Sheet.** When the server advertises `gridcraft_native` (see `crewship doc status`), **Sheet** is offered in the Artifacts New artifact dialog and opens the native GridCraft editor; without the profile it stays listed under Coming. It reuses the existing page and craft initialize endpoints, so no new API or CLI command (#4635).

- **A skipped schedule no longer blames a routine disabled afterwards.** When a schedule's last fire was skipped with nothing counted as missed, the Triggers tab now always shows "skipped: previous run busy or routine inactive". Before, a routine that skipped a tick because its previous run was still going and was disabled later showed "skipped: routine inactive", reading today's state into a past fire.

- **`crewship page enable` installs the Page compiler on a server whose page project storage is already configured (part 1 of #3108).** Prerequisite: `CREWSHIP_PAGE_PROJECTS_PATH` (or `storage.page_projects_path`) is set and the server was started with it; `page enable` does not configure storage and refuses to run without it. A default storage location and enabling Pages Apps on a fresh install without configuration or restart are not part of this release (#3108 stays open). `crewship page enable` builds the Page compiler image from the binary itself (no source checkout), tags it `crewship-pages-build:<fingerprint prefix>`, labels it with a fingerprint of its whole build context (Dockerfile and base image digest included) and records its exact image ID in `<CREWSHIP_PAGE_PROJECTS_PATH>/pages-build-image.json` (mode 0600); run it on the Docker host as the server's account, with the server's configuration. The server uses only the recorded image, and only while it keeps that ID, tag and label — never an image found by its label alone, since crew images built `FROM` a labelled base inherit it — for Pages and Artifacts Project builds alike, within seconds and without a restart once storage is configured; a missing or non-verifying record fails closed. `crewship page disable` removes this version from the record and then its image (`--all`: every recorded version), deleting only images that still verify. `CREWSHIP_PAGE_BUILD_IMAGE` stays an optional override that wins when set; Docker Compose deployments and air-gapped hosts use it with `crewship page enable --image-only`. A local installation with Studio on `http://localhost:<port>` no longer needs `CREWSHIP_PAGE_RUNTIME_ORIGIN`: the server derives `http://127.0.0.1:<server port>`, a separate browser site, used only for browsers that reach the server directly on a loopback host — not through a proxy (`Forwarded`, `X-Forwarded-*` or `X-Real-IP`) — and never for the same-host editor. After upgrading the binary, run `crewship page enable` again; older images stay recorded for rollback. ⚠️ **Behaviour change:** while Pages Apps are not enabled, `GET /api/v1/pages/{slug}/project/preview` for a Page without a draft answers 503 `page_apps_not_enabled` instead of 404, and the Page build, check, publish and application 503s now carry `code` `page_apps_not_enabled` or `page_runtime_origin_missing`. See [Operate Pages applications](docs/guides/pages-apps-operations.mdx).

- **Craft reconnects an interrupted metadata stream.** Recovery checks current authority for the same admission, allows exponential backoff while an old server stream is still held after transport loss, and stops after bounded retries; saves and custody changes are never replayed.

- **Artifact API reference explains version and access rules.** OpenAPI summaries and descriptions now document artifact manifests, comments, Design and native Craft tasks, including conflict, quota and visibility behavior; routes and schemas are unchanged.

- **Native Word and Sheet proposals have a separate retained storage allowance.** Every retained candidate counts toward a 64 MiB default budget, including rejected and superseded proposals. Concurrent proposals cannot exceed it, and filling it leaves the human’s available history allowance intact. Reads and saves no longer scan proposal payloads. A refusal preserves existing work and history.

- **Native Word and Sheet proposals survive backup and fork restore.** A fork keeps each candidate on its new document with an identifier the editor and CLI can open; backups preserve the exact candidate bytes and content hash.

- **Native agent proposals are idempotent within their authenticated run.** Two runs of the same agent can reuse a request identifier without adopting each other’s proposal. Apply and propose share the run’s change request limit; proposals cannot bypass an unresolved save. Exact retries reuse the recorded candidate without running the engine again, including after the document advances.

- **Design keeps work visible when saved history is full.** A clear message replaces the saved status and offers a draft download containing the local canvas and unsent feedback, or an explicit copy of the canvas into a new Design with fresh history. The original editor, unsent feedback and retained versions stay intact. Copy creation checks current source and create permissions atomically and is never automatically replayed.

- ⚠️ **Design readers and commenters see only the shared version.** Private saved and live changes are withheld from REST and websocket readers, and comments target the displayed shared snapshot. Workspace administrators read and edit every Design, with foreign access recorded atomically in the audit log and keyed journal, and edits using the existing locks and versions.

- Add an original-human and immutable-Page bound key-recovery primitive for private browser drafts, checked against current read authority. Browser retention and sign-out integration remain separate.

- **A Word or Sheet save whose reply was lost in a long outage is still confirmed.** Reconciling the exact attempted version no longer needs a live editing lease, so an outage longer than the lease no longer leaves an already saved draft offered for recovery; the expired lease still cannot save.

- **The chat's side viewer lies over the chat on a tablet.** With chat artifact projects on, below the large breakpoint an open artifact or saved document covers 78% of the chat from the right instead of squeezing the conversation into a narrow column. Wide screens keep the shared row; phones keep the full-screen viewer.

- **Chat starts a project from "+" › New artifact.** With chat artifact projects on, the composer's "+" menu offers Project next to Word. Picking a starter sets the same explicit creation consent as before, and the chosen kind shows as one removable chip ("New Project") in place of the two text buttons, so the toolbar fits on a phone.

- **A Page opens with its content inside Artifacts.** Its application or panels show in the library detail with the same views Pages uses, read by the page's immutable ID; the detail no longer sends you to Pages.

- **New `crewship` commands for API operations the CLI reached only with another method.** `crew member set-role` (or `--clear`), `agent learning`, `agent files --container`, `persona suggest`, `checkpoint get`, `notifychannel update` and `nuke keeper-requests`; `workspace member capabilities list` without a user id lists every member in one request, and `workflow get` reads a template by id before falling back to a name lookup. `GET /api/v1/workflow-templates` now creates the built-in templates on a fresh workspace, as `/api/v1/templates` already did, so `crewship workflow list` is no longer empty there. Built-in workflow templates are now read-only through `/api/v1/workflow-templates` too (`403` on update or delete, as on `/api/v1/templates`), since listing would otherwise recreate a deleted one and duplicate a renamed one. The `docs-inventory -strict` CLI-parity gate now compares HTTP method and path rather than path alone, and calls made only by `crewship seed` no longer count as coverage (#4510).

- **Every artifact in the Artifacts library has its own address.** Opening one goes to `/artifacts/<id>` (its immutable page ID), so Back returns to the list it was opened from, and a reload or a shared link opens it again. Links from before, `/artifacts?item=<slug>`, open by slug and move to the new address; an ID address never falls back to a slug another artifact may hold now.

- **Home's Artifacts card opens Artifacts.** With the Artifacts library on, *All artifacts* goes to `/artifacts` and each recent item to its own `/artifacts/<id>` address instead of Pages. Without the flag nothing changes.

- **Design System artifacts get an opt-in token preview.** An artifact project with a `design-system.json` file (colors, typography, spacing, radii and an optional component list) opens as a read-only sheet of swatches, type scale, spacing and radii when the web UI is built with `NEXT_PUBLIC_ARTIFACT_DESIGN_SYSTEM=true`. Agents and the CLI create and version it through the existing `page artifact create/publish/restore` commands; no new endpoint or storage. Default off.

- **Recovered HTTP panic reports identify the route without request details.** Crash reports and local panic logs use the registered route pattern and panic type; unmatched requests use a fixed label.

- ⚠️ **Behaviour change: notification channel URLs are checked more strictly.** The delivery library (shoutrrr 0.22.1) rejects a channel URL that could never send when a channel is created from the provider form or tested, and at send time for raw URLs: Gotify needs a real application token (15 characters starting with `A`, or a Gotify 3 `gtfya.` token), Google Chat needs both `key` and `token`, Mattermost needs a host, and ntfy topics follow ntfy's naming rule. Saved channels are never checked at startup or when listed; a Google Chat channel saved without `key` or `token` now reports a delivery error. SQLite driver updated to modernc.org/sqlite 1.61.0.

- **Artifact history warns before it is full and previews a retention rule.** Artifact and native document reads now return `quota.level` (`none`, `near` from 80%, `critical` from 95%, `full` at the limit) next to the existing `warning`. The owner snapshot, also printed by `crewship page artifact versions`, adds `retention_preview`: a dry run of "keep every version from the last 14 days, then the newest per day, plus latest, shared, named and restored versions" listing what it would thin. Nothing is deleted; retention stays keep-all. A `QuotaBanner` component for the Artifacts library is included but not yet wired.

- **Agents prepare a proposal when a person is editing a Word or Sheet document.** Instead of a bare refusal, the agent's `craft_propose` records a complete candidate over the version it read; the document stays unchanged. The person holding the editor can compare it, accept it as their own save (rights, lease and current version are re-checked in one transaction; a proposal over an older version becomes stale) or reject it. Any co-editor with write rights can reject without holding the editor. Open proposals over a version the document has moved past are marked stale when the agent proposes again, so they no longer count toward the limit of 16 open proposals per document. Also available as `crewship craft connect` actions. The agent's task then succeeds with outcome `proposal` and the proposal id (shown by `crewship craft task status`) instead of failing without a receipt; only a proposal recorded by that run counts.

- **An agent runtime is no longer held busy by another crew's interrupted run.** A run recovered without a container but recorded for a different crew no longer blocks refreshing this crew's runtime; a run with an unknown crew still blocks it (#4486).

- **A Read-only Design viewer can no longer stall every database write or lock an editor out.** Answering a Design websocket sync request no longer runs the Yjs engine while holding the server-wide writer lock, and a flood of sync requests closes the socket (4429). An update the engine refuses now closes with 4400 "Design update rejected" instead of 1008 "permissions changed", which sent the browser into an endless re-admission loop; 1008 is used only for changed authority. Another person claiming an editor's presence ID is ignored instead of closing the editor, and the same person reconnecting replaces their stale connection.

- **`crewship feature-flag` help explains roles, outputs and the Artifacts flags.** Every subcommand now has a description and an example; the help lists the Artifacts workspace flags with their defaults, dependencies and the web build switches their screens need, says that creating, updating and deleting a flag needs an instance administrator, and notes that `update`, `delete`, `enable`, `disable` and `inherit` print only a confirmation line (`create` honours `-f json`). Command behaviour is unchanged.

- **Deleting a workspace closes its public Page links.** Deletion revokes the links in the same transaction, and public reads also refuse previously deleted workspaces.

- **A preference no longer carries over to the next account signed in to the same browser.** The browser's copy of each preference (recently opened artifacts, favorites, panel sizes) now belongs to one signed-in user, so the next account no longer sees the previous account's values on first paint or uploads them, private artifact slugs included, into its own preferences. Nothing is read from the browser until the session is known, the older shared copy is dropped, and a change not yet saved for one account is sent only when that account signs in again.

- **Chat opens saved items in Artifacts.** With the Artifacts library on, the chat viewer has *Open in Artifacts*, and saved-document cards, the document access panel and page provenance link to the item's own `/artifacts/<id>` address instead of Pages. Without the library flag the links stay as they were.

- **Pages can hand its overview to the Artifacts library.** With `NEXT_PUBLIC_PAGES_OPEN_ARTIFACTS` and the library flag both on, `/pages` opens `/artifacts` in the same workspace. Reference links, restricted members' catalogs and single pages stay on Pages. Off by default.

- **The built-in `crewship` agent skill now covers Artifacts.** The guide an agent reads through the CLI explains when to use artifact projects, Design canvases and native Craft documents, which flags and switches each needs, who may write, how to reply to comments and hold the Craft lease, and what to do on a version conflict (409), full storage (413) or an uncertain 503 without retrying blindly. Command behaviour is unchanged.
- **Artifacts is the single home for a page and its Word or Sheet.** Behind the same two flags, `/pages/<slug>` resolves the page's immutable ID and opens `/artifacts/<id>` in the same workspace for a Page, a native Word or Sheet or a versioned project. Reference links, pinned versions, edit addresses, restricted members and any page whose ID cannot be resolved stay on Pages. A native Word or Sheet is edited inside its Artifacts detail in the single Craft editor with its lease (who edits now, ask for the handoff) when the server confirms the editor is available; otherwise the detail says editing is not available and keeps the saved preview. Off by default.

- **Shared artifact commenters can post feedback in the preview.** Comments stay anchored to the shared version without granting editing or agent execution rights; changing accounts, workspace or permissions retires an unfinished selection.

- ⚠️ **Behaviour change: a Comment grant can no longer queue agent work on an artifact project.** The Artifacts detail now offers Select and Save comment to Comment-level readers, as `/pages/<slug>?artifact=1` already did. `POST /artifact/comments` with `send_to_agent:true` returns `403` and stores nothing unless the author has Edit, matching Design comments. An agent run whose intent names no comment may answer feedback only with a version it published, never with `needs_clarification`, and no run may answer a task another run holds.

- **Workspace identity erasure also clears Mooring human attribution.** Collaboration edits keep their exact saved history while losing the erased person's ID; generic Mooring mandates keep their preconditions and revocation state and can no longer authorize that person's agent. Other people and workspaces remain unchanged.

- **Project source edits survive a lost save reply and a closed tab.** If the save reply is lost, the editor confirms the exact next version instead of reporting a false conflict, and an unsaved source draft is kept in the browser and offered back until it is saved or discarded.

- **Agents gain bundled Design and native Craft playbooks.** They explain scoped mandates, retained Design versions, session-bound leases and confirmed native saves. Design tool descriptions clarify version and conflict handling.

- **`crewship slides` and `crewship doc` help describes the real commands.** The generic "Slides <op>" and "Document <op>" texts are replaced with descriptions and examples, the `doc draft` subcommands get a summary, and native decks and documents are no longer presented as living in Pages. Command behaviour is unchanged.

- **Private artifact and document drafts survive expired sign-in.** Recovery requires the same identity and a fresh Page-read check. Failed local capture keeps the editor open behind a recovery warning; explicit sign-out asks before removing persistent copies and preserves newer revisions. New local payloads are encrypted; legacy plaintext from other identities is removed before identity admission, and confirmed read revocation removes reachable copies (#4606).

- **Artifact and Design drafts are no longer lost or left behind in the browser.** Edit source no longer overwrites a source draft kept after a crash, a successful save keeps edits typed after it was submitted, and a failed browser-storage read no longer deletes the stored comment draft.

- **The Artifacts detail no longer sends you to Pages where Pages opens nothing.** Behind `NEXT_PUBLIC_PAGES_OPEN_ARTIFACTS`, a native Word or Sheet whose editor is unavailable shows its saved version without an Edit that opened the same unavailable editor on Pages, and its preview error no longer points to Pages. An old-editor Word keeps Open in Pages only while its saved document can be read, because Pages opens it with the same read. Off by default.
- **Test Design canvases can be identified in the library.** Human canvas creation now retains the explicit test-item marker for catalog filtering.

- ⚠️ **Behaviour change: `journal priority` and `memory export` honour `--format`.** With `--format json` (or `yaml`/`ndjson`), `crewship journal priority` prints the server's answer as an object with `id`, `priority` and `previous`, and `crewship memory export` writes the bundle as before and then prints `out`, `documents` and `skipped` instead of the prose listing. With the default table or `quiet` output both keep their human-readable line. `memory export` help now states that it requires OWNER or ADMIN.

- Add human Comment grants for shared artifact feedback without edit or agent execution rights, explicit QA item markers and catalog filters, and confirmed archive and folder-move previews with live access checks. Access reports include effective capabilities and their sources; existing content, history and grants remain intact.

- **`--format json` now prints what the server sent for routines, skills and workspaces, and mutation commands answer in JSON.** `routine list/get` decoded the response into a CLI struct before printing it, so JSON lost the pending draft and its test result, `files` and `manifest`; `routine versions` lost each version's `test_result`; `skill get/list` lost `lifecycle_state`, `needs_credentials`, usage and missing credentials; `workspace get/list` lost `kind`, `personal_owner_id` and `guest_routine_max_run_minutes`. Machine formats retain every server field and preserve the explicit empty routine keys existing scripts received. Deleted-crew IDs remain usable for inbox history, unreadable successful crew-delete responses still produce a JSON receipt, and memory file reads are capped locally at 128 KiB. The human views gain a `Draft:` line and a TESTED column on routines, Lifecycle / Needs credentials / Uses 7d/30d on `skill get`, a LIFECYCLE column and `--lifecycle` filter on `skill list`, and Kind / Personal owner / Guest routine max run on workspaces. `agent stop/delete`, `crew delete`, `routine replay`, `policy set`, `skill archive/restore`, `workspace logo set/remove`, `routine pending cancel` and routine folder/template delete print the server's outcome under `-f json` instead of nothing; human output is unchanged. `admin instance backups overview` reports `crewless_workspaces`. New `crewship memory initialize` (first-write memory provisioning) and `crewship feedback peer-card` (read your own peer card). `feedback preferences` commands accept an agent slug, show the preference VALUE, check `--reason` against catalogue v1 and print JSON receipts. `inbox list --crew` accepts a slug, and `inbox list --deadline today` / `inbox counts` send your local end of day like the web inbox (`--day-end` overrides) (#4508).

- **An unsent artifact comment survives a crash.** The chat and library artifact viewer keeps the comment text in this browser for the same person and Page, and offers it again after reopening; the place has to be selected again.

- **Artifact comments reach agents as fenced data.** `artifact_comments` and `artifact_versions` now wrap comment text, the quoted element label and every reply in the same nonce-delimited `<untrusted source="artifact_comment">` block used for issue text, so a reader with only a Comment grant cannot write instructions into the owner's run. Selectors and code file content stay exact for anchoring and republishing.

- **Artifact saves are confirmed after an interrupted success response.** The CLI reads the exact successor version without repeating the publish request, preserves definitive refusals, and rejects duplicate-path matches. Craft errors redact session tokens before truncating their display.

- **`crewship page artifact comment --send-to-agent` no longer leaves the task stuck at "pending".** The task only starts when the artifact's source chat receives a message carrying its purpose, which the viewer sends and the CLI never did. `--wait` on `page artifact comment` and `page design comment` now sends it, confirms the host saved it and waits for the agent's answer or clarification; `crewship run --chat <chat> --artifact-target <file>` sends the same purpose by hand, including a "Describe it" creation (#4505).

- ⚠️ **Behaviour change: a busy agent exits `9`, a full artifact history exits `2`.** A message bounced because the agent already has a live run now exits `9` (was `1`) for `crewship run` and the new `--wait` commands; nothing was sent or stored. A full artifact version history (HTTP 413 `artifact_history_quota`) now exits `2` (was `1`) and says nothing was saved, your `--file` is unchanged and every version is retained (#4505).

- **`crewship craft` shows why the server refused.** Refusals printed only `native HTTP 409` and exited `1`. They now carry the server's text with the session token removed, exit with the usual codes (`5` conflict, `2` validation, `7` server, `8` network) and fill the `--format json` error envelope; a lease conflict names who holds the lease, and a proposal refusal says whether it was stale. Agent `task` commands still print status only (#4505).

- **`crewship page artifact publish` confirms a save whose reply was lost.** After a transport error, a 5xx or a 409, it reads version base+1 once and reports the save as done when that version holds exactly your manifest; otherwise the original error stands. `crewship page artifact reconcile` does the same check by hand (#4505).

- **More Design and Mooring operations from the CLI.** `page design create --test-item`, `page design watch --authority-revision`, `mooring command-session` and `mooring session --reauthorize` (#4505).

- **Home-installed agent CLIs remain visible during startup checks.** Offline qualification uses a separate temporary home while preserving read-only executable paths from the immutable image.

- **Mooring connect help now explains streaming and refusal conditions.** It documents output formats, the 256 KiB frame limit, agent-token refusal and rejected connections; the Design and Craft task reference covers versions, lease generations and uncertain saves.

- **Design artifacts gain an opt-in collaborative canvas.** People and agents can edit frames, shapes, text and images through Yjs, with live presence and normal artifact version history. Agents can address their selected canvas by its immutable ID. Disabled by default. Long-running cookie sessions renew only their collaborative transport after fresh authority checks, retaining unsaved work. Restoring saved canvases preserves prototype-named node IDs and their original contents.

- A shared dev release now switches one checked-in build profile (`CREWSHIP_BUILD_PROFILE` in `.env.production`); the flag tests and the phone browser contract verify the main and the release profile, and main must keep the main profile.

- **CLI stop confirms the caller’s cancelled run.** Waiting for a stop and signal handling require a private request-correlated completion (`cancel_accepted`, then `cancel_result`); another member’s terminal event, an agent stop or a server shutdown cannot report success. Repeated requests for the same run — on one socket or from several of the same user’s sockets — share its outcome, and the server answers `cancelled:false` with a reason after a 90 s deadline. **Requires a server from this release:** against an older server `chat stop --wait` and a Ctrl-C/SIGTERM-stopped `run` report “run ended; cancellation not confirmed by server (server too old?)” and exit 10 once the run’s `done` arrives, instead of waiting out the timeout. Chat retry selects the caller’s authored turn rather than another member’s latest message; an unattributed legacy turn is retried only in the caller’s own private chat (`GET /api/v1/agents/{id}/chats` now reports `visibility` and `created_by_caller`).

- ⚠️ **Behaviour change: `crewship run` stops a run on SIGTERM and only says `[cancelled]` once the server confirms it.** SIGTERM — what `timeout`, CI runners and supervisors send — used to kill the CLI and leave the run going server-side; it now sends the same stop as Ctrl-C. Both print `[stopping…]` and keep reading until the run's own terminal event, then `[cancelled]`; a stop not confirmed within 30 s exits non-zero, and a second signal still exits at once. `--no-stream` runs are stoppable the same way. New `crewship chat stop <chat-id> [--wait]` stops a run you started from another terminal or the browser (#4504).

- **`crewship run` and `crewship ask` can send what the web composer sends.** `--attach <file>` (repeatable) uploads into the chat and names the paths in the message with the composer's exact wording; `--page <slug>` attaches a Page snapshot; `run --chat <id> --ask-form <form> --var name=value` submits an agent's ask form with the envelope the server re-checks, printing `[form delivered]` or exiting non-zero with the refusal; `run --create-document` sends the composer's "Create document" intent. `run` also prints the run summary (`[summary] $… · tokens · turns`) and delegation, escalation and port-exposure progress (#4504).

- **New chat commands for what only the browser could do.** `crewship chat <id> --parts` shows thinking, tool calls and results, and group-chat authors; `chat export <id> -o file.md` writes the Export dialog's Markdown; `chat retry` and `chat edit -m` are Regenerate and Edit-and-resend; `--watch` on `chat refs`, `chat decision list` and `chat proposal list` re-prints on change, and `chat room messages --follow` tails a room. `chat stream` now renders the user's line, the run summary, busy/build/refusal notices and broadcasts instead of dropping them. Smaller: `conversation search --chat --from --has --after --before` (client-side, marked partial like the search box), `chat list --counts` (per-kind totals) and `crew peer-conversations --offset` (#4504).

- **`crewship chat stream` shows which assignment, escalation or exposed port an event is about.** Session broadcasts that are not chat events (`assignment_*`, `escalation_*`, `peer_query_*`, `port_expose_created`) reached the NDJSON run stream as a bare type name; the WebSocket delivered the same frame with its payload. The stream now carries the payload as `metadata`, cost-redacted like every other frame (#4504).

- **`crewship chat <id>` shows message times again, and `--since` filters.** The transcript read each message's `created_at`, which the messages endpoint never sends — it sends `ts` — so every header printed without a time and `--since` kept every message. It now reads `ts` (#4504).

- **"Send to agent" on Design and Project comments reports delivery correctly.** A delivered comment no longer turns into "Retry when the source chat is connected" after 15 seconds, and a busy agent is reported at once instead of after a timeout.

- **Native Craft editing can continue past access-token expiry.** The browser refreshes its cookie before admitting or renewing the same editing connection and replaces only its authenticated metadata stream. Unsaved work, the lease generation and in-flight saves remain in place; document mutations are never replayed.
- **Read-only Craft viewers saw editing controls.** Native Craft previews now show edit actions only when the server confirms current edit access. Comment viewers can open an explicitly published native preview without acquiring an editor lock or reading private drafts. The CLI exposes the same shared preview and publication paths. ⚠️ **Behaviour change:** admitted native CLI actions and shared preview reads reject HTTP redirects.
- **Workspace backups now preserve experimental workbooks.** Encrypted portable restore and forks retain snapshots, published audience and immutable mutation receipts; recovery fences unfinished edits and requires fresh editor sessions and run permissions.

- **Full document history now says what happens and what you can do.** Word and Sheet editors stop saving, state that every version is kept and the unsaved work stays in the browser, and offer the draft as a download. Projects keep their preview and source draft at full quota. Neither promises more storage.
- Add a disabled dashboard dataset storage foundation with atomic document version checks, bounded JSON batches, server attribution, portable backups and Page lifetime cleanup; code versions remain in the existing artifact VersionStore.
- Accept valid near-limit Dashboard data batches by counting their exact metadata and original value bytes, preserving document limits and atomic version conflicts.
- Add default-off Dashboard collection reads and atomic JSON document batches through authenticated Page API, CLI and original-run MCP tools. Shared readers use the current shared code manifest; data changes preserve code history and document conflicts never overwrite newer data.
- Classify Dashboard artifacts from the authorized code manifest in Page lists and detail: owners use the latest code, shared readers use the current shared pin. The disabled Dashboard data flag preserves the ordinary Project classification.
- Require actual Chromium execution of native document privacy regressions in frontend CI while preserving the strict browser-dialog guard.

- Add an opt-in Artifacts library at `/artifacts` (`NEXT_PUBLIC_ARTIFACTS_LIBRARY`): a gallery or table of projects, Word, Sheet, Slides and dashboards with kind and shared version, a project detail on its version history and the edit lock of a native Word; the Pages list reports `artifact_kind` and `artifact_shared_version`.
- Rebuild the opt-in Artifacts library on the Harbor 2 panel: Home, Mine, Favorites, Clean up, Test items, Empty and Archive views kept in the URL, a colour and drawn thumbnail per kind, folder icons, J/K navigation, and one New artifact dialog that offers only kinds this workspace can create, including Slides through an agent. Share with Read, Comment or Edit inside the workspace, an Access tab that says why each person can open an item, folder settings, and Move, Share, Archive and Unarchive on a selection, each confirmed after a preview of who gains or loses access; archiving hides and never deletes. `NEXT_PUBLIC_ARTIFACTS_SHARING_MOCK` runs sharing in the browser until the backend routes ship. New Doc and New artifact create Word documents through one shared hook.
- Add opt-in inert Dashboard previews (`NEXT_PUBLIC_ARTIFACT_DASHBOARDS`): authorized collection data refreshes numbers, tables and native meter charts without publishing new code; shared readers stay on their shared manifest and data has source and freshness labels.

- **Every Dashboard number shows where it came from.** With `NEXT_PUBLIC_ARTIFACT_DASHBOARDS` on, hovering or keyboard-focusing a bound value in a Dashboard preview shows its dataset, row and field, its producer (`You`, `Contributor` or `Agent`) and its last update time in UTC; the same text is the value's accessible description and appears in the Data sources list. Values whose producer is unknown, or whose document is not loaded, are marked "Source not stated" and drawn with a dashed underline instead of looking authoritative. The provenance comes from the reader-safe fields the data API already returns; no API or storage change.
- **A Design created from the Artifacts New dialog opens.** The dialog handed the new page's slug to the detail as if it were an ID, so a fresh Design landed on "This artifact is not available". It now opens the created artifact by its slug.
- Add Preview, History and Comments tabs to the opt-in Artifacts library; sending an anchored comment starts the source agent, with delivery confirmation and retry of the saved task.
- Add a bounded Slides artifact import adapter for a closed `deck.json` and authored HTML profile, reusing the existing slide schema and static comment anchors without enabling a new editor or preview.
- Open backend-typed artifacts in their versioned viewer from library links and ordinary Page URLs, preserving workspace and selected versions without falling back to an empty panels view.
- **Artifact comments could report that the agent did not start after it answered.** Persisted chat acknowledgements now confirm the exact artifact request, and verified task progress clears stale delivery warnings and their retry action.
- Show agent artifact project steps in chat as cards with kind, version, Draft/Shared state and a running "Creating version n…" step that settles into "vn ready · Restore"; off by default behind `NEXT_PUBLIC_CHAT_ARTIFACT_PROJECTS`.
- Chat artifact cards wear the same coloured kind tile and kind label as the Artifacts library (from the shared kind registry), show `Shared vN` and the server-reported `Agent working…` as status pills, say "Can’t show this version here" instead of guessing a type, and the running step says the current version stays as it is, or that nothing was saved when it fails; still behind `NEXT_PUBLIC_CHAT_ARTIFACT_PROJECTS`.
- **Saved artifact comments could lose Retry when their viewer was closed.** Reopening now offers Retry for an undelivered task, rereads its current delivery state and reuses the same saved comment; accepted or running tasks are not sent again.
- Add an opt-in private native-document draft journal and whole-snapshot save coordinator. Recovery offers compare or copy, stale generations cannot replay drafts, and only an exact durable receipt confirms a save. Existing editor profiles remain unchanged.

- **Native Sheet documents can use the full GridCraft editor.** The experimental, default-off native profile now initializes qualified Grid workbooks with the same edit lease, local draft and confirmed whole-document save flow as Word.

- Open an artifact card in a side viewer (full screen on phones) with screens, element select and anchored comments, the agent comment queue, version history and restore; off by default behind `NEXT_PUBLIC_CHAT_ARTIFACT_PROJECTS`.
- Add a default-off typed artifact Slides preview (`NEXT_PUBLIC_ARTIFACT_SLIDES`) with existing slide canvases, thumbnails, presentation, authored comment anchors and authorized PDF download; requires the backend Slides capability.
- Show the Craft edit-lock bar, agent proposal cards (Compare / Accept / Reject) and recovered local drafts in chat, and a "+ New artifact" composer menu offering only kinds with a backend; off by default behind `NEXT_PUBLIC_CHAT_CRAFT_LEASE` and `NEXT_PUBLIC_CHAT_ARTIFACT_PROJECTS`.
- **Opening a new conversation logged three 404s.** A draft session no longer requests its execution profile, messages or participants before the first send creates it.

- **`crewship workspace artifact-policy show|set` work with a workspace chosen by slug.** The slug from `--workspace`/`-w`, `CREWSHIP_WORKSPACE` or the config is now resolved to the workspace ID before the request, as other workspace commands do, instead of being put raw into `/workspaces/{id}/` and answered with 404; a slug that does not resolve fails rather than falling back. `set` without either `--crew-id` or `--clear-crews` now says one of them is required instead of `not both`.
- **Project Edit grants could return 403 instead of allowing changes.** Human editors can read and save the latest complete project with version conflict checks and their own attribution. Read and Comment stay on the shared version; publishing a shared pin, restoring history and agent execution keep separate owner permissions.

- **Artifacts CLI help now explains data, Slides, archive and creation policy commands.** The help includes required flags and examples, and agent refusal text names artifact and Design operations. Command behavior is unchanged.

- **Artifact authoring clients support complete project versions.** Add pilot MCP tools and `page artifact` commands for atomic manifests, explicit version conflicts, restore and anchored feedback on servers that enable the artifact project backend.
- Artifact project feedback exposes verified human/agent attribution, occupied addresses have a distinct error, and authoring tools require stable selection IDs.
- Add default-off authored Slides projections and vector PDF export with explicit version pins and current Page/run authority rechecked after rendering. Existing artifact history and comments remain authoritative.

- Add authenticated artifact project creation and workspace availability endpoints behind the disabled artifact projects flag.

- Artifact creation and publication tools now request stable element IDs so generated screens support precise element comments.
- Version the bundled Project, Dashboard and Slides authoring packages and preserve their release in agent skill files, with immutable compiled type metadata and unchanged content versions.

- **Page catalogs filter and page on the server.** Search names and slugs, combine kind (including Design), privacy, version, owner, folder and empty-item filters, and choose stable ordering through the existing API and `page list` CLI. The Artifacts library can page its All view on the server behind the default-off `NEXT_PUBLIC_ARTIFACTS_SERVER_CATALOG` flag. Totals and page windows include only authorized matching items; existing unpaged callers retain their array response.
- Clear copied-command feedback timers when onboarding unmounts.

- **Saved Slides pages could look empty.** Page detail and list responses now include native Slides presence and schema metadata, allowing the existing opt-in Slides viewer to recognize saved presentations.
- Add a standalone, bounded Slides-to-PDF foundation with a fixed embedded font, vector shapes and tables, and explicit text overflow errors; product export entrypoints are not enabled yet.

- **Native single-editor documents gain a default-off edit lease boundary.** SQL-backed holder generations fence expired, handed-off and revoked writers; workspace erasure and user deletion remove retained holder identities while preserving the fence. Lease acknowledgements recheck authority after SQL; recovery retires source holders while retaining generations, and portable replacement refuses issued target fences. A target-local workspace issuance marker preserves restore protection after Page deletion. Runtime editor and version-store wiring remain disabled.

- Expose a default-off native Craft human session and edit-lease HTTP API with Page-scoped availability, named holders, requested handoff and live connection renewal. Original credentials and current Page rights fence every action; existing document profiles are unchanged.

- Add a bounded host adapter for original Word/Sheet engine edits and reads: pinned executables, private files and a closed command allowlist. Agent authority remains in the separately guarded native task and edit-lease boundary.

- Add separately opt-in native Word/Sheet agent tasks with explicit original-human consent, confirmed run identity, shared edit leases, original-engine edits and receipt-backed whole-document saves. Human holders are refused; the original human can inspect actual task outcomes and stop the agent without lending a human editor session.

- Allow native Craft editors to copy to the clipboard while keeping clipboard reads and opaque-frame isolation restricted.

- Add a default-off whole-native WordCraft/GridCraft version store with immutable compatibility pins, engine validation, lease and CAS fencing, exact snapshot receipts and portable profile backups. Its visible 16 GiB history budget preserves versions on exhaustion; editor activation remains separate.

- Create vendored WordCraft numeric test fixtures exclusively so a competing output file cannot be truncated.

- Execute a flat WordCraft editor package with a real WASM snippet import in the packaging regression, checking the original ABI identity and manifest hashes.
- Keep an idle native WordCraft read alive when typing starts, ignoring its obsolete projection without resending the command.
- **Taking over a native document no longer ignores the first click during refresh.** Lease controls wait for a newer read-only editor snapshot to finish opening before accepting custody actions.
- Explain when a browser cannot support the isolated WordCraft command editor, including iPhone browsers.

- Allow the 72 generated fixture-qualified WordCraft commands in the default-off C1 backend test profile, with closed parameters and a new exact catalog identity.
- Keep native selection receipts valid when a WordCraft command also returns command-specific metadata.

- Add a disabled native WordCraft command HTTP controller with immutable viewer fences, confirmed SQL-only projections and bounded current-rights delivery; product startup registration remains separate.
- Validate private C1 checkpoints and quoted RPC frames with their existing 4MiB/32MiB byte bounds and a fixed bounded JCS structure profile, preserving the legacy command-envelope limits.

- Preserve bounded native C1 command selection in the original immutable staged operation receipt and atomic SQL outcome, without adding a shared peer caret or inferring selection from input.

- Add a disabled command-document runtime lifecycle that initializes only new documents, restores confirmed SQL state, and retains existing owner fencing without falling back to the legacy adapter.
- Bound the native C1 host's live generation history across repeated restores, preserving pending candidates and handles when replacement capacity is refused.
- Add a separate opt-in C1 renderer source recipe and actual native WASM registry/codec harness, with confirmed selection checks and explicit pending-input refusal; it does not enable product UI, preserve rapid input or change the legacy SDK.

- Add a default-off private inherited-FD WordCraft command host that pins its native helper and stages immutable checkpoints for trusted SQL confirmation, without exposing a public commit endpoint.
- Keep private native WordCraft agent commands and outcome lookups bound to their original confirmed chat mandate and current Page permissions.

- Add an opt-in private native command port with pinned engine identity, bounded correlated process messages, opaque staged handles, and SQL-authoritative recovery without command replay.

- Keep the opt-in WordCraft command host candidate separate from confirmed state until a trusted host SQL-success callback, retaining participant undo and committed operation receipts across checkpoint recovery.
- Preserve new command-document formats and immutable engine pins while legacy collaboration adapters refuse their payloads, including when command support is disabled.
- Add a separately disabled SQL interface for new WordCraft command documents, with current-rights checks, atomic checkpoints and operation receipts, and reconciliation without replay after uncertain outcomes.

- Keep idle WordCraft editors connected through standard WebSocket ping/pong while preserving the existing response and inactivity limits.
- Show the Crewship page name in attached WordCraft chrome and hide its standalone Discord, Share and Zotero controls.
- **Native document exports did not download.** Word and spreadsheet export copies now download through the host browser while retaining the isolated editor and separate server save confirmation.
- **New Doc was unavailable with only the native Word profile enabled.** The qualified, default-off native profile now offers Word creation through the existing whole-document initializer and opens the full editor after releasing creation custody. Ambiguous initialization never creates another Page or blindly retries a write.

- Open document links in their accessible workspace before requesting document content, preserving unsaved-work navigation guards.

- **WordCraft documents can be created from Pages.** When native collaboration is enabled, choose WordCraft in New Doc to open a blank document in the editor without setup scripts.

- **Create native Sheets from New Doc.** The Sheet choice appears only for a qualified GridCraft release, initializes its original engine model, and reopens saved native Sheets in the full editor.

- **Native Sheet documents can use the full GridCraft editor.** The experimental, default-off native profile now initializes qualified Grid workbooks with the same edit lease, local draft and confirmed whole-document save flow as Word.

- **New Doc was unavailable with only the native Word profile enabled.** The qualified, default-off native profile now offers Word creation through the existing whole-document initializer and opens the full editor after releasing creation custody. Ambiguous initialization never creates another Page or blindly retries a write.

- **One departing or expired collaborator could disconnect everyone.** Keep late lease replies scoped to the original closed participant and finish an already reserved reply before that participant leaves, preserving the other collaborators' session.

- **Opening large collaborative documents could time out.** Avoid repeated checkpoint validation in incompatible message variants and scan the existing base64 schema vocabulary directly, preserving checkpoint integrity and the five-second startup deadline.

- Bind document-agent task registration and partial-result policy to the original admitted human task before native submission.

- Add bounded native document pages to the original task's `doc_read` tool, preserving one immutable revision, complete application data and current read authorization across continuations and physical delivery.

- Allow an explicit read-only native document task through the existing original-message flow, preserving its attached read intent across admission, native grants, renewal and retirement while rejecting submissions. Default tasks retain their original write mode.

- Qualify Mooring startup metadata and complete targets from one checked owned WordCraft document, preserving checkpoint integrity and final owner checks without changing runtime deadlines.

- Replay contiguous committed Mooring native deltas after recipient reopen or a delivery gap, checking current reader rights for every frame without creating a new snapshot or source authority.

- Show recorded native agent edits separately from current document grants and tasks, with independently authorized source-chat backlinks. Historical references grant no rights and do not claim artifact creation or complete version history.

- Package the optional Mooring runtime and isolated WordCraft editor from pinned public sources, with embedded asset integrity checks and disabled-by-default runtime configuration.

- Bound Mooring session admission request and response I/O, flush buffered responses under the original ingress lease, and retain the read deadline through HTTP body cleanup.

- Rust-backed Mooring saves retain immutable original human/agent task attribution in the same transaction as each new saved atomic change. Rejections, failed commits and known retries do not create another edit record; this does not yet provide artifact creation, version browsing or live chat acceptance.

- **Document access in chat:** distinguish the agent's current document grants from verified active task permissions. Hide inaccessible document metadata, expire unverified views, and identify unknown output provenance explicitly.

- Preserve original task authority and private-run ownership through the existing Mooring agent dispatcher and confirmed-attempt chain. This prerequisite does not enable an agent route or qualify a private execution environment.
- Mooring sessions retain a Pending notification and its matching terminal receipt separately while delivery is blocked, preserving each until its own completion.

- WordCraft documents expose existing authorized sharing from their header and list menu without replacing the running editor. Opening access rechecks the current viewer and keeps document sharing separate from agent task permissions.

- Run the complete catalog of actual Mooring Rust/SQL integration tests in hosted CI using freshly built public-source fixtures; reject missing, skipped or failed execution evidence.

- Grade the actual Mooring session response and optional editor DTOs against their OpenAPI schema without increasing the ungraded-response budget.

- Keep the participant stalled-write regression tied to its unchanged physical/context deadline even when the network poller wakes before the context timer callback.

- Document the default-off Mooring session request/response and bodyless WebSocket upgrade, with exact conditional-route checks and CLI/configuration contracts.

- WordCraft explains restricted undo/redo refusals without closing the editor or changing its save state; deletion undo and changes overlapping another author's deletion remain refused.

- Mooring CLI streams honor JSON/NDJSON and YAML output; unsupported quiet output is rejected before opening input or connecting. Original submitted packets remain unchanged. Literal HTTP registrations expose the existing authenticated session and WebSocket paths to route inventories.
- Account for both Mooring FIFO lifecycle goroutines during API teardown, and make the file-download classification guard ignore braces inside Go literals and comments.
- Isolate Mooring Page-grant revocation to the affected participant while rechecking unaffected writers against current rights. Retain bounded old-gate output until its original provenance and current delivery gate are both verified, and decline a revoked pending ticket without inventing a replacement grant.

- Connect default-off Mooring human submissions to immutable live originals, same-writer public receipts, and SQL-backed per-atomic peer updates. Bootstrap requires the actual native human and complete-origin-inventory capabilities; restart recovery and agent writing remain separate qualifications.

- Add a default-off authenticated Mooring HTTP/WebSocket controller with one-use human joins and current SQL-gated checkpoint delivery. Raw editing remains refused until the native human prepare capability is integrated; in-process backup restore requires disabling the controller and restarting.
- Retain bounded original human proposals only after authenticated admission commits, and require their immutable publication proof before any sealed outcome lookup or dependency rejection. Missing or uncertain originals remain nonterminal; this does not enable raw editing.

- Mooring SDK recovery refuses incomplete full snapshots even when Yrs reports no missing updates, preserving every original unsaved draft instead of accepting silently omitted history.

- **Mooring agent reads:** an inactive session checkpoint reader retains the original agent mandate and confirmed attempt under the existing immutable authority; it grants no write or external delivery access.

- **Independent collaboration authors:** dormant admission callbacks distinguish original author generations from broad delivery invalidation, so another user's grant revocation does not reject an unaffected original author. Current source and Page policy remain required; missing tracking or schema drift stays nonterminal, and no content path is enabled.

- **Collaboration revocation metadata:** prepare persistent author-relevant generations from canonical policy mutations, separate from broad delivery invalidation. Portable restore preserves target tombstones. Admission integration remains unqualified and disabled.

- **Mooring ingress groundwork:** an inactive bounded host registry retains original operation membership and authenticated author proofs after admission COMMIT. Session transport remains disabled pending independent review and mixed-author revocation qualification.

- **Mooring session groundwork:** inactive queued commits retain their exact owner and original author proofs; uncertain authorization cannot become a durable refusal. No session transport or agent execution is enabled.

- **Mooring recovery groundwork:** inactive human admissions can retain their original identity and authority across a verified Rust-only replacement. Old store bindings and join tickets cannot follow the new process; issued delivery gates remain recorded until blocked or expired.
- **Mooring ownership groundwork:** a host can voluntarily release its exact current owner lease, preserving its generation and every issued delivery expiry. Replacement ownership does not acknowledge pending delivery gates.

- **Mooring admission groundwork:** an inactive human registry preserves original Page authority, burns bounded join tickets once and opens current SQL delivery gates. Its store wrapper holds the restore fence through the complete operation.

- **Mooring authorization groundwork:** an inactive human Page authority adapter checks current canonical grants, folder scope and original credential inside the protected writer transaction.

- **Mooring admission preserves the original human credential.** Authenticated chat receipts retain the original user revocation fence and exact credential through run admission and retries; legacy receipts remain unfenced and cannot authorize the new Mooring admission path.
- Conversation transcript appends stay inside their configured storage root even when an existing transcript path is a symbolic link.
- Adapt WordCraft C-E acceptance to actual HTTP commit receipts and passive native queue observations, keeping separate visual evidence, authenticated peers and participant undo requirements.
- **[Resource Access v1](docs/security/rbac.mdx#resource-access-v1)** delivers Guest/restricted mode, per-object agent/routine/project sharing, crew View/Use presets and trusted Manage with ordinary membership controls, existing Pages ACL, Publish in UI/API/CLI, and atomic chained audit with sealed keyring, rotation, verification and alerts. Credential grants, crew/workspace recipients, the complete inherited Access card/grid, universal GET/stream/query-count guards, unified Pages grants and Guest published-routine execution remain deferred to v1.1; the documented absence of a universal leak guard is an accepted release limitation.

- **Explicit crew managers can use ordinary member controls.** A live trusted Manage share enables adding and removing ordinary crew members in Settings. Role editing and removal of explicit crew roles remain administrator controls. Failed access checks and context switches withdraw grant-based controls.

- **Crew sharing can create explicit trusted Manage grants.** The crew Share dialog and person Access editor offer Manage to trusted MEMBER/MANAGER recipients, preserves account mode and other grants, and keeps inactive shares visible for revocation after role changes. Guest shares remain View/Use; Manage does not assign roles or expose credentials.

- **The opt-in WordCraft command editor can show silent connection loss without losing its draft.** A separate connection indicator stops claiming “Uloženo” after its configured server-silence limit and waits for authoritative server state on recovery, without replaying commands. The command host must explicitly wire this component before it affects an editor.

- **Idle work polling avoids unnecessary writer transactions.** Empty or not-yet-eligible queues use a fresh read hint; capacity, deadlines and attempt ownership remain checked in the claiming transaction when work is present.
- **Trusted members can receive explicit crew management shares.** Administrators can grant crew Manage to trusted MEMBER/MANAGER recipients through the member-policy API and CLI, permitting crew profile/configuration and membership changes without explicit crew role overrides. Role assignment, crew deletion, private-network opt-in, budgets and workspace administration retain their existing guards. Account conversion requires deliberate revocation of trusted-only shares first; writes and audit remain atomic. Existing Access editors preserve and display these shares.
- ⚠️ **Behaviour change: Host lifecycle hooks require instance administration.** Creating, editing or enabling host commands now requires an instance administrator and appropriate token scope. Existing host hooks are retained but disabled for explicit review after upgrade; restored hooks also require local review. UI and CLI explain how an administrator can review and re-enable them. Live host-hook changes commit atomically with their authorization audit. Shell output capture is bounded while retaining the existing truncation and exit-result behavior. Container hooks and the default lifecycle pause are unchanged.
- **Guest agent access can inherit from an explicit crew share.** Administrators can share a crew with View or Use through the member-policy API and CLI. View discovers current crew agents; Use also permits Chat and Run, without Delegate or credential access. Revocation, crew retirement and agent moves fence existing attempts. Access screens preserve and display saved crew shares.

- **Guest runs of published routines are deferred from the v1 contract.** Guests retain explicitly shared View, Results, Edit and Publish rights; publication never starts execution. Team members and crew triggers initiate routine runs under their existing authorization rules. Guest execution requires a separately qualified private runtime: a default install returns `503 restricted_runtime_unavailable` without creating or queuing work. Existing optional runtime code and configured qualifications are unchanged.

- **Restricted text workers have an independent release producer.** A main-only manual workflow can publish scanned, signed immutable `responses_text` candidates with source, binary and license provenance. Pull requests and publication test the real production worker against synthetic data; signing requires the exact candidate digest to pass. Image approval, host qualification and Guest runtime acceptance remain separate steps.

- **Restricted native scratch tools can fail on noatime-backed Docker storage.** The native image rebuilds bubblewrap with an atime-preserving remount fix while retaining the inner workspace sandbox and unchanged container security policies.

- **Guests can read explicitly shared crews.** Crew View/Use now opens filtered crew list/detail with identities, agent counts and current agent statuses, while configuration, credentials, membership and activity stay hidden. `crewship crew access` explains the actor’s current Guest share; Use remains conditional on agent authority and runtime preflight. Revocation, crew retirement and issuer authority apply immediately to subsequent requests.

- **Administrative security operations explicitly opt in to emergency audit fallback.** Only single/all-session revocation can use this fallback in the session handler; unlock remains chained-only, and unknown internal operations are rejected before any account or audit mutation. Web password changes and resets continue to fail closed on a broken audit chain.

- **CLI object sharing accepts routine Publish.** `crewship share` and `unshare` now accept `--operation publish`, matching the Share dialog. The server still requires Edit in the resulting policy; unrelated grants and issuer provenance are preserved, and conflicts are never retried.

- **An open workbook could remain active after its editor grant was removed.** Revocation now closes the persisted editor session in the grant transaction, sends a targeted `session_closed` control immediately, and drops queued protected frames while keeping other workbook subscriptions alive. A bounded fallback catches membership and ownership changes.

- **An agent could save a result calculated from cells that had already changed.** Workbook commands now carry cell and range read preconditions, including the range structure revision, and reject changed inputs with a visible reason. Older agent clients conservatively require an unchanged base revision.

- **A full workbook history could silently erase earlier revisions.** Writes now fail visibly with `quota_exceeded` when history or checkpoint capacity is exhausted, preserving the confirmed workbook and every previous revision.

- **An unavailable embedded editor offered no direct retry.** A failed startup now explains the availability problem and offers “Retry editor” after the existing connection deadline, creating a fresh isolated frame. Connected editors retain their current draft and pending changes.


- **A confirmed application edit could remain stuck on “Saving…” during a live update.** The editor host now waits for an in-flight snapshot read and its queued fresh read before acknowledging the durable receipt, while retaining the same mutation for a failed-read retry.


- **Mooring activity was missing from journal filters.** Creation, confirmed edits and agent mandate changes now use registered event types and appear in the Artifact activity group with matching icons.


- **Selecting a workspace could leave the rest of the application unclickable.** Workspace rows now allow the menu to dismiss normally after selection, releasing its modal pointer lock before returning to Artifacts or another workspace screen.


- **Application editors can share a small TypeScript protocol SDK.** The pilot adds a manifest-driven editor surface and a non-Rust reference editor with separate local drafts, live confirmed state and durable receipt status; GridCraft retains its existing conflict recovery on the shared capability channel.


- Workbook publication, custody requests, explicit ownership transfers and orphan deletion now append their authorization audit atomically; failed audit writes roll back the access change.

- Workbook conflict notices and save status keep the editor frame stationary, preserving rapid input during refusals, including on narrow screens.

- ⚠️ **Shared workbooks no longer accept direct agent mandates.** The experimental post-publication exception bypassed the required proposal path. New admissions and legacy mandate use now fail closed with `proposal_required`; proposal delivery remains unavailable. Private workbook mandates are unchanged.

- **Workbook previews now explain why editing is unavailable.** A disabled workspace, unsupported browser, failed availability check or invalid editor configuration has a visible reason and next step. Failed availability checks can be retried without reloading the page.

- **Workbook editor: edits saved during a reload no longer stay "Saving…".** When the workbook was reloaded (pruned history or an import) while a saved edit waited for earlier revisions, the editor was never told it was saved and kept showing it as unsaved, hiding later changes to that cell. Such an edit is now confirmed right after the reload, a repeated send gets the same confirmation without a second write, and a reload never takes the editor back behind a revision it already shows.
- **Workbook editor: a refused edit never loses cells.** A refused multi-cell edit (a paste, a fill) keeps every cell on the Page, marks which ones another writer changed, and waits for a decision: **Keep mine** writes all of its cells again, **Take theirs** keeps the other writer's values only for the cells they changed and still saves the rest, and **Discard mine** drops an edit with no such cell. Every refusal (also an unconfirmed edit or one whose recalculation could not be confirmed) stays open until decided, survives a workbook reload, and holds the status at not saved and the leave prompt; deciding one never clears another. Each notice row names its cells for screen readers, announces itself politely, disables its buttons while the choice is saved and moves focus to the next decision or the editor. Taking theirs on a session that expired unnoticed reopens the session instead of closing the editor.
- **Workbook editor: clearer bundle failures and same-cell conflicts.** An editor bundle that does not match the approved version is now reported as such instead of as a protocol break. When another writer changes a cell you are editing, the host warns at once (when the editor reports its open drafts) and keeps your draft; a commit refused because of that change shows both values with Keep mine or Take theirs instead of only an error. Take theirs sends nothing; once no other refused change is shown and nothing else is unsent, the status returns to no unsaved changes and the editor reloads the head so its own refusal notice clears. Conflict notices also clear whenever the editor loads a fresh snapshot.
- **Experimental embedded workbook editor host (off by default).** With the workspace flag `gridcraft_editor` and a server editor session, a workbook Page frames the editor from its own origin with exactly `sandbox="allow-scripts"`, `credentialless` and no referrer, checks the handshake (frame window, opaque origin, bundle digest), and ends the session and removes the frame on any later load of the frame. **Saved** appears only after a durable server receipt; an answer without one is retried a bounded number of times and then reported as not saved, without holding back later edits. A failed workbook read at open, a handshake that does not finish within 15 seconds, the editor being turned off or its bundle withdrawn while open, and an expired session all remove the frame and fall back to the read-only preview with a notice. Leaving with unconfirmed edits asks first. Otherwise the read-only preview stays.
- **The embedded workbook editor needs no extra hostname and no configured origin.** With the editor enabled and no `CREWSHIP_EDITOR_RUNTIME_ORIGIN`, Crewship serves it on the Studio origin under `/_editor/b/<digest>/`, with no DNS record, certificate or proxy route, and without any origin setting: the editor's policy and Studio's `frame-src` follow the origin each request reached (its `Host`, and the scheme by the trusted-proxy rule), and the host page frames the editor by path. `CREWSHIP_PAGE_STUDIO_ORIGIN`, when set, becomes the only origin the editor answers on (other hosts get `421`). The editor still runs in an opaque, CSP-sandboxed origin. Its policy sources and Studio's `frame-src` name only the bundle path, so it cannot call the Studio API or navigate itself onto a Studio page. That path scoping holds only while nothing in front of Crewship redirects or rewrites `/_editor/`; with the mandatory iframe attributes (`sandbox="allow-scripts"` and `credentialless`) the frame stays opaque and without cookies either way. The server learns the public origin from signed-in browser requests (or uses the configured one) and checks it for such a proxy, recognising a traversal that reaches Crewship outside the editor by its `X-Crewship-Route` header; a confirmed redirect, path rewrite or stripped `X-Crewship-Route` disables the editor on that exact origin until three consecutive checks pass again. Because those request headers are under any signed-in user's control, learning is bounded: `https` only (plain `http` only for loopback on a server bound to loopback), never link-local, cloud-metadata, unspecified or multicast addresses (the self-check also refuses to connect to them), one origin per user, at most four, forgotten after 24 hours unused, and an administrator's origin always gets a slot. Until a browser has used Studio the check is `pending`. The public `/healthz` shows only `ok`, `pending`, `failed` or `disabled`, counting only the configured origin and origins an administrator used; instance administrators see origins, causes and which user taught each origin with `crewship admin instance workbook-editor`, and `crewship doctor` repeats the check from outside for origins on the `--server` host and warns while the server's own check has not passed. The docs list the proxy rules (path unchanged, `Host` forwarded, no redirect, no SSO gate), which are reverse-proxy defaults. It answers `403` to requests that carry Crewship's own session, refresh or CSRF cookies, so it never loads without `credentialless`, while cookies a load balancer or CDN sets (for example ALB stickiness or `__cf_bm`) do not stop it from reopening in the same tab. It also refuses Studio pages loading its code. Editor responses send Studio's exact HSTS value, assets are `Cache-Control: private` so shared caches never store them, Studio documents get `private` added to their `Cache-Control` while their policy names the request's origin, and the editor policy carries `webrtc 'block'`; because Chromium does not enforce that directive yet, bundles that reference the WebRTC API are refused at load in both modes. A dedicated editor origin remains optional hardening. Same-host mode is refused with a cleartext non-loopback configured Studio origin, with a Page runtime on the Studio origin, and when `null` is a trusted origin.
- **Default-off workbook editor origin.** Operators can configure a dedicated HTTPS origin that serves only digest-pinned, manifest-verified editor bundles (pinned by the manifest digest) under a fixed server-set policy: the document is CSP-sandboxed into an opaque origin (no cookies, storage, top navigation or popups) and must be framed with `sandbox="allow-scripts"` plus `credentialless`, assets load cross-origin without credentials, manifests are decoded strictly, inline scripts run only by hash, `'wasm-unsafe-eval'` applies only there and `frame-ancestors` is limited to the Studio origin. The configuration refuses an editor host shared with or parent of Studio or the Page runtime, apex and trailing-dot hosts, and trusted API origins; Studio frames it while enabled.
- **Experimental offline workbook operations** add a default-off GridCraft Artifact adapter, native-file imports and scoped agent cell edits with durable receipts, retry recovery and bounded worker admission. Runtime activation requires a qualified persistent digest-pinned worker reached over a private authenticated socket. Embedded editing, collaboration and portable workbook backup/restore are unavailable; affected workspace backups fail explicitly.
- **Guest access explanations match the supported resource policy.** Member settings name agents, routines and projects; CLI help explains the runtime prerequisites, and Edit explains the separate Publish share instead of claiming publication always needs a trusted reviewer.
- **Skill repository imports use verified, pinned HTTPS connections.** Redirects and inherited Git/proxy/credential configuration are disabled. Administrators can allow exact private Git hosts with `skills.private_hosts`; loopback and metadata targets stay blocked. Imported `SKILL.md` files are read within the chosen import root, with bounded regular-file reads.
- **Backup inspection reads metadata and reports that integrity has not been verified.** Restore, verification, recovery and conversion use operator-configured decoder, work, output, metadata, time and admission limits. Defaults allow one million logical entries and 256 MiB of cumulative path/link names across all passes. Large operations can fail with an explicit resource allowance error; operators can tune the documented capacity settings.


- **LLM stream accounting avoids redundant JSON decoding.** The sidecar decodes valid SSE usage envelopes once while retaining existing token accounting and malformed-root fallback.

- Mooring SDK recovery refuses incomplete full snapshots even when Yrs reports no missing updates, preserving every original unsaved draft instead of accepting silently omitted history.

- **Ask form patterns are checked by the server before a submitted answer is saved.** Author patterns no longer run in the browser's native regular-expression engine, including in message previews. The server uses the chat agent's stored definition and the same answer validator as CLI preview; a refused answer stays in the open form with its field error. ⚠️ **Behaviour change:** Go-only patterns such as `(?i)` are now enforced where older browsers silently skipped them. Legacy stored patterns Go cannot compile remain unenforced, while saving a new or updated definition with an invalid pattern is still refused. Invalid or stale submission envelopes are rejected rather than saved as ordinary messages. Restricted text-only chats refuse ask forms instead of discarding their validation metadata. Deferred submissions recheck the current form and Page access after an environment build; refusals are private and correlated with the original submission.
- ⚠️ **Behaviour change: routine expression inputs stay data.** CEL and expr code now receive typed inputs and prior step outputs instead of rendered program text. Simple legacy `{{ inputs.x }}` references, including a whole quoted reference, translate at runtime without rewriting saved definitions. Embedded or complex templates are rejected on save and fail closed for historical definitions; use typed selectors directly. Complete JSON step outputs retain their JSON types, missing selectors fail explicitly, and nested selectors walk each path segment. `crewship routine validate` reports the same migration guidance.
- ⚠️ **Behaviour change:** Public Pages password checks have configurable process-wide and per-link concurrency limits. Busy checks return 429 with Retry-After immediately; existing per-link rate limits and password refusal responses remain in force.
- **Native WordCraft and GridCraft editors stay connected through unrelated workspace changes.** Creating another Page, changing a grant on another Page or adding a workspace member no longer disconnects every open native editor with "Editor odpojen" and a 403 on the next save. A native editing session now ends only when a change can affect that person or that Page, including a revoked and restored grant, membership loss or a revoked credential.
- **Open Design canvases stay connected through unrelated workspace changes.** Creating another Page, changing a grant on another Page or adding a workspace member no longer closes every open Design websocket in the workspace, which could drop unconfirmed edits on large canvases. A Design connection now closes only when a change can affect that person or that Design Page, including a revoked and restored grant, membership loss or a revoked credential.
- ⚠️ **Behaviour change:** Routine-version and consolidation diff previews share configurable byte, line and concurrency budgets. Oversized previews return 413 and busy comparisons return 429 with Retry-After immediately; the UI and CLI show an explicit refusal. Accepted comparisons keep their existing hunks and stored definitions are unchanged.

- **Audit history damage is detected without operator requests.** Full instance and workspace verification now runs at startup and hourly outside writer transactions; post-upgrade defects and unchained fallback records alert instance admins. Delivery receipts commit with the inbox notice and survive inbox purge/retention, so handled security notices are not repeatedly restored or resent.
- **Crews pick up a new sidecar after an upgrade without `crewship crew restart-agents`.** A crew container keeps running the `crewship-sidecar` it was created with, so after an upgrade agents silently lacked whatever the new sidecar adds (such as new MCP tools) until an operator recycled the crew. Crew containers are now stamped with the hash of their sidecar (`crewship.sidecar-hash`); at a crew's next start a container with a different or missing stamp is recreated when it is stopped or idle, keeping its volumes, workspace data and credentials wiring, and a `sidecar.recreated` journal entry records the old and new hash. A container with an active run is never interrupted: the run keeps the existing `sidecar.stale` signal and the container is replaced at its next idle start. Runs that start together recreate it at most once. ⚠️ The first start of each idle crew after upgrading to this version recreates its container once, because existing containers carry no stamp yet.
- ⚠️ **Downgrade boundary: saved preset choices are per version.** After migration `20261022114610`, a routine can carry both a v1 and a v2 preset choice. Earlier builds cannot handle that and are refused at start by the version-skew guard. Downgrade by restoring the pre-upgrade snapshot (see Upgrades → Rollback / downgrade), never by deleting migration records.
- Guests with separate View, Edit and Publish shares can save, structurally validate and publish an exact shared draft from the web editor. Publication never starts a run; conflicts require explicit reload. Routine Share and the person's Access card expose Publish with its Edit dependency. The new immutable v2 preset (levels None, Edit, **Edit + Publish**) preserves separate View, Results and Run shares and revokes Publish through the same reviewed preview; v1 stays unchanged, and saved preset choices are now kept per preset version so applying v2 no longer overwrites a v1 record. A refused publication or structure check (422) shows the server's reason. Publishing a routine that other saved routines reach through `call_pipeline` is refused with 422. Bounded execution remains a separate runtime slice.
- **A staged audit key rotation is installed at start only if its audit entry vouches for it.** A `crewship audit rotate-key` interrupted after its audit commit is finished at the next start only when the entry is the newest rotation, names the staged active key and that key is not yet in the keyring; a stale or replayed `audit-keyring.json.pending-*` file is kept aside as `.discarded-<entry id>` (never overwriting an earlier copy) and the start continues with a warning instead of installing it.
- **Content scanners skip regex work when required literals are absent (#3995).** Conservative per-rule prefilters preserve Unicode case folding, custom and registered-secret rules, stream boundaries, normalization, findings and existing limits.

- **Agent MCP configuration values no longer reach the audit log, and agent privilege changes roll back when their audit fails.** Updating an agent used to copy the request body, including `mcp_config_json` with any API keys in its `env` or headers, into `audit_logs` and the journal, after the change had committed. The update is now one transaction with its hash-chained audit, which records previous and current tool profile, crew, role and MCP servers (server names, transport, command name and env/header key names only); temporary hire, rehire and release are chained the same way. Rows written by earlier versions are not rewritten: rotate credentials that were set in an agent's MCP configuration. A MANAGER's credential folder move is now checked against the folder's policy as it stands in the update's own transaction.
- **Optional qualified runtime: Guest-published routine execution (deferred from v1).** `crewship routine run <slug> --wait` starts a bounded manual run of a Guest-published routine on its recorded agents and `responses_text`/`native_api_key` profiles. Logging out does not stop it; revoking a used grant, removing or suspending the member, an administrator revoking the user's sessions (recorded durably, so this works after the user logged out), a grant issuer losing authority, rotating an agent's credential, or withdrawing the routine stops it before the next step, as does a 30-minute run limit. Delayed start is refused for published routines. Start and stop (with its reason) are recorded in the chained audit journal. Schedules, webhooks, nested calls and Page actions still refuse published routines.
- **Withdraw a Guest publication and set the Guest run limit.** `crewship routine unpublish <routine>` (Publish holder or workspace OWNER/ADMIN) withdraws a Guest-published routine: new runs are refused and running ones stop before their next step, with the change audited; republishing makes it runnable again. OWNER/ADMIN set the hard limit for one Guest-published run with `crewship workspace update --guest-routine-max-run-minutes N` (1-240, default 30).
- **Project checkpoints allocate less memory (#3993).** Pack creation reuses compression state between objects while preserving independent completed zlib streams and Git pack verification.

- **The audit signing keyring is encrypted at rest, and `crewship audit rotate-key` rotates it.** `<data-dir>/audit-keyring.json` held the audit HMAC keys as plaintext JSON. It is now sealed with AES-256-GCM under a key derived (HKDF) from the current master key; an existing plaintext keyring is sealed at the next start, and a master-key rotation re-wraps it at the restart the rotation already requires (keep earlier `ENCRYPTION_KEY_V<N>` until then). A keyring that does not open with the configured master key stops the start instead of being replaced. `crewship audit rotate-key` (`POST /api/v1/admin/audit/signing-keys/rotate`, instance OWNER with `instance:admin`) adds a new active key, keeps the old ones for verification, records `audit.signing_key_rotated`, and takes effect at the next start. A keyring configured outside the data directory is read but never rewritten. ⚠️ **Behaviour change:** builds before this one cannot read the sealed keyring; before rolling back, export it with `crewship audit export-keyring --plaintext` (see the audit security page).
- **Crew links, the artifact creation policy, credential folder policy and routine origin clears roll back when their audit fails.** These access changes used to be recorded only in the unchained Settings Audit log, some of them after the change had already committed; each now appends the hash-chained journal in the same transaction, with previous and current values, and still writes the Settings Audit row. Refused waitpoint decisions are chained the same way without naming the callback token. The crew runtime privilege audit now also records `init` and mounts, alongside `privileged` and added capabilities.
- ⚠️ **Behaviour change: first-run Setup is refused for MEMBER.** `POST /api/v1/onboarding/setup` now requires the OWNER, ADMIN or MANAGER role in the workspace; a MEMBER (or VIEWER) gets 403 Forbidden instead of creating the first crew. Ask a workspace owner or admin to run Setup, or to raise your role first.
- **Managed native executable verification avoids whole-file Go buffers (#3994).** Hashing and ELF inspection retain the same open descriptor and existing static-ELF acceptance. Unix image capture uses private, immediately unlinked temporary storage; Windows retains the existing buffered archive path.

- ⚠️ **Behaviour change: a password reset now revokes the account's CLI tokens.** Redeeming an emailed reset link and `crewship admin reset-password` used to revoke only browser sessions, so a CLI token minted under the old (possibly stolen) password kept working. Both now revoke every live CLI token of the account in the same transaction as the new password, the revoked sessions and the `auth.password_reset` audit entry (which now counts `cli_tokens_revoked`); after the emailed reset, open streams using those tokens close. Scripts and other machines need a fresh `crewship login` after a reset.
- **`crewship recover --force` works on a data directory that already booted.** Recovery restored the database and then refused because the directory's own audit keyring differed from the bundle's, stopping before `secrets.env` was written. It now checks the keyring before changing anything, replaces it with the bundle's atomically and keeps the old one as `audit-keyring.json.replaced-<UTC time>`.
- **Forked workspace restores keep Artifact comments dispatchable to agents.** `--as-workspace` and `--as-crew` gave each send-to-agent task a new id but left the comment's `task_id` on the old one, so pending feedback vanished from the hand-off list and could not be sent. The comment now follows its task.
- **`crewship admin reset-password` signs with the target instance's audit keyring.** With `DATABASE_URL` it used the default `~/.crewship` keyring, creating one if absent, so its audit entry could not be verified by the server owning that database. It now uses the keyring beside the database or in the named data directory, never creates one, and says which `CREWSHIP_AUDIT_KEYRING_PATH` to set when it cannot tell.
- **Audited writes no longer slow down as the audit history grows.** Appending to a workspace journal or the instance audit chain now checks only the chain tail and the new rows instead of re-verifying the whole history inside the write transaction (one append against 100,000 rows: about 1.4 s before, 0.3 ms after). Older defects no longer make every audited write fail with HTTP 500 after an upgrade; `crewship journal verify` and the new `crewship admin instance audit verify` (`GET /api/v1/admin/instance/audit/verify`) report them as `historical_invalid` / `historical_unverified` (rows from before the keyring upgrade or the last reseal) or `post_upgrade_invalid` (keyring-signed rows). A tail that does not authenticate, or whose predecessor vanished without a compaction checkpoint, still refuses. Revoking CLI tokens or sessions, suspending an account and local `crewship admin reset-password` recovery still succeed when the instance chain tail is broken, recording an audit row marked as an unchained fallback; access-granting actions, including password change and web password reset (now a clear 503), stay refused.
- **Instance admins are told when an audit chain breaks or is resealed.** A refused append, a failed check in the instance audit log or a defect found by `crewship journal verify` or `crewship admin instance audit verify` (including `post_upgrade_invalid`) record an `audit.chain_break_detected` instance audit event and put **Audit chain needs attention** in each instance admin's inbox (category security); every reseal records an instance event and sends **Audit chain resealed**. Background journal entries refused by a broken workspace chain are now held and retried every 30 seconds (up to 10,000) instead of being dropped, and other workspaces keep writing meanwhile.
- A Document or Slides page with edits the server has not accepted now asks before an in-app link leaves it (Keep editing or Leave anyway); the link used to do nothing and say nothing.
- Replaying a Document creation submission after a lost reply no longer adds a duplicate human message or starts another run.
- **A MANAGER's agent delete is re-checked against their current role, and agent-created agents name the calling run in the audit.** The delete's authorization is now decided again inside the delete transaction, so a demotion, removal or ownership change that lands meanwhile refuses it (403). The `agent.created` audit records the workspace and crew the caller's internal token is bound to and, for a valid run token, the run and agent; an invalid one is flagged, never trusted. The redacted MCP audit records a server command's executable only when it is a plain program name, so a quoted value split by spaces is no longer recorded in its place.
- **Creating and deleting an agent now roll back if their audit fails.** Agent create, delete and agent-initiated (internal) create used to be audited best effort after commit. They are now chained in the same transaction and record the agent's crew, role, tool profile and MCP servers (redacted). A removal after a failed review hold is chained too, and it completes even if the client disconnects. The MCP audit no longer records `NAME=value` assignments that come before the executable in a server command.
- Enter in a Document acts where the caret is shown: after a quick keyboard caret move such as Ctrl+End, it no longer splits the document where the caret was a moment before.
- Explicitly update an existing personal Document from its private chat with `run --document-target`, retaining the original human purpose and revision through agent drafting.
- New Documents retain their initial confirmed version in history, so it remains readable after later edits.
- Build releases with Go 1.27.3 to fix the reachable crypto/x509 certificate verification vulnerability GO-2026-6809.
- Fix Document formatting updates with bounded position-history metadata and aligned browser/service editor dependencies (#3855).
- **Chat says Stopping until the stop is confirmed.** After Stop on a live reply, the Stop button reads **Stopping…** and does nothing more until the server reports how the turn ended; pressing it again sends no second cancel. The partial reply stays on screen, and a turn that did not complete ends with one line in words: **Stopped**, **Interrupted** or **The run failed**, each noting that the reply above is partial or may be incomplete (or that it ended before any reply); the line stays after a reload. Applies to chats on the versioned event stream; older streams still return to ready at once.
- **New Doc states who can open the document.** The dialog no longer calls a new Doc private: it says **Who can open it — you, and workspace owners and admins; others only after you share it**, which is what the server enforces for a Doc created there. The Pages guide says the same and notes that such a Doc is not listed in **My space**, which holds only Documents whose audience is you alone.
- **Copy on a chat reply says what happened.** The reply's Copy button turns into a check and screen readers hear **Copied to clipboard** only after the browser confirmed the copy; when the clipboard refuses (permission, an insecure dev host without the fallback), it says **Copy failed. Select the text and copy it with your keyboard.** instead of failing silently. The same confirmed copy is used in the onboarding setup chat.
- **Saved documents in chat say who can open them, and empty documents say how to start.** A document card in the chat adds **Private to its owner and workspace owners**, which is what the server enforces for documents created from a chat. An empty document no longer shows a blank area: the editor says **This document is empty. Start writing below, or ask an agent in a chat to draft it.**, and the document panel in the chat points to **Edit here**. A document that only holds an inserted heading, list or table is not called empty.
- **Copy on a chat reply says what happened.** The reply's Copy button turns into a check and screen readers hear **Copied to clipboard** only after the browser confirmed the copy; when the browser refuses both the clipboard and the fallback copy, it says **Copy failed. Select the text and copy it with your keyboard.** instead of failing silently. The same confirmed copy is used in the onboarding setup chat.
- **A stopped reply stays in the chat.** A turn stopped (or failed) before any reply no longer disappears when the chat reloads its history; it stays below the message it answered with its **Stopped** line. A page reload still shows only the message, because the server keeps no record of such a turn.
- **Undo and Redo on the Document toolbar.** The editor's toolbar has **Undo** and **Redo**, so a phone or tablet without a keyboard shortcut can take back an edit. Undo only ever takes back your own edits in this editor: a paragraph another person saved in the meantime stays, and cannot be undone from your editor.
- **Chat says Stopping until the stop is confirmed.** After Stop on a live reply, the Stop button reads **Stopping…** and does nothing more until the server reports how the turn ended; pressing it again sends no second cancel. The partial reply stays on screen, and a turn that did not complete ends with one line in words: **Stopped**, **Interrupted** or **The run failed**, each noting that the reply above is partial or may be incomplete (or that it ended before any reply); the line stays after a reload for a turn the server saved. Applies to chats on the versioned event stream; older streams still return to ready at once.

- **New agents can save Documents in a running crew.** Authorized creation and drafting no longer fail because the shared container's startup roster lacks the new agent's label; current run and human permissions are still checked by the host.

- **Backup downloads stop after access is revoked.** Bundle downloads recheck credential, account and live role before each chunk. Browser streams also observe session revocations persisted by a separate local recovery process. Private Page custodians retain versions, exports, documents, projects and chat context when restricted elsewhere; access by another workspace OWNER remains audited before output.

- **Access changes and their audit commit together.** Workspace/crew settings, crew deletion and admin session/lockout changes roll back if audit fails. Private membership and invitation snapshots retain old rights without exposing them through public feeds or search; provisioning records non-secret account/setup facts.
- **First-run Setup records crew membership atomically.** Setup requires current crew-creation authority (MANAGER, ADMIN or OWNER); stale, suspended and globally restricted accounts cannot create a crew through onboarding.

- **Guests can publish an exact shared routine draft through API and CLI.** Validation is structural only; publication checks live explicit rights and commits immutable authority plus audit without starting a run. Stale/busy snapshots return 409, existing triggers 422 and null descriptions 400. Generic callers and triggers cannot use bounded publication authority; manual execution remains a separate slice.

- **Routine Publish is an explicit share.** Member policies, invitations and provisioning accept `publish` only together with `edit` for the same routine; otherwise they return 422 without writes. View and Run stay separate. Preset changes preserve this dependency. Bounded publication archives retain their authority across backup/restore and cannot enter generic runs or triggers.
- **Harbor 2: the rail on one axis.** Every icon, the workspace mark, Search, the Crewship sail and your avatar are centred on the same line in the folded and the open rail; icons are 18 px, and the workspace, the sail and you are all 28 px. Search is an icon like any other row in the folded rail and a borderless field in the open one. The open workspace card shows your role under the name. The app list scrolls between a fixed top and foot with a fade at the edge, and groups (Work, Build) fold in the open rail and stay folded on this device. The sail stays Crewship blue in every style.
- **The Crewship sail is always in the rail.** It ends the rail, just above the footer's rule, in its own lit blue tile, and stays when the rail folds to icons; the top of the rail is the workspace switcher and Search. It opens **About Crewship**: what Crewship is, the edition and build, and links to the documentation, what's new and reporting a problem.
- **Linked issues appear in a new chat without a reload.** After the first message of a new conversation, the chat used to show a bare **Unavailable** line and no linked issue, proposal or decision cards until the page was reloaded; it now checks access as soon as the conversation exists.
- **A chat you cannot use says so.** Opening someone else's private chat by its address shows an empty composer, as before (the address alone does not reveal whether it exists). The first send is refused, and the chat now keeps a notice in place: **This conversation isn't available to you**, with **Start a new chat**. Your draft stays in the box. A refused send no longer blames your connection, and **Prepare project inputs** is not offered there.

- **Harbor 2 on a phone: Inbox and Settings pilot.** On a phone an Inbox item's header is Back, the item's name in two lines and a ⋯ with Previous, Next, Archive and Mark unread; Back returns to the list with its search, filters and scroll — also after the browser's Back or a reload — and after a direct link it goes to the Inbox, never out of the app. A workspace switch starts the list clean. Active filters get **Clear filters** beside their chips; a search that finds nothing says what and where; a failed load shows Retry in the list. A Settings section is a step in the browser history, so Back returns to the section list and asks first when a form has unsaved edits. Save bars dock on every phone width and ride above the on-screen keyboard; the tab bar steps aside while you type; toasts sit above both. Header buttons are real 44 × 44 targets on touch screens. On the approval detail the decision note sits above the buttons, Approve keeps its size while it works, run steps no longer wrap letter by letter, and denying an approval shows "Denied · <routine> stopped" instead of a red failure.
- **Animated Voxel avatars, the new default (#3789).** The avatar picker offers DiceBear's **Voxel Bot** and **Voxel Art**, marked New, and new agents start on Voxel Bot — from the dashboard, the CLI, the API or a template. Drawn at 32 px or larger they blink and stretch now and then; smaller ones stay still, and so do all of them with Reduce motion On, with the new **Settings → Appearance → Animated avatars** switch off (on by default, synced with the other appearance choices; per viewer, so a workspace default never sets it), or when the operating system asks for reduced motion. The picker says so in one line when an animated style is chosen. **Existing agents keep their face:** upgrading pins every agent that was drawn with the old default to Bottts Neutral by name (the picker now shows it as Bottts Neutral rather than "Follow the crew"); agents with their own style or a styled crew are untouched. The voxel styles come from DiceBear 10, loaded beside 9.4 only for them (CC0 1.0); the other 25 styles stay on 9.4. Voxel avatars are always drawn live, never stored, and **Store missing avatars** counts them as such. `crewship agent create|update --avatar-style` and `crewship crew apply-avatar-style --style` accept `voxel-bot` and `voxel-art` and list every style in `--help`. ⚠️ **Behaviour change:** an unknown avatar style slug is now refused — `400` from the API, an error from the CLI before anything is sent — instead of being stored and drawn as the default.

- **Composer artifact context and conversation library, behind the same flag.** An attached item needs an explicit create, update or reply-only choice, shows executor, location and the real audience before sending, and blocks on an ambiguous target. The library lists only explicitly linked items, with restricted links shown anonymously. Updating an attached document from chat stays disabled until the server confirms the chat's audience (no such signal exists yet); a reply-only or plain message is unaffected.

- **Composer artifact context and conversation library, behind the same flag.** An attached item needs an explicit create, update or reply-only choice, shows executor, location and the real audience before sending, and blocks on an ambiguous target. The library lists only explicitly linked items, with restricted links shown anonymously. Updating an attached document from chat stays disabled until the server confirms the chat's audience (no such signal exists yet); a reply-only or plain message is unaffected.

- **Chat result cards and viewer switching, behind `NEXT_PUBLIC_CHAT_ARTIFACT_CONTEXT` (off by default).** Result cards report server run state, saved content and freshness separately, and give revoked access, lost connection, unknown result, conflict, stopped run, missing runtime and broken preview each their own next action. The side viewer header switches only between accessible conversation links and keeps an exact revision distinct from an explicit latest. These components are not mounted in this change and no backend serves their endpoints yet.
- Stop pending Document journal writers before erasing browser drafts on sign-out or account change, so delayed writes cannot restore private copies.

- **Composer artifact context and conversation library, behind the same flag.** An attached item needs an explicit create, update or reply-only choice, shows executor, location and the real audience before sending, and blocks on an ambiguous target. The library lists only explicitly linked items, with restricted links shown anonymously. Updating an attached document from chat stays disabled until the server confirms the chat's audience (no such signal exists yet); a reply-only or plain message is unaffected.

- **Chat result cards and viewer switching, behind `NEXT_PUBLIC_CHAT_ARTIFACT_CONTEXT` (off by default).** Result cards report server run state, saved content and freshness separately, and give revoked access, lost connection, unknown result, conflict, stopped run, missing runtime and broken preview each their own next action. The side viewer header switches only between accessible conversation links and keeps an exact revision distinct from an explicit latest. These components are not mounted in this change and no backend serves their endpoints yet.
- Stop pending Document journal writers before erasing browser drafts on sign-out or account change, so delayed writes cannot restore private copies.

- ⚠️ **Behaviour change: GDPR erasure anonymizes retired credential creators.** Retired credentials no longer require a live custodian; their creator attribution becomes NULL while IDs and audit history remain. Active credentials retain the existing custody requirement, and creatorless tombstones cannot be reactivated. Workspace restore/fork preserves nullable retired creators.
- Retain original human authority for targeted Document runs and refuse missing or superseded intent bindings; the chat update entry point remains disabled.

- ⚠️ **Behaviour change: credential retirement irreversibly erases vault material.** Existing and newly retired credentials retain their IDs and audit history, while secret/refresh values, account metadata, custom fields and pending OAuth state are cleared, including historical restore/fork imports. Active credentials remain unchanged. Integration removal now rolls back if credential retirement or its audit cannot be completed.

- **Chat shows the model the chat is configured to use.** The composer's model control read a path the server never served and always offered a built-in list, silently treating its first entry as selected. It now shows the model the chat run preview reports, lists the provider's models from the server labelled as live or curated, says plainly when the list cannot be loaded, and states that a listed model is not proof of access or of what a run will use. Choosing a model from the list is not offered yet.

- **Audit signing keys survive vault-key rotation and instance recovery.** New audit rows identify their signing key; retained keys verify history without rewriting it. The encrypted recovery kit retains the keyring. An explicit OWNER `crewship audit reseal` checkpoint can start a verified continuation while preserving the unverified status of history whose key is missing.

- **Slides says a local draft is not saved, in the same words as Document.** With `NEXT_PUBLIC_SLIDES_EDITOR` on, an edited deck reads **Not stored in this browser or on the server · keep this tab open**, and **Saved** with **Confirmed by server** appears only after a receipt for the change that was sent. Document and Slides now share one save lifecycle (save states, a write queue that waits for the receipt and retries the same change, and the leave prompt); Document's save words are unchanged, and nothing changes with the flag off. When access to a Document is removed while edits are unsent, it now says **Your latest edits were not saved: access to this document was removed.** (the unsent edits are still not kept) (#3889).

- Preserve Claude Code tool result text and error details in chat and run traces when the CLI returns structured content blocks.
- Reject unsupported Document revision selectors instead of silently returning the latest content. Saved checkpoints remain available through their explicit reader.
- **Edit a chat's saved document without leaving the chat.** The document panel opened from a result card now has **Edit here**: the body becomes the document's own editor, with its save state and recovery, and **Done editing** shows the saved result. Leaving editing or closing the panel with unsent edits asks first; **Open full editor** still opens the Page in a new tab (#3886).
- **The Document save status separates "saved locally" from "confirmed by server".** While work is unsent the header says whether the browser has kept a copy, is still writing it, or could not store it; only a server receipt shows "Confirmed by server".
- **Unconfirmed Document edits survive browser reloads.** Pending human edits are retained privately per signed-in user and document before transmission; reopening offers explicit recovery after current access is checked. Unavailable browser storage prevents editing, and restored drafts never replay an old write grant automatically. The browser copy is deleted when access to the document is lost (401, 403, 404) and on sign-out, session expiry or a change of signed-in user, so a shared browser keeps no private text.

- **Native Slides can be initialized and read with `crewship slides` when `CREWSHIP_SLIDES_ENABLED` is enabled.** Current custodians can save a schema-1 deck on an empty private Page; exact retries retain the original receipt. Reads check live private access and audit another workspace OWNER before releasing content. Private Pages remain indistinguishable from missing Pages even for malformed requests. The adapter remains disabled by default.
- Prepare a client-side mirror of the strict native Slides operation contract (hashes, validation, atomic batch apply and diff-to-patch) with a flagged save client contract; no editor or save route is exposed yet.
- Prepare a static App preview boundary with scripts, navigation and external resources disabled, pinned revisions and immediate removal on access loss; it is not mounted in app routes and stays behind `NEXT_PUBLIC_STATIC_APP_PREVIEW` until a Page endpoint serves publication HTML.
- **Document history can compare revisions and revert one change; agent proposals can be reviewed.** Compare any retained revision with the last saved version by labelled blocks (unsent edits are not included) (including link and formatting changes), revert a single change as a separate action from restore, and accept or reject a proposal. Compare is always available; revert and proposals stay off behind `NEXT_PUBLIC_DOCUMENT_REVIEW_ACTIONS` until the server endpoints exist.
- **Chat search with filters.** The chat sidebar has a search dialog (Ctrl/Cmd+Shift+F) with This chat / All chats / Files tabs and `from:`, `in:`, `has:`, `after:`, `before:` filters. Results open the exact message; `from:` matches only the message's author (agent or an agent's own replies; `from:me` waits for the server to return the author), a full page of 50 says more may exist, a full page narrowed on the client, an unavailable source or an error is shown as such and never as a clean zero. The Ctrl/Cmd+Shift+F shortcut is on for everyone but never fires inside text fields. Files search and room/DM search wait for backend support.
- **Chat sidebar views (behind `NEXT_PUBLIC_CHAT_SIDEBAR_VIEWS`, default off).** With the flag on, the chat sidebar has Unreads and Agents running views, and lists hold still under the pointer or keyboard focus: background updates change rows in place and a Refresh button applies new order, while your own actions (search, favourites, opening a row) apply at once. The open chat stays listed, marked "Open chat", when a view would filter it out. Mentions, Threads, Saved, Drafts, Waiting for you and Review are sample-data previews behind `NEXT_PUBLIC_CHAT_SIDEBAR_SMART_SECTIONS`.
- Prepare the native Slides editor interactions: select (Shift for several), drag, resize and keyboard-nudge elements, layer commands, undo/redo, empty/loading/error/conflict states and a read-only phone preview. The editor is not mounted yet and edits stay a local draft until the Slides save route exists.

- Read and initialize native Slides through the server's `GET .../slides` and `POST .../slides/initialize` contract (behind `CREWSHIP_SLIDES_ENABLED`): the read must name the requested Page in `deck.deck_id` and carry exactly the five documented fields, and an initialize receipt is checked field by field. The Pages route mounts the editor behind `NEXT_PUBLIC_SLIDES_EDITOR`; edits are a labelled local draft because the server has no save route yet.

- Prepare a client-side mirror of the strict native Slides operation contract (hashes, validation, atomic batch apply and diff-to-patch) with a proposed save client contract; no editor or save route is exposed yet.
- **The Document save status separates "saved locally" from "confirmed by server".** While work is unsent the header says whether the browser has kept a copy, is still writing it, or could not store it; only a server receipt shows "Confirmed by server".
- **Unconfirmed Document edits survive browser reloads.** Pending human edits are retained privately per signed-in user and document before transmission; reopening offers explicit recovery after current access is checked. Unavailable browser storage prevents editing, and restored drafts never replay an old write grant automatically. The browser copy is deleted when access to the document is lost (401, 403, 404) and on sign-out, session expiry or a change of signed-in user, so a shared browser keeps no private text.

- Prepare the native Slides editor interactions: select (Shift for several), drag, resize and keyboard-nudge elements, layer commands, undo/redo, empty/loading/error/conflict states and a read-only phone preview. The editor is not mounted yet and edits stay a local draft until the Slides save route exists.

- Read and initialize native Slides through the server's `GET .../slides` and `POST .../slides/initialize` contract (behind `CREWSHIP_SLIDES_ENABLED`): the read must name the requested Page in `deck.deck_id` and carry exactly the five documented fields, and an initialize receipt is checked field by field. The Pages route mounts the editor behind `NEXT_PUBLIC_SLIDES_EDITOR`; edits are a labelled local draft because the server has no save route yet.

- Prepare a client-side mirror of the strict native Slides operation contract (hashes, validation, atomic batch apply and diff-to-patch) with a proposed save client contract; no editor or save route is exposed yet.

- Prepare a static App preview boundary with scripts, navigation and external resources disabled, pinned revisions and immediate removal on access loss; it is not mounted in app routes and stays behind `NEXT_PUBLIC_STATIC_APP_PREVIEW` until a Page endpoint serves publication HTML.

- **Password changes, HTTP and local CLI password resets, workspace/folder deletion and folder ACL changes fail atomically when their required chained audit cannot be recorded.** Passwords, reset-proof consumption and session/token revocations commit together; existing CLI commands retain their request shapes. Session disconnects are notified only after commit. Workspace deletion and workspace member removal recheck current authority inside the writer transaction.

- **Routine schedules say how their last fire ended.** Each schedule in a routine's Triggers tab now ends with "last fire <time> · <outcome>": "queued for capacity" when a full routine queued it, "skipped: capacity or catch-up" when a waiting occurrence or catch-up after downtime dropped it, and "skipped: routine inactive" (or "previous run busy or routine inactive" for an active routine) when nothing was counted as missed. The schedule does not record which cause applied, so the label names both. The scheduling, routines and manifest guides now describe capacity queueing, catch-up alerts and replay with edited inputs and metadata.

- **Terminal and restricted text streams stop at credential loss.** CLI terminal tickets use the shared source-token registry; revocation, suspension and original expiry close open shells. Source-credential checks remain in memory. Terminals additionally recheck live resource authority with one SQL query per PTY data/control frame and check idle shells on the 30-second watcher. Resource queries configure a five-second context deadline, but native SQLite busy handling can outlast it; no hard maximum closure time is guaranteed. This security fallback does not complete the H1 zero-SQL goal.
- **Filter My space.** The private Document catalog can be narrowed by type, scope, owner and state; groups that cannot vary on the list are hidden. Counts only reflect items the server returned.
- Move to a working folder (who gains content and history, same ID, a result per item) and Duplicate are built behind `NEXT_PUBLIC_ARTIFACT_COPY_MOVE` and stay hidden until the server routes exist.
- Show a personal view of private Documents and display the private creation audience before sending a chat request.

- **Tool activity in chat no longer shows failures as success.** A group of tool steps says "Worked" only when every step succeeded; a failed step is labelled, opens the group and is never green, and parallel tool calls are matched to their own results. A finished reply with steps that have no recorded result reads "Finished" rather than success. A reasoning block shows its approved safe summary line next to the recorded time.

- Prepare a strict Document-to-DOCX converter for validated saved content; export delivery and Microsoft 365 compatibility remain unqualified.

- **Workspace default look.** An owner or admin can set a default style, accent and theme for the workspace (Settings › Appearance › Workspace default, `crewship workspace update --appearance-default`, `PATCH /api/v1/workspaces/{id}` field `appearance_default`). Members inherit every value they have not chosen themselves; Appearance shows which is which and offers Use workspace default. Appearance sync now saves only values you changed, instead of your whole look. Personal appearance changes save as you make them and the last one can be undone from the toast that follows.

- **Harbor 2: Settings details.** Appearance › Sidebar now uses the rail's own names (Expanded, Expand on hover, Collapsed). An old `/settings?tab=audit` link opened by a Member or Manager lands on the Audit log page, which says who may read it, instead of silently showing Profile. The Account security page for restricted sessions uses the same 820 px column as the rest of Settings. The CLI calls behind Members, Crew links and the journal check are now covered by acceptance tests.

- **One name: Artifacts.** The command palette, the Dashboard strip, the Artifacts overview card and the Activity filter now say Artifacts where they said Pages (addresses and commands are unchanged).
- **Command palette: the empty state follows the design.** Opening ⌘K shows Recent, Quick actions, Go to and Switch workspace; the list of settings pages appears once you type, like the other results.
- **Sidebar modes have one set of names.** The rail menu now says Pinned open, Rail · expand on hover and Rail, as Settings › Appearance does.
- **Crews: the icon you pick is the icon you get** (#3767). The icon dialogs and the New/Edit crew identity tile preview the crew as the header draws it (solid colour tile, white glyph). Settings ends with the Danger zone; the image card says what "current" is compared against.
- **Crews: New crew opens the crew it created** (#3762). After Create crew, /crews kept the crew it had auto-opened on load on the canvas; it now opens the new one.
- **Dashboard sparklines for Success and P95.** `GET /api/v1/metrics/timeseries` accepts `metric=success_rate` and `metric=p95_duration_ms` (per bucket, from the same rules as the run insights); a bucket in which no run finished has no value. `crewship metrics --series` now sends `--window` and `--bucket` (the old `--range` was never read by the server and still works as the window).
- **Calendar: agents and .ics.** Every event of `GET /api/v1/workspaces/{id}/pipelines/calendar` now lists the `agents` its routine's steps run (for the Agents view and the agent filter), and `GET .../pipelines/calendar.ics` (`crewship routine calendar --ics`) returns the same window as an iCalendar file. A signed subscription URL that calendar apps can poll is not part of this.
- **Crew monthly budget and Release now.** `GET/PUT/DELETE /api/v1/crews/{id}/budget` and `crewship crew budget get|set|clear` set a crew's monthly spend limit (Admin and above; tiered by default: warn from 80 %, stop new runs at 100 %). `POST /api/v1/agents/{id}/release` and `crewship release` end a temporary hire before its expiry; it becomes an expired hire and Rehire brings it back. ⚠️ A hard or tiered limit makes admission refuse unmetered legacy proxy traffic for that crew.
- **Crews needing a rebuild on the Dashboard.** New `GET /api/v1/crews/provisioning-summary` and `crewship crew provision summary` list, in one request, the crews whose image build failed or that have no built image yet. The Dashboard shows them as a "N crews need a rebuild" tile after capacity (it used to say "Nothing needs you" while the Crews panel listed those crews under Needs you).
- **Harbor 2: Crews defects against the v67 wireframe.** The Delete crew dialog now names what the crew holds ("3 agents · 2 routines · container running"). The agent Skills card has **Add skill** (no detour through Manage skills). The crew options menu has **View as YAML** and **Download crewship.yaml**. The command rows in crew and agent Settings carry a line of description and a Copy button; the crew card adds `crewship apply --file <slug>.yaml`, and the agent card lists `agent update --llm-model` and `logs --follow`. Agent Settings shows a static **Hooks** card with a CLI hint; it says plainly that hooks are paused on the server and do not fire yet.
- **Harbor 2: skill Activity.** The Activity action on a skill page now opens Activity filtered to that skill (it used to switch to the Used by tab), and it is also available on a phone.
- **Harbor 2: skill Activity.** The Activity action on a skill page is also available on a phone. It opens the skill's Recent uses under Used by until Activity can filter by skill.
- **A shorter style picker.** Settings › Appearance › Style shows one live preview of the chosen style, with its description, above category chips and a compact grid of colour palettes, six to a row on a desk. Pointing at a palette previews it; clicking chooses it. (#3757)

- **Harbor 2: every wireframe style in Settings > Appearance.** The style gallery now carries 28 more styles (44 in all), so each colour style in the design has exactly one counterpart under a neutral name: Terracotta, Beacon, Carbon, Meadow, Heather, Aubergine, Lagoon, Parchment, Coral, Iris, Twilight, Marigold, Cobalt, Studio, Mulberry, Console, Bluebell, Regal, Cerulean, Denim, Sandstone, Frost, Pebble, Wisteria, Pane, Dove, Tangerine and Skyline. A new **System** section groups the seven desktop and mobile looks. Each style brings its own accent colour (41 hidden accents, not offered in the accent picker). Every style passes the same contrast checks as Harbor; where a dark ground was lighter than the accents allow, it is a little deeper than in the design.
- **Harbor 2: Activity says who and what by name.** A change row is titled with the issue, artifact, agent or crew it changed, and names the person who made it instead of "A person" (the journal lookup now lists the workspace's people by name, never by email; `crewship journal lookup` prints them too). Statuses read "Backlog → Todo", an assignment says who it went to, and the change group is called Artifacts.
- **Harbor 2: the Issues panel's six views.** Views now lists My work, Needs my reply, Agents working, Waiting for my review, Blocked and All issues, each with an exact count from the server. `GET /issues` gained `owner_id`, `delegate_id`, `work_mode`, `mine`, `working`, `needs=reply|review` and `blocked`, and `crewship issue list` the matching `--owner`, `--delegate`, `--work-mode`, `--mine`, `--working`, `--needs`, `--blocked`. A project's bar in the panel now shows done over total issues and is not drawn for an empty project. The issue page's ⋯ menu has Duplicate issue.
- **Harbor 2: a routine folder has its own menu.** Each folder heading in the Routines panel has a **⋯** menu: **Rename…**, **Icon and colour…**, **New subfolder**, **Move to…** and **Delete folder…** (its routines are kept and become unfiled; its subfolders move up a level). Folders nest up to three levels and show their icon. API: `icon` and `parent_id` on `pipeline-folders` (create and PATCH; a cycle or a fourth level is refused); CLI: `crewship routine folders create/update --icon --parent`. Sharing a folder is not offered: a routine folder still grants no access (#3768).
- **`crewship seed --ui-tour`.** A new additive seed profile for reviewing the product with realistic data: on top of the default demo (on dev slots after `crew reset --yes`) it adds scheduled routines in routine folders (Daily operations, Customer care, Finance, Reports) with run history — completed, waiting for a person and failed — so Calendar shows upcoming fires, plus a 22-issue board and the inbox items and activity those produce. Idempotent and needs no provider credentials. See `docs/cli/seed.mdx`.
- **Harbor 2: Routines overview, panel and folders.** The overview opens with a page head (Routines, "7 routines · 4 need you · next run today 09:30"); the top bar no longer repeats the counts. Card titles are never cut off (Next 24 hours links to **Calendar**). Health lists a routine quietly when it is fine (no dashes, no $0.00, no "All good" on every row) and a **Checkup across routines** card lists only the routines that have something to fix. Health now reads each routine's last 20 runs, success rate and 30-day spend from the new `GET .../pipeline-health` (`crewship routine health`). The Routines panel groups by **Folder** once one exists: **New folder** in the toolbar, **Move** when selecting several (`crewship routine folders ...`, new `pipeline-folders` API); a folder only organises, it grants no access. Panel search also finds a routine by the text of its steps (`GET .../pipelines?q=`, `crewship routine list --search`). The Checkup card shows the server's checklist (`GET .../pipelines/{slug}/checkup`, `crewship routine checkup`). A draft and the versions that hold a tested definition show their **Test run passed/failed** (kept per definition hash). New routine limits offer **Skip the new start** (`concurrency_policy: skip`: a schedule records Skipped, a webhook answers 200 SKIPPED). `crewship routine schedules preview --when "every weekday at 8:30"` turns words into a cron on the server. Routine templates: `crewship routine templates` and the `pipeline-templates` API (using one saves a draft). A routine step can **create a page** (`page.create`). Fixed: turning a schedule back on after the circuit breaker said the failure count resets after the next successful run; it restarts from zero immediately. ⚠️ **Behaviour change:** the panel's default grouping is Folder (it falls back to Crew while there are no folders); the "What it does" hint reads "Written from the definition by the server, not by a model."

- **Harbor 2: Skills and Integrations, the parts that needed the server.** Skills show the last **30 days** (Library column "Uses · 30 d", the skill page's "Last 30 days" card with its errors, and `uses_30d` / `errors_30d` in the API and `crewship skill list`). Managers can **archive and restore** skills by hand: Archive / Restore in a skill's ⋯ menu and in the Library's selection bar (Restore in the Archived view), `POST /workspaces/{id}/skills/{skillId}/archive|restore` and `crewship skill archive|restore`; built-in skills cannot be archived, and a restored skill that no agent holds is still judged by the keeper's sweep. A skill's **Activity** button opens Activity narrowed to the work whose agents called that skill: Activity has a **Skill** filter (chip, `?skill=`, Filter facet), fed by the new `skills` / `skill_count` on `GET /chains` (matched on the agent and the assignment's time window, since calls are not recorded against a run). Triggers: an **agent trigger shows its call count** (`GET /workspaces/{id}/webhook-deliveries/summary`, `crewship work deliveries summary`); a routine trigger's Mapping tab has **Test mapping**, which shows the inputs a sample call would give the routine and whether it would accept them without running anything (`POST /pipeline-webhooks/{id}/test`, `crewship routine webhooks test`); and **rotating a routine trigger's secret can keep the old one valid for 1 hour, 24 hours or 7 days** (`rotate_grace_seconds`, `crewship routine webhooks update --rotate-secret --grace 24h`). ⚠️ **Behaviour change:** the skill page's Activity button is now a link to Activity instead of switching to Used by (Recent uses stays in Used by).
- **Harbor 2: skill Activity.** The Activity action on a skill page opens Activity filtered to that skill, also on a phone.
- **Vault: folders.** Secrets can be filed in folders (two levels), shown under Views in the Vault panel; picking a folder filters the list, the panel's + creates one, and Add secret and the secret's Protection card choose or change the folder. A folder can limit who reveals its values (owners and admins, or nobody), set the lowest Keeper tier and a default tier for new secrets, and remind you to replace a secret after N days; secrets past their reminder appear under Needs attention. `crewship credential folder list|create|update|delete`, `--folder` on `credential create|update|list`, and `GET|POST|PATCH|DELETE /api/v1/credential-folders`. ⚠️ **Behaviour change:** none for existing secrets (unfiled); a folder's reveal policy only tightens the workspace reveal gate. Folder sharing (Can use / Can manage) is not part of this change.
- **Vault folders keep their protection when they move or tighten (#3706).** Moving a folder (to the top level or under another parent) that would loosen its effective reveal policy or tier floor now needs an owner or admin; a manager gets 403 and nothing changes. Raising a folder's lowest tier, moving a folder under a stricter parent, or filing a secret into a stricter folder lifts the secrets concerned to the floor in the same write, and Keeper always gates at the higher of a secret's tier and its folder's floor. The Vault panel gains Edit folder for the open folder (name, who can reveal, lowest tier, replace reminder). ⚠️ **Behaviour change:** a raised floor raises existing secrets (it used to leave them below it), and `PATCH /credentials/{id}` with only `folder_id` into a stricter folder raises the tier instead of returning 400.
- **Vault: API key spend.** An AI provider account that is an API key shows "$ this month" (the calendar month so far, UTC) on its card; subscription seats still show no price. New `GET /api/v1/paymaster/credential-spend` (OWNER/ADMIN; `range=month`) and `crewship paymaster credential-spend`.
- **Harbor 2: the Issues panel's six views.** Views now lists My work, Needs my reply, Agents working, Waiting for my review, Blocked and All issues, each with an exact count from the server. `GET /issues` gained `owner_id`, `delegate_id`, `work_mode`, `mine`, `working`, `needs=reply|review` and `blocked`, and `crewship issue list` the matching `--owner`, `--delegate`, `--work-mode`, `--mine`, `--working`, `--needs`, `--blocked`. A project's bar in the panel now shows done over total issues and is not drawn for an empty project. The issue page's ⋯ menu has Duplicate issue. ⚠️ **Behaviour change:** Waiting for my review is for the person who asked for the work (not the owner) and only when client acceptance is on; Needs my reply also counts a failed session and an execution that needs a person; Agents working includes a stale session. The New issue dialog has an Owner and a Delegate picker instead of one Assignee, and `POST /issues` takes `owner_user_id` and `delegate_agent_id` together (`crewship issue create --owner --delegate`).

- **Clear screens when a session ends, and when the server is restarting (#3787).** The app now shows a full screen with the Crewship sail in place of the bare login form, and **Sign in** opens the form. After **Log out**, "You're signed out" says "See you next time." and offers **Sign in again** and **Back to crewship.ai**. An expired session shows "Your session expired" with the account that was signed in and **Use another account**; if you had an unsent chat message it says the message is kept on this device, and after signing in you return to the same address. A session ended elsewhere (another device, an admin, a suspended account) shows "Signed out on this device". When the server cannot be reached while the app is opening, the app shows "Crewship is restarting" with "Next try in N s · Try now" and keeps trying on its own. Before, it showed a skeleton for about 8 seconds and then a login form that could not work. ⚠️ **Behaviour change:** the login page's "Your session expired. Please sign in again." banner is gone (the screen replaces it). A Log out the server did not confirm still goes to the plain login page. A cold load with the server down no longer counts as signed out.

- **A lost realtime connection is reported quietly, and the app keeps reconnecting (#3783).** A backend restart no longer shows a yellow **Disconnected** bar and a red **Disconnected** pill in the chat header from the first second. A drop shorter than 4 s shows nothing; a longer one shows a neutral "Reconnecting…" bar (with "· N messages queued" when there are any), or "Crewship is restarting · reconnecting…" when the server says it is restarting (close code 1012 or 1001). Only after about two minutes of failed attempts does it warn — "Can't reach Crewship · retrying every 30 s" with **Retry now** — and it keeps trying every 30 s instead of stopping until the page is reloaded; it also tries at once when the network comes back, the tab becomes visible or the window regains focus. With the browser offline it says "You're offline · Crewship will reconnect when you're back" and waits for the network. One bar per screen: the chat's bar steps aside for the app's, and the chat header no longer has its own connection pill. ⚠️ **Behaviour change:** the bar simply disappears when the connection is back (no "Reconnected"); the System status pill stays amber ("Reconnecting") while the connection is being retried and turns red only once Crewship cannot be reached; the realtime banner and the dashboard's and Issues' offline state wait 4 s instead of 3 s; a page whose document cannot be saved says "Reconnecting… · changes are unsaved" instead of "Disconnected".

- **Afterglow theme and theme packs.** Settings → Appearance → Style has a new **Gaming** group with **Afterglow**: a dark night-indigo theme with a sunset gradient, neon pink and an amber primary action; page titles and big numbers are set in Big Shoulders Display, the rest in Manrope (both bundled, and loaded only while Afterglow is in use). It is dark only, keeps the Crewship sail blue and meets 4.5:1 text contrast. A workspace can set it as its default look. New themes are one file in `lib/theme-packs/` plus a registry line; see [Theme packs](docs/guides/theme-packs.mdx). (#3790)

- **Design canvas peer names are readable on every presence colour.** The canvas now darkens any collaborator colour behind the white initials and cursor name labels until the text meets WCAG AA contrast (4.5:1): the earlier green and orange show one shade darker, and colours from other clients are adjusted the same way when they are drawn.

- **Harbor 2: app-wide states.** Opening the app no longer shows a full-page spinner: for a second there is just the background, then the app frame as a skeleton; if your workspaces cannot load, the frame shows the error with Retry and Log out stays available. A link opened while signed out now brings you back to it after login. An unknown address shows "This page doesn't exist" inside the app (with Go to Dashboard and Search) when you are signed in. Crash pages use the same error card with the error id and **Copy details**, and the last-resort crash page follows your light or dark theme instead of always being white. Restricted accounts see the screen named as in the navigation (Vault, not Credentials) with one way on. An unavailable workspace is a blocking dialog without a close button, listing the other workspaces with your role. The app banners (reconnecting, Docker not running, update available) share one look and show **one at a time**; the reconnecting banner says since when the data is old and offers **Retry now**, and a page's own offline banner no longer appears next to it. ⚠️ **Behaviour change:** realtime failure toasts ("Scout couldn't finish the run", routine and mission failures) stay until closed and repeated failures fold into one toast with ×N; an escalation no longer toasts while you are on the Inbox and now offers Open; "Mission started" no longer toasts.

- **Harbor 2: Dashboard in the new layout.** The 24h / 7d / 30d window moved from the page's own sticky bar into the top bar, and the page opens with a greeting and one live line ("2 things need you · 3 agents running · next routine in 18 min"). What needs you is shown as up to four number tiles (decisions, failed runs, issues for review, crews waiting for capacity, missed schedules) with the rest named on one line; it says "Nothing needs you" only when the inbox answered. Results & review has four views (All / For review / In progress / Finished — running work is part of In progress), Up next, Your crews (a two-column grid of crews and their state), the run summary, Run volume and Pages use one card style, and an empty card is one line. A card whose data failed to load says so with Retry instead of looking empty. A workspace without crews shows one "Your workspace is ready" state, and the post-onboarding checklist is a "Get started" card. On tablets the tiles and figures are 2 × 2. ⚠️ **Behaviour change:** on phones the window is not offered (the page reports 24 h); the Spend figure reads "unavailable" rather than "not metered" while the ledger has not answered; who can see Spend is unchanged.
- **Harbor 2: the rest of the issue page.** `/issues/<id>` now shows the Issues panel beside the issue, and its top bar has Previous / Next issue (through the list you came from), a ⋯ menu with Copy link, Move to project, Cancel issue and Delete issue, and Back to list. Runs are a segment of the issue's timeline (All / Comments / Activity / Runs) instead of a separate card. Add relation and Attach PR open titled popovers at their field; Add relation searches the workspace for the issue. Owner can be changed on the issue page. A project's Files tab can upload a file (or its next revision) and retire one. The peek puts focus on its content, so Enter right after opening it opens the full page. The Issues filter opens inside the panel instead of a floating menu, and List / Board and Display options use the shared segmented control. ⚠️ **Behaviour change:** the filter facets fold and show at most six values with "All N…" for the rest.

- **Harbor 2: the issue page, the project page and the rest of Issues.** An issue's own page is now two columns: the title, a session block that says who is working on it and what you can do next (nobody, delegated but not started, working, awaiting input, ready for review, needs a person, accepted, or a person holds it), the brief, sub-issues, relations, pull requests, runs and one timeline of comments and activity; beside it a Work & control card (who holds the work and at which revision, Take over, Hand off, Submit result, Stop, Start work, Lead review, and client acceptance as a switch that explains why it is locked once work has started), then the properties with Owner and Delegate shown separately. Hand off, Delegate, Submit result and Request changes open dialogs; Stop asks whether to stop after the current step or now. A project opens with a hero and Overview, Tree, Issues, Files and Settings tabs (the tab is kept in the link); project files can be downloaded from Files, and admins can delete a project from Settings. A board card can be moved with the keyboard through its Move to menu, and the + on a status group or column opens New issue in that status. ⚠️ **Behaviour change:** a link to a project that no longer exists shows "This project doesn't exist" instead of silently opening the list; old `/orchestration/projects/<id>` links open that project; the workflow buttons moved from the issue's header into the session block and the Work & control card. Fixed: links that open Issues filtered to a crew or an agent (for example an agent's "Open filtered" link) used parameter names the page never read and showed every issue.

- **Harbor 2: the Issues page.** The left panel now holds Views (My work, All issues), Projects (with health and progress) and Saved views — the current filters can be saved there by name — plus one Filter menu with Status, Priority, Delegate, Owner, Who holds the work, Labels and Crew; active filters show as removable chips and live in the URL, so a filtered list can be shared. The list is one 38 px row per issue, grouped by status, project, delegate or priority, with Display options (⇧V) for the order and which fields a row shows. The board has Backlog, Todo, In progress, In review, Done and Failed columns, and a card can be dragged to another column. Selected issues get a bar at the bottom for Status, Priority and Project. Clicking an issue opens a side peek (J/K next, Enter for the full page); on a phone it opens the full page. Keys 1–9 switch views, C creates an issue, `/` searches, Esc clears filters. ⚠️ **Behaviour change:** new users start on the list (a saved Board choice is kept); `/issues?issue=<id>` opens the peek, and editing happens on the issue's own page; the Activity/Runs/Changes/Comments/Spec/Docker drawer is no longer on the Issues page (Activity and the issue page carry that information); Cancelled and Duplicate issues appear in the list, not as board columns. Bulk "Done" now sends the status the server accepts (the old value was silently skipped), the bulk bar says when only some of the selected issues changed, and Done issues show in the board's Done column again.

- **Inbox paging, search and filters run on the server.** `GET /api/v1/inbox` takes `cursor` (keyset paging; the response carries `next_cursor`), `q`, `space`, `unread`, `attention`, `deadline`, `crew` and `agent`; `GET /api/v1/inbox/counts` takes the same filters and adds `by_attention` and `by_deadline`, so a count is the number of rows the list returns. `crewship inbox list` gains `--cursor`, `--query` and the matching filter flags (`--all` follows the cursor), and `inbox counts` the same filters.
- **Inbox: Load more, server search, server facet counts.** History past the newest page is reachable with a "Load more" at the end of the list; the search box sends its text to the server (after a short pause) instead of filtering only the loaded rows; and the type, attention, deadline and unread facet counts come from `/api/v1/inbox/counts`. A server without these keeps the previous behaviour.
- **Inbox no longer walks resolved history.** When the server offers `GET /api/v1/inbox/counts`, the Inbox loads the newest page, then only the active items, and takes the history figure from the server ("Showing the latest N of M in history"); an older server is walked in full as before.
- **Harbor 2: the Inbox.** The list is the 272 px side panel with search, Filter facets inside the panel (State, Attention — Decision, Input needed, Review, Repair — Source type and Crew), Sort (urgency first, newest or by crew; remembered), the To handle / Updates / History spaces (keys 1–3), an Overview row and Select several (Mark read, Archive). Every item opens in one layout — sender and attention, title, message, then the decision with its buttons at the bottom right — followed by where it came from, run steps and context. The top bar shows Inbox › kind, the position (4 / 16), Previous/Next (K/J), Archive (E) and the message menu; after a decision a receipt offers View record and Next to review. Wide screens add a sender column with earlier items. ⚠️ **Behaviour change:** opening the Inbox no longer previews the first row — the pane shows "Your inbox, at a glance" until you pick one; Archive stays disabled on an undecided approval; the decision buttons are ordered with the primary last (right-most); irreversible card actions confirm in the shared dialog; an unknown item link says "No longer in your inbox". Dashboard `?attention=` links, `?view=`, `?kind=`, `?item=`, `?agent=` and `?filter=` keep working.
- **Harbor 2: Activity is one list.** The overview cards and the Issues / Agents / Routines lens pages are replaced by one table of work and changes — routine runs, agent work on issues, and changes to issues, routines, pages, crews and access — grouped by Active now / Today / Yesterday / day, with repeated completed runs of one routine on one day folded into one row. The left panel holds search, Filter and the views Everything, Needs a person, Running and Could not finish (keys 1–4) with counts for the chosen time range. The top bar has a new time-range control (step shorter or longer, presets, calendar, From / To, time zone) and CSV export. A row (or J / K) opens a side Peek with how the work connects, details, earlier runs of the routine, related objects, and Stop / Run again where your role allows; Open run still leads to the run's own page. ⚠️ **Behaviour change:** the default range is the last 7 days (was 24 hours); agent work started outside routines is listed again; issue, routine, agent and crew drill-down pages now open as a filtered list. Old links (`?lens=`, `?status=`, `?mission=`, `?pipeline=`, `?run=`, `?walk=`, `?entry=`) still land. The Journal stays a separate admin page.
- **Harbor 2: Activity, finished.** Several updates to one issue or one page on one day now show as one row ("CRW-142 · 4 updates — Todo → In progress → In review") with a Peek that lists them in the order they happened; Display › Group repeated runs turns it off, and work that is still running or needs a person never folds. A `?run=` link to work outside the chosen time range widens the range so the run is in the list, not only in the Peek. Run and record pages keep exactly one page heading while they load and after. **Spend** (owners and admins) is laid out as in the design: Spend · 24 h, Spend this month, Model calls · 24 h and the most expensive piece of work, spend by crew this month as bars, the most expensive work of the last 24 hours, and a note that on subscription plans the cost is an estimate. Links that still pointed at the old Journal — crews, the agent inbox banner, the hooks page, issue and chat links, and ⌘K — open Activity directly; Activity accepts an agent or crew slug and an issue identifier in its links. The panel's Filter opens its facets inside the panel, under the search, with at most six values per facet and **All N…** for the rest, instead of a floating popover. ⚠️ **Behaviour change:** Spend no longer has its own 24 h / 7 d / 30 d picker, the spend-over-time chart and the by-agent table; the ⌘K **Journal** row is gone (typing "journal" finds Activity) and **Runs** opens Activity's runs and agent work.
- **Harbor 2: the Journal is part of Activity.** Workspace owners and admins find the Journal's timeline as **Technical log** and its runs tab as **Fleet runs** under Ledgers in the Activity panel, and Spend as the **Activity / Spend** switch in the Activity top bar — with the same filters, saved views and live tail as before. Who may see them is unchanged: owners and admins only. Every old link still works: `/journal…` and `/runs` open the same view with the same filters (`time`, `from`, `to`, `crew_id`, `agent_id`, `trace_id`, `mission_id`, `severity`, `mute`, `q`, `run_window`, `run_status`, `run_trigger`, `run_page`). ⚠️ **Behaviour change:** members, managers and viewers who open a Journal link no longer see the "kept for workspace admins" page; they land on the Activity list narrowed by what the link said (time range, crew, agent, issue, run, search, run status and trigger), and a Spend link opens plain Activity. The command palette names the views Technical log, Fleet runs and Spend under Activity and offers them to owners and admins only.
- **Harbor 2: Activity is one list.** The overview cards and the Issues / Agents / Routines lens pages are replaced by one table of work and changes — routine runs, agent work on issues, and changes to issues, routines, pages, crews and access — grouped by Active now / Today / Yesterday / day, with repeated completed runs of one routine on one day folded into one row. The left panel holds search, Filter and the views Everything, Needs a person, Running and Could not finish (keys 1–4) with counts for the chosen time range. The top bar has a new time-range control (step shorter or longer, presets, calendar, From / To, time zone) and CSV export. A row (or J / K) opens a side Peek with how the work connects, details, earlier runs of the routine, related objects, and Stop / Run again where your role allows; Open run still leads to the run's own page. ⚠️ **Behaviour change:** the default range is the last 7 days (was 24 hours); agent work started outside routines is listed again; issue, routine, agent and crew drill-down pages now open as a filtered list. Old links (`?lens=`, `?status=`, `?mission=`, `?pipeline=`, `?run=`, `?walk=`, `?entry=`) still land.
- **Admin sub-pages need an instance administrator.** People, Security and Backups under Admin now show the same "no access" page as the Admin console to anyone who is not an instance administrator, instead of drawing the page.
- **Harbor 2: Admin on the new layout.** Each Admin section opens with a short head (icon, title, one sentence) and uses the Settings cards and rows. Overview shows the build, six check tiles, one capacity strip and the cards three to a row; Runtime and Notifications open with a strip of figures; Notifications explains the one instance-wide switch and links to Channels; Limits filters to the changed ones and resets with one icon; Data retention applies to all workspaces or the chosen ones and keeps that choice in the link. On a phone Admin opens on its list of sections and a section has Back. Someone who is not an instance administrator now sees a "no access" page instead of being sent home. Removing orphaned containers, removing every crew runtime (typed word), switching off a service that channels use, signing a person out everywhere, suspending, removing access, transferring and deleting a workspace, removing empty personal accounts and replacing a workspace from a backup (typed slug) all ask through the shared confirmation, which now stays open when the server refuses; a retention change whose preview went stale keeps its dialog with a fresh preview.
- **Settings › Audit log link for a non-admin.** An old `/settings?tab=audit` link opened by someone below Admin now ends on the Audit log page's "no access" sentence instead of silently opening Profile.
- **Harbor 2: Settings on the new layout.** Every Settings section opens with a short head (icon, title, one sentence) and uses the same cards and rows: the rule or hint under each label, a lock that says who may change a value, and the control on the right, dropping under the label on a phone. On a phone `/settings` is the list of sections; a section opens with a Back to the list. Sessions & tokens is now two cards, Browsers & devices and CLI tokens. Change password is a form (Enter submits, a refusal shows under its field, success shows in the same dialog), and clicking your email copies it. Deleting the workspace, revoking a CLI token, signing out everywhere else and unlinking two crews use the shared confirmation, which waits for the server and stays open if it refuses. Access & Secrets shows its classification and placement as counts that open the Vault. Members can reissue (a new link, valid 7 days) or revoke a pending invitation. The audit log can verify the journal's hash chain on request. Failed loads show an error with Retry. ⚠️ **Behaviour change:** the ⌘K "Create CLI token" row now opens Settings › Sessions & tokens; the per-crew breakdown and credential links on Access & Secrets are replaced by counts; the CLI token form offers one checkbox per scope (each resource has a single scope today).
- **Harbor 2: Skills.** The Skills page has the new layout: a panel with the views Library, On agents, Not on any agent, Needs attention, Proposed by agents and Archived (keys 1–6) and the filters Source, Domain, Trust, Status and Used by crew; one library table with sort (Most used, Recently updated, Name), grouping by source or domain, 50 rows at a time and **Give to crew** for several skills at once; rows instead of a table on a phone. A skill's page has Overview, SKILL.md (Preview / Source), Used by (per crew, give to the whole crew), Security and Version. **Add skill** replaces Import and New skill: pick a repository, see which skills it has and which licences are refused, then choose the crews that get them — or paste a SKILL.md, describe it or write it. A **Command line** dialog lists the matching `crewship skill` commands. ⚠️ **Behaviour change:** the card grid is gone; trust reads Verified / Not reviewed / Flagged; Proposed by agents shows only to owners and admins (the roles whose approval the server accepts); removing a skill asks for confirmation and is in the ⋯ menu; the Activity tab moved into Used by as Recent uses; the Maturity and Needs a credential filters are gone (Needs attention lists missing credentials). Old `?view=` and `?tab=` links keep working.
- **Harbor 2: Integrations in four spaces.** Integrations is now split by who starts and who receives: **Tools** (apps your agents act in through Composio), **Triggers** (URLs other systems call to start a routine, an agent or an artifact), **Channels** (chat apps, email, push and incident tools that reach people) and **Webhooks** (signed JSON to your own systems). Each space has its views in the side panel, one primary action in the top bar (Connect an app, New trigger, Add channel, Add webhook), a short health strip and a table that becomes rows on a phone; keys 1–4 switch spaces. Opening a channel, webhook, trigger or connected app gives it its own page with tabs and a shareable `?id=` link. **Add channel** is three steps (App, Where it posts, What it sends) with a message preview, and Add webhook is the same dialog from step two; a webhook's or trigger's one-time secret now stays on screen until you press Done. Composio access is set per agent on each app's Access tab. Removing the Composio key, removing a channel, rotating or deleting a trigger secret and disconnecting an account ask first and stay open if the server refuses. ⚠️ **Behaviour change:** `/integrations` opens Tools (or the space you used last) instead of notification connections; "Add integration" is replaced by each space's own action; personal notification settings are under Channels › My notifications and the delivery log under Channels › Deliveries; the admin "Everyone's connections" switch is now Whose › Everyone's personal in the Channels panel. Old `?tab=…&section=…` links keep working.
- **Harbor 2: Crews.** `/crews` opens straight on a crew (the last one you looked at) instead of a catalogue grid; on a phone it opens the list. The side panel lists Views (All crews, Needs you, Working, Idle, Temporary hires; keys 1–5), the crews grouped by status or A–Z, the open crew's agents with the lead's star and a hire's time left, and the agents without a crew. The top bar carries Activity, Terminal, Chat with the lead, a crew menu (Restart agents, Copy CLI command, Copy link, Delete crew…) and one New menu (New crew, Crew from a template, Import crewship.yaml, New agent, Hire a temporary agent; keys C and A). A crew page has one head (status, lead, size, autonomy, image and container) and the tabs Overview, Team, Tools and access, Environment, Memory, Settings; an agent page has a link back to its crew and the tabs Overview, Instructions, Model and limits, Tools and access, Memory, Settings. The tab is part of the link (`?tab=`), and older links (`?tab=work`, `skills`, `credentials`, `settings`) land on the matching tab. ⚠️ **Behaviour change:** the Edit crew, Crew administration and Edit agent dialogs are gone; their fields are on the Environment, Settings, Instructions and Model and limits tabs and save through one save bar. The dock offers only Terminal and Files (plus Logs for an agent), and the terminal now also opens for a crew in `/crew/shared`; Messages, YAML and Docker moved out (peer messages to the agent's Overview, containers to Environment). The Team tab shows temporary hires with Approve, time left and Rehire, and a Hire a temporary agent dialog. New crew picks icon and colour inline and starts from Suggest a team (the lead proposes agents you can rename or remove), a template, a crewship.yaml or an empty crew. The panel's Role, Model, Runtime, Hire, Activity and Health filters are gone.
- **Harbor 2: Crews, second pass.** New agent is a four-step wizard (Who, Model, Access, Instructions): start from a blank agent, a template or a copy of an existing agent, pick the account it pays with and its skills, and both are assigned right after the agent is created (anything refused is named, the agent stays). A crew's Environment tab shows separate cards for Container (Start / Stop container, Restart agents, Open terminal), Image (Change, image updates, Rebuild… with a cached or a clean build, build history), Tools and versions, Features (Add a tool / Add a feature), Network (with the Private network switch for admins), Resources, Services, Preview links (Revoke), Environment variables, Security and Folders, filtered by a segment. Crew Memory shows CREW.md with its last author and version history and every agent's AGENT.md; agent Memory has Remember between runs as a switch, what the agent knows about you (Forget asks first) and AGENT.md with History and Export. The agent's Instructions tab says where its instructions come from, lists their history, resets them to the crew default after a confirm and edits the crew default. The agent Overview gets Messages from teammates. Switching tabs with unsaved edits now asks first. ⚠️ **Behaviour change:** the runtime and security blocks, the integrations list and the container restart button left crew Settings (they are on Environment and Tools and access); Memory between sessions moved from Instructions to the agent's Memory tab.
- **Harbor 2: the Vault's AI providers.** The AI providers space (owners and admins) now has a health strip (accounts, need a new sign-in, pay for nothing, people with an account), account cards or a list (the default from 13 accounts) grouped by provider, owner or account group, the views *Needs attention*, *Not paying for anything* and *My accounts*, and a page per provider (`?provider=`) with how it signs in, its runners, how agents get it and the workspace default. Account groups have their own page (`?pool=`) with Accounts, Order and Settings; a change someone else saved meanwhile is reported instead of overwritten. An account's **Pays for** tab lists the agents that can use it, by crew, with a switch each, plus *Pay for the whole crew* and *Use as workspace default*. **Add AI provider** is its own dialog (Provider → Connect → Pays for) and can put the new account in a group; **Sign in again** reopens it at Connect with the name locked. A secret's **Give to agents** now assigns it to agents, crews or the whole workspace under a variable name. Keys **1** and **2** switch between Secrets and AI providers, and `/credentials` reopens the space you were last in. Usage bars appear only once the server reports usage ("No usage data yet" until then). ⚠️ **Behaviour change:** the account groups dialog, the Providers list with its *Assign* button and the *Assign to agent* dialog are replaced by the pages above; *Re-login* is now *Sign in again*, and *Revoke* moved from the account's header to its Settings tab.

- **Harbor 2: the Vault.** `/credentials` now lists secrets in a table (service, who holds it, last use, tier and classification, state) 50 rows at a time, with a health strip for rejected, soon-expiring and unused secrets, views and filters in the panel (Type, Service, Used by crew, Classification, Scope, Tag, Keeper tier), and bulk **Change tier** and **Delete**. The address carries the view and filters, so `/credentials?crew=<crew>` and `/credentials?class=SEALED` land on a filtered list and survive a reload; `?tab=providers` still opens AI providers. A secret opens as a page with tabs — Overview, Access, Value history, Activity, Settings (`?tab=`). Pasting a key in Add secret recognises the service in the browser. ⚠️ **Behaviour change:** the Edit dialog is gone — details are edited on the Settings tab with the page's save bar; **Replace value** now keeps the old value working for a grace period you pick (24 hours by default; *No grace* for the previous behaviour) and the grace can be ended early; Reveal is a single **Reveal for 30 s** button with the reason checked at the field; bulk delete says which agents and routines are affected and stays open when a delete fails; the overview dashboard and the list in the left rail are replaced by the table. Folders, sharing, external vaults, import and Workspace keys are not shown until the server supports them.

- ⚠️ **Behaviour change: approvals are decided in the Inbox only.** The separate Approvals page, its card list and side sheet are gone; `/approvals` now opens the Inbox at the decisions waiting (`/inbox?attention=approvals`), `?status=decided` or `?status=all` opens Inbox History, and `?agent_id=` is carried along, so links in older emails, Slack messages and `crewship open approvals` keep working. The command palette lists approvals once, as **Decisions waiting**. Who may decide and every decision endpoint are unchanged.
- **Routines: turning a tripped schedule back on.** The notice and the confirmation now say the failure count is back to zero as soon as you turn it on, not "after the next successful run".
- **Routines: the rest of Harbor 2.** The panel's **Filter** opens inside the panel, with a new **Trigger** facet; **View** groups by trigger and sorts by next run or spend; **Select several** turns off routines (Owner and Admin) or runs the ones that need no answer. The overview opens with four figures, **Needs you** (approve a plain decision in place), **Running now** (Stop for Owner and Admin) and **Next 24 hours**; **How routines work** explains routines, also under the empty state. **Run** offers **Run now · Test run · Later** in one dialog (Later plans a one-time start, pinned or following the live version). The run page lists the steps with an inspector (Output, Input, Log, Details), a step opens as its own screen on a phone, and runs open a peek from All runs and from the runs panel. ⚠️ **Behaviour changes:** **Triggers** no longer repeats schedules, webhooks, one-time starts and automations in cards below the list — each row is edited where it is listed; the overview's attention strip, outcome tiles, Up next and Drafts to publish are replaced by the figures, Needs you, Running now and Next 24 hours; **Test** opens the run dialog on Test run instead of starting at once; the run page's step map is gone (Steps or Timeline). A preference changed just before a reload (for example **Full detail**) is no longer lost.
- **The routine page is the editor.** A routine opens with its state in words — Live, Not live yet, Changes not live — and tabs Overview · Steps · Triggers · Settings (Versions with **Full detail**, which is remembered). Test, Run and the ⋯ menu sit in the top bar. **Steps › Edit steps** adds, removes and reorders steps and edits prompts and decision forms; **Settings** covers name, inputs, limits, the chat command, access and budget; both save a draft through one save bar, and nothing goes live until it is published. **Triggers** lists schedules, webhooks, the chat command, events and the Run button in one list, with Add trigger (next five starts previewed) and the webhook delivery log. The run page gains Copy for AI, figures, previous runs with a peek (J / K) and a timeline. Older `?view=` links open the matching tab. ⚠️ **Behaviour changes:** the menu's **Copy** became **Duplicate as draft** (it no longer puts an untested copy live); **Import** now saves a draft in the crew you pick instead of publishing; **Stop** on the run page is shown to Owner and Admin only, matching the server; Owner and Admin can now **Delete** a routine from the web; disabling, rejecting, deleting and discarding ask in the app's confirmation dialog instead of the browser's; **Restore as draft** is not offered on the Versions tab for now.

- **`crewship routine draft publish` accepts the file that `routine draft get` or `save` printed.** The CLI used to re-sort the definition's keys and HTML-escape its text when printing a draft, so publishing that file was refused with 422 "save_token invalid", which hit every draft saved in the browser. Draft envelopes are now printed byte-exact (only whitespace changes), and the draft GET/save API responses no longer HTML-escape `&`, `<` and `>`; JSON consumers read the same values. `routine approve`, `reject`, `disable` and `enable` honour `-f json|yaml|ndjson`, and a role refusal names the role the verb needs while keeping exit code 4.

- **Create a routine in the web app.** **New routine** is now a five-step wizard — Basics, When, Steps, Limits, Test and save — with a summary beside it. Pick the crew, start it manually, on a schedule (with the next three starts previewed) or once, add agent tasks, approvals, notifications, waits, issue actions, web calls or another routine as steps, set a cost limit, test it without side effects and turn it on. A routine that calls the web or uses credentials is saved for a Manager review instead. **Save as draft** keeps it unpublished; copying a routine brings its steps and limits but not its triggers; **Describe it** hands your own words to the crew lead in chat. ⚠️ **Behaviour change:** New routine and Import are available to Manager and above only (the server already refused the rest); Members see them disabled with the reason, and `C` does nothing for them.
- **Routines on the Harbor 2 layout.** The top bar shows Routines › view or Routines › crew › routine and holds New routine and Import; the in-page "Back to routines" bar is gone (the breadcrumb leads back). The panel lists Views first — Overview, Needs you, Running now, All runs, Drafts, switchable with keys 1–5 and kept in `?view=` — then the routines grouped by crew, each with one status pill and a pencil when it has changes that are not live. Filter by Status, Last run and Crew; group by crew or not and sort by last run or name. An empty workspace shows New routine with the CLI hint, and a load error offers Retry.
- **Sign-in screens keep the sails.** Sign in, create account, password reset, first-run setup and invitation acceptance draw the form beside the animated sail panel again (a short banner above the form on tablets and phones); the panel stands still with Reduce motion. Password fields gain a show/hide button and a "Caps Lock is on" line, new passwords tick "At least 8 characters" as you type, first run shows its place in setup (Account · Workspace · Model · Crew), and sign-in fills from password managers as a username. ⚠️ **Behaviour change:** a successful password reset counts down 5 s to sign-in (was a silent 2 s) and shows a Sign in button; a rate-limited sign-in says how long to wait; with sign-up switched off, sign-in says to ask an administrator for an invitation and a refused sign-up shows "Sign-up is closed" instead of the server's configuration hint.
- **Sign-in says where you return to.** A sign-in link that carries a page to return to (`/login?redirect=…`) now names that page under the title — "You'll return to Issues." — by its name in the navigation, never the raw path. A target the sign-in would refuse names nothing; where you land after signing in is unchanged.
- **Harbor 2: sign-in and public pages.** Sign in, create account, password reset, first-run setup and invitation acceptance now share one card: the logo above it, a short title and description, the fields, and one primary button at the bottom right (full width and pinned to the bottom on a phone). A wrong value is shown under its field, a refusal from the server in one band above the buttons, and "account created" / "session expired" as a banner inside the card. Shared artifacts (`/p/…`) and the shared-chat reader get a minimal top bar with only the logo and what you are looking at. Requests, redirects and the deliberately non-committal messages are unchanged. ⚠️ **Behaviour change:** accepting a Guest invitation now needs the "I understand this applies to the whole account" box ticked first; a `/join` link without its token says so instead of showing a disabled button; button labels read Sign in, Create account and Continue.
- **Calendar: Filter opens inside the panel, and Repeating says why it is off.** The Calendar's Filter button now opens its Status facet inside the side panel, under the search, instead of a floating popover, so the dates stay in view while you narrow them. In Schedule a start, Repeating is a disabled choice with its reason ("Managers and above can add repeating schedules.") for anyone who may not add schedules, instead of a choice that opened a form with no button.
- **Calendar page.** `/calendar` shows the workspace's routine starts and runs in Week, Agenda (the phone default) and Month views, with Mine / Workspace, crew and status filters, a "Need you soon" strip for runs that wait for someone or failed today, and a peek with the action each date needs: Open routine, Run now, Cancel start, Open run or Decide. **Add a date › A routine start** plans a one-time start, or — for Managers and above and members allowed to create schedules — a repeating schedule with its next three starts previewed. The command palette and the Dashboard's "Up next" now open Calendar; Routines › Calendar keeps working and links to it. Issue due dates, milestones and decision deadlines are not shown yet.
- **Harbor 2: first-run setup as one card.** `/onboarding` is now a single card under the Crewship lockup: the step's title, the shared step bar (Workspace · Model · Crew), the step, and a footer with Back, Skip setup and Continue / Launch (⌘↵ / Ctrl↵ continues). The crew step widens to put the Guide chat beside "Built so far"; templates show their agents and what they need. Loading shows the card's skeleton instead of a spinner, a failed restore shows an error card with Retry, the Docker check and CLI pairing states read as status pills and notes, and finished steps can be clicked to go back. A saved token reads *Token saved* with Replace. Every request, the save order and the redirects after Skip and Launch are unchanged. ⚠️ **Behaviour change:** the live preview pane is gone, the runtime re-check button reads **Check again**, an expired pairing code offers **New code**, and the template link reads **Pick a template instead**.
- **Harbor 2: one dialog shell.** Thirty-five create, edit and form dialogs across routines, crews, issues, integrations, credentials, skills, settings and admin now share the same surface: four fixed widths (480/640/800/960 px), the same header with a close button, a bottom sheet on phones, and ⌘↵ / Ctrl↵ to confirm. Confirmations ("Stop this run?", rotating a webhook secret) use the shared confirmation dialog in place of an ad-hoc one or the browser's `confirm()`. Fields, validation and submit behaviour are unchanged. ⚠️ **Behaviour change:** Create mission and the account-group editor now ask before discarding typed input; the Approve button in an approval request uses the standard primary colour.
- **One status pill.** Issues, routines, activity, crews, inbox, integrations, approvals, admin security and the journal now show every status and severity with the same pill and colours, so a failure, a pause or a review reads the same on every screen. Statuses that used to appear as raw values (`ALLOW`, `pending`, `SEALED`, `goal_met`, a run's `completed`) now read as words (Allow, Pending, Sealed, Goal met, Done). Counts and neutral labels use a plain badge.
- **Error toasts stay until you close them.** Success and info toasts still leave after 4 s and at most three show at once; an error now waits for its close button so the message cannot vanish before it is read. Chat and Pages keep the old timing in five places until their teams switch over.
- **Leaving an editor with unsaved changes asks in the page.** Following a link, the command palette, a bell or Back from a routine or Page editor with unsaved changes now opens the shared confirmation (Leave / Keep editing) instead of the browser's `confirm()`; Leave continues to where you were going. Reload and closing the tab still use the browser's own prompt.
- **Inbox totals come from the server.** `GET /api/v1/inbox/counts` and `crewship inbox counts` return the items you can see per space (to handle, updates, history) and per kind in one request, with the list's visibility, so a client no longer walks every page just to label its tabs.

- **Harbor 2 look, first step.** New light and dark palette (white content on a grey sidebar ground, corrected text greys that meet WCAG AA everywhere, opaque accent selection), Inter bundled with the app, 10 px cards and flat primary buttons. ⚠️ **Behaviour change:** a new device starts at Small text (13 px) and the System theme; devices and accounts that already have a text size or theme keep it, and Text size now reads Small / Standard / Large. On touch screens every control is at least 44 px. Appearance gains a separate `appearance.style` preference (only Harbor today) and shows **Not synced · Retry** if the server refuses a write.
- **Harbor 2 shell.** A 240 px sidebar (a 56 px rail on tablets) with the workspace, Search ⌘K, the sections, Settings, Admin and your profile at the bottom; one 48 px top bar with the area's breadcrumb, the page's title and its one primary action, and the Activity and Inbox bells; each page's header now sits in that top bar instead of a separate strip, with view tabs kept on the page. Phones get a bottom tab bar with More. ⚠️ **Behaviour change:** the profile menu moved from the top bar to the bottom of the sidebar (in More on a phone).
- **Harbor 2 kit, filters and panels.** Filters open inside a page's side panel, under its Filter button, with at most six values per facet and "All N…" for the rest; on a tablet the side panel starts closed and opens over the page from the top bar. Wizards show every step done when finished, and confirmation lists name what is lost, kept or at risk in words for screen readers. ⚠️ **Behaviour change:** at 768–1279 px the side panel no longer takes a column; open it with the panel button in the top bar.
- **CLI token changes are auditable.** Creation and revocation now commit together with instance-level, keyed audit records; administrators can see per-entry integrity without exposing token values or inventing proofs for legacy history.

- **One attachment queue for the chat composer.** Picked, dropped, pasted and camera files now share one queue per conversation and upload one at a time. A chip says Waiting, Uploading, Failed or Cancelled in words; a queued or running upload can be cancelled and retried without removing the chip, and files past a provisional client limit (10 per message, 25 MB each; not server-approved) are refused with a reason. Pasted files are now attached instead of being silently held back. A failed or cancelled file keeps Send off with a visible reason and Retry/Remove on the chip; uploads are kept per person and workspace, continue while you switch to another chat, and stop when you leave the chat page.

- **Crew sharing is available from the web controls.** Workspace administrators can share View/Use from crew Settings or select Crew in a person’s resource Access editor. The dialog explains the current/future agent audience, conditional execution and the exclusion of Delegate, credential visibility and crew administration. Existing API/CLI authorization, issuer provenance, revision conflicts and account modes are preserved.

- **Crew View/Use shares support explicit presets.** Administrators can preview and confirm None, View or Use in person Access or the existing API/CLI flow. Preview explains the current/future agent audience; unrelated grants, original issuers and older preset selections are preserved. Crew presets grant neither Delegate, credential visibility nor administration.

### Upgrade and recovery notes

- Preserve the configured v1 audit/journal root in encrypted instance recovery kits after secret re-encryption; successful envelope conversion does not authorize retiring that root. ⚠️ **Behaviour change:** Instance backup now rejects an invalid `ENCRYPTION_KEY` instead of producing a recovery kit with an unusable audit root.

- Before downgrading across the durable routine-start migration, stop incoming triggers and drain queued and in-flight starts. Otherwise use a forward fix; downgrading with outstanding work and upgrading again can repeat accepted work.
- Resuming a routine body provides at-least-once execution: an interrupted step can repeat external effects. This is not an exactly-once guarantee. An uncertain interrupted setup hook remains visible as interrupted rather than being automatically repeated.
- If durable start recovery fails at startup, the server refuses to start. Resolve the reported recovery/storage error before restarting; do not bypass recovery.

### Fixed

- API responses now match the published contract on 23 operations: empty lists answer `[]` instead of `null`, a new agent reports its restricted profile, and the OpenAPI document describes the real shapes, nullable fields and both error envelopes.
- **An identical Mooring create retry no longer returns a private document after its author loses access.** The existing transaction-local author check now runs before looking up the saved result as well as before committing a new document.

- **Workbook creation now rechecks the original author’s current rights in its transaction.** Lost membership, restricted access or removed Page-create rights refuse both creation and identical retries; a rights change during insertion rolls back the staged Page.

- Revoke every matching Page grant when a reference identifies both a current subject and a departed stored ID, without changing unrelated grants. ⚠️ References matching multiple live subjects now return 400 instead of selecting one arbitrarily. Creation and reissue also verify that other subjects' grants remain unchanged. Losing issuer authority during the audit commit returns 403 and rolls back the change; database failures remain server errors.
- **Old `/paymaster` links open Spend instead of Not found.** The page moved into the Journal's Spend tab; `/paymaster` now redirects there, and spend links built by the app point at it directly.
- **Harbor 2: Spend respects the role.** The dashboard no longer asks for the cost ledger or draws the Spend tile below ADMIN, and Activity › Spend shows "Spend is unavailable: only workspace owners and admins can see costs." instead of failed-load cards if the server answers 403 (#3662 on the new layout).
### Fixed

- Prepare a strict Document-to-DOCX converter for validated saved content; export delivery and Microsoft 365 compatibility remain unqualified.


### Fixed

- ⚠️ **Behaviour change: cost figures are readable by workspace OWNER and ADMIN only.** `GET /api/v1/paymaster/spend/by-crew`, `spend/by-agent/{crewId}`, `spend/by-mission/{missionId}`, `top-spenders` and `GET /api/v1/journal/spend` (and so `crewship cost`, `crewship paymaster` and `crewship spend`) now answer `403` to MANAGER, MEMBER, VIEWER and GUEST; before, the web app hid Spend but any member could read it from the API. An empty window returns `"rows": []` instead of `null`. The dashboard and Activity no longer ask for, or show, spend for other roles.

- Preserve captured run completion timestamps across retained-output recovery and terminal replay; legacy records retain their original replay identity.
- Restore a confirmed Document checkpoint as a new version after explicit human confirmation; exact retries preserve the receipt and older write mandates remain fenced.

- Keep newly added members’ canonical initial rights out of automation previews, matching and inputs. ⚠️ **Behaviour change:** `member.added` free-text journal search now matches summary only, including historical events; canonical audit payloads and keyed hashes are retained.

- Workspace member addition and account provisioning now commit their chained audit atomically, recheck live administrator authority, and keep initial rights and setup material out of public journal frames.
- Crew member additions, removals and role override changes now commit with their old/new membership audit or roll back, with notifications only after commit.
- Record the first workspace OWNER as the dedicated `member.owner_created` event atomically with workspace creation, personal signup and bootstrap; failed audit writes roll back creation, while public feeds and automation previews, predicates and templates omit the stored membership snapshot. ⚠️ **Behaviour change:** Guest `POST /api/v1/workspaces` returns 403 without creating a workspace. All `member.owner_created` and `member.access_changed` events now search summary only, including historical rows and formerly public payload fields; canonical audit payloads remain unchanged.
- Keep private authorization audit snapshots out of automation previews, matching and template inputs as well as shared journal feeds; retain the canonical keyed audit unchanged. ⚠️ **Behaviour change:** Protected authorization events now search summary only (including historical rows and formerly public payload fields); exact transactional audit readback refuses post-insert deletion or tampering.
- Dispatch due manual backups reliably across fractional-second timestamp boundaries, while keeping future busy retries queued until their exact deadline.

- Wait for provider sign-in recovery to release its database connection before server shutdown finishes.

- Accepted routine webhooks keep a durable run identity while waiting for capacity or recovering after restart. Webhook capacity waits expire after 24 hours; uncertain deduplicated starts stay visible for inspection instead of linking a nonexistent run.

- Record routine starts before setup hooks, so interrupted setup remains visible and cannot be mistaken for work that never started.
- Keep private Document output private in its source conversation, live delivery and agent diagnostics; audit foreign OWNER inspection before returning copied data.
- Refuse workspace replacement and forced recovery that would discard newer private conversation classification while retaining diagnostic log copies.

- Retain private artifact conversation classification across recovery and result deletion; refuse restores that would lose its original audience.
- Keep private Page grant administration and production limited to the custodian and workspace OWNER, including when legacy grants exist.

- Commit Page grant creation, reissue and revocation with their chained audit records; failed audits leave permissions unchanged and publish no change notification.

- **Guest Page catalogs keep working when private chat Documents exist.** Unauthorized private entries are omitted without failing the listing; private editing, OWNER access and the Guest route allowlist remain separate checks.
- Audit private Document reads against the custodian authorized by the fenced read, and withhold content when the required audit cannot be recorded.
- Audit OWNER reads of another human’s private Page export, version history and access report atomically before disclosure; ignored or removed audit rows withhold the response. Ordinary Page reads retain a read-only snapshot without taking the SQLite writer lock.
- Clear saved Document previews and chat-result titles on page deletion, and ignore responses started before the deletion.
- Rate-limited shared issue searches no longer fill workspace capacity with unused project buckets or refresh their idle lifetime.
- Workspace role updates now commit with a chained audit event and the existing Settings audit record or roll back. Capability audit events retain the previous and resulting effective sets while keeping those values out of the general journal feed.
- Isolate stream admission revocation epochs by credential and user, so another user's logout cannot reject valid requests; repeated signout of an already revoked session no longer sends another revocation notification.

- Open saved Document cards in the native editor with an immutable Page reference. Every read retains the original identity and current access checks, so reusing a deleted document's address cannot open a replacement. Query-only navigation follows the new reference.
- Document reads and initialization retries reject unsupported saved schemas before returning content, while preserving their confirmed data and authorization checks.

- ⚠️ **Behaviour change: cost figures are readable by workspace OWNER and ADMIN only.** `GET /api/v1/paymaster/spend/by-crew`, `spend/by-agent/{crewId}`, `spend/by-mission/{missionId}`, `top-spenders` and `GET /api/v1/journal/spend` (and so `crewship cost`, `crewship paymaster` and `crewship spend`) now answer `403` to MANAGER, MEMBER, VIEWER and GUEST; before, the web app hid Spend but any member could read it from the API. An empty window returns `"rows": []` instead of `null`. `GET /api/v1/metrics/timeseries?metric=cost_usd` answers `403` the same way. Every other endpoint that carried a cost next to data members may read now leaves the cost out below ADMIN (the field is absent, not `0`): routine runs, run records, run tree and run results, routine budgets (`has_budget` / `over_budget` stay), the journal list, entry and SSE stream (payload amounts and `$…` in summaries), agent runs and chat message metadata, the chat run preflight, the agent inbox, missions and mission metrics, work items, eval runs, the run NDJSON stream and WebSocket frames. `crewship routine budget`, `routine runs-all`, `routine records`, `routine tree`, `work get` and `routine run` print `—` or the budget state instead of `$0.00` when amounts are withheld. The dashboard and Activity no longer ask for, or show, spend for other roles; the routine screens, run pages and chat preflight show the budget state or leave the cost out instead of `$0.00`. The Routines Health table (`GET /workspaces/{ws}/pipeline-health`, `crewship routine health`) leaves out `spend_usd` the same way; the CLI prints `—`.
- ⚠️ **Behaviour change: private chat Documents are visible only to their human owner and workspace OWNER.** Other roles receive 404 and no catalog title; OWNER access to another human's document is audited before disclosure. Legacy sharing cannot silently widen private audiences, and OWNER selects an explicit successor before removal of a private artifact's custodian.
- ⚠️ **Privacy change: folder moves no longer expose private Page identities in workspace events, journal feeds, automation previews or automation inputs.** Canonical audit targets remain intact. Historical folder-move entries without a valid classification, including ordinary Pages, now use a generic public projection and are excluded from full-text search; newly classified ordinary Page events retain their metadata.
- **Agent details now show the configured provider and model** in table, JSON and YAML output; these settings remain distinct from evidence of the model serving a run.
- ⚠️ **Behaviour change: credential revocation ends open client streams.** Browser and CLI WebSockets, journal SSE and run NDJSON stop authorizing frames after logout, session/token revocation or credential expiry. Request a fresh ticket and reconnect with a valid credential; running routines retain their separate grant/account authority.
- **Credential history survives retirement and name reuse.** Integration cleanup and failed credential proposals retain tombstones instead of deleting audit history. Reusing a retired name creates a new ID and adds a recoverable ID suffix to the old historical label; audit references now prevent accidental hard deletion. ⚠️ Workspace replacement now refuses changes that would orphan out-of-scope legacy audit history instead of silently erasing it.

- Scheduled routines retain at most one waiting occurrence per schedule when capacity is full. Later capacity-blocked occurrences are recorded as skipped/missed, without failure alerts or circuit-breaker trips.

### Added

- **Replay captured routine runs with corrected inputs, tags and metadata.** Omitted values inherit the source; empty objects and arrays clear inherited values. Changed inputs are validated against the selected routine version. (#3592)

- Prepare scoped native Slides initialization with atomic receipts and caller-owned transactions; API and editor activation follow separately.

- Open saved Documents beside their conversation with fresh human read checks; mobile back navigation and desktop dismissal preserve the unsent chat message. Modified clicks retain native page links.

- Added scoped, read-only resolution of saved Documents for the chat preview; panel integration remains separate.
- Add controlled native Slides editor and presentation components with explicit unsaved state and a schema-1-only rendering boundary. Persistence and application integration remain separate.
- Add strict native Slides operation contracts and atomic in-memory candidates for future transactional presentation writers.

- Browse retained Document checkpoints in a separate read-only history view without replacing the live draft or editor. Every API and CLI history read rechecks current human access.

- Add a scoped document viewer shell with explicit unavailable states, keyboard dismissal and focus restoration. Chat integration remains separate.

- Prepare a shared read-only saved Document and checkpoint renderer that rejects non-Document roots and handles serialization failures without retaining stale content; production history and panel wiring remain separate.
- Read retained Document checkpoint lists and exact saved bodies through the API and `doc checkpoints` / `doc checkpoint`, without restoring or changing the current draft.

- Record member capability changes and workspace member removals in the chained journal atomically with their mutations. Audit failures roll back the change; capability values remain restricted to the existing administration endpoint.

- Select Create document in the chat composer to request a private saved document using Czech or English prose, with explicit per-message consent.

- Document drafting commands honor JSON, YAML and NDJSON output formats while preserving exact revision and checkpoint identities.

- **Workspace owners can control document creation by agents.** The workspace policy API and CLI expose an explicit creation switch, disabled by default; run authority remains bound to the requesting human and current permissions.

- **Documents can be created and edited with durable save feedback.** When document support is enabled, create an empty document in the UI or CLI, edit it and reopen the confirmed saved content. Opening saved content does not add a paragraph or trigger a write.

- Render versioned chat progress with stable replay identities, explicit partial and tool outcomes, permitted reasoning summaries and persisted timing. Keep provider accounting separate from confirmed completion and clear protected transcript state on identity changes.
- Read versioned chat source references through the existing authorized agent-session and workspace-room message APIs and CLI, preserving original identities without sending messages.

- Protect run-admission restore targets and bundle callbacks, including generated reserved metadata columns and distinct FilesOnly destinations.

- Refuse unsupported run-admission payloads in raw dump restore before opening the write transaction or invoking callbacks.

- Add byte-preserving canonical validation for routine run-admission envelopes and their outer identity tuple. This storage prerequisite does not create admissions or enable execution.

- Document a review proposal for crew and credential sharing with explicit human audiences; no access behavior changes.

- Archive only verified native legacy routine heads during upgrade, preserving exact content, origins and integer pins without reconstructing historical versions. Verify each persisted archive before recording the cutover.

- Await final host-capture fixture writes before removing temporary directories.

- Preserve distinct routine version authority identities and legacy history without enabling Guest publication or runtime.

- Decode exact publication identities and capture nonsecret provider declarations without enabling publication or provider execution.

- Define a host-only canonical publication identity that binds exact grants, actors, source origins and selected child versions without enabling publication or runtime.

- Preserve genuine archived identities in API history, upsert, and resurrection test fixtures.

- Seed pipeline API smoke tests through the migrated database and real archived routine store.

- Prepare host-only exact grant provenance for bounded routine publication: selected grant and publisher/issuer membership identities survive unrelated policy saves but cannot be replaced by trusted-mode bypass or reissued shares. No publication endpoint, permission or runtime is enabled.

- Invalidate protected editor reads and pending saves when switching members or resources, so returning to a cached scope requires a fresh read.

- Clear reviewed member preset consent on access loss and ignore late mutation responses from an older verified policy read.

- Settings resource access offers explicit immutable presets for existing Guest resources, with exact previews and confirmation. Saved intent stays separate from live grant authority; conflicts and uncertain writes require reloading before new consent.

- Clarify that resource preset preview, confirmed application and the Settings selector are available; remove obsolete foundation-only descriptions without changing access behavior.

- The CLI can apply an explicitly confirmed resource-preset selection with one write, exact JSON/YAML field names and no automatic consent refresh or retry.

- Transactional audit appends reject ignored journal inserts and withhold notifications so the owning business transaction can roll back.

- Applying a resource preset preserves every unrelated canonical grant row, including inactive historical grants whose resources are unavailable; ordinary complete-document policy updates retain their existing validation.


- Preset CLI document decoding shares the existing bounded, strict file/stdin contract without changing supported consent fields or refreshing revisions.

- OpenAPI administrative member-policy reads and replacements reuse a named complete policy document; accepted fields, CAS requirements and permissions are unchanged.

- Explicit resource-preset application in the API recomputes reviewed consent atomically with canonical grants, audit and saved selection. Retained issuers and unrelated rights are preserved; stale consent requires a new preview and never triggers automatic reissue.

- Read-only resource-preset previews in the administrative API and CLI show exact managed changes, retained provenance, Results disclosure and independent destructive consequences. Confirmation digests bind live state without granting authority or changing permissions.

- Internal transactional recorder for explicit preset selection intent, fenced to live administrator authority and matching canonical managed grants. The helper does not enable a public apply route or change permissions.

- Prepare nullable durable routine identities and start phases; dispatch behavior is unchanged.

- Deferred routine receipts expose stable waiting reasons in API, CLI and Plan, including neutral legacy causes and recovery attention.

### Added

- Administrative member-access reads include server-computed preset selection provenance. Saved intent remains separate from effective permissions; manual edits cannot forge selections and personal access responses omit this metadata. The new selection fields keep their API names in CLI YAML. OpenAPI reuses the existing grant-provenance shape without changing authority.

### Changed

- Reduce workspace and entity WebSocket delivery authorization to one current SQL snapshot per frame, retaining immediate account, membership and restricted-profile revocation checks, including the private-page owner or workspace OWNER audience.

- OpenAPI administrative member-access documents share the unchanged project/routine variants and complete resource-right union. Primitive operations remain independent; no preset or permission behavior changes.

### Changed

- OpenAPI administrative member-access documents reuse the existing agent-right shape as a named schema. Accepted operations and runtime permissions are unchanged.


### Added

- Administrative API and CLI catalog for immutable v1 project and routine access presets. Listing preserves API field names in structured formats and does not grant permissions or enable preset application.
- **Admitted runs can create a saved document through `crewship doc create`.** The requesting human owns the populated document, and retrying after a lost confirmation returns the same result. Document support and creation policy must be enabled.
- **Document creation runs can save confirmed draft checkpoints.** An original drafting request permits guarded edits only to its new document in the same live run. Exact retries preserve saved work; a human edit or replacement run never silently extends the permission.

- Index preset selection ownership, resources and selectors for parent cleanup and scoped backup lookups.

- **Revoked project data stays hidden during connection errors.** Shared project details, milestones and issue deletion previews require a fresh successful read after access is refused; cached responses and late saves cannot restore the old view.

- Guests with explicit project Read+Manage can open a known-project management link without List. The screen reuses reviewed metadata/milestone forms, preserves drafts during temporary workspace-directory loss, and optionally previews a known issue for confirmed deletion with the separate Delete issues share, without issue discovery or broader grants.

- **Participants can start a conversation in an empty shared chat.** A current authorized execution profile confirms the existing chat without a creator-only create request; every send still rechecks access and refused sends keep the draft.

- **Proposal comments address the chat agent explicitly.** “Send comment to agent” now includes its canonical mention so shared chats trigger the requested reply; rejected sends keep the comment draft.

- **Guests can connect their CLI from the account menu.** Connect CLI now opens the existing browser pairing dialog for Guest accounts after access loads, retaining their current grants. Guest menus also avoid an unavailable system-version request.
- **Issue editor links and images use a URL dialog instead of the browser prompt.** Inserting or editing a link, and inserting an image from the toolbar or the `/image` command, opens a dialog that pre-fills the current link, accepts only `http://` and `https://` URLs (an empty value removes a link), shows the error under the field and returns focus to the same place in the editor. Cancel and Esc change nothing.

- ⚠️ **Behaviour change: enabling privileged runtime access requires an instance administrator.** Workspace OWNER/ADMIN rights alone no longer enable `allow_privileged_credentials`. Scoped CLI tokens also need `instance:admin`. Workspace administrators may still disable the opt-in; existing privileged containers require separate review and recreation.

- **Protected chat runs wait for confirmed execution results after their observer disconnects.** Chat preserves partial replies and leaves the run admitted for retained-output reconciliation instead of recording a false failure or cancellation.
- **Human-owned content can be handed over explicitly.** Workspace administrators can review eligible readers and transfer custody while preserving content and grants. Private content requires a human successor before its owner leaves; ordinary Pages retain their existing succession behavior.

- **Guest CLI pairing accepts verified browser sessions.** Pairing start and poll now pass the restricted route gate only for interactive sessions. CLI bearer callers remain forbidden; redemption retains the same current Guest grants as browser CLI token creation and rejects logout, revocation or suspension.

- Chat shows advisory configured-model payer, budget and gate details above the composer after a current viewer/chat profile check.
- **Crews can opt into whole-run approval before agent execution.** The existing policy API and `crewship policy set --whole-run-approval` enable a real `agent_run` rule. Chat preflight and runtime use the same crew-scoped rule, while default behavior and autonomy modes remain unchanged.
- **Decision drafts retain focus during access rechecks.** Typing and caret position survive temporary verification outages; sending waits for verified access and explicit source-version review, while uncertain submitted responses remain locked for exact retry.
- **Withdrawn chat approval sources cannot be rejected through a stale Inbox ID.** Canonical decisions now retain the original chat generation and current operator audience; authorized refusal still works when only the original requester loses access.

- **Chat decision answers preserve the Inbox token scope.** Narrowly scoped CLI tokens cannot answer through chat; the same existing workspace administration scope is required, including retries. Read-only role demotion still permits an authorized completed retry.
- **Routine runs distinguish fresh chat invocation from inherited recipe authority.** Verified direct-human calls retain their exact source run privately; legacy and scheduled execution continue without a guessed question. Explicit invalid run credentials are refused before creating a run.

- **Guest intake changes and deletion preserve active routine work.** Queued, running and waiting runs still block changes after their issue execution becomes superseded; completed runs do not. Rejected deletion keeps the issue and execution intact.

- **Shared routine results retain private provenance.** Replays preserve their source and trusted caller origins; issue runs, ambiguous legacy origins and malformed authority evidence stay hidden. Final outputs receive the same credential scrubbing as step outputs, including historical shared reads. Oversized selected results return 413.

- **Guests can inspect explicitly shared routine history and outputs.** A new Results share with View exposes run metadata and selected outputs in UI and CLI, without execution authority or transcripts. Inputs are not shown directly; outputs may contain them. Existing View/Run shares retain their previous scope; inherited private conversation audiences still constrain results.
- **Shared issue searches visit only projects with live List grants.** Search and counts resolve current grant authority before reading issues, avoiding scans of hidden workspace issues. Issuer demotion/suspension and Read/Contribute without List return no list results.

- **Guests can search shared issue titles and identifiers in UI and CLI.** Filtering and total counts retain live project grants; hidden descriptions, comments and unrelated projects are excluded. A new search starts from the first page in the UI. Creation confirmation remains visible when the filter hides the new issue.

- **Shared issue searches explain temporary rate limits.** The browser keeps results and search drafts, pauses search polling and disables repeated requests until the retry interval ends. A definitive access denial discards old results so later throttled retries cannot restore them. CLI commands print retry guidance, exit 6 and require an explicit retry.
- **Reloading a shared routine draft now discards local edits even when its saved revision has not changed.** A failed reload retains the local edits, and background refreshes of the same revision keep them.
- **Agent images and charts appear in chat.** Authorized PNG, JPEG and WebP outputs from the reply’s run render inline with a filename caption, alt text and byte version. Access rechecks remove unavailable images; SVG and disguised active content stay outside the viewer.
- **Decision reply drafts remain scoped to their viewer and source.** Reload restores an uncertain reply with its original retry key; definitive access loss removes protected recovery, and paginated source lists reconcile as complete snapshots.

- **Chat can answer verified information requests from the same source as Inbox.** TEXT escalation cards use live access and deadline checks, reviewed source versions and stable retry keys; terminal receipts retain the actual human actor. Credential requests stay in the existing protected Inbox flow.

- **Escalation requests retain their verified execution source.** New run-authenticated requests keep the original agent run ID for accurate chat decision anchoring. Older service requests remain unanchored and retain their existing Inbox resolution.

- **Decision cards gain a typed response view.** Source-defined workflow actions retain their identity, terminal decisions show read-only receipts, and uncertain replies keep the same operation key for retry. Integration with live decision sources follows separately.

- ⚠️ **Behaviour change: CLI pairing follows its source browser session.** Suspended accounts and missing, logged-out, revoked or expired source sessions cannot redeem codes. Request a fresh browser code for older pairings without session provenance; CLI-token authentication cannot start pairing.
- **Dependency updates now build and package together.** Refresh the frontend, Go and CI dependencies, explicitly declare lockfile version changes, and retain the version-scoped license inventory.
- ⚠️ **Behaviour change: crash reporting uses Sentry v11.** Self-hosted Sentry must be 26.4.2 or newer. Browser, Node and Edge initialization disable collection of user identifiers, request metadata, AI content and other payload data. Browser release-health sessions stay off and telemetry consent remains required.

### Fixed

- Isolate shared issue-search limiter capacity to 256 accounts and 2048 audience buckets per workspace while retaining global bounds. Ordered idle expiry avoids scanning active buckets on capacity refusal and preserves their rate budgets; global saturation can still refuse new buckets.
- Waitpoint decision confirmations and CLI errors no longer repeat approval capabilities; transport failures retain their existing error type and exit code.
- **Agent questions stay connected across chat and Work.** Authorized decision forms appear beside their run and in “Waiting for you”; opening one uses the same source in the Work panel or a full-screen phone panel. Inbox answers refresh the card to a read-only receipt. Uncertain replies retain their original operation key across reload; temporary failures preserve drafts, while access denial clears the source and recovery data.
- **Chat can project existing synchronous whole-run approvals.** Verified human run sources share the canonical Inbox decision and source retry metadata. Newly host-correlated blocking approvals enforce expiry and live operator/requester checks before commit; per-tool, async and legacy paths retain their existing behavior.
- **Chat can project existing synchronous whole-run approvals.** Verified human run sources share the canonical Inbox decision and source retry metadata. Newly host-correlated blocking approvals enforce expiry and live operator checks before commit, with live requester admission required for approval; authorized refusal can still settle withdrawn requests; per-tool, async and legacy paths retain their existing behavior.
- Chat pull-request cards label their data as stored metadata, including empty lists; live CI remains unavailable. The credential diagnostic runbook distinguishes a local missing credential (412) from a forge failure.
- **Issue proposals are interactive in their originating chat.** Review and edit the proposed selection, confirm or discard the reviewed version, and open the same proposal in Work or a full-screen phone panel. Card and panel drafts stay separate; uncertain writes retain their retry key. Temporary access-check failures preserve drafts with writes disabled, while explicit access loss and sign-out clear protected recovery data.
- **Chat can inspect the current payer and budget before work.** The read-only run preflight reports Paymaster remaining balances and predicted whole-run gate for the configured agent model, with an explicit unknown price and current provider admission constraints. It reserves no funds and grants no approval.
- **Whole-run approvals follow the actual gate mode.** Nonblocking async reviews now allow the run to continue even when reward history changed a configured synchronous gate. Approval metadata records the effective mode and trusted run provenance; unknown adapter modes continue to block pending work. Direct human approvals recheck the recorded requester after the wait; delegated and legacy runs retain their existing paths. Legacy approval reads keep new internal chat/run references private.
- **Personal memory withdrawal stays inside its workspace.** A guest invitation or restricted-membership change no longer erases saved preferences in another workspace. Local withdrawn preferences remain forgotten; previously erased values cannot be reconstructed. Clearing all preferences also works for agents without a crew.
- **Chat drafts survive temporary access-check outages.** Network errors and server failures keep the last verified cards mounted as rechecking with writes disabled. Explicit access denial still clears protected data and cannot be undone by another failed check.
- ⚠️ **Upgrade: restart agent containers after updating the backend and sidecar.** Coordinate an idle window and use `crewship crew restart-agents` so existing containers receive the matching sidecar; old sidecars can fail issue writes. Follow [the execution-authority rollout](RELEASING.md#execution-authority-rollout-3068), including the read-only `doctor execution-origins` audit against the actual stage/production database before upgrade.
- **Chat issue drafts survive saving and access rechecks.** Field and comment drafts clear independently; editors retain focus during successful refreshes. Unknown writes retain their original retry key across panel close and reload, and conflicts reload current values alongside the draft.

- **Chat issue hints stay within their conversation.** Showing an issue refreshes only the originating chat; issue changes refresh revisions without announcing activity in another chat. Card-only viewers subscribe to a dedicated hint channel, avoiding run-stream traffic. Streaming observers recheck current access before receiving frames, and deletion, relation and review-policy changes refresh cards.
- **Chat table previews rejected ordinary spreadsheets and legacy CSV text.** Hyperlinks are ignored without fetching, chart tabs are skipped while worksheets remain visible, invalid dates are labelled, and UTF-16/Windows-1250 CSV text is decoded locally. Both shipped worker acceptance checks now run in CI.

- Chat Artifacts includes supported files in the canonical per-run output folder while retaining internal, hidden-directory and attachment filters.
- **Mobile table selections return to Chat without covering the draft.** Asking about selected rows closes the artifact overlay and preserves existing draft text. Switching between Chat, Work and Artifacts keeps previews within the selected panel and retains their tabs.

- **Chat issue references stay scoped to the current viewer (#3068).** Reconciliation replaces complete snapshots, clears protected projections after a denied access check, and preserves durable run anchors. Uncertain human writes retain the same revision and idempotency key through recovery, including a denied retry after a lost acknowledgement.
- Chat CSV/TSV artifacts gain bounded local-worker previews with sorting, filtering, virtual rows and source-preserving selection. Ask about selection appends a versioned reference to the draft without sending it. Access denial clears displayed artifact bytes.
- Chat XLSX artifacts gain bounded local worksheet previews, saved formula results and source-preserving draft selection. Corrupt, encrypted, macro-enabled and oversized workbooks, and those with external data connections, retain an explicit download fallback. Macro-enabled `.xlsm` outputs remain discoverable for download only.

- **Issues created in chat stay with their conversation turn (#3068).** Viewer-authorized cards survive reload and failed runs, open an existing Issue detail panel, and support permitted field edits and comments with conflict and uncertain-write recovery. Access loss hides protected card and panel data; phone and keyboard flows use the same controls. Direct work execution remains on the canonical Issue page.

- **Chat issue cards can refresh sooner after successful writes.** Authorized chat sessions now receive content-free reference/revision invalidation hints; reference snapshots include `contract_version: 1`. Queued session delivery also rejects suspended users and deleted chat agents/workspaces.
- **Suspended accounts stop receiving realtime updates.** Channel subscriptions and queued WebSocket delivery now recheck the active account, including global and identity feeds and protocol control messages.
- Issue cards in chat can show linked pull requests on demand, using authorized stored provider metadata. Cards distinguish failed or missing synchronization and explicitly mark CI as unknown; no private source or diff is fetched.

- Guests with explicit routine View and Edit draft shares can change collaborative drafts through UI and CLI with revision/base conflicts and atomic audit. Published recipes, execution authority and trusted testing/review gates remain intact; direct Guest publication is still separate work.

- Guest project managers can create and edit milestones with reviewed versions and atomic audit. Empty-only removal preserves linked issue work; UI and CLI enforce current action flags and conflict review.
- Guests can remove reviewed Backlog/Cancelled issues through an explicit Delete issues share, with Read/Manage, current snapshots, active-work guards and atomic audit/chat receipts.

- ⚠️ **Behaviour change:** Page shares become inactive when their issuer is suspended or restricted as a Guest anywhere. Existing share metadata remains visible to Page administrators with an account-status explanation.
- ⚠️ Tokens with limited scopes can no longer create successor tokens or pairing codes. Use an interactive sign-in to create credentials; trusted full-role token creation remains available.

- Internal foundations preserve explicit versioned resource-preset choice provenance through backup and fork restore. Existing grants remain unchanged and no preset selector/API/CLI is enabled yet; immutable v1 bundles, managed-edit invalidation and empty migration state prepare #3271.
- Internal preset planning reads one live-authority snapshot and explains exact bundle changes, preserved issuers and independent consequences without changing any grants. Empty grant collections remain JSON arrays; unavailable unrelated historical resource grants remain preserved without granting authority. Confirmation checksums do not authorize access; public preview and application remain disabled pending the next #3271 slices.

- Guests with an explicit routine View share can inspect its definition without an execution runtime or agent Run grants. Stored Run grants retain their existing invocation-only disclosure; View does not expose another person’s private runs. UI, CLI and access explanations use the same live issuer policy.
- Guests with explicit project Read and Manage shares can edit shared project names and descriptions. UI and CLI preserve review snapshots and refuse conflicting saves; private project metadata and unrelated operations remain inaccessible.

- **Agent chat transcripts survive workspace and crew backups (#3109).** Encrypted bundles include scoped structured history, remapped fork identities and stable message/run anchors. Damaged lines produce per-chat completeness warnings instead of blocking all backups. Collection only fences file pinning; restore fences publication and commit, preserving existing histories unless replacement is explicit. Cross-workspace chat collisions are refused. The search/feedback mirror and atomic hard-crash recovery across filesystem/DB publication remain separate limitations.

- **Agents can remember explicitly stated feedback preferences.** Optional future preferences on thumbs feedback now have scoped, source-tracked storage, asynchronous status, CLI self-service edits and deletion, and private-session recall with consent checks. Bare thumbs remain feedback only.

- **Choose what an agent should remember from feedback.** Thumbs now offer optional explicit future preferences with verified memory status, and the chat Memory panel lets you inspect sources, change or forget preferences, and control personal memory.

- Pages folder and page menus now follow caller-specific server ACL decisions: readers see no mutation controls, folder editors can arrange, and page owners retain move access.
- Guest accounts can complete CLI login by creating their own token from a verified interactive session. Minted tokens retain Guest restrictions; bearer credentials cannot remint a wider successor.

- Guest project contributors can submit Backlog requests, post explicitly shared comments and arrange intake work. Administrators choose the project intake crew; historical staff comments stay private and shared threads stay bound to their original project. UI and CLI cover the same operations.

- **Share routines and projects from their detail cards.** Workspace administrators can inspect Guest shares, preserve unrelated rights and issuer provenance, revoke individual operations or explicitly reissue inactive shares. Conflicting saves require a fresh review. Routine sharing offers Run; project sharing offers independent List and Read.
- **Share individual routines and projects from the CLI.** `share`, `share list` and `unshare` preserve unrelated rights and issuer provenance, expose inactive shares and require explicit `--reissue` to move authority. Stale policy saves fail without retry.

- **Guests can understand their own access.** Settings shows named resources and execution prerequisites; `workspace access me` and the workspace `access/me` API expose the same self-scoped explanation. Temporary refresh errors preserve the last good result, while access loss clears it. Concurrent resource deletion becomes an unavailable row.
- Policy saves and explicit grant reissues record previous and new issuers and rights atomically. Member access CLI supports `--reissue` and shows inactive shares; Settings displays issuer names when available.

- **Editing one Guest share preserves other administrators’ grants.** Unchanged rights retain their issuer and creation time, and inactive grants require an explicit reissue. Administrative policy shows issuer and active status; changes to already inactive issuers no longer stop newly authorized work.

- ⚠️ **Behaviour change: resource shares follow current administrator authority.** Guest discovery, Issues, chat and routine execution stop using a grant when its issuer leaves, is demoted or suspended, or becomes a Guest. Stored shares are preserved; restoring the issuer does not revive previously admitted runs.
- Guest accounts cannot acquire ADMIN or OWNER in any workspace; a database invariant protects both directions of the account-wide restriction. Guest Page actions retain Pages ACL checks and also require explicit routine Run and agent grants; existing capabilities are not backfilled.
- Native Guest runtime candidates use a patched Debian 13 userspace while preserving the exact pinned bubblewrap 0.8 and Codex sandbox contract. Candidate publication still requires a passing vulnerability scan, signature verification and live acceptance before installation.

- **Audit chart selections clear when the same bar is selected again (#3094).** The chart and table retain the chosen time-window anchor while activity loads or filters change, so incoming samples no longer shift a relative bucket beneath the selection.

- Fix Settings reloads while account access loads, Guest chat regeneration controls and restricted resource path segments. Add CLI Guest invitation policy/consent flags and binary acceptance coverage.
- ⚠️ **Behaviour change:** Guest invitations, provisioning and resource policy changes refuse accounts that own or administer any workspace. Stale Guest invitation signup returns a typed conflict. Automation rules recheck the active routine author's membership in that workspace, and any non-NULL suspension blocks instance administration.

- ⚠️ **Behaviour change: only workspace owners may provision ADMIN accounts.** The setup-link flow now applies the same role assignment rule as membership updates and invitations. Workspace administrators can still provision MANAGER, MEMBER and VIEWER accounts; refused requests preserve existing accounts and setup links.

- ⚠️ **Behaviour change: guests run only routines explicitly shared with them.** Routine run grants now combine with every required agent grant, without a workspace-wide routine capability. Existing restricted members need routine grants added; pending private work is invalidated on upgrade. Settings › Members can select individual routines.
- **Guests can be added with initial shares and inspect project Issues.** Guest invitations install initial shares atomically with acceptance, including signup redemption. Existing accounts explicitly accept the account-wide restriction; direct provisioning cannot silently restrict a claimed account. Project list/read grants expose a filtered, read-only Issues catalog and detail without shared activity or related-resource data. Settings and `workspace member access explain` describe saved grants and blocked execution prerequisites.
- **Suspending a human routine author stops unattended triggers.** Schedule, webhook, wake-check, nested calls and automation rules recheck the author’s live account; promoting a Guest to administrator requires explicitly restoring trusted access.
- **Access refusals explain what remains available.** Restricted screens show Crewship branding, administrator guidance and links to the member’s available sections. Discover-only agents no longer offer sending messages, and the Pages rail hides folder creation when creation is unavailable.
- **Workspace recovery keeps account and administration usable.** Workspace selections are stored separately per account; a stale preference recovers on login. Directory outages preserve active drafts while account and instance API requests remain available. Remaining chat and output-file path identifiers reject dot segments before dispatch. Private workflow suspension matches login’s NULL-only active-account rule.

- **A temporarily missing workspace no longer silently switches context or discards a draft (#3083).** Retry preserves the selected workspace and local draft while content and workspace requests remain unavailable; choosing another workspace uses the existing unsaved-change confirmation.
- **Memory file access remains inside its configured storage root during directory replacement.** Sidecar fallback reads and writes, indexing, restores and proposed-skill reads use pinned directory handles and reject symlinked path components. Local sidecar fallback requires an explicit trusted storage root; ordinary crew launches configure it automatically. Custom sidecars without one retain the host bridge but refuse unsafe local fallback.

- Invitation creation, reissue, withdrawal and acceptance record non-secret workspace activity atomically with their state changes (#3084).
- **Private workflow dispatch follows current account status.** Queued and recovered work retains its existing resource, role and execution safety checks.
- **Restricted routine failures retain their meaning.** Missing graph dependencies return the existing opaque unavailable response, while storage failures remain temporary service errors; unsupported declarations still report a request error.

- **Pages creation and import controls follow current workspace permissions (#3081).** Readers keep access to existing content; authorized roles and explicit `page.create` grants retain authoring. An open draft survives permission loss while submission is disabled.

- **Members never shows another workspace's roster while loading.** Switching workspaces clears the previous roster immediately, including when the new request fails; refreshing the same workspace keeps an open invitation's setup link visible and refreshes capability grants too. A member whose grants have not loaded cannot have them overwritten by an edit. Reopening backup setup also selects the current instance plan instead of retaining a plan from an earlier opening.

- **A password change can revoke CLI tokens too.** `POST /api/v1/users/me/password` accepts `revoke_cli_tokens: true` and reports `cli_tokens_revoked`; `crewship auth passwd --revoke-cli-tokens` and an "Also revoke all CLI tokens" checkbox in the web dialog send it. Without it nothing changes: browser sessions are signed out, CLI tokens keep working.

- **A workspace's security page reads at a glance.** Admin › Security › a workspace opens with five tiles — Watchdog, Findings, Four-eyes, Leases, Judge — each with its icon, whether it is on and how, and a click to its card. The cards say less: the long explanations are behind an ⓘ beside each setting (and read out to a screen reader), what to flag is a row of toggles with an icon each, own rules are folded until there are some, and the review rate, the DENY alert threshold and the lease length offer the usual values one click away beside the field that still takes any other.
- **Backups lead you through the first setup.** Until there is a backup key and an enabled plan, Admin › Backups opens with **Set up backups**, and *Back up now* opens it instead of failing with "recipient_ids is required". Step one makes the backup key in the browser (Web Crypto X25519, encoded as age: the private key is shown once to download or copy and never sent; the server keeps the `age1…` public half) or takes a pasted one; step two creates the Complete recovery plan (nightly, a year of copies, on this server); step three runs the first backup. Only an enabled plan of everything on the whole instance counts; a plan for some workspaces does not finish the setup.
- **Admin › Backups is built like People & workspaces and Security.** The panel switches between Overview, Runs and Restore and lists the plans, every workspace with its newest backup, and the instance settings (Storage, Keys & alerts); the four groups of run filters are gone from it. A tick beside each workspace (and *All workspaces*) picks what Overview, Runs, a new restore and **Back up now** cover — several at once, none being the whole instance — and the name opens the workspace. **Runs** is built like the Audit log — the time range in the sub-bar, the Crew Journal's chart of runs by result (a bar or a dragged span narrows the table), and Scope, Result, Kind and Proof filters above the table — and ticked runs are pinned, unpinned or downloaded from the green selection bar. A workspace opens its own backups (`?workspace=`): newest backup and proof, its plan, Needs attention, nights and last runs, with Back up now and Restore. The Overview is the whole instance, adds a table of workspaces, answers the five questions as a checklist, and its Needs attention says High / Medium like every other page. Restore puts New restore, History and Drills above the wizard. On a phone the sub-bar keeps icons only and the views are a switch, not a select.
- **Admin › Security is built like People & workspaces.** The panel switches between Overview, Workspaces and Activity, and lists the instance settings (Credential judge, Decision rules, Background checks, New workspaces), the activity streams with their counts and every workspace with how it is watched; a search finds a workspace. The list of workspaces to tick at the top of the panel is gone. What is set per workspace is no longer four sections: the **Workspaces** view is one table — watchdog, review rate, DENY alert, enforced four-eyes, lease, judge, then what a new workspace starts with — whose rows open a **workspace profile** with all its settings, and ticked rows change together from the green selection bar (Watchdog, Alerts, Lease, Judge), still previewed workspace by workspace before anything is written. The Overview shows the same table under Needs attention; Activity narrows to one workspace. Old `?section=watchdog&ws=…` links open that workspace's profile. Workspaces show their logo there and in People & workspaces' chips, access grid and person profile; the instance Keeper responses carry `workspace_logo_url`.
- **A change of the log level is on record.** Admin › Runtime › Logging and `crewship system log-level set` write each change to the instance audit (`instance.log_level_changed`: who, from, to, for how long), and the server's return to the baseline when the time runs out as `instance.log_level_reverted`; the card lists the last three. Fixed: switching to `error` silenced the server log line that reported the switch. The card says the baseline comes from `CREWSHIP_LOG_LEVEL` on the server, and *Drop back after* is offered only for a level other than the baseline.
- **Top bar, user menu and Settings › Appearance redesigned.** The status pill shows one message in one tone, the worst state winning: an icon only while healthy, otherwise "N agent errors", "N queued", "No agents", "Connecting", "Reconnecting" or "Offline". Clicking it opens System status with the agents in error. The user menu links its header to Profile and states your role and workspace. It has a compact theme switch, a sounds on/off switch, Notification preferences, "Sessions & CLI tokens" with the active-session count, **Connect CLI…** (the onboarding's device-code pairing, now available any time), a Help & resources submenu and the build label. Accent moved to the new **Settings › Appearance**, alongside theme, density (Compact), reduce motion and "Sync across devices", which stores the choice under the `appearance` key of `/api/v1/me/preferences`. **Sessions & tokens** is now its own Settings section instead of the bottom of Profile. The workspace switcher adds Workspace settings and Invite members, and replaces the placeholder workspace in the phone navigation sheet. The Activity bell has Live / Recent / Failed filters. The Inbox bell filters by kind and offers Approve / Deny in the row for plain routine approvals. Appearance also offers a **Team colour** accent derived from the workspace's brand colour (General › Pages appearance), with each shade's lightness adjusted to stay WCAG AA. Notification sounds are now saved with the user per workspace (`notification-sounds.<workspace-id>` in `/api/v1/me/preferences`) instead of only in the browser. Appearance adds three accents (Sky, Fuchsia, Pink), shown as a row of large swatches with a live preview, Text size (Small / Default / Large) and the Sidebar mode, all saved with the user; ⚠️ **Behaviour change:** the default Pages palette is now the **Crewship** palette (brand blue on the product's dark ground) instead of mint, for every workspace that never customised it — including the Page starter's CSS fallbacks. Pages appearance offers Crewship, Crewship light, Midnight, Paper or Custom, one compact colour list with AA badges, a larger live sample and *Reset to Crewship default*; it stacks on phones and tablets. Nested pages (Settings › Crew links and Audit log, Admin › People & workspaces, Security and Backups) show the way back once, as a bordered "← Settings" / "← Admin" button on the sub-bar next to the page name and description, instead of repeating the path at the top of their side panel. In light, the left rail is now white like the section panels, on a quiet grey page ground. Settings › Members is a nested page too (`/settings/members`). It starts with **Needs attention** — who can reveal secrets in plaintext, Members or Viewers holding skills or credentials, invitations that have expired or are about to — each with a button that lists or opens them. The roster is grouped by role (or A–Z), and what each person may do reads as up to three chips — Routines, Content, Secrets, with "n/m" when only part of an area is held, a red "Secrets · reveal" and "Chat only" — instead of a dot per capability. The side panel filters by role, by area, by "needs a look" and lists pending invitations with when each runs out. A row opens the person in a side panel: role, a preset (Chat only / Power user / Builder — the server's `chat` / `power` / `admin`) with what differs from it, each ability as a switch grouped by area, crews and agents, removal, and a warning with "Turn … off" / "Make Manager" when the role and the access disagree. Tick rows to set a preset, grant or revoke for many people at once — all as drafts that only Save in the page's save bar commits (Discard drops them); high-stakes grants ask first. Drafts belong to their workspace: switching workspaces with unsaved changes on any page with the save bar asks first, as leaving does, and nothing is editable until the server has said what each person holds. Every role and ability wears the product's icon for it (Routines' scroll, an issue's dot, Pages, Memory, Skills, Credentials), and Manager, Member and Viewer have icons of their own. **Add member** takes the role as cards and what the person may do — the role's default or a preset — and applies the preset right after the account is created; Add and Remove share one dialog style. The person panel shows whether Reveal is switched on for the workspace, and Settings › Access & Secrets no longer keeps its own editable list of who may reveal: it says how many people hold it (with the recommendation of two) and links to Members, where the "Can reveal secrets" view shows the workspace switch and grants reveal like any other change; on a phone that page no longer runs off the right edge. Old `/settings?tab=members&member=…` links open the same person there. The space sign-up creates for someone who has no invitation ("<Name>'s Workspace") is now their **personal account**, and "workspace" means only a place people share. The workspace switcher shows it first, under *Personal account*, with the person's name, then *Workspaces*. Admin › People & workspaces lists personal accounts under People — a *Personal accounts* view that a search narrows (by the owner's name too), with *Remove N empty* — and never among the Workspaces; people's chips read "Personal account". A workspace's page renames it and turns it into a personal account or back, for an instance admin who is not a member. `GET /api/v1/workspaces` and the workspace responses carry `kind` (`team` | `personal`) and, for a personal account, `personal_owner_id` — whose it is (its longest-standing owner), so someone who joins another person's personal account as an owner sees it under Workspaces, not as their own. The Access grid lists only workspaces. `crewship seed` names the demo workspace *Acme Company* on a fresh database instead of "Demo User's Workspace". The page opens with **Needs attention** — locked accounts (Unlock), unfinished sign-ups, people in no workspace, empty personal accounts — each facet has an icon, ticked people can be added to a workspace with a role or suspended at once (the bar over ticked rows — here, in Settings › Members and on Credentials — is green like the save bar, so it is not overlooked; so is the stand-alone Save bar a section draws outside such a page), and Add person / New workspace pick roles as icons (New workspace can add people right away). Settings › Audit log takes its time range from the sub-bar — the Crew Journal's picker (Last hour to Last 90 days, All time) with the month calendar behind *Custom…* — instead of the side panel. Its chart is the Crew Journal's — events stacked by severity across the picked range, where a click picks a bar and a drag picks a span; that slice narrows the table (and shows as a filter chip) without changing the range. Each category wears the product's icon for what it records. People in the side panel show their photo and a bar for their share, busiest first, with those who did nothing in the range folded into one line; the table shows photos too. The Journal's *Custom…* no longer closes the moment it opens. Fixed: the frontend's `admin` preset lacked `credentials:reveal`, which the server grants; a sheet opened from state in a dev build closed the moment it opened (React StrictMode's double mount spent its back-button history entry). ⚠️ **Behaviour change: lifecycle hooks are paused.** The feature is unfinished — a webhook gets the raw event JSON, which Slack, Teams or PagerDuty do not accept without a relay, and the subagent handler was never wired — so it is switched off rather than offered: hooks do not fire, every `/api/v1/hooks` endpoint answers `503` with the reason, `crewship hooks` is hidden, and Settings no longer lists it (`/settings/hooks` says it is paused). Rows in `hooks_config` are kept. `CREWSHIP_HOOKS_ENABLED=1` on the server turns hooks back on for development.

- **Deferred and resumed human routine runs follow current account status (#3079).** Autonomous triggers and dry-run validation retain their existing behavior.

- ⚠️ **Behaviour change:** Signup invitation handoff requires the matching invitation link; existing accounts can explicitly accept after signing in or through `workspace invite accept`. Invitation listings retain metadata without redemption tokens; pending links can be reissued or revoked. Legacy unaccepted invitation links stored as raw tokens are invalidated on upgrade; an authorized inviter must create a new invitation or reissue the pending invitation. Accepted invitation history is preserved. New proofs are stored hashed, and browser/CLI handoff avoids putting proof in redirect URLs or command arguments (#3071).
- **Restricted navigation follows each member’s grants (#3072).** Chat, Routines and Pages appear only when the selected workspace membership can access their catalog; account security remains available. Switching workspaces no longer borrows another membership’s screens. A missing execution runtime does not hide otherwise authorized navigation. Open screens recheck changed access through the existing foreground polling interval.

- ⚠️ **Behaviour change:** Manual schedule runs record the requesting operator and follow their current workspace execution authority (#3070).

- **Assignments use durable work admission (#3057).** Ordinary assignments, mentions, channel requests and mission planning share fenced claims and run identities with scheduled and webhook work. Cancellation is durable before execution creation, results and mission completion retry safely after restart, and current assignment attempts can use run-bound memory. Legacy running assignments continue to hold capacity; an upgrade refuses ambiguous queued rows that still name an exec.

- ⚠️ **Behaviour change: assignment concurrency now shares the server-wide work caps (#3057).** Assignments are admitted by the same dispatcher as scheduled and webhook work, so they count against its server-wide limits: 8 executions in total, at most 6 of them background, and one execution at a time per agent. Before, only the per-crew budget limited assignments. That crew budget (`max_concurrent_agents`, or else the crew container memory divided by `runtime.agent_min_memory_mb`, which is 2 for the default 4096 MB / 2048 MB) now applies to every work item that carries a crew, including scheduled routines, webhooks and chat-class Pages tasks. A setup that ran more than 8 assignments at once, or relied on routines and webhooks bypassing the crew budget, now queues the excess instead of starting it.
- **Finished assignments always complete their projection (#3057).** A queued follow-up that can never be dispatched (target agent deleted, comment author removed, crews disconnected, the requester's authority no longer valid, or a gate declining) is recorded on the delivery as refused, and the human author gets an inbox notice. Agent-declared deliverables that are missing, escape the crew's shared directory, are not regular files or have a disallowed type are skipped and logged; escaping symlinks are still never read. Only host faults retry the projection, and a settled assignment awaiting projection no longer holds an execution slot.

- **Local Linux Docker runs retain output across controller loss (#2845).** A private host helper keeps the actual CLI execution and redacted output independent of its reader. Recovery projects output and terminal results with durable acknowledgements, preserves work-generation ownership, and refuses duplicate launches. Capture has per-run and aggregate bounds and acknowledgement-based retention. Unsupported providers keep the existing transport; uncertain forced stops retain reconciliation rather than report completion.

- **⌘K finds every place in the app (#3045).** As you type, the search box finds:
  - every Settings card, opening the tab and scrolling to the card; `/settings?tab=…&card=<slug>` links to one
  - the tabs and sections of Integrations, Inbox, Activity, Journal and Routines
  - actions that live behind a button: Create issue, Invite member, Create CLI token, Change password, Store missing avatars
  - the Admin console, for instance administrators
  - missions, routine schedules and automations, each crew tool on its own row, and your other workspaces to switch to

  Several words now match in any order. Every row is gated the way its page is. See [Search (⌘K)](docs/guides/search.mdx).

- **Agent Issue actions produce durable chat references (#3068).** Typed MCP tools create, update, comment on and show issues with host-verified requester authority and stable retry keys. `crewship chat refs` reads authorized replacement snapshots; `crewship operation get` exposes sanitized metadata. Issue responses include state-aware viewer actions and revisions, including work policy. Reference pages batch current card data. Human PATCH supports revision preconditions, and PATCH/comments support stable retry keys; deletion retains minimal authorized receipts. Interactive frontend cards, proposals and dedicated entity WebSocket events remain follow-ups. Limited CLI tokens cannot acquire unrestricted chat authority; existing WebSocket tickets must be refreshed after this update.

- **Issue work preserves authenticated web/API requesters (#3068).** Public issue creation, starting or handing work to an agent, recurring issues and comment mentions retain a revocable requester admission. Unrelated chat audience changes do not revoke web admissions; revoked recurring templates leave the due queue and notify a current member. Verified live runs can escalate even when their requester grant is blocked. Human and agent Issue creation, PATCH/comments, bulk status/priority/assignment edits, attachments and code-link changes commit audit intents with their mutations. Bulk label/project audit and remaining relation/workflow/Inbox mutation doors are tracked separately (#3105). Mention delivery survives disconnect/restart, queued receipts prevent duplicate dispatch, and failed deliveries have bounded retries, private terminal notices and admin API/CLI diagnostics. Completed delivery payloads are cleared and receipts expire after seven days; unchanged labels leave the issue revision unchanged. Scoped CLI tokens retain ordinary CRUD without gaining execution authority. Unverified recurring occurrences retain explicit unavailable provenance and notify an eligible owner once, so missing legacy creator attribution cannot turn them into autonomous work. Scoped execution edits cannot reuse another person’s template authority; labels and disable retain the existing origin, same-person edits retain a valid grant, and full-session content edits capture the editor’s own admission. Scoped explicit re-enable is refused unchanged. Plain comments now emit `mission.comment` for existing notification preferences and automation rules; audit-only traces do not appear as automation run IDs. Restored memberships receive a fresh web execution epoch; old web-origin work requires authenticated re-admission. Failed-delivery payload retention, journal recovery and restore/fork mention reconciliation remain follow-ups (#3103, #3104).

- **Execution authorization boundaries (#3068).** Routine agent steps now have durable `ROUTINE` admissions and publish agent RUNNING state. Restricted accounts cannot use the human Issue PATCH/comment paths, and narrow CLI token scopes cannot be widened into a standing human execution grant. Unknown legacy unfinished assignments, pipeline runs and pending work remain blocked until fresh authenticated admission; review the affected queue before rollout. `crewship doctor execution-origins` provides a read-only local inventory with record IDs, workspace counts and explicit uncertain cases; it does not authorize execution or certify rollout. Existing history and standing routine definitions remain preserved.

- **Execution-authority upgrade steps (#3068).** Before each stage or production upgrade, run the read-only execution-origins doctor against that target's actual database; the production owner performs the production audit. After deploying matching backend/sidecar artifacts, recycle retained crew containers with `crewship crew restart-agents <slug-or-id>` only in a coordinated idle window; the command removes the container and can interrupt active work. Restored web-origin recurring templates pause until reviewed and saved/re-enabled through a fresh full authenticated session. See the [rollout procedure](RELEASING.md#execution-authority-rollout-3068).

- ⚠️ **Behaviour change:** Chat-requested issue writes keep the original requester’s authority through delegation and deferred routines (#3068). Upgrade recovers unique durable human receipts and positively admitted machine roots; legacy queued work without such proof requires a fresh authorized request, including historical UI/cron work with missing evidence. Records are preserved. OWNER/ADMIN operators can auditably clear a stale routine head and selected schedule origins without changing pinned versions or already admitted work. Restoring or forking data does not grant copied human work autonomous rights.

- **The Crews sidebar has Status, Filter and View, like Routines and Skills (#3043).** Status counts agents (Needs you, Working, Idle, Expired hires) and lists the ones you pick. Filter narrows by role, model, runtime, hire type, activity and crew health, with removable chips. View groups by crew, by status or not at all and sorts by crew size, name or last active. Leads come first with a crown; rows show each agent's role and when it last worked, and each crew's running missions or last activity. Hover adds Chat on an agent and Add agent on a crew, and the collapsed sidebar keeps the crew icons with an attention dot. Status, filters and view are kept in the URL (`?status=needs&role=lead&group=status`).

- **Security: the server image's docker CLI is Docker's static 29.9.0 build (#3047).** Alpine's `docker-cli` package in alpine:3.24 was built with go1.26.8, so the image carried the critical net/http advisories GO-2026-6612 and GO-2026-6604 that #3039 fixed for Crewship's own binaries, and the image scan failed on every build. The Dockerfile now downloads the static docker CLI for the target architecture, checks it against a pinned SHA-256 and copies only the `docker` binary.

- **Explicit skill authoring grants now allow imports.** Trusted workspace members holding `skill.create` can import SKILL.md content or URLs, matching generation. Revocation is checked on each request; Guest restrictions, CLI scopes and import validation remain enforced.

- **Skills has the same explorer as Routines and Issues, and can be filtered by agent (#3033).** The left panel lists View buckets (All, On agents, Not assigned, Needs a look, Proposed by agents), the workspace's crews with their agents and how many skills each holds, and the domains in use; source, trust, maturity and "needs a credential" sit in the Filter popover. Each card shows one trust word (Verified, Unverified, Not scanned, Flagged), the credentials the skill needs, the agents that hold it and its uses in the last 7 days. A strip at the top names what needs a person: a flagged skill on agents, a proposal waiting for review, an agent missing a credential a skill needs. A skill opens beside the explorer with Overview, Agents (one switch per agent, applied at once, or a whole crew), SKILL.md (download) and Activity; built-in skills cannot be deleted and say so. The Overview lays the SKILL.md out (when to use it, steps, what it hands back, guardrails) with agents, uses per day, needs and source in a rail; the SKILL.md tab has an outline, the frontmatter as a table and a Source view. Every skill shows its own icon. New skill either has Claude write it or lets you write it, with an icon and domain picked up front; Edit and Duplicate as new skill save through the importer, which re-runs the scan and refuses to change built-ins. Proposals are approved or rejected on the page. On a phone the explorer is a drawer behind Filters. `/skills/<id>` links open the same view. The Runtime facet (every skill is instructions-only), the always-zero install count and the Browse / Installed / Generated tabs are gone.

- ⚠️ **Behaviour change:** **Skill holders are scoped to your workspace (#3032).** The skills catalog is shared across workspaces, but the agents listed on a skill (`installed_on`), the `?installed=1` / `installed_for_agent_id` filters and a skill's `agent_count` counted agents of every workspace, so a member could see other workspaces' agent names and crews. They now only see the caller's workspace. Skills also report this workspace's usage (`usage`: uses in 7 days, errors, total, last used), `lifecycle_state`, `needs_credentials` and, per agent, the required credentials it is missing; `GET /agents/{id}/skills` carries the same. `crewship skill list` gains AGENTS and USES 7D columns, and `crewship agent skills` prints the skill name and category it showed blank before.

- ⚠️ **Behaviour change:** **Skill holders are scoped to your workspace (#3032).** The skills catalog is shared across workspaces, but the agents listed on a skill (`installed_on`), the `?installed=1` / `installed_for_agent_id` filters and a skill's `agent_count` counted agents of every workspace, so a member could see other workspaces' agent names and crews. They now only see the caller's workspace. Skills also report this workspace's usage (`usage`: uses in 7 days, errors, total, last used), `lifecycle_state`, `needs_credentials` and, per agent, the required credentials it is missing; `GET /agents/{id}/skills` carries the same. `crewship skill list` gains AGENTS and USES 7D columns, and `crewship agent skills` prints the skill name and category it showed blank before.

- **Settings › Members marks restricted members (#2878).** A restricted member's row shows a Restricted chip next to the role chip, and the expanded panel names the access mode; saving a changed mode in Edit resource access updates the roster. `GET /workspaces/{id}/members` returns `access_mode` to a trusted OWNER/ADMIN (the same gate as a member's access policy) and omits it for everyone else; `crewship workspace member list` has an ACCESS column (`-` when withheld).

- **Cancelling a run parked at an approval can no longer race its resume (#2910).** If an approval, signal or event resumed the run at the same moment, the API could report the cancellation while the resumed run went on to execute its next steps. Exactly one side now wins: either the resume is refused and the run stays cancelled, or the resumed run is stopped before its next step and records `cancelled` (instead of `interrupted`). The response carries `"parked": true` only when the cancel recorded the row itself.

- **A model call refused by the sidecar says why (#2899).** Every admission failure used to read as 403 "hard-budget traffic requires the restricted broker", even on a workspace with no budget. Only a host decision is still a 403 (a hard budget, or a refused agent, crew or credential scope); an unreachable host, a rejected sidecar credential, an unavailable budget store or a missing binding is a 503, and an unreadable host answer a 502. Each message names its kind. The troubleshooting guide lists what each one means.

- **A taken or reserved agent slug is shown under the Slug field (#2862).** Creating or renaming an agent onto a slug in use used to toast the raw JSON body, and a rename onto a taken slug failed with a 500. The API now answers `409` with a machine-readable `code` (`agent_slug_taken`, `agent_slug_reserved`, `crew_lead_exists`) and the `field` it concerns, next to the unchanged sentence; the agent dialog shows it under Slug (or Role), and the crew and agent canvases, model configuration and crew dialog show the server's sentence instead of JSON. A race between two new LEAD agents is reported as `crew_lead_exists` instead of a taken slug.

- **Routine runs show reported usage, not spend (#2193).** A run's `cost_usd` is what the agent CLIs reported, priced at list rates; under a subscription nothing is billed per call. Routine run detail, the crew bottom panel and the workspace digest now say "reported usage" with an approximate `~$` figure; `routine records` and `routine runs-all` call the column REPORTED USAGE. The `cost_usd` field is unchanged.
- **Restricted members see only what they can use (#2861).** For a restricted account, `GET /api/v1/workspaces` now returns `restricted_session` and `restricted_surfaces` (`chat`, `routines`, `pages`, `account_security`). The server derives the list from its route allowlist. The sidebar, phone menu and phone tab bar show only those screens. Any other URL shows "Not available with your access" without loading the screen, and `/` opens Chat. Settings shows only account security (password, sessions, revoking CLI tokens).

- **Background sweepers no longer fire in lockstep after a restart (#1891).** The sub-hour periodic loops each wait a random offset within their own period before their ticker starts. That covers the harbormaster timeout, waitpoint, pending-run, ephemeral-agent, assignment queue/running/lease, OAuth and provider-login refresh, presence, episodic-index and port-exposure sweepers. A deploy used to line up their phases so the 30-second sweepers hit the database on the same second. Loops that run once at boot still do so immediately. The daily jobs scheduled by wall-clock hour are unchanged.

- **The first message of a new conversation can be sent again (#2898).** Opening an agent with no saved conversation left Send disabled: the draft has no row yet, so its execution profile stayed pending, realtime stayed off and the composer waited for a connection that only the first send would start. Send is now offered once the profile check has answered. The send creates the conversation, resolves its profile, waits for the connection a trusted chat needs, and only then goes; a refused profile, a failed create or a connection that does not open leaves the message in the box with a toast. The same applies to a `?prompt=` handoff.

- **`crewship backup verify` catches a workspace bundle that left rows behind (#2009).** A workspace backup now checks, in the same database snapshot, every row the schema ties to the workspace (its own `workspace_id`, or a foreign key into an exported workspace row) against what the backup's scope filters exported. The result is recorded in the manifest as `contents.scope_reconciliation`. `verify` reports `INVALID` with `table: N of M workspace row(s) in the source were not exported` for a bundle that recorded a shortfall, including an encrypted one. The verify API returns the list as `scope_shortfalls`.

- **Private routines and Page actions say why nothing is listed (#2877).** A restricted member on a server without private execution sees "Private execution isn't installed on this server — ask an administrator" instead of "catalog unavailable" and "nothing available" at once. Loading, empty, unavailable and not-installed are now one state each. The routine and Page catalogs, routine runs and restricted Page actions answer `503` with code `restricted_runtime_unavailable` to restricted members only; every access refusal stays an opaque `404`.

- **A tool switched off on an MCP integration is refused by the crew sidecar's gateway (#2178).** `crewship integration tools disable` and the per-tool switch now also stop the sidecar's `/mcp/call` from calling the tool and hide it from `/mcp/tools`, from the sidecar's next start. Agent CLIs that connect to an HTTP MCP server directly are not gated per tool yet.

- **A repeated webhook delivery gets its receipt even while the first one is running (#2964).** If the acceptance write could not commit in time, for example because the original delivery's run held the database, a duplicate was answered `503 acceptance unavailable`. It now gets `202` with the original work and its current state; only new work is refused.

- **Security: Go 1.27.2 and golang.org/x/net v0.60.0 (#3039).** Fixes the net/http and HTTP/2 advisories GO-2026-6599, 6600, 6603–6605 and 6607–6613, and GO-2026-6617, that `govulncheck` reports as reachable on 1.27.1 / x/net v0.59.0. The release image builds with `golang:1.27.2-alpine`.

- **The Work queue and Webhook deliveries look like Activity (#3017).** Opening either one keeps the rail and switches it, with a slide, to the ledger's own rows:
  - status in Activity's words — the Waiting and Expired filters, which nothing ever filled, are gone;
  - agents with their avatars, and whether their queue moves;
  - event families.

  Each row narrows the page. The Work queue gives:
  - a summary sentence and a flow from Arrived to Done;
  - **Needs you**, where work with an unknown outcome is settled with **Retry**, **Mark as failed** or **Mark as done**, and the card says how many items wait behind it;
  - failures grouped by cause;
  - one lane per agent, with its crew's colour;
  - the latest work, one sentence each.

  Deliveries show each endpoint's health (an endpoint with nothing in a day reads quiet), arrivals per event family, and what each delivery became, with a detail panel that opens its work. Each narrowing shows as a removable chip, so a filter whose row left the window can still be cleared. On a phone the rail starts closed and work and deliveries open in a sheet. Retry's dialog says when the input cannot run again and does not run it. The pages read their whole window plus all unfinished work, so stuck work stays in Needs you; a routine's endpoint is named as such, not as a deleted agent. The 7 d lane axis on these pages and on Activity's home marks every day; it skipped one before.
- **The work queue and webhook deliveries name who, what and how it ended (#3012).** `GET …/work-items` items carry `agent` (name, slug, avatar, stored `avatar_url`, `deleted`), `crew` (name, colour, icon, `deleted`), `event_type`, `duration_ms` and `cost_usd`; `GET …/webhook-deliveries` carries `agent` and the resulting `work_state`. `crewship work list` shows the agent's name and the event instead of the agent id and capacity class, and `crewship work deliveries list` shows the agent and the work state. Both lists take `since=` (a time window; pages run oldest first) and the work list `open=true` (unfinished work however old), with `--since` and `--open` in the CLI. A replay names its original's event, a deleted crew says so, and duration and cost are given only when known. `crewship work list` no longer has the CLASS column; it is in `-f json`.
- **Activity's rail follows source and severity filters too (#3007).** With a source, severity or telemetry filter, the rail lists only the runs the matching events belong to, and is empty when none match. It no longer keeps listing every run beside an empty column. Agent work started outside a routine is hidden in Activity for now; the index and CLI still list it.
- **A crew, agent, issue or routine filter keeps Activity's home, narrowed (#3002).** The column used to swap the home for the raw journal list ("morgan runs claude --print …"). It now shows the same cards for the chains the rail shows, titled with the filter. Source, severity and telemetry filters keep the event list. `GET …/pipeline-runs` returns each run's `chain_origin`.
- **Activity's Filter narrows the rail too (#3000).** With a crew, agent, issue or routine picked, the rail kept listing every run beside a column that showed only the filtered ones. The facets now narrow the chain list that every surface reads. The rail's routine focus slides in and out like the column beside it.
- **Activity's rail can focus one routine, and says what each row is (#2998).** Picking a routine's row narrows the rail to that routine and lists its runs by day with time and outcome. The status rows and time range apply to those runs, and a run opens beside the list. Every row now leads with **Routine**, **Issue** or **Agent** before what started it.
- **Agent work started outside a routine is in Activity (#2993).** A delegation from a chat, an issue mention or lead planning was missing from the chain index. A root assignment is now a chain of its own (`kind: assignment`, grouped by the stored `chain_origin`), with outcome counts, its agents and the issue it was for. It is listed only for people who may read the chat it came from, or, for issue work, for trusted members. Activity shows it as a row titled by its task and opens a work page with its delegations and asks; `crewship chain list` shows `work: <task>`. The chain index also attaches issues through `assignments.mission_id` for routine chains.
- **The Activity Bar speaks the rail's words, and ↑/↓ step between runs (#2988).** The toolbar dropdown says *waiting for you*, opens the run (**Decide →**, **Open run**) instead of the routine or a "trace", and lists cancelled and interrupted runs under Recent in grey with their own word. Cancel is offered only to OWNER/ADMIN, and the footer opens the waiting bucket when something waits. On a run's page, ↑/↓ move to the previous or next run in the rail.
- **The chain walk no longer shows inbox items outside the caller's audience (#2986).** `GET /api/v1/chains/{anchor}` returned every inbox item a run produced, including titles of items targeted at a higher role or another person. Inbox nodes now follow the `/inbox` rule. A hidden anchor is a 404, and the response declares that items were withheld without naming them.
- **The chain walk follows links it missed (#2986).** These are issue ↔ assignment through `assignments.mission_id`, issue → run through `issue_executions`, run → the issue it created (`missions.author_run_id`), and `run_needs_human` asks for routine runs and issue work. Activity's run page lists created issues from the walk, with no five-ref cap. The link contract is `docs/specs/activity-links.md`.
- **Activity's issue page shows the issue's whole history (#2983).** Events, comments and runs are read directly by issue, each with its own paging, and merged newest first with Load older — instead of being derived from the loaded page of chains and their five capped issue refs. `GET …/issues/{identifier}/events` gains `before_seq` + `limit` for backward pages (`crewship issue events --before-seq --limit`), and the issue endpoints also accept the issue's id.
- **Cancelled and interrupted runs no longer read as finished (#2981).** The chain index (`GET /api/v1/chains`, `crewship chain list`) counts `completed_runs`, `cancelled_runs` and `interrupted_runs`. Activity has a **Stopped** status row, and a run's page says Cancelled or Interrupted; a stopped branch never hides running or waiting work. The CLI's STATUS column reads `waiting`, `FAILED`, `running`, `cancelled` / `interrupted` / `stopped` or `ok` instead of `ok` for everything that had not failed.
- **Activity reads like Issues and Routines and is about runs (#2979).** The tab strip above the page is gone; Work queue and Webhook deliveries are rail rows. The rail lists every run under the Routines status rows, titled by routine name, with Group by in place of the lens tabs. A row opens the run: status, Retry / Stop, the approval or why it failed, its steps with attempts, what it caused, what it is linked to and changed, and its routine's previous runs. The home is built from runs: what needs you (decidable for plain approvals), what is live and next, every run on its routine's lane, recurring failures, outcomes and the latest runs. The Inbox digest links into Activity.
- ⚠️ **Behaviour change: the Journal page is shown to workspace OWNER and ADMIN only (#2979).** Other roles are sent to Activity. The journal API is unchanged.
- **Journal streams stop after access is revoked.** Replay and live delivery recheck account suspension, workspace membership and the account-wide Guest boundary before sending entries; deleted workspaces no longer keep an existing journal stream active.
- **Stopping an idle agent succeeds instead of failing with `runtime stop not confirmed` (#2879).** `POST /api/v1/agents/{id}/stop` answers `200` with `outcome: "already_stopped"` when the server establishes nothing is running (no invocation owned by the daemon, a readable run store, and no non-terminal run record for the agent), and `outcome: "stopped"` when it ended a run. A refusal is still `502` and now carries a stable `code`: `stop_not_confirmed` when a process may still be live, `runtime_unavailable` when the runtime could not be read. `crewship agent stop` prints `was not running; nothing to stop` for the first and a next step for each refusal; the web Stop buttons word the refusal by its code and the agent page says "Agent was not running".

- **An agent's restricted client execution can be changed in the web app again (#3028).** Edit agent › Model and execution has the Restricted client execution field; the change is part of the dialog's draft and applies on Save, after the agent. It had no UI since #3008. The unused Admin memory-configuration card is removed: Admin › Data retention › Memory versions edits the same setting.

- **Opening chat, a crew or an agent no longer writes the agents' avatars (#2876).** Viewing an agent without a stored avatar render used to send `PUT /api/v1/agents/{id}/avatar` from the viewer's browser — refused for viewers, members and restricted members, noise in access logs for everyone, and whoever looked first decided the stored face. Rendering is now read-only. The render is stored when an agent is created or edited in the dashboard (the agent editor, the avatar picker, a crew's avatar style, a crew created from a template). ⚠️ **Behaviour change:** existing agents and agents created through the CLI, API or Captain no longer fill in on their own; store them with **Settings › General › Agent avatars › Store missing avatars** (admins) or the same button beside a crew's **Avatar style** (managers and up). Until then they are drawn from their seed, as before.

- **Settings and Admin read as one product (#3022).** A refused switch in Access & Secrets or Hooks flips back and says why in the bottom-right toast instead of a line in the card. Every field, select and picker has the same size as its neighbours; supporting text (row descriptions, hints, empty states) is 12px instead of 11px and nothing is set below 11px; every table uses one header, cell and row style; person status, Keeper decisions, "No owner" and "Off" are status pills.

- **Open-source license capacity showed inactive limits.** The license API, administration and CLI now report unlimited crews, members and agents, including when a signed license contains historical caps. Signed claims and enforcement hooks remain available for future releases; administration explains that resource licensing may change.

- **A workspace can have a logo (#3005).** Settings › General › Identity has a Workspace logo row (Upload, Change, Remove; PNG, JPEG or WebP up to 2MB, the same rules as a profile picture), and `crewship workspace logo set <file>` / `remove` do the same. The workspace switcher and Admin › People draw the logo instead of the initial. API: `POST`/`DELETE`/`GET /api/v1/workspaces/{workspaceId}/logo`; setting or removing it is `ADMIN+` and audited.

- **A project's detail saves through the page's floating Save bar, and a bulk status or priority change asks first (#2984).** Name, status, priority, health, lead, dates, icon and colour are held as a draft until Save sends them in one request; clicking away from the name keeps it, and stepping through dates no longer writes each day. Setting several issues to a status or priority from the list now confirms, naming the change and that automations reacting to a status change may run.

- **The Pages editor saves through the floating Save bar (#2984).** The Content card (name, description, icon and colour) is a draft until the bar's Save; its own Save button is gone, a refused save is a corner toast that keeps what was typed, and leaving the editor with edits still asks once — Discard now drops the draft too. The Panels document, Access grants and publishing keep their own explicit actions.

- **Editing an agent no longer changes who pays for it or how it learns behind your back (#2984).** In the agent Edit dialog the provider account ("Pays with") and the learning posture were written the moment they were picked; they are now part of the draft, count as unsaved changes, and are applied when you choose Save changes, after the agent itself. Closing without saving leaves both as they were. The unused save-per-field editor that duplicated the dialog's sections was removed.

- **Issue edits wait for the Save bar (#2984).** On the issues page and /issues/<id>, changing a title, description, status, priority, assignee, date, estimate, project, milestone, routine or labels no longer saves on the spot: the floating bar counts the changes and one Save sends them together. A status of Done, Cancelled, Duplicate or Review, or a new assignee, asks first and names the automations it starts; the description no longer saves itself while you type, and a title edit is kept when you click away. Opening another issue with edits pending asks first.

- **Admin › Backups no longer lists every empty personal workspace as a problem (#2990).** Workspaces that hold no crew are summed up in one Needs attention item ("4 workspaces without crews have no backup") instead of two rows each, get no coverage row, and the summary counts them apart. The overview response carries `crewless_workspaces`.

- **Integrations: a connector's command, URL and environment wait for Save (#2984).** Editing an MCP server's name, command, arguments, URL, transport or environment variables no longer saves on blur; the edits join the page's floating Save bar and one Save sends them together. Collapsing the connector with edits pending asks first. Tool switches, webhook and notification toggles still apply at once.

- **An invited person no longer gets an empty workspace of their own at signup (#3006).** Signup redeems the address's live invitations first; when it joins at least one workspace, no "<name>'s Workspace" is created, and the person lands in the inviting workspace. A signup with nothing to redeem, or only invitations to deleted workspaces, still gets its own workspace. Existing workspaces are untouched.

- **Admin › Backups: the side panel shows only what applies to the page (#2990).** The scope appears where it changes what is listed (Overview, Backup history, a new restore), the workspace list only once Selected workspaces is picked, and the run filters (result, kind, proof, when, each with the rows it opens) only on Backup history; below them sits the navigation. Workspaces without crews, such as the one every signup gets, fold behind "Show N without crews", and a workspace shows its logo when it has one (`GET /admin/workspaces` now returns `logo_url`).

- **Restore checks and the restore itself judge a target by one rule (#2990).** The checks used to approve targets the restore then refused — a crew target for a workspace backup, replacing a workspace from a custom or crew backup, an empty server or drill for a non-instance backup — and neither looked at the new name. Both now share `ValidateRestoreTarget`: a new workspace or crew name must be a valid slug and free on this server, deleted workspaces included; a taken name is refused before anything is written (`409` from the restore). `restore/checks` and `crewship admin instance backups restore-checks` take the new name (`as_workspace` / `as_crew`, `--as-workspace` / `--as-crew`).

- **A backup plan over several workspaces no longer reports success while one of them failed (#2990).** The plan's `failed` and `stale` incidents clear, and the heartbeat is pinged, only once every run of that due time (or manual start) has finished and none failed, was interrupted or was skipped. Before, the first workspace to finish well resolved the incident and pinged the heartbeat, hiding a failure in another workspace or pinging while it still ran.

- **Admin › Backups no longer shows a partial restore as finished (#2989).** Recovery now shows the server's own verdict and names what did not land: missing attachments, crew files, rows short per table, incomplete items, clamped credentials and dropped columns, and says when crew files still have to be brought back into the containers.

- **Settings and Admin save through one floating bar (#2984).** Edits on any card add up in a bar at the bottom of the page ("3 unsaved changes · Discard · Save", ⌘S / Ctrl+S) instead of a Save button per card. Leaving the page or switching section with edits pending asks first, and a failed save is a toast in the bottom-right corner that keeps the edits and offers Retry. Switches still save at once; changes across several workspaces still go through their preview.
- **Routine HTTP results now redact injected credentials, including JSON and URL-escaped values.** Redaction applies before response bodies and request errors reach step results, run history or broadcasts.
- **Generated clients described incorrect crew provisioning responses.** OpenAPI now matches the status fields, managed tool/launch artifact metadata and optional build progress, documents provision/rebuild success as 202, and includes rebuild admission errors and conflict diagnostics. ⚠️ **Specification correction:** generated clients no longer expose `crew_id`, `phase`, `updated_at` or trigger `success`, which these handlers never returned; regenerate clients to adopt the corrected contract. HTTP behavior is unchanged (#2897).

- **Page rejections show their reason in the web app and CLI.** A 422 page rejection (for example a payload over the size cap) now also carries an `error` field with the same sentence as `message`, so the web app shows that sentence instead of "Request failed (HTTP 422)" and the CLI prints `API error (422): <sentence>` instead of the raw JSON body. The existing `rejected`, `kind`, `detail` and `message` fields are unchanged.

- ⚠️ **Behaviour change: routine authoring and validation now reject unsupported transform expressions, including skipped branches.** Existing definitions must be corrected before re-saving or draft testing; there is no automatic rewrite. Running an existing definition still skips inactive branches, while unsupported expressions reached at runtime fail. Use code for arithmetic or pipes. Whitespace around array indices remains supported.
- **Approval waits now honor the documented `wait.timeout_sec` setting.** A positive step-level `timeout_seconds` takes precedence; parked waits keep their recorded deadlines.
- **Webhook deliveries with invalid form inputs now return `400` before acceptance.** Malformed target definitions return `409`. Corrected retries can use the same delivery key. Signed, rate-limited validation failures count toward webhook delivery failure health and can alert managers. CLI help now describes literal additional inputs and the reserved `event`, `raw` and `headers` payload fields.

- **A stopped installation can reset its application data without losing management state.** `reset --data` validates an explicit local target, removes exact installation-labelled Docker resources, restores clean database defaults and preserves identity, configuration, secrets, logs and backups. Interrupted resets block startup until a successful retry. `paths` shows effective configuration without creating files. (#2977)
- **Reconnecting an AI client could silently narrow its configuration permissions under a restrictive umask.** Successful reconnects and rollback now retain the inspected file mode; connection receipts remain private. Standalone `ai status` diagnostics are verified for owned, modified and missing-executable registrations without printing configuration secrets (#2853).
- **Server scratch files and update caches now belong to the selected installation.** Development PID checks refuse unrelated processes after PID reuse; `/api/health` shares `/healthz` liveness and writer-ownership checks while keeping the healthy `status: ok` field. (#2977)
- ⚠️ **Behaviour change: server paths now follow one installation root regardless of DATABASE_URL.** Explicit storage, log, memory, Bolt and socket configuration is respected, including YAML values equal to old defaults. `CREWSHIP_HOME` and `start --data-dir` select the root; startup refuses to abandon existing data in prior locations instead of silently using a new empty store. Relative SQLite URLs retain compatibility. (#2977)
- ⚠️ **Behaviour change: development data and builds no longer default to shared temporary directories.** `dev.sh` uses a persistent installation outside the checkout, preserves exported configuration over `.env.local`, and refuses unsafe legacy transitions. Existing explicit path pins remain valid. (#2977)
- ⚠️ **Behaviour change: demo RBAC accounts use English role profiles.** `seed --with-users` now provisions 44 baseline and capability accounts with initial password `rbac-demo-1234`, replacing the four personal-name fixtures. `seed rbac-matrix --server URL --workspace ID` adds the roster without reseeding resources and requires workspace OWNER for its ADMIN profiles; existing passwords, roles and grants remain unchanged. Bootstrap OWNER credentials keep their existing defaults.

- ⚠️ **Behaviour change: demo seed requires an explicit server and usable provider credentials before making changes.** `--offline-demo` explicitly creates fixtures without model execution. Bootstrap tokens are saved in the target profile without replacing unrelated defaults. `--with-memory` provisions all demo tiers through the target server before provisioning, with durable create-if-absent writes that preserve operator edits and never write server memory on the CLI host. `--with-users` uses authenticated account provisioning without enabling public signup; retained accounts require proof and never have their passwords reset. An incomplete role fixture fails. (#2977)
- **The operations Page collector could linger after failed fleet telemetry.** It now releases rejected HTTP response bodies immediately, keeping the unavailable-fleet snapshot without waiting for request expiry.
- **Idle retention could start cleanup after its lifecycle was canceled.** Boot and periodic passes now check cancellation before admission, including when a tick and cancellation are ready together; retries for an unavailable daemon are preserved (#2925).

- **CI: a trusted-main guard flags any change to CI control files (#2960).** `CI Inventory Guard` runs main's code against PR files as data. Required-job inventories of the CI, Security and CodeQL workflows, the routing and verdict helpers, and a closed namespace (`.github/`, `scripts/ci/`, every `scripts/` path a workflow references) are compared with main; any change needs a separate administrator dispatch for the exact head SHA.

- ⚠️ **Behaviour change: a routine `agent_run` step now waits for a busy agent instead of failing at once.** When a chat, an assignment or another routine holds the agent, the step waits up to its `timeout_seconds` (15 minutes without one) or until the run is stopped, then fails with a reason naming the busy agent. Waiting steps take the agent in no guaranteed order, hold their run and do not survive a restart. (#3023)

- **CI: the full Go suite and the shuffled suite run in three package partitions each.** `Go` keeps vet and the cross-builds; `Go test` and `Go Shuffle` split `go list ./...` largest-first by measured cost and prove every package runs exactly once (a truncated listing still fails).

- ⚠️ **Behaviour change: an immediate routine start whose concurrency slot is full is now queued instead of refused with `429`.** It returns `202 SCHEDULED` with `pending_id`, `queued: true` and `reason: "concurrency_limit"`, starts when a slot frees, and waits at most `ttl_seconds` (one hour by default) before ending `expired`. A retry with the same `Idempotency-Key` returns the same pending start. Send `queue_if_busy: false` (CLI `--reject-if-busy`) to keep the `429`. Webhooks, schedules, replay and agent-invoked runs are unchanged. (#3025)

- **CI: race tests stop re-migrating test databases and skip checkptr inside the transpiled SQLite library.** One migrated template is now shared per source tree across test binaries (it cost 56 s per binary under race), `internal/api` prefetches its per-test database copies, and `cmd/crewship` fixtures start from the template instead of running the migration chain seven more times. Under `-race`, CI compiles `modernc.org/*` with `checkptr` off (migration chain 55 s → 29 s); race detection and checkptr stay on for all Crewship code.

- **Every accepted deferred routine start now says what became of it in the UI.** The routine's Plan view lists waiting starts with their state, including waiting for a free slot with tries and the earliest next try, and recent starts that left the queue as Started (with the run link once recorded), Did not run or Expired with the reason, or Removed. The overview names accepted starts that did not run in the last seven days and how many wait for a slot. Requires the receipt API from #3015. (#3011)

- **CI: Vitest runs in four partitions with one merged coverage gate (#2933).** `Frontend Test` keeps its name, requires every partition plus the type checks, verifies that every discovered test file ran exactly once and evaluates the unchanged coverage thresholds on the merged report.

- **CI: the CLI race suite runs in three partitions, internal/api in six and the remaining race packages in four (#2931).** `Go Race (CLI)` and `Go Race (internal/api)` keep their names and now verify that their partitions cover the full test inventory exactly once. The CLI race job took 16–26 minutes as one process; each partition runs about a third of it.

- **Restricted conversations built their context 4x slower than necessary as history grew (#2959).** Every prompt re-checks the origin authority of each recalled entry three times, and each check parsed the same SQL again. Those checks now reuse prepared statements within their transaction; queries, arguments, isolation and revocation behaviour are unchanged. A 155-turn conversation drops from 116 ms to 29 ms per turn, and the race-instrumented `internal/access` CI package, previously the pipeline's 25-minute critical path, shrinks accordingly.

- **Repeating `crewship seed --nuke --with-users` could fail to restore RBAC fixtures.** Workspace cleanup preserves global accounts, so the seed now authenticates retained fixture accounts with their documented passwords and restores membership through the normal guarded API. Account IDs, passwords and other sessions are preserved; changed passwords are refused.

- **The contract gate's CI server now has the fixture the 13 bucket-3 operations need (#1815).** The ephemeral server configures Page project storage, a separate Page runtime origin and the restricted runtime; the seed publishes real Page apps (10-minute step cap), and a blocking fixture step proves the bound crew/integration pair, a real project revision and a real restricted member (own token, owner still gets the designed 404) before the gate runs. The gate grades the tools operation on the bound pair and the three restricted routes as that member, the pair and workspace are pinned as single-value enums in the schema copy `run.sh` feeds Schemathesis (`openapi-pinned.json`), with the member's token set by per-path headers; its Pages grading depends on slugs Schemathesis harvests, so the dedicated probes are the positive evidence for Pages storage. This is not 13/13: the two history operations still report the real "revision 0" schema finding, and the restricted run-detail operation has no positive receipt (it needs an admitted restricted run in the real runner image). `throwaway-server.sh` gains an allowlisted `--env` and an owned `--page-projects` directory. No product code changed.

- **`crewship init` could bootstrap the wrong server despite CLI configuration.** It now honors the common server selection order (explicit flag, active profile, environment, config, default), supports `-s`, and prints the selected server in the login hint. ⚠️ **Behaviour change:** a selected profile without a server URL refuses initialization instead of falling back to localhost.
- **Manual MCP startup could discard the selected login and send an environment token to a fallback server.** Explicit credential files now require a valid selected server before replacing CLI state or loading a catalog; an explicit valid `--server` remains supported without a profile. Unknown profiles fail closed.
- ⚠️ **Behaviour change:** **Legacy direct-run probes now refuse uncertain process-group evidence.** Group signals calibrate against the image utility; unsupported options and permission failures stay UNKNOWN. Failed durable-state reads also refuse legacy probes instead of silently continuing.

- **Ambiguous managed-launch descriptors could overwrite earlier fields.** The launcher rejects duplicate or noncanonical JSON fields before creating process identity; its native core now includes a standalone conformance entrypoint, parser fuzz targets and documented measurement limits.

- **Webhook and scheduled managed runs could falsely confirm a stop after losing their PID file.** Their creation gates now retain the persisted managed identity after the agent invocation returns, including when pilot selection is disabled; missing managed PID files remain UNKNOWN.

- **Pilot agent runs can refuse stale CLI selection from persistent home.** An explicit server crew-ID opt-in binds static native Codex launches to immutable build hashes and lock versions, clears inherited loader options, and uses a trusted direct launcher. Static PIE Codex packages are supported; unsupported scripts and dynamic binaries fail closed. Selected crews must recreate runtimes to bind the immutable launcher generation; ordinary crews retain their current behavior. Managed runs retain process-group stop and recovery identity; native mise candidates are recorded separately from legacy PATH-first inventory.

- Managed runs rejected during prompt or command preparation now finalize as errors before workload creation, releasing unresolved run occupancy. Managed launches execute the verified open descriptor and reject tmpfs overlays over trusted code; legacy direct-run probes keep their existing behavior; enabling the launch pilot changes launcher staging for all new crew runtimes.

- **Unsupported `k8s` startup wiring could return no container provider.** Container initialization now refuses it with supported provider choices; ordinary configuration validation continues to reject Kubernetes.

- **Routines could wait forever for an event despite a step timeout.** ⚠️ **Behaviour change:** Existing parked waits older than their configured timeout (one hour when omitted) expire on upgrade and run their failure hooks. Persisted event waits now retain their original deadline across retries and restarts, expire through normal timeout/failure handling, and preserve signals delivered before the deadline. Cancelled runs reject late signals, and event recovery workers drain during shutdown. Blocking nested waits keep waiting on their original deadline when an advisory wake belongs to a sibling subscription.

- Concurrent egress-fence installation retries incomplete rule reads without reinstalling or accepting a fence that fails verification. Checks reject results spanning a ruleset generation change.

- **Importing a Crew YAML could silently disable required AI CLI checks.** The creation wizard preserves the typed policy, including configurations without explicit tools, and rejects unsupported policy values.

- Recovery and explicit stop now share atomic runtime updates: an OOM-killed or missing container can leave RUNNING, concurrent completion is preserved, and a stop also closes the controls of runs discovered during ownership inspection.

- ⚠️ **Behaviour change:** Runtime readiness refuses paused Docker containers with an actionable error, including warm-cache hits, preserving their live processes until an operator explicitly unpauses them. (#2860)

- **Confirmed stops from direct agent starts no longer wait forever for a missing start event.** Recovery retains the run's workspace, publishes the confirmed terminal event without inventing a start, and preserves dispatcher-owned outcomes and conflicting or unknown tenant identities.


- **Runs that survive a server restart no longer rely on the startup probe alone.** Background recovery follows only the original recovered identities, preserves new admissions and unknown runtime states, and retries terminal history publication after confirmed process absence. It does not infer a successful exit from missing processes.


- **An interrupted container run could remain RUNNING after a server restart.** Startup now checks eligible persisted runtime identities and reconciles confirmed absence, while preserving live or unverified work and dispatcher-owned outcomes.

- **Repeated environment rebuilds left untagged images outside cache cleanup.** The orphan sweeper now recognizes published artifacts from revision history while preserving images selected by live crews and unknown untagged images. The existing opt-in deletion policy and age floor still apply.
- **Editing an environment during a build could fail waiting messages.** Superseded builds retry the current definition within the original job budget; obsolete CLI qualification cannot prevent that retry, and unchanged definitions still enforce their required checks.
- **`crewship crew rebuild` and its documentation claimed the cached image is discarded up front.** The CLI help text, its `--no-watch` message and four documentation pages described a cache-marker wipe the code never performs: the bypass belongs to the admitted build job, the previous image stays selected until the new build succeeds, and a failed rebuild leaves it in place.

- Runtime editing preserves existing TOML and unsupported mise shapes instead of erasing tool pins; rejected raw edits no longer partially apply other settings.

- Crew runtime settings show requested and built AI CLI versions with image-bound startup-check status, explicit unknown evidence, and refresh after build events.
- Idle cache eviction preserves images selected by live crews and removes unselected artifacts by immutable ID; unknown database references keep images.
- Offline AI CLI qualification disables inherited image healthchecks, keeping the sandbox limited to its lifetime keeper and explicit probes.

- Required AI CLI checks reject a build whose observed CLI version differs from its explicit mise pin; requested tool status now gives explicit mise selectors precedence over overlapping features.

- `crew provision lock-apply` validates a reviewed native update proposal against unchanged selectors and lock inputs, preserving other configuration fields and emitting updated JSON without deployment.

- Managed environment definitions can require image-bound offline AI CLI checks before publishing a replacement; failed or unavailable checks preserve the selected image.

- Agent run state and execution events retain the actual container source image ID when available, independently of later environment updates.

- Mise lock resolution now reports proposed native tool versions and deterministic selector/bundle hashes, distinguishing version changes from other lock changes.

- Managed runs disable Gemini/OpenCode automatic update controls; missing Gemini system settings now fail preflight before launching the CLI.

- Crew create/update accept bounded native mise lock bundles without expanding the 10 KiB non-lock configuration budget; large escaped locks are no longer truncated by the request reader.

- `crew provision lock-resolve` creates or updates complete native mise lock bundles in a disposable Docker builder, preserving exact pins and reporting the resolver image/platform/version.

- Managed mise builds accept complete native lock bundles, enforce locked reinstall, and preserve lock inputs through manifest and visual tool edits; `crew provision lock-pack` packages local lock files.
- **New environment images wait for current work and activate when the runtime is confirmed idle.** Managed Docker admission reserves the container through preparation and execution; image activation and idle expiry share that reservation. Recovered runs, external occupants and background processes prevent automatic replacement. Unknown occupancy requires an explicit stop; crash-loop recovery remains available.

- Environment provisioning records immutable build history and refuses to publish a build after its definition changes. Inspect the latest records with `crewship crew provision revisions`.
- Built AI CLI toolchains receive an offline startup/version qualification through a runtime-neutral sandbox port; results distinguish unavailable and failed checks from authenticated provider tests.

- **Provisioning status now distinguishes requested CLI selectors from observed versions.** New builds record bounded CLI version/path observations in the image. Docker inspections use the immutable image ID without starting the image; old or unreadable evidence stays unknown. The CLI status command shows built versions. This does not claim that a running, modified environment still matches its image.


- **Explicit crew rebuilds could keep stale agent CLIs.** Rebuild now bypasses the provisioned-image and installation-layer caches while retaining configured version pins. Claude background updates and Codex startup update checks are disabled for Crewship-managed runs; rejected concurrent rebuilds preserve the existing cache.

- Concurrent starts can no longer fork installation identities by observing a partially written nonce owner; owner publication is atomic and malformed records fail without re-keying.
- **Old stop markers could keep agents RUNNING across later restarts.** Manual and dispatcher-owned stops now release their projection markers; pending history protects only its own trace. Atomic state updates preserve concurrent terminal results.

- **Restarted agents could remain RUNNING after their container disappeared, and a concurrent stop could miss a newly tracked invocation.** Recovery now confirms container absence, and stop closes the live invocation gate before reporting success.
- **AI operation discovery now ranks multiword searches** — generated API prose and ranked token search replace whole-query substring matching. Public descriptions omit internal handler comments; resource reads, nested creates and named actions receive clearer labels. MCP splits read/write tools, classifies audited POST reads, restricts admin writes and supports tag filters and optional client human approval. Workspace path selectors can no longer override the configured workspace.

- **AI clients can connect directly to the Crewship binary.** Bundled `mcp serve` exposes paginated API discovery, focused schemas, a built-in Agent Skill and guarded JSON requests. `ai connect` registers Codex/Claude Code, `ai config` emits credential-free client snippets, and `ai skill` exports the embedded guide. Mutations require startup opt-in plus per-call acknowledgment; identity, redirect and size guards are shared with the CLI.

- **CLI agents can discover API operations and inspect their inputs without scraping help.** `api operations` searches the embedded OpenAPI catalog, `api schema` returns focused schemas, and `api request` calls HTTP endpoints through the active profile with explicit mutation consent, offline previews, bounded input/output, and atomic downloads. `commands <path>` narrows discovery and includes required flags, inherited options, and runnable status. (#2836)
- ⚠️ **Behaviour change:** CLI HTTP redirects must remain on the original server origin, including scheme and port. Configure a moved server explicitly; generic `api request` refuses all redirects.

- **A crew started immediately after stopping could receive a stopped Docker container.** Runtime reconciliation now uses the newer inspect state for reuse and configuration drift decisions, rather than the older container-list snapshot. This also prevents a stale stopped listing from triggering configuration-based removal of a running crew. (#2855)

### Added

- **Proposal card editing and recovery primitives** support explicit issue selection, reviewed confirmation summaries and isolated field/comment drafts; production Chat integration follows the proposal API.
- **Agents can publish reviewable issue plans from their current chat.** Sidecar MCP and agent CLI commands create and revise inert proposals with verified run identity, stable retry keys, and fresh requester checks; later turns preserve the original source provenance.

- **Review agent issue plans before creating work.** Durable chat proposals support bounded edits, version conflicts, explicit human confirmation, and safe retries through the API and CLI; selected backlog issues and audit receipts commit atomically.

- **Experimental typed decision evaluation from the CLI** — recover the opt-in `crewship decisions evaluate`, `triage` and `rerank` pilot with bounded requests, advisory results and credential-free dry runs. This local command uses explicitly supplied provider keys outside server Paymaster accounting; hosted inference remains unverified.
- ⚠️ **Behaviour change:** CLI AI connections preserve installation symlinks and support `ai status`, `ai doctor`, ownership-checked `ai disconnect`, and optional bundled skill installation. Registrations created outside the new ownership mechanism, or edited afterward, require explicit native-client removal before reconnecting. MCP refreshes stored login credentials per request, can use the server OpenAPI catalog with an explicit offline fallback, and supports exact operation write allowlists. Focused tools list agents/crews/routines, start and wait for routines with durable receipts, and diagnose runs and crew runtimes.

- **A fenced crew can reach its own services.** A restricted crew on the egress-fence pilot that declares `services:` and is on its own network now gets a narrow path to them: each service has a fixed address on the crew network, the fence opens exactly those addresses on their ports, and the names resolve from the runtime's `/etc/hosts` because DNS stays closed. Declaring a service whose name sorts first shifts the others to new addresses: they are re-attached there and the fence follows, also when ensuring the services fails part-way. The same crew on the shared network is still refused. (#1368, #2240)

- Upload encrypted recovery archives through Admin › Backups › Recovery or `crewship admin instance backups upload`, with cancellation, checksum validation, disk-space checks and atomic catalog/audit recording.

- **Waiting for a routine could report uncertain or canceled work as successful.** `wait` now exits 5 for `needs_reconciliation` and 2 for either cancellation spelling; `routine run --wait` reports these outcomes as errors in human and machine formats.
- **Reconnecting an owned AI client could lose its working registration after a failed add.** Native edits and verification now run against a staged configuration, preserving the prior registration and ownership receipt on failure and refusing concurrent configuration or receipt edits. ⚠️ **Behaviour change:** owned reconnections require a regular client config file; symlinked configs are refused.
- E2 proposal and decision card contracts with closed form schemas and authorized read-projection fixtures. This foundation does not yet expose proposal confirmation or decision actions in Chat.


### Changed

- **Shared project management now has a verified CLI/API contract.** Real-router acceptance checks known-project Read+Manage without List, unrelated-client isolation, metadata and milestones, separate issue deletion, narrow credentials, active work, conflicts, audit rollback and live issuer revocation. Existing rights remain independent.


- **Required Go race checks run in smaller parallel groups.** The API suite is split into four complete test partitions and the remaining race-tested packages into two balanced groups. Every partition remains required, with coverage evidence, distinct timing artifacts and the existing timeout and aggregate budget checks (#2886).

- Live chat demo scripts now require `--state-dir` or `CREWSHIP_CHAT_DEMO_DIR` for private credentials, outside the checkout. The fleet-watch example requires `CREWSHIP_FLEET_ROOT` instead of assuming a workstation checkout path. Existing demos can reuse their state by selecting its current directory.

- Public documentation now separates product contracts from internal working records and prototypes. Start at `docs/README.md` for guides, specifications and decisions; contributor instructions remain in `AGENTS.md`. Assistant-specific workstation files are ignored and rejected by the tracked-path CI guard. Public builds need no private context checkout. (#2778)

- ⚠️ **Behaviour change:** Restricted routine, Page and assigned-issue runs now use the shared work ledger and dispatcher. Interrupted runs with uncertain effects show “Needs review” and require reconciliation before outputs are released or new work repeats; legacy running jobs are adopted into this state.

- **Shared Guest issue searches have a bounded rate budget.** Browser sessions and CLI tokens share account/workspace and project budgets, including empty searches and pagination. Temporary limits return 429 with retry guidance; existing project audiences, counts and detail permissions are preserved.
- Cap shared issue search limiter memory globally at 32768 lazy audiences, retaining active budgets and reclaiming only safely expired entries.

### Fixed

- **Removing a backup key or off-site destination could time out when the database connection pool was full.** Deletion now reuses its transaction for in-use checks, preserving named refusals and allowing unused keys and destinations to be removed. (#2924)

- ⚠️ **Behaviour change:** **Confirmed recovery stops with no recorded start now have clear audit history.** Record one `run.recovered_stop` event with explicit ownership checks and no billing, automation or completed-run statistics. Late lifecycle writes for an audited identity are rejected instead of creating an invented run.

- **A corrupt notification channel could stop healthy workspace deliveries.** Unreadable channels now remain available for administration but are excluded from delivery and test sends.
- **Memory append buffers used unchecked sums for initial allocation sizes.** Append now checks the combined size before allocating and reports oversized content instead of overflowing.

- Crew group headers expose their collapse state and support activation with Enter and Space.

- Run registry compaction uses exclusive temporary files, preventing pre-existing staging symlinks from overwriting unrelated files.

- Foreach body steps now receive the same retry, failure-policy, output-validation and lifecycle-hook checks as top-level routine steps, rejecting invalid definitions before they run.

- Routine definition tag batches commit atomically; rejected batches leave existing labels intact, and adding an existing label remains idempotent at the tag limit.

- Crew journal summary actions reset on crew/workspace changes and suppress notifications or refreshes from abandoned requests.

- Runtime availability ignores superseded checks; graph agent cards support keyboard activation, routine cards hide unknown step progress, and graph edges refresh changed handles and arrow markers.

- Integration workspace changes close old confirmation dialogs, clear selection and form state, and suppress notifications from abandoned connection actions.

- Crew policy controls discard abandoned reads and drafts, stop a policy save from continuing into quota writes after selection changes, and disable pending saves when edit access is removed. Unreadable optional quota metadata falls back without hiding the loaded policy.

- Task and mission details retain their selected tab when the same entity refreshes; mission logs include completed tasks even when no start timestamp was recorded.

- Toolbar build and agent-restart actions reset on crew or workspace changes, abort abandoned requests and suppress late notifications without unlocking a newer operation.

- Activity run lists count waiting approvals as active, retain their Inbox action without a saved definition, announce detail-read failures and cancel abandoned deep-link scrolling. Issue source chips no longer nest a link inside a run expansion button.

- Journal run feeds cancel superseded reads, clear previous workspace data and ignore delayed table, insight and live-feed responses after selection changes.

- Routine detail panels clear previous selections, stop reads when closed and cancel abandoned rollback/export operations. Read, rollback and export failures are announced in the panel; failed exports no longer cause unhandled rejections.

- Mission timelines retain agent counts when collapsed, announce expansion state and make task timing/usage tooltips reachable from the keyboard.

- Database snapshot restore creates exclusive staging and rollback files, preventing a pre-existing staging symlink from redirecting writes and preserving earlier rollback copies from the same second.

- Empty routine lookups cannot select a demo pack whose optional probe is absent. CLI HTTP test logs return independent header and body snapshots so assertions cannot corrupt later observations.

- Mission controls require complete workspace/crew/mission selection, cancel abandoned requests and ignore stale completions or errors after a selection change.

- The activity feed’s Done filter includes canonical `DONE` missions alongside legacy `COMPLETED` events, with success styling for both.

- Issue-board refresh timers are cancelled when workspace callbacks or crew filters change, preventing queued events from refreshing a former selection.

- Dashboard realtime refresh timers are cancelled when the selected workspace changes, preventing a queued event from refreshing the former workspace.

- Composio trigger lists and enable dialogs clear on workspace changes, ignore superseded reads and abandoned creation responses, and report active-subscription read failures instead of claiming no subscriptions exist.

- Recipe installation clears credentials, account labels and reveal state when closed or switched to another workspace/recipe; abandoned previews and installations cannot update the new selection or redirect it. Credential inputs and reveal controls have accessible labels.

- Workflow template galleries clear previous workspace data and drafts, ignore abandoned requests, distinguish loading failures from empty catalogs and report creation/deletion network errors.

- Integration marketplace search ignores superseded responses, keeps the current request's loading state, resets stale totals on failure and includes uncategorised servers in their facet.

- Audit-note fields in save footers have distinct accessible labels, including when several editable cards appear together.

- Deployed documentation checks require the declared page identities, so duplicate or unrelated index links cannot hide a missing page behind matching totals.

- Notification preference failures roll back only their own edits, preserve concurrent successful changes, and cannot restore data from a former workspace. Workflow and automation lists clear old scope data and loading state; step I/O clears the previous step while its replacement loads.

- Refreshing a Page review respects disabled reads and unavailable source archives instead of requesting an absent baseline revision.

- Backup activity checks report routine-query failures instead of silently treating them as idle; older schemas without the routine-run table remain supported through an explicit schema probe.

- The repository UID invariant checks the actual runtime package paths, so a checkout directory containing `sidecar` or `provider` cannot make unrelated UID literals satisfy the check.

- Page application reads wait for both a workspace and a Page selection instead of requesting an incomplete URL; incomplete crew owner references retain a visible fallback label.

- Page actions reject non-finite numeric inputs and defaults; project recovery refuses checkpoint pins that do not identify an existing Git commit.

- MCP credential creation clears secret input when its workspace or environment variable changes, cancels abandoned requests and ignores late results after closing the picker.

- Guaranteed memory-tool writes require a caller-supplied operation identifier, preserving retry deduplication instead of silently inventing a fresh identifier on each attempt.

- Backend connection status and uptime reset when switching or clearing the selected workspace, so an earlier workspace cannot appear connected during the new workspace's first check.

- Native restricted execution refuses a missing authority database instead of panicking before worker admission.

- Account-group management stays idle and hides cached metadata when no workspace is selected.

- User preferences finish loading after refused or empty server responses while retaining the locally cached value.

- File trees clear stale contents, selection and loading indicators when workspace selection is cleared or resolving. Refresh correctly replaces a directory with a file and clears the path prefix when the listing becomes empty.

- Notification channel reads reject malformed stored configuration and filters instead of silently treating unreadable category restrictions as permission to deliver every category. Valid legacy empty filters retain their existing defaults.

- Account signup recovers from network and unreadable error responses, keeps entered values for retry, and announces refusals accessibly. Password reset treats a null refusal body as a server refusal instead of a network failure.

- First-run secret bootstrap validates the entire key set and persists generated keys before exporting them. Failed persistence or validation cannot leave partial process secrets that a retry mistakes for externally managed keys.

- API mutations reject malformed or imprecise `Retry-After` values instead of treating them as valid retry delays.

- Work-ledger retention reports expired payloads and reclaimed bytes only after their transaction commits, preserving completed-batch counts when a later batch rolls back.

- Secret replacement discards drafts and obsolete completions when its workspace, credential or dialog changes. Revealed values report clipboard success only after the browser confirms it, with recoverable errors and no stale copy status after hiding.

- Chat questionnaires clear when the agent or workspace changes; failed optional requests cannot leave the previous agent’s forms visible.

- Backup conversion releases its rewrite stream when sealing fails, so encryption errors cannot strand the converter or its temporary output. Unknown CLI adapter names use the neutral brand without reading inherited object properties.

- OAuth setup discards obsolete authorization and code-exchange responses, clears owned popups and timers when its scope closes, and prevents overlapping polls or duplicate exchanges. Journal registry scanning skips vendored sources and handles unrelated constants without inheriting an old event type.

- Removed the unused legacy credential dialog and its tests; credential creation continues through the existing wizard.

- Enforce Page build output limits on actual subprocess pipes; prevent an inherited buffer fast path from bypassing cancellation and retaining unbounded worker output.

- Keep integration catalogs and workspace summaries current when searches or workspace selections change; ignore obsolete API-key saves and encode scoped identifiers. Add recovery coverage for dispatch, off-site backups and conversation writes.

- Connector access editing refuses to save when existing grants cannot be read, encodes resource identifiers, and ignores stale tool, summary and save responses after the selected agent or workspace changes. A missing workspace no longer leaves the connector summary loading indefinitely.

- Runtime reconciliation uses the latest inspected container state, so a stale running-list entry cannot return a stopped crew as ready, and a stale stopped-list entry cannot trigger replacement of a now-live crew.

- The shared agent context panel encodes agent, crew and workspace identifiers when loading context.

- Memory import and export reads remain inside their selected tree when a parent directory is replaced with a symlink, including direct file and directory reads.

- Agent detail panels follow their enabled state and ignore errors from obsolete requests after a selection changes.

- Tool argument validation compares object and array enum values structurally instead of panicking, and rejects null when the enum does not allow it.

- A stopped or cancelled scheduler leader no longer authorizes new work while its last lease is still fresh.

- Outbound URL validation rejects blocked IPv6 literals with zone identifiers before dialing, matching the connection-time SSRF guard.

- Onboarding reuses a CLI-delivered model token from the current workspace without asking for the secret again. The Guide starts reliably under Strict Mode, ignores superseded proposal previews, and keeps its created inventory scoped to the workspace across slow or failed polls.

- Notification provider and channel-agent registries, routine schedules, run records and trace details settle loading when their selection is cleared. Obsolete requests and schedule mutations cannot restore data from a previous selection.

- Routine budget views clear data when their workspace changes and ignore obsolete mutation responses. A pending read can no longer overwrite a successfully edited cap.

- **Routine tag and step override commands honor machine output.** Tag additions/removals and step override writes now emit structured results for JSON and YAML output while keeping the existing human messages.

- Keep the skills browser scoped to the current workspace and Installed lens across imports; rebuild active search results after catalog changes and show crew-assignment network failures in the dialog.
- Isolate Docker network integration-test installations and subnet leases so concurrent runs cannot adopt or remove each other’s containers.
- Workflow graphs omit dependency and permission edges whose source or target is absent from the displayed graph.
- Notification channel settings and delivery logs clear loading and errors when their workspace is removed. Responses still decoding and completed channel mutations from an older workspace cannot replace or refresh the newly selected workspace's data.
- Pipeline lists, run feeds and webhook settings settle loading when their workspace is cleared; old webhook refreshes and aborted run requests cannot interfere with a newly selected workspace.
- The quota helper checks its backend and server identity before binding a namespace, avoiding a nil-backend panic and catalog changes on rejected startup.
- Value previews keep their configured length limit when strings include display quotes or JSON serialization falls back to text.
- **A terminal could reconnect after being closed or show errors from a previous crew.** Disconnect now invalidates pending authentication and obsolete socket callbacks, releases resize tracking, and reports missing or malformed connection tokens as errors. (#2775)
- **Routine approval prompts could return after their workspace was cleared.** Clearing the workspace or run selection now invalidates outstanding waitpoint requests before their results can restore stale approvals. (#2775)
- **Run heatmaps could show an older retry or lose live results while history loaded.** Step metrics keep the newest historical completion, preserve live completions when history arrives or fails, and clear the previous run's metrics when the selection changes. (#2775)
- Docker environment builds publish immutable local image references, so another rebuild cannot silently replace a selected artifact. Failed explicit rebuilds keep the previous reference; cache inventory and ordinary cleanup recognize image-ID references. The build cache key advances once to avoid retagging legacy references.
- Confirmed stops recovered after restart now retain a durable journal retry until history and agent state are recorded; retries preserve existing outcomes and leave work-owned settlement to the dispatcher.
- Confirmed stops recovered after restart now retain a durable journal retry until history and agent state are recorded; retries preserve existing outcomes and leave work-owned settlement to the dispatcher. Another durable running invocation keeps the agent RUNNING even before its journal start is visible.
- Agent runtime diagnostics now find runs by their durable run IDs, prefer an active invocation, and report unavailable state instead of inventing an idle result.
- Restart recovery preserves the exact live run while closing older orphan traces, and leaves work-owned outcomes to the durable dispatcher. Legacy agent-keyed runtime records remain conservatively protected.
- Runtime reconciliation uses the latest container inspection rather than an older list snapshot, avoiding stopped-container reuse or removal of a newly running container.
- Agent stop recovers durable runtime identities after a server restart and refuses to confirm process absence when the signal tool is unavailable.
- Crew restore skips empty sections and prepares missing shared memory directories, preserves file modes and timestamps, and verifies the shared permissions before writing payloads. Off-site fetch registers downloaded bundles in the local catalog without overwriting another fetch.
- CLI Page actions accept `--expected-intent-hash`; restricted routine receipts support structured output and `--wait`, including delayed runs. Backup creation honors machine output formats. Agentless runtime removal and failed legacy pruning report their actual outcome. (#2777)
- **Resource grants showed raw ids for the kind not selected in the add-grant picker** (#2863). In a member's restricted resource access, the grant list resolved names only from the directory of the currently selected kind, so with "Project" selected every agent grant showed its id (and vice versa). Both the agent and project directories now load, and each grant is named from its own kind's directory.
- **Agent Stop hid a stop the runtime did not confirm** (#2864). On a phone, the agent header's Stop swallowed every failure, so a `502` from `POST /api/v1/agents/{id}/stop` (`runtime stop not confirmed` / `runtime stop unavailable`) looked like success; the agent canvas showed only `HTTP 502`, and its request also omitted `workspace_id`, so the route refused it before trying. Both buttons now share one stop call: a failure shows an error toast saying the agent may still be running and leaves its status as it was; only a confirmed stop shows `STOPPED`.
- **Restricted members saw a permanent "Reconnecting…" banner and a shell full of failing requests** (#2861). Restriction applies to the whole account, but the web app asked for a realtime ticket, the inbox count, system version/runtime/license, engine, crews, provisioning, active runs and the journal lookup, all of which the restricted allowlist refuses with 404, and it retried the ticket forever. The app now works out one access mode per session (any restricted membership makes the session restricted, also in workspaces where the membership is trusted), sends nothing outside the allowlist until that mode is known, and leaves those calls and widgets out of a restricted session. Realtime reports a terminal "unavailable" state with no banner, and a 404 from `/ws-token` is terminal for every session instead of a retry loop. `/routines` and `/pages` pick the restricted screens from the session mode. A restricted chat now checks for messages from other participants or tabs every 10 seconds while visible, since it has no WebSocket. Navigation is not yet filtered; that follows separately.
- **The crew service quota editor said backups of quota disks are refused.** Since format v4 (#2745) crew, workspace and instance backups include quota-service disks whenever the server's quota helper is configured. The editor's warning and the service disk quota guide now say so: backups are refused only without the helper, and an interrupted backup keeps the service stopped until an admin retries with `--recover-services`. (#2866)
- ⚠️ **Behaviour change: crew updates no longer confirm guesses of hidden service settings.** Updates that submit `services_json` for a crew whose configuration is redacted now return the same conflict even for an exact plaintext match. Omit `services_json` when retrying unrelated crew edits; private values stay on the server and public service/quota edits remain supported. (#2742)
- **The Work ledger offered Replay on finished restricted workflow work**, and the click failed with 409. The button is now disabled for restricted workflow items and the page states the server's reason: "Private workflow replay requires a new authorized routine or Page admission." Other domains are unchanged. (#2865)
- **Restore history showed "NaN undefined" for a source bundle no longer in the catalog.** Admin › Backups › Recovery › History now says "source date unknown" when the server sends no source date (it only knows it while the bundle is still catalogued). (#2867)
- **Old stop markers could keep agents RUNNING across later restarts.** Manual and dispatcher-owned stops now release their projection markers; pending history protects only its own trace. Atomic state updates preserve concurrent terminal results.
- **Restarted agents could remain RUNNING after their container disappeared, and a concurrent stop could miss a newly tracked invocation.** Recovery now confirms container absence, and stop closes the live invocation gate before reporting success.
- Confirmed stops recovered after restart now retain a durable journal retry until history and agent state are recorded; retries preserve existing outcomes and leave work-owned settlement to the dispatcher. Another durable running invocation keeps the agent RUNNING even before its journal start is visible.
- Agent runtime diagnostics now find runs by their durable run IDs, prefer an active invocation, and report unavailable state instead of inventing an idle result.
- Restart recovery preserves the exact live run while closing older orphan traces, and leaves work-owned outcomes to the durable dispatcher. Legacy agent-keyed runtime records remain conservatively protected.
- Runtime reconciliation uses the latest container inspection rather than an older list snapshot, avoiding stopped-container reuse or removal of a newly running container.
- Agent stop recovers durable runtime identities after a server restart and refuses to confirm process absence when the signal tool is unavailable.
- Crew restore skips empty sections and prepares missing shared memory directories, preserves file modes and timestamps, and verifies the shared permissions before writing payloads. Off-site fetch registers downloaded bundles in the local catalog without overwriting another fetch.
- CLI Page actions accept `--expected-intent-hash`; restricted routine receipts support structured output and `--wait`, including delayed runs. Backup creation honors machine output formats. Agentless runtime removal and failed legacy pruning report their actual outcome. (#2777)
- **`crew delete` left auto-managed service credentials behind** (#2771). A crew with a `services:` datastore (Redis, Postgres, ...) gets an `AUTO_MANAGED` credential such as `REDIS_PASSWORD` at apply time. Deleting the crew kept that row, so the next manifest declaring the same service failed on a duplicate credential. A same-slug re-apply was worse: it reused the stale row, so agents got the old password while the new sidecar got a new one. Crew delete now removes a credential only when the stored row proves the crew owns it (`provider=AUTO_MANAGED`, `created_by_actor_type=system`, `provisioned_for_service=<crew-slug>/<service>` in the same workspace) and nothing outside the crew is bound to it. The response lists the names in `removed_credentials`, and the CLI prints them. User-created credentials and credentials another crew uses are never touched. Orphans left by crews deleted before this fix, and rows tagged with a crew's earlier slug, cannot be proved to belong to a crew; remove them with `crewship credential delete`.
- **Crews can get their own Docker network (first stage).** A crew listed in `container.crew_network_crews` runs on its own bridge with a small subnet from `container.crew_network_pool`: other crews cannot reach its containers, and its `postgres`/`redis` service aliases no longer collide with another crew's. Off by default; existing crews move only when listed and their container is next recreated. Needs crewshipd on the Docker host (not the containerised production compose setup, where a listed crew is refused). (#2240)
- **Restricted crews can opt into a network-layer egress fence (pilot).** With `container.egress_fence_crews` set, a listed crew's container only lets the sidecar's traffic out, so a process that ignores the proxy can no longer open connections to the internet, the host, other containers or Docker's resolver. This enforces the outbound proxy path; it is not full network isolation (inbound connections from other crews are #2240). Off by default; restricted, non-privileged runc crews only. (#1368)
- **`crewship run`, `ask` and `-p` hung forever when stdin was a pipe nobody closed** (a harness or CI shell, cron with an inherited pipe), even with the prompt given as an argument; no run was ever created. A prompt given on the command line now never reads stdin unless `--stdin` asks for it: `git diff | crewship ask --stdin "review"` appends the diff as context, and without the flag a one-line `[stdin not read …]` hint goes to stderr when stdin is a pipe or file. With no prompt argument, piped stdin is still read as the prompt (`echo hi | crewship run mia`). (#2770)
- **Routine script steps in restricted crews could not use HTTPS through the proxy at all.** Since the provider budget admission, every HTTPS tunnel from the crew-level sidecar a script step uses was refused with 403, even to allowlisted domains, because that sidecar has no agent identity. It is now admitted under the crew's own identity, taken from its crew-bound token, with no credential and the same hard-budget rule as an agent; disallowed hosts are still refused. (#2761)

- The private workflow dispatcher can start behind a backup quiet window and resume after it opens. A private workflow claimed just before a backup quiet window closes now waits for a bounded dispatch retry instead of failing and revoking its authority before execution. (#2746)
- **Node's built-in `fetch` now goes through the crew proxy.** Node ignores `HTTP_PROXY`/`HTTPS_PROXY` for `fetch` unless `NODE_USE_ENV_PROXY=1` is set, so a Node tool in a restricted crew reached the network directly, past the allowlist. Agents and script steps now get the variable (Node 22.21+ and 24+; crew images ship 22.23); loopback stays direct. Older Node still ignores it. (#2763)
- **Crew overviews showed "No runs in the last 7 days" for crews that were running.** `run.started` journal entries from chat, sidecar, assignment and peer-query runs never recorded the crew, and crew-scoped run insights read recorded ownership, so they counted nothing. New runs now record the agent's crew at run time; earlier runs stay unattributed because the journal is append-only.
- **Deleting an agent left its runs running.** `DELETE /api/v1/agents/{id}` only marked the row deleted: live runs kept going (their tmux sessions even survive a server restart) and a run accepted just before the delete still started after minutes of provisioning. The delete now stops that agent's runs and only those, reports `runs` (`none`, `stopped`, `pending`), and a background pass keeps stopping runs of deleted agents found in persisted run state after a restart. Every run is also checked right before its process is created, so no entry point can start a deleted agent. Memory, chats and attachments are kept.
- Mission timeout cleanup waits out backup quiet windows before changing task/mission rows or writing progress events. (#2753)
- Complete backups preserve persistent quota-service disks in encrypted format v4. Offline instance recovery stages verified images under fresh generations and keeps services in maintenance until an audited import on the destination host. (#2744)
- ⚠️ **Behaviour change:** A writing server holds exclusive local database ownership before startup; a second server is refused and instance backups discard copies if ownership is lost. Offline commands that write the database (`reset-password`, `promote`, `invalidate-sessions`, `add-admin --local`, `seed-inbox`, `memory restore`, `db restore-snapshot`, offline telemetry) now refuse while the server runs; read-only ones (`admin sessions list`, `admin list-users --local`, `memory show/log --local`) still work beside it. Network/shared-storage replicas require distributed fencing and are unsupported in this 1.0 mode. (#2756)
- **`nuke` reported success over orphaned docker runtimes.** With docker unavailable on the server, `nuke all` warned, deleted the crews and reported success, leaving their containers and volumes with nothing left to find them; a partial teardown (a volume still in use) was only logged and answered 200. The runtime teardown now runs first and must be vouched for: no runtime provider (`reason: unavailable`) or any resource that could not be removed exits non-zero before anything else is deleted, keeping the crews for a retry. Only a provider that never runs docker runtimes (`reason: unsupported`) is passed over, and said so.
- **Routines, scheduled runs and webhooks failed on a crew whose cache image was evicted or never built** (`ensure image: cached devcontainer image missing locally`). Every crew start now waits for the image to be rebuilt, as chat and dispatch already did; a failed build fails the start with `crew image not ready`. A crew whose configuration needs no build but was provisioned anyway now also rebuilds its evicted image instead of reporting it ready.
- Restricted members can invoke an admitted routine from a minimal private catalog and poll their own routine or declared Page action receipts without a shared journal fallback. Catalog fingerprints also pin nested declarations across submission retries. (#2711)
- Project files have explicit immutable versions, exact read/write grants, current checks during downloads, stale-write protection and aggregate storage limits. Retired bytes are removed while version provenance remains; native input capabilities require fresh admission. (#2711)
- Agent Settings can opt restricted clients into native Codex scratch tools. The server pins a separate worker and sandbox policy, keeps API credentials in the host broker, accounts for each tool-followup model call, and delivers files only to the current conversation audience. (#2711)
- Restricted conversations support human memory notes, scoped search and context-version export. Withdrawing a note revokes its provenance and dependent prepared runs; another participant cannot withdraw its author's note. (#2711)
- Restricted members can explicitly preflight a project-backed assigned issue into a private routine. Exact source rights, brief revisions, budget and capacity are checked before atomic reservation/enqueue; duplicate claims reuse only the same actor’s receipt and uncertain failures require reconciliation. (#2711)
- Restricted runs can retain bounded immutable output files. Lists and downloads check the current private or explicit group audience; revocation hides filenames and bytes, and regrant does not resurrect old versions. (#2711)
- **Member resource access can be managed in Settings.** Workspace administrators can choose trusted or restricted access and replace exact agent/project operation grants. Stale edits require an explicit reload; an empty restricted policy revokes all resource operations. (#2711)
- **A new agent could inherit a deleted agent's memory and output.** Agent data lives under its slug inside the crew (`/crew/agents/<slug>`, `/output/<slug>`), and creating an agent released a deleted agent's slug for reuse. A slug that another agent of the same crew used — deleted, renamed or moved away — is now reserved for it: creating, renaming or moving an agent onto it in that crew returns `409`, enforced by database triggers for every insert path. Existing tombstones are reserved by the migration; slugs a live agent already took are left for the agent-ID data migration to sort out. Interim until agent data is keyed by agent ID.
- Restricted manual routines and declared Page actions can queue bounded nested workflows with explicit agent delegation, independent frozen provider slots, private proof-bound results and live declaration checks. Unsupported execution profiles are denied before any leaf starts.
- Ordinary restricted CLI runs create their own private run context under the exact run permission, independently of chat permission.
- Restricted group chat now shares only context classified for the exact live participants; audience and permission changes stop old attempts and start a fresh context.
- Restricted conversational execution checks the chat grant separately from direct CLI run authority. Administrators explicitly opt agents into isolated text Responses in agent Settings; profile changes revoke prepared provider attempts and native login/tool execution stays unavailable on the text path. (#2711)
- Restricted chat and CLI runs can use an opt-in isolated text Responses worker with scoped history, durable cost reservations, live output authorization and no shared execution fallback. Agent discovery exposes only explicit grants; native tools and provider-login agents remain unsupported on this path. (#2711)
- Crew Settings expose service disk quota policy, per-volume capacity and immutable generations, with an explicit legacy trusted storage label. Snapshot preconditions prevent quota edits from replacing concurrent service changes; private settings remain preserved. (#2703)
- Crew services enforce swap, rotated log and temporary filesystem limits and audit Docker limits before reusing a container. Opt-in `quota_enforced` services use a readonly root and fixed-size helper-backed ext4 volumes (`quota_bytes`, immutable `generation`); unavailable helpers fail closed. Legacy roots and named data volumes remain trusted and unbounded. Quota service recovery is controller-owned rather than automatic Docker restart. Production installs use a root helper with paired `quota_helper_socket`/`quota_helper_namespace` configuration, immutable per-database catalogs and readiness ordering before reconciliation. (#2703)
- `crewship seed --codex-auth-file <path>` switches the demo agents to a private Codex ChatGPT login without setting `SEED_CODEX_AUTH_FILE`; the flag overrides the variable, and errors name whichever source supplied the path. The seed variables (`SEED_CODEX_AUTH_FILE`, `SEED_LINEAR_OAUTH_*`, `SEED_GOOGLE_OAUTH_*`) are now documented.
- **`crewship run` printed an empty answer when the crew's environment had to be built first.** A send parked behind an image build (a new crew, or an evicted cache image) gets a deferral `done` before the server replays it; `run`, `run --no-stream`, routine iterate and `ask` with several agents now wait for the replayed run's answer and exit non-zero when the build never started.
- Crew services can opt in to disk quota enforcement with `quota_enforced`: a read-only root, bounded `/tmp` and `/run`, swap, PID and rotated-log limits, and fixed-size persistent volumes (`quota_bytes`, immutable `generation`) preallocated by a per-database root helper (`scripts/install-quota-helper.sh`, `CREWSHIP_QUOTA_HELPER_SOCKET`/`CREWSHIP_QUOTA_HELPER_NAMESPACE`). Services that do not opt in keep their containers and profile unchanged across the upgrade. Quota services are refused on hosts without swap or PID accounting, keep their volumes across crew renames, change capacity only through a new generation (validated by the API and `crewship apply`), and make crew and workspace backups refuse until quota snapshots exist. The helper quarantines bad catalog entries instead of failing to start, and the installer leaves the container prefix alone and only soft-depends on the helper. See the Service disk quotas guide. (#2703)
- Crew Settings expose service disk quota policy, per-volume capacity and generations, warn about the backup restriction, and reject stale edits with a snapshot precondition while preserving private settings. (#2703)
- Instance backups refuse unsupported standalone quota-service volumes, matching the workspace and crew backup guard. Admission and the immutable database snapshot are both checked; no archive is published after a service declaration changes between them.
- Instance administrators can read container cleanup observations without a selected workspace; workspace administrators retain their existing tenant boundary.
- Container cleanup, idle runtime retention and cache eviction participate in the instance backup write barrier: a copy waits for an in-flight removal, new scans defer while the window is closed, and large removal backlogs yield between resources. Mount evidence and cleanup diagnostics remain on the same side of the barrier as Docker mutations.
- `crewship backup inspect`, `backup verify` and `backup download` work on an instance bundle, and so does Download in Backup history. They went through the per-workspace routes, which answer 404 for a bundle that belongs to no workspace. `GET /api/v1/admin/instance/backups/bundles/inspect`, `…/verify` and `…/download` (`?path=`, instance administrators) serve any bundle in the catalog — the manifest, the checksum check, the bytes, the download recorded in the instance audit log — and the three commands fall back to them when the workspace route answers 404 or 400.
- A single skipped backup no longer pages the instance admins. One night the server stayed busy, the writes in progress did not drain or the disk was too full is shown as `skipped` with its reason in Backup history, the nights strip and Needs attention; the second skipped run of a plan in a row (for the same workspace, or the instance) raises the `failed` incident as "Nightly backup skipped 2 times: writes did not drain" (or `workspace busy`, `not enough space`, `backups are held`), and the next good run resolves it. `CREWSHIP_BACKUP_SKIP_ALERT_AFTER` (1–30) changes the count; `stale` still fires when no good backup lands within `stale_alert_hours`.
- The quiet window no longer holds over a routine run that is starting. A run the pipeline scheduler or the pending-run dispatcher started was counted as busy only once its row said `running`, so a run claimed just before the window closed could write its row and execute its steps inside the consistent copy. Every routine run is now admitted by the window before it writes anything and counts as running work from then on: admission is refused while the window is closing or held (the schedule stays due, the deferred run stays pending, a resume waits for the release), and the re-check after the write drain counts runs admitted before the close. Each pass of a mission's loop is a write the drain waits for, and the assignments it dispatches are admitted the same way. What the window does and does not cover is listed in the backup guide.
- The instance backup's quiet window is a real write barrier. The hold used to be checked only when a request or sweep started, so an upload, edit or retention sweep accepted a moment before the window kept writing while the database snapshot and the file copy were taken, and the two could disagree. Now every mutating request and every background writer (retention and garbage-collection sweeps, memory syncs and nightly consolidation, schedule fires, queued-work claims, notification re-deliveries) registers while it writes; opening the window refuses new writes, waits for those in progress, and only then copies. Reads, streams and downloads never count. A write still running after the drain timeout (60 s, `CREWSHIP_BACKUP_DRAIN_TIMEOUT`) abandons the window without copying and records the run as skipped ("writes did not drain"). Long sweeps step aside at their next batch and resume after the window. The 20-minute cap now applies to the copy itself.

### Improved
- Backup alerts reach the notification channels chosen under Keys & alerts, beside the instance admins' inboxes. The Alerts card's Tell row lists every workspace-wide notification channel that admits System health (Slack, Discord, Teams, e-mail, signed webhooks, Opsgenie and the rest), each with a Send test button and how its newest alert went; the inbox is always on. Each ticked channel gets one message per incident state change — opened, each repeat, resolved — naming the plan, what happened, how often and how long ago the last good backup was, with a link to Backups › Overview made absolute against `CREWSHIP_PUBLIC_URL`. Delivery is the notification system's own (sealed channel secrets, the SSRF-safe transport, the provider kill switch, the delivery log and its recovery sweep, deduplicated per channel and state change); a failed send is recorded with its reason, retried, and shown on Overview as "Backup alerts could not be delivered to <channel>". `GET …/backups/settings` returns `available_channels` and `channel_status`, `PUT` checks each channel it adds, and `POST …/backups/settings/test-alert {channel_id}` sends a test; CLI `crewship admin instance backups settings set --channel <id>` and `crewship admin instance backups test-alert --channel <id>`.
- Backups can be restored from an off-site copy. `GET /api/v1/admin/instance/backups/copies?destination=` lists the bundles a destination holds and marks those already on this server; `POST …/copies/fetch` downloads one with the environment layers it needs into the backups directory, each verified, as a server job that answers `202` at once and runs under its own deadline, so a large download is never cut by a client timeout; `GET …/copies/fetch/{id}` follows it. Recovery › step 1 gets **From off-site storage…** (fetch, or use the copy already here, then carry on), and the CLI `crewship admin instance backups copies list | fetch [--wait] | status`.
- The drill reminder works. With `drill_reminder` weekly or monthly (the default), the backup scheduler opens one instance-wide `drill` incident when no test restore has been recorded for 7 or 31 days (counting from the oldest backup when none ever was), delivered once to every instance admin's inbox with the command to run ("No test restore in 32 days — run `crewship backup drill --bundle … --identity …`"), and resolved as soon as a drill is recorded or the reminder is switched off. It has its own slot, so it never hides a failed drill.
- Backups can take complete container environments. With Complete environment chosen (Schedules › Container environments, `env_mode: complete`), each crew container is committed under the same pause as its files, after an optional flush hook (`sync`, or the crew's `crewship.backup.flush` label), and its image — including the container's local changes — is saved into an environment store beside the backups, every layer once and shared between bundles; retention and deletion drop a bundle's references and remove only layers no other bundle needs. Every volume and bind mount comes along, with the configuration to recreate the container safely: Docker socket mounts, privileged mode, host namespaces, added capabilities, devices, host path binds and published ports are recorded and restored switched off, and secret-looking environment variables are left out. Restore checks add a runtime check per environment (a crew built for another architecture, or whose layers are gone, gets its data back and its environment rebuilt from the crew image), a restore reports each environment restored, rebuilt or skipped, and `crewship admin instance backups environments land` loads what an offline `crewship recover` staged once the server runs with Docker. Processes start fresh: what was only in memory is not restored. `CREWSHIP_BACKUP_ENV_INLINE=1` makes bundles carry their layers inside. Behind a Docker socket proxy, environment capture needs `COMMIT: 1` and the new `ImageSave`/`ImageLoad` endpoints under `IMAGES`.
- Backups tell the people who run the server when something goes wrong, and can leave the server. A failed, skipped, incomplete or stale backup (no good one for 36 hours by default), a failed off-site upload or a failed drill opens one incident per plan, counted on repeat and resolved by the next good run; every instance admin gets one inbox item for it ("Backup needs attention · Complete recovery backup failed. Last successful backup: 32 hours ago.", with View failure and Retry), carried to their own email, Slack or other channels under System health. A heartbeat URL is pinged after every good run so an outside service notices when the whole server is down. S3-compatible storage (R2, B2, Wasabi, MinIO, AWS) can be added under Storage — connection tested before it is saved, secret sealed with the vault key, private networks only by explicit choice — and a plan copies each bundle there, counting the copy only once it is verified; retention deletes remote copies too, and the Local-only warning goes once every recent backup has one. Backup keys (age public keys) are managed under Keys & alerts, with a downloadable recovery sheet. Limits apply: runs at once, CPU cores, disk and upload MB/s; a run that would leave less than 10 % of the disk free does not start and says why; and the payload is encrypted as it is packed, so no unencrypted staging file ever reaches the disk. CLI: `crewship admin instance backups settings get|set`, `recipients list|add|remove`, `destinations list|add|test|remove`, `incidents`, `recovery-sheet`.
- Backup plans run on their own. An instance administrator saves a plan — Complete recovery, Workspace backup, or a custom choice of contents that keeps what it depends on — with a schedule in its own timezone (daily, weekly, monthly or cron), which runs also take complete environments, how many copies to keep and who can open them; every plan is encrypted. The server's backup service (never an agent) runs each due plan once, even across a restart; after downtime it makes one catch-up run instead of one per missed night; while agents are at work in a workspace it waits up to two hours, looking again every 15 minutes, then records the run as skipped. Each run keeps its phases (copy, pack, encrypt, check, off-site); a run the server stopped in is marked interrupted, its partial file removed, and retried once. After a good run the plan's keep rules rotate that plan's own copies. A custom backup carries only its categories (a memory-only backup: crews and agents, memory and its history, nothing else), is marked custom in its manifest, never counts as protecting a workspace, and cannot be restored with `--replace`. Runs, next run times, a calendar of done and planned runs, a contents preview and the Overview (verdict from the weakest latest full backup, what needs attention, fourteen nights, space) come from the server now. `crewship admin instance backups plans list | get | create | update | delete | next | calendar | preview`, `runs`, `run`, `overview`.
- Whole-instance backup and recovery. An instance bundle holds the entire database (a page-level snapshot), every file store (attachment and workspace files, memory and its version history, page projects, chats, skills, each file with its SHA-256) and every crew container, copied in one quiet window: running agent work drains first (up to two hours, else the run is skipped), then writes, uploads, inbound webhooks, schedules, queued work and retention sweeps are held for the copy only, capped at 20 minutes and released on any error or crash; packing and encryption happen afterwards and the run records how long writes were held. With the recovery kit on, every vault key version the database uses rides inside instance bundles (never workspace or crew bundles). `crewship recover` restores one offline into an empty data directory: checksum, decrypt, every file checked, migrations forward, sessions dropped, session key rotated, keys written to `recovered-keys.env`, and routines, webhooks and queued work held until an admin resumes them. `crewship backup drill` test-restores in isolation and checks that attachments open, memory loads, credentials unlock, journals verify and routines stay held; `--post` records it as proof level 3. New instance-admin routes and commands: `admin instance backups run | run-status | vault-keys | recovery-kit | check | restore-checks | drills`, `admin instance holds list | resume`. Instance backups run in the same backup service as plans: a Complete recovery plan now writes an instance bundle, every run (scheduled, catch-up or manual, instance or workspace) is one durable run with its phases and `hold_ms`, `admin instance backups run` takes `--plan` or `--scope` with `--recipient` or `--passphrase-file` (the passphrase stays in server memory until the run starts, never stored) and `--wait`, and `run-status` shows one run in the shape of `runs`. While a restore's schedule hold is set, scheduled backups are recorded as skipped until an admin resumes it; manual runs still start. The Overview says when the latest instance backup cannot unlock credentials on a new server, naming the key versions its recovery kit does not carry.
- Old backups stay recoverable. `crewship backup convert --bundle <file>` (offline, no server needed) writes a copy of an older bundle at the current format version, sealed to the same keys, and reports each step's changes and what that version never carried (v1 bundles held no issues, credentials or memory versions; v1 and v2 held no crew memory). The original is never modified. A bundle older than restore, verify and inspect read directly now gets the exact convert command instead of pointing at a `backup migrate` tool that did not exist. CI restores a fixture bundle for every format version on every run, and a format change cannot merge without its converter step and fixture.
- Admin › Backups is rebuilt around five questions — what is protected, how often, where, for how long, and whether a restore really worked. Data › Backups folds out six pages in the Admin sidebar: Overview (a status card with three separate proofs, a warning while every copy sits on this server, concrete problems, the last 14 nights and the disk room), Backup history (runs with their phases and proofs; pin, check contents, download, restore), Schedules (presets or custom contents that keep their dependencies, when, next runs, a calendar, retention of copies), Storage, Recovery (checks, dry run, restore in phases, then resume what is held) and Keys & alerts. A strip above each page picks the whole instance or selected workspaces, kept in the URL. Retention becomes Data retention: every kind of live data per workspace, with a dry run listing what a change overwrites and how many rows the next sweep deletes. Parts whose server endpoints have not shipped say so instead of showing figures; history, checks, downloads and workspace restores use the existing backup endpoints meanwhile. Old `?tab=backups` links land on the Overview.
- Data retention across every workspace. An instance administrator sees and sets how long each workspace keeps routine runs, approvals, audit log, credential audit, memory versions, page panel data, inbox items, chats and Keeper decisions, for one, several or every existing workspace. Before a save, a preview lists per workspace and per window how many rows the next sweep would delete. What a new workspace starts with is a separate setting with its own confirmation; it changes no existing workspace, and saving for all workspaces never changes it. Inbox items, chats and Keeper decisions are new windows and stay forever until set; when set, a daily sweep removes only resolved or read non-blocking inbox items, idle chats without open work, and decided Keeper requests, never pending ones. The server's fixed limits are listed read-only. `GET`/`PUT /api/v1/admin/instance/retention` and `…/retention/defaults`, `crewship admin instance retention get | set | defaults get | defaults set`.
- The isolated runtime prototype can broker stateless text Responses requests with a server-selected model and output ceiling. Remote resource references and tools are denied; application model execution remains gated. (#2711)
- Workspace administrators can read and replace versioned member resource policies through the API and `workspace member access`. Stale edits return 409; explicit empty restricted grants deny all. Restricted execution remains unavailable on unintegrated routes. (#2711)
- The web app adopts Harbor, the marketing site's design language. Night (the default) and a new warm-violet Dusk are dark themes; Day is a full light theme. Pick one, or System, from the profile menu; the choice is kept per browser. The UI uses the platform system font with JetBrains Mono for labels, ids and status chips. Primary buttons, cards, inputs, status chips and concept icon tiles follow the Harbor shapes, and every theme's text, link, chip and button colours are held to WCAG AA by the theme contrast test.
- The web app adopts Harbor, the marketing site's design language, in a dark theme (the default) and a new light theme. Pick one, or System, from the profile menu; the choice is kept per browser. The UI uses the platform system font with JetBrains Mono for labels, ids and status chips. Primary buttons, cards, inputs, status chips and concept icon tiles follow the Harbor shapes, and every theme's text, link, chip and button colours are held to WCAG AA by the theme contrast test.
- The app rail opens in one motion. The tile column stays where it is in both states and only the labels fade in, so opening the panel no longer resizes icons, shifts padding and pops in group names one after another. Plan, Run, Build and System are separated in the collapsed rail by a gap and a short rule. One button (or ⌘B) pins the panel open and collapses it again; "Expand on hover" is an option in its menu. Each destination has its own colour, shown only on the page you are on and under the pointer.
- Admin › Security covers every workspace, whichever one the admin sits in and whether or not they belong to it. The panel starts with a Workspaces section: "All workspaces" and each workspace with a tick, kept in the URL. Activity, the overview and the new "What's on where" table (what each workspace has switched on) cover the ticked workspaces. A per-workspace setting — judge, watchdog, alerts, leases — edits the one ticked workspace, or with several ticked shows what they share, marks what differs as Mixed, and saves only after a dialog lists what is overwritten where. A save for all workspaces also becomes what new workspaces start with. Instance-wide settings grey the list out. An instance admin who is only a MEMBER where they stand can now read posture and the judge settings.
- The app rail opens in one motion. The tile column stays where it is in both states and only the labels fade in, so opening the panel no longer resizes icons, shifts padding and pops in group names one after another. Plan, Run, Build and System are separated in the collapsed rail by a gap and a short rule. The row at the bottom names the sidebar mode and opens a menu with all three — Expanded, Expand on hover, Collapsed (icons only, never opens) — in the rail as well as the open panel; ⌘B pins and unpins, returning to the rail mode you chose. Each destination has its own colour, shown only on the page you are on and under the pointer.
- The app rail wears Harbor icon tiles, the same as a nested page's collapsed panel: the page you are on is tinted in its concept's colour (Chat teal, Inbox sky, Routines purple…), the rest stay neutral and take the tint with a lift and tilt on hover. Reduced motion keeps them still.
- Admin › Security replaces the Posture, Keeper and Keeper reviews tabs with one nested page built like People & workspaces. Overview says in one line whether Keeper and its judge work, lists what needs attention with a link to fix each item (Keeper off or its judge down first, then the server's posture warnings), shows the deploy-time setup read-only and the judge's recent record. Activity holds credential requests and all four Phase-2 reviews in one list, narrowed by kind and decision, and a row opens its full record with secrets redacted. The seven settings (Credential judge, Decision rules, This workspace, Background checks, Watchdog, Alerts & approvals, Credential leases) each get a section labelled Instance or Workspace. Old `?tab=posture|security|reviews` links land there.
- Admin › Runtime, Notifications and Limits read like Settings: one centred column, no second heading under the sub-bar, and a one-line summary instead of four figure tiles. Limits collect edits in one save bar and offer Reset only where a value was changed; descriptions keep their first sentence with the rest on hover. Notifications ask in the row before switching off a provider that channels use, and fold categories past six providers. Runtime folds the other supported runtimes into one row, sets the log level with two rows and one Apply, and moves "remove every crew runtime" into a Danger zone card with the typed confirmation in place.
- Admin's infrastructure pages are reorganised and restyled like the rest of the console. Security posture moves from Runtime to its own Security › Posture page and memory history to Data › Retention. Notifications groups providers into chat, push and incident with how many channels use each, filters by on, off and in use, asks before silencing a provider channels depend on, and shows the email and webhook transports. Limits (was Rate Limiters) opens with what changed from the defaults, filters by area or changed only, searches, and says whether an override is tighter or looser than the default. Two Overview fix buttons that pointed at sections that did not exist now land on Limits and Posture.
- Admin › Workspaces and Users read like the rest of the console: a figures row, search and filter chips, sortable lists and a drawer per row. Workspaces show members, crews against the licence, a week of runs, spend over 30 days, last activity, pending invitations and privileged-credential flags. Users show online status, last activity, signed-in devices and CLI tokens, and locked accounts; the drawer changes roles per workspace, signs a device or every device out, unlocks an account, and exports or erases personal data. The instance owner sees every workspace and account; everyone else sees their own workspace, and the page says which.
- Admin › Users and Workspaces have the data behind them: the instance owner (`CREWSHIP_OWNER_EMAIL`) now sees every workspace and every account, workspace admins still see their own workspace, and the `X-Admin-Scope` header says which. Users carry every membership, last activity, signed-in devices, CLI tokens and lockout state; workspaces carry runs per day for the week, 30-day spend, pending invitations, language, retention and the last audited change. New per-person actions, each audited: list a person's devices and CLI tokens, sign them out of one device or all, and lift a sign-in lockout — `crewship admin user sessions|revoke-session|sign-out|unlock <email>`. `crewship admin list-users` gains LAST ACTIVE, SESSIONS and LOCKED columns and `--locked-only` works over HTTP; `crewship admin workspaces` gains RUNS 7D, SPEND 30D and LAST ACTIVITY.
- Admin › Overview opens at once and fills card by card; the journal chain check no longer holds the page. It leads with the build, edition and one row of health checks (database, engine, containers, host daemon, disk, journal) with an overall verdict, then capacity against the licence as bars, findings with their fix beside the week's runs, and Platform, Integrity, AI helpers and License cards. Every figure is one the server measures itself, so it reads the same on Linux, macOS and Windows.
- The app rail shows which Crewship this is at its foot: the ship, the edition and the build (the ship alone when collapsed, with the rest on hover). Admins can click through to the Admin overview.
- Disk capacity is now measured on Windows too; it used to report "not supported".
- Icon tiles lose their dotted texture; the tinted wash and hairline stay.
- Settings › Crew links and › Audit log open as their own pages (`/settings/crew-links`, `/settings/audit`) with a side panel of their own and a back arrow to Settings, instead of a third column; old `?tab=` links forward. Crew links reads as directions — who hands work to whom, and what each may do with the other's shared files (none, view, view and deliver) — in three views over the same data: By crew (the crew list in the side panel, Hands work to / Receives work from, each direction a sentence), All links (a searchable table) and Matrix (rows hand work to columns, hover highlights the row and column); any direction opens one editor. Crews that share a name show their slug. The Audit log's side panel picks the trail and time range; the table uses the full width. Both work on a phone (tabs and a crew picker).
- The nested pages' side panel works like the Routines sidebar: search, a Filter button with the active count, collapsible sections with counts, and a collapse toggle; on a phone it opens as a bottom sheet. The Audit log keeps every filter there: trail, time (presets plus a month calendar showing how busy each day was; click a day, Shift-click to extend), category (now including Runs), person and run result (completed, failed, cancelled, filtered on the server). Each value shows how many events picking it would show, and a two-week histogram over the table jumps to a day. Rows, sections and the histogram animate in, and stay still with reduced motion.
- Settings › General › Pages appearance has a Preview: a panel over the right half of the screen shows a sample Page application painted with the palette — the same variables the Pages SDK applies — and follows unsaved edits live; its palette strip edits the same draft, and nothing saves until Save. Form controls across the app share one text size (text-control, the size of the label beside them); the workspace name, slug and language pickers in General line up at one width.
- Settings → Audit log is searched and filtered on the server: search covers action, type and person across the whole trail (not just the loaded page); time range offers presets from the last hour to 90 days plus a custom from–to range with both days included; filter by person and type; active filters show as removable chips and live in the URL, so a reload or shared link opens the same view. Rows read as a table — time, person, event (a verb pill with the target), and an Access pill on events that change who can reach what. Trails that filter by time only no longer offer search or person. Export CSV follows the same filters and adds the target name.
- The web app adopts Harbor, the marketing site's design language, in a dark theme (the default) and a new light theme. Pick one, or System, from the profile menu, together with an accent colour (Blue, Indigo, Violet, Teal or Graphite); both choices are kept per browser. Selected rows in every side panel share one style, and a list row shows its severity once, in its status pill. The UI uses the platform system font with JetBrains Mono for labels, ids and status chips. Primary buttons, cards, inputs, status chips and concept icon tiles follow the Harbor shapes, and every theme's text, link, chip and button colours are held to WCAG AA by the theme contrast test.
- **Idle runtimes and unused cache images could only be reclaimed by hand.** Two opt-in settings, both off by default: `CREWSHIP_IDLE_RUNTIME_RETENTION_DAYS` removes this installation's stopped runtime containers of live crews after that many days stopped (volumes and host data stay, the next start recreates the runtime), and `CREWSHIP_CACHE_EVICTION` removes `crewship-cache:*` images no container on the daemon has used for an hour, never during a build and never forced; the next start rebuilds them.
- **Deleted crews could keep runtime containers running after Docker failures.** A periodic controller now stops and removes containers of positively deleted owners with matching installation labels (bound to both the database and the data directory, so servers sharing one data directory never act on each other's containers), retries after reconnect, and preserves volumes and mounted host data. Crew deletion returns a container cleanup observation; admin and local doctor diagnostics retain failures across restarts. Legacy and foreign containers remain untouched.
- **Crew deletion confirmation described the wrong data effects.** The UI and CLI now warn that runtime processes and container writable files are lost, while automatic cleanup preserves mounts; the existing explicit sidecar data deletion remains visible.

### Improved

- Restricted chat, CLI runs, routines and declared Page actions dispatch through explicitly installed isolated profiles with private contexts, frozen authority and current output checks. Unsupported adapters and unintegrated routes remain denied. (#2711)

- Isolated execution packages support typed text and native Codex workers, readonly immutable project snapshots, independent delegated provider slots and bounded private workflows. HTTP and startup activation remain gated until the application integration is installed. (#2711)

- ⚠️ **Behaviour change:** Legacy sidecar provider traffic is denied when an enabled hard budget cannot be attributed or reserved. Missing terminal usage retains a conservative debit; managed sidecars must be reconciled after upgrade. (#2711)

- Backup creation rejects crews and workspaces with standalone quota service volumes until their snapshot transport is available, preventing successful bundles that omit service data. (#2703)
- Restricted runtime preparation can pin an explicit agent provider-key grant before building context. Credential revocation, rotation and model changes invalidate prepared attempts and descendants; regrant cannot revive them. Production restricted dispatch remains gated. (#2711)
- The isolated runtime prototype can broker stateless text Responses requests with a server-selected model and output ceiling. Remote resource references and tools are denied; application model execution remains gated. (#2711)
- Workspace administrators can read and replace versioned member resource policies through the API and `workspace member access`. Stale edits return 409; explicit empty restricted grants deny all. Restricted execution remains unavailable on unintegrated routes. (#2711)
- Release archives, Linux packages and container images now include dependency license texts and attribution manifests, with artifact checks that verify the bundled files. Contributor documentation now separates maintained contracts and guides from historical working records. (#2718)
- Chat creators and workspace administrators can issue expiring, revocable read-only transcript tokens through `chat share` or the API. Recipients use `/shared-chat` without workspace membership; reads recheck issuer authority and exclude structured tools, reasoning, attachments and execution access. (#2703)
- Routines can check assigned TODO issues without an LLM call using `query: assigned_issues`; conditional runtime steps no longer prewarm an otherwise idle container. (#2703)
- Declared crew services can opt into persistent running/stopped intent from crew Settings or the CLI. A leased controller restores services independently of agent wakeups; missing credential references block startup, and explicit stops survive restart. (#2703)
- Crew links now expose directional shared-file permissions in Settings and `crew file-access`: deny, read, or read plus delivery. Existing links keep their permissions; new Settings links start with no file access. Version checks prevent stale access edits and stale UI link replacements. (#2703)
- Channel settings use an inline right panel with avatar pickers and one Members list. Creators can add/remove people from public channels without changing workspace-wide access; reading and muting no longer imply membership. The open Work/Artifacts rail matches its panel background. (#2699)
- Chat's right rail is two panels — Artifacts (⌘1) and Work (⌘2) — and the sidebar keeps shared conversations findable. Favorites pin agents, people and rooms into one section (browser-local, per workspace and user); search runs against names and session titles on the server, including sessions beyond the sidebar's loaded page; Filter carries the conversation category, agent session kind, crew and status. The Artifacts panel lists only client-facing outputs (PDF, images, sandboxed HTML, CSV/TSV preview; XLS/XLSX download), previews inline or expanded with a five-second Follow/Pause, and opens and saves through the file download and save routes instead of writing a directory listing over the file. Work names a conversation's exact issue or routine source: `GET …/agents/{id}/chats` gains `q`, `chat_id`, `routine_id` and `source=1` — the `source` object carries the routine/issue id, name, run and step — and new routine chats persist that association through the `chat_routine_provenance` migration rather than a title match. (#2699)
- Chat now uses the same subbar and collapsible navigation pattern as Issues and Routines. Its agent context opens live artifact previews beside the conversation and links to the agent's assigned issues and authored routines through Work. (#2698)
- The default demo seed is now four connected Harbor Goods business stories — Sales, Finance, Marketing and Shipping — plus Crewship Lab: 3 crews, 9 agents, 5 projects with one TODO Issue each bound to its check routine, 6 Pages and 15 routines, all running on local sample data with no third-party accounts. Page actions expose check, optional AI draft and resolution separately; human approval gates the local Sales, Finance and Shipping delivery, and a completed action leaves a local outbox receipt and moves its Issue to DONE. Crewship Lab keeps real workspace telemetry — live container CPU and memory per crew through a workspace-scoped sidecar read — plus a bounded live container monitor, and the chat-reply-inbox demo use case checks that a saved agent Chat reply appears in Inbox. `crewship seed verify` now verifies the business demo by default (`--complete-demo` also approves the local actions and checks completed Issues and outbox evidence); the legacy ci-watch/docs-drift packs are no longer installed and remain reachable only through `seed verify --pack`. (#2700)
- Demo seed can use a private Codex `auth.json` to configure the default agents and routines for a ChatGPT subscription login. `.env.example` now lists the seed settings; the existing Anthropic path remains available.
- Inbox now previews the first item without changing its unread state, keeps decisions and operational alerts in distinct list sections, and replaces the repeated overview cards with the selected item's detail. Its crew filter uses each crew's icon and colour, searchable names and slugs, and current-view counts; source-type filtering is tucked under Advanced. Dashboard decision counts now include human-input runs and exclude system advisories, matching the focused Inbox list. (#2696)
- Inbox now shows human decisions before older routine alerts, separates those groups in its overview, and gives the desktop list more room for request titles. Missed schedules use blue, paused schedules use red, and history stays neutral. Dashboard attention links now filter the main Inbox pane as well as the list. (#2696)
- Dashboard: Results & review now shows live agent and routine runs, issues in progress or awaiting review, and recent outcomes in a filterable scroll area. Attention highlights issues needing review and opens Inbox with the matching approvals, run alerts or schedule alerts filter already selected; the crew list scrolls through the whole fleet, Up next links to the routine calendar, and run-volume bars use crew colours. Routine type icons stay neutral, while Done is green, calendar alerts are blue, and the larger run-summary icons regain their coloured accents. The run summary cards share one layout. On desktop, the work and crew panels share one height and scroll independently with visible controls; smaller screens stack them. The sticky dashboard header keeps its title and a 24h/7d/30d selector in the product font; the redundant status panel, counts and header actions are gone. Host CPU/RAM gauges remain available through `/metrics` for Prometheus and Grafana without SQLite history writes. (#2696)
- CLI help now describes `plan` and `--plan` as prompt-guided planning; they do not disable the agent's configured tools. The CLI guide also notes that `--with-cmd` runs locally while collecting context.
- Pages can open an unsent agent chat draft. The Page reference is removable, and sending it rechecks both readers' live access before adding a bounded identity snapshot and durable provenance.
- Scheduled agent runs now enter the durable work queue alongside agent webhooks. Cron accepts a due occurrence and advances its cursor atomically; the shared dispatcher checks current permissions, serial capacity and cancellation before execution. Restart catches overdue occurrences, and the old direct cron executor is no longer in the production build. The release parallel profile remains disabled. (#2643)
- Chat links can open a new unsent draft with `?new=1&draft=1`; prefilled text no longer overwrites a person's existing composer draft. Existing `?prompt=` auto-send links retain their behavior.
- Routine and credential details now explain the caller's effective actions using server-calculated role, capability, workspace policy and scope gates. Run and secret reveal show conditional eligibility rather than promising that live preflight, fresh login and audit checks will pass. The same answers are available through `crewship routine access` and `crewship credential access`.
- Credential details now link to saved routines that declare the credential's type and show whether those routines would currently select it. Scope edits and deletion show known dependencies; the same view is available through `crewship credential dependents`. The view marks actual run use as unattributed and warns when a lookup fails. (#2674)
- Run again checks the previewed recipe hash and pins the verified version before execution; a changed HEAD returns 409 with a reload action. CLI routine run now accepts `--version` and `--expected-hash`. Reviewed starts skip mutable step overrides. (#2664)
- Routine run details now show the trigger, executed recipe version and declared credential types from that run's archived definition. They distinguish declarations from per-run use, which is not recorded, and do not present legacy invoking IDs as verified identities. (#2662)
- Routine and agent run details now offer a previewable, bounded evidence copy with run references and recorded activity; issue run rows show assignment IDs separately. New routine tool events carry their run ID for accurate correlation, while missing journal records are shown as unavailable evidence. (#2656)
- Routine and schedule catalogs now page through large workspaces without truncating results; schedule lists and the calendar resolve routine details in batches.
- Activity now includes the accepted work ledger and webhook deliveries. The separate Work navigation item is removed; existing `/work` bookmarks open the corresponding Activity view. (#2636)

### Fixed
- An off-site copy is no longer counted as verified on its size and the uploader's own `x-amz-meta-sha256` metadata, which a store holding different bytes would still repeat. Uploads now send `x-amz-checksum-sha256` for every object and part, the check compares the store's own SHA-256 checksum of the object (composite for multipart uploads) with the local bundle's, and a store that returns no checksum has the copy downloaded and re-hashed. Each copy records which proof was used (`verified_by`); `GET …/backups/destinations` returns `last_verified_by`, and Storage and the run's off-site phase say "verified by the provider's checksum" or "downloaded and re-hashed".
- Admin › Backups › Overview no longer draws a night whose backup came out incomplete as a green "backup created": `GET …/backups/overview` reports such a night as `incomplete` (with what is missing in its detail), and the strip shows it hatched in the warning colour with its own legend, "created · incomplete".
- Backup rotation can no longer remove the last copy known to be whole. A newer incomplete bundle that went through a test restore used to count as the plan's checked copy and push out the only older complete bundle whose test restore had succeeded. Per plan group, the newest complete bundle with a successful test restore and the newest complete bundle with checked contents are now always kept (with their off-site copies), and bundles that recorded gaps no longer fill the `keep_min` checked floor.
- A Complete recovery plan's whole-instance run now collects each crew's full file scope, `/var/lib` included, on every run: it used the standard scope, so on the days without an environment snapshot the bundle lacked the data of services an agent installed (redis, postgres…). The workspace and instance runs of one preset now choose the scope in one place.
- A Data retention confirmation writes exactly what its preview showed. The preview keeps its workspaces and changes as a snapshot; changing the selection or a value drops it (an answer for an earlier selection, A→B→A included, is ignored), and Apply sends that snapshot with the server's `preview_id` as `expect_preview`. Before, a preview made for one workspace could be applied to another after switching. `PUT /api/v1/admin/instance/retention/defaults` now returns `preview_id` and takes `expect_preview` too; a default changed since the preview is a `409` and nothing is written, in the console ("Something changed since the preview — review again") and in `crewship admin instance retention defaults set`.
- The Recovery wizard reaches the instructions for a whole-instance restore. Empty server and Isolated instance used to require a dry run against `POST /api/v1/admin/instance/backups/restore`, which does not exist, and ended on a 404; after Keys and Checks the wizard now shows the exact `crewship recover` or `crewship backup drill … --post` command for the picked bundle, with a Copy button.
- The per-workspace backup routes (`/api/v1/admin/backups*`) follow the instance-admin rules: an instance administrator creates, lists, verifies, downloads, rotates and restores any workspace's backups by naming it, without being a member; a workspace ADMIN still reaches only their own, and everything stays scoped to the workspace named. `metrics` needs no workspace and admits instance administrators rather than only the `CREWSHIP_OWNER_EMAIL` owner. The console names the workspace on every such call (the run's own, or the one ticked), and `crewship backup … --workspace <slug>` works for a workspace the caller is not in: the CLI no longer runs its member-only slug lookup when the request already carries a `workspace_id`.
- Backup and security docs no longer describe instance admins as "the owners of the oldest workspace while nobody is named"; that rule ran once, as a bootstrap, and never comes back.

- ⚠️ **Behaviour change: an oversized JSON body on crew and backup writes answers 413, not 400.** Creating or updating a crew (`POST /api/v1/crews`, `PATCH`/`PUT /api/v1/crews/{crewId}`, over 8 MiB) and writing a backup plan or the backup settings (`POST /api/v1/admin/instance/backups/plans`, `PUT /api/v1/admin/instance/backups/plans/{id}`, `PUT /api/v1/admin/instance/backups/settings`, over 1 MiB) now reply `413` with `"code": "body_too_large"`, so a client can tell "shrink it" from "fix the JSON". Requests declaring a body over the server-wide 16 MiB limit instead receive `413` Problem Details without this code. Invalid JSON within the limit still answers `400` with the same message.

- A server restored with `crewship recover` no longer re-runs the backup that was in flight on the source when the bundle was taken: runs left running in the snapshot are marked interrupted and not retried, and a held instance retries no interrupted run on its own.
- `crewship admin instance backups|retention|holds …` no longer ask for a selected workspace: the routes are instance-wide, so an instance admin who belongs to no workspace can use them.
- A backup no longer fails as a whole because of one crew or one file. When Docker refuses to copy a crew's section (a bind mount whose host directory is gone), that section is skipped, the crew's other files are kept and the bundle is marked incomplete (`crew_section_failed`); a file in an instance file store the server may not read (agent output owned by a container user) is skipped and named (`file_unreadable`). An unreachable daemon, a torn stream or a cancelled run still fail the backup.
- Backups keep their promises. A Complete recovery plan now rotates its instance bundles after every good run like a Workspace plan does — the keep_min floor and pins protect, and a removed bundle leaves the catalog, gives back the environment layers no other bundle needs and loses its off-site copies (rotation now removes the catalog row of every bundle it deletes, workspace plans included). A bundle whose environment layers live in the shared store is copied off-site with them: a refs object beside the bundle names its layers, each layer is uploaded once and skipped when the destination already holds it, retention deletes a remote layer only when no other remote bundle still names it, and a restore from off-site brings the bundle and its layers back onto a server that has neither. The whole-instance backup no longer stages its consistent copy in the clear: the database snapshot is held in memory and serialized straight into the sealed payload, every other staged file is encrypted with a per-run key that exists only in memory, and staging is wiped on success, failure and at boot; writes are held for less time than before (64 MiB of stores: 104 ms instead of 169 ms).
- Admin › Backups says what it does. Keys & alerts no longer promises Slack or email from the heartbeat row: alerts reach each instance admin's inbox, then their own notification channels (Settings › Notifications), and the card says exactly that (`backup_settings.channels` is stored for later and routes nothing). When the disk is too full for the next run — the default 10 % free-space floor refuses every run on a 95 %-full disk — the Overview's first Needs attention item says so with the figures and a link to Storage, the Space card says "New backup runs will not start", the skipped run's reason says what to do, and the overview API carries `space.min_free_percent` and `space.refusal`. `CREWSHIP_BACKUP_MIN_FREE_PERCENT` is documented in the backup guide.
- Admin › Security: "All workspaces" is its own choice in the panel — every workspace now and later — and ticking workspaces by hand picks just those, so a server with a single workspace still reaches that workspace's full editor (security contact, its own judge key, watch rules). The all-workspaces form links to each workspace's own editor. People & workspaces unlocks an account, and lists a person's sessions, for an instance admin who belongs to no workspace.
- A suspended account could still sign in through Google: the callback minted a session without checking the suspension. It now refuses, and the login page says only that it could not sign the person in.
- Removing a member from a workspace hands their pages to a crew in the same transaction as the removal, so a removal that fails (on the instance route, one whose audit entry cannot be written) leaves the pages with the person.
- Admin › Security: a saved preview is fingerprinted over every workspace's whole settings, so a watch rule rewritten to the same length since the preview is refused too; a preview asked for before the selection went away and came back is dropped; clicking "Load more" twice loads the next page once.
- Backup bundles now carry attached files. A workspace bundle held every `attachments` row and none of the files they name, so every restore landed attachments whose downloads failed. Bundles gain an `attachment-blobs/` section (additive, no format bump — an older server restores such a bundle as before); restore writes each file under the restored row's workspace (the new one on a `--as-workspace` fork), checks its SHA-256 and never overwrites a different file. A file missing at backup time is recorded in the manifest (`contents.attachments_included`, `attachments_missing`, and a new `contents.incomplete` list that also names missing memory blobs and missing crew containers), and the restore response reports attachments restored, already present, missing and in conflict.
- ⚠️ **Behaviour change:** Backup rotation never deletes the newest copies. A bundle used to be dropped when it was beyond `keep_last` **or** older than `keep_days`, so a workspace whose backups had stopped for longer than `keep_days` lost every copy at the next rotation. `keep_last` is now a floor age never touches (at least one bundle, even with `keep_days` alone), `keep_days` applies only beyond it, pinned bundles are never deleted, and crew bundles are counted separately from workspace bundles. The library gains a grandfather-father-son `RetentionPolicy` (newest per day / ISO week / month) for scheduled plans.
- Admin › Backups no longer says a bundle "cannot leak" a credential. Vault secrets stay sealed, but agent home folders ride along and can hold their own logins (`~/.aws`, `~/.ssh`, tool logins); the page says so and that this is why every bundle is encrypted. The retention card describes keep-last as a floor that age never touches.
- Instance administration writes every change and its audit entry in one transaction: when the audit entry cannot be written, granting or removing an instance admin, suspending, adding people, changing access and creating, handing over or deleting a workspace are undone and answer 500, instead of succeeding with no record.
- An instance admin who is only a MEMBER of their current workspace can edit the credential judge and decision rules, which the server already allowed; a workspace ADMIN who is not an instance admin sees them read-only, as the server treats them. An instance admin with no workspace at all can open People & workspaces and mint a token scoped to `instance:admin`.
- Admin › Security: a bulk edit belongs to the workspaces it was made for — ticking other workspaces drops it (and says so), a preview answering for an earlier selection is ignored, and confirming sends exactly the previewed request with its `preview_id`, which the server refuses (409) if a workspace or a value changed since. A late answer for an earlier selection no longer replaces the current activity. The overview says what could not be checked instead of a green "nothing stands out", and the audit histogram marks a read that failed part-way as incomplete. Activity filters and pages on the server over the whole history, with "Showing N of M". "What's on where" shows four-eyes as enforced (L4 required even with the toggle off) and whether a judge is the workspace's own or inherited. "All workspaces" also sets the defaults for new workspaces when the server has only one. Panel rows, matrix cells and settings controls grow to 44px under a touch pointer.
- A destructive confirmation (delete, revoke, overwrite) showed its confirm button in the primary blue: the red was passed as a class that lost to the default variant. It is the destructive variant now.
- Human chat context resolution rechecks the original authority immediately before loading agent configuration, in addition to admission and final delivery checks. (#2711)
- Keeper reviews that name no credential (skill, behavior, memory health, lessons) no longer vanish from the keeper request list: a NULL credential id failed the scan and the row was skipped, so the reviews panel read 0 while reviews existed.
- The judge's health card now asks within the workspace; without it the admin floor answered 400 and the card hid itself.
- CLI tokens now list their scopes: `GET /api/v1/auth/cli-tokens` returns `scopes` (omitted when unrestricted), Settings › Profile shows them, and `crewship token list` has a SCOPES column (`all` for a full-role token). A narrowed token used to look unrestricted on the screen meant for auditing access.
- Settings no longer shows a Manager a section they cannot read: Audit Log is Admin and up (the API always refused a Manager), and Access & Secrets says a Manager's role cannot see who holds reveal instead of claiming nobody does; a failed read says so rather than reporting an empty list.
- Deferred human chat messages preserve their original membership and conversation authority through provisioning. Revocation followed by rejoin or restored chat access cannot revive queued work; pending messages from different humans no longer overwrite each other. (#2711)
- Human chat sends and deferred provisioning resumes now recheck the authenticated sender before loading prompts or credentials. Removed membership or group participation denies resolution; crew tokens cannot assert a human identity. (#2711)
- **Open chat streams recheck access before each delivery.** WebSocket and HTTP run streams stop delivering when the current conversation authority denies access or cannot be checked. Resource grants and durable attempt authority add a server foundation for restricted clients; unintegrated execution, file, memory, and stream routes remain closed to that profile. Restricted client rollout is not yet enabled. (#2711)
- A member can no longer attach a new agent chat to another member's private conversation by supplying its session ID. The API rejects the attempt instead of reporting a newly created chat. (#2711)
- ⚠️ **Behaviour change:** New crew sidecar deliveries carry per-agent credential deadlines and refresh effective grants every minute. Removing one grant no longer relies on deleting the entire credential; after two minutes without fresh authority, new credential selections fail closed. Legacy crew-less payloads retain their previous behavior. Existing crew containers pick up the protocol on their next sidecar refresh/restart. (#2703)
- ⚠️ **Behaviour change:** Cross-crew file requests must identify the crew bound to their internal token, and delivery paths containing traversal are rejected before path joining. This prevents impersonating a sibling crew and overwriting files outside the delivery path. These checks do not isolate agents sharing a crew container. (#2703)
- **Forked restores no longer silently lose capability tokens, inbox items and message feedback.** A fork (`--as-workspace` / `--as-crew`) re-mints every capability token it carries — invitation links, port exposures, pipeline webhooks, page public links and page webhooks — together with its digest, so no secret that worked against the source works against the fork; invitations stay usable from the fork's member list and the other capabilities arrive revoked and are reported per table in the CLI, API, log and audit row. `inbox_items`' and `message_feedback`'s unique keys are now scoped per workspace, so forks keep their inbox and feedback rows instead of dropping them. (#2274)
- **A workspace export no longer fails when a crew container is stopped, and no longer resumes a container it did not pause.** Running containers are paused for collection and always resumed; already-paused ones are collected under their existing pause and left paused; stopped ones are collected without being started. A provisioned crew whose container is gone from the daemon is backed up DB-rows-only and named as such in the create response, manifest, CLI warning and audit row — an incomplete export no longer reads as a complete one. (#2612)
- **The dashboard's "Needs your attention" counts stopped at the inbox's 100-row window.** `GET /api/v1/inbox` now returns `active_by_kind`, an exact per-kind count of the caller's visible not-resolved items, and the dashboard counts from it rather than the windowed rows. An idle dashboard tab also no longer triggers a live provider (Docker) service listing per crew on every realtime burst. (#2187)
- **Durations over an hour rendered in minutes.** Dashboard and mission durations roll over to hours (`2h 5m`), `/issues?create=1` no longer reopens the composer on a plain reload, and colourless crews rotate the existing chart palette instead of all rendering the same grey. (#2187)
- **WCAG contrast regressions on the dashboard, crews, routines, credentials, settings, admin and chat surfaces.** The toolbar build-status badge, alpha-muted secondary text and brand-tinted count chips moved onto the contrast-safe tokens, and the axe wcag2a/wcag2aa scan is now part of the nightly gate instead of an unread drift report. (#1617)
- **A human-approved Keeper escalation now actually grants what was approved.** Resolving an escalation as ALLOW was a dead end: the agent had no route to learn the outcome and a retry was judged afresh, where the L4 tier floor re-escalated every read — an approved production credential could never execute. The agent can now poll `GET /keeper/request/{id}` on its sidecar (scoped to the acting agent) and present the approved request id on the retry (`approval_request_id` or `X-Keeper-Approval`). The approval binds to the same agent, credential, request type and — for `/execute` — the identical command, is single-use (races resolve to exactly one winner), expires after 15 minutes, and is spent before execution. Only a row resolved by a person is consumable, and the retry's own row is never spendable, so approvals cannot chain. (#2574)
- **The sampled behaviour watchdog no longer discards WARN and ESCALATE verdicts.** Every fired sample now writes the same keeper log row and inbox fan-out the synchronous review endpoint produces — WARN → non-blocking inbox item, ESCALATE → operator review (blocking in block mode at strict/guided autonomy), block-mode DENY → blocking inbox item plus the existing journal entry — following the workspace's governance configuration; ALLOW and full-autonomy verdicts stay journal telemetry. Previously only a block-mode DENY left a trace. (#2575)
- An L4 DENY now clears the default DENY-notify risk threshold: the tier's risk floor was 6 while unconfigured workspaces notify at 7, so a critical refusal never reached the inbox there — despite the comment claiming otherwise. (#2575)
- LLM proxy provider keys are now bound to a specific agent run. A finished run's token is refused before credential injection, including after a sidecar restart; old agent-only route tokens are refused. Drain active agent processes when deploying this protocol change. (#2643)
- Run evidence orders RFC3339Nano events correctly within the same millisecond. A Page chat reference stays available after a rejected or disconnected send and is consumed only when the message is saved; regenerating a Page message requests a fresh snapshot without copying the old one. Chat send sizing now counts the full WebSocket frame. (#2684)
- **`crewship work list --agent <slug>` showed no work for an agent that had work.** The CLI now resolves the slug to an ID before applying the server's ID filter, and reports an unknown slug instead of an empty page. Historical work remains filterable by its agent ID. (#2643)
- **Editing or re-enabling an agent schedule could run an old due occurrence.** Schedule settings and the next due cursor now commit together; disabling clears the cursor, enabling chooses a future occurrence, and invalid enabled cron expressions are refused before any write. (#2643)
- **A run could be acknowledged before its start record reached durable storage.** Internal run creation now commits `run.started` before allowing the agent to start; an unavailable durable journal fails closed. (#2643)
- Testing a stored OpenAI Codex subscription or legacy CLI auth blob no longer sends its OAuth credential to an API-key probe or reports the resulting 403 as an invalid login. The API, CLI and credential detail show that this login was not checked; metered provider logins retain their API-key probe. A controlled CLI run is still needed for a subscription login. (#2643)
- Routine credential lookup and `credentials_required` now honor every live crew grant in `credential_crews`, not only the legacy first `crew_id`. The availability check and actual injection share one selection rule; older single-crew credential updates keep the grants in sync. (#2676)
- **Routine reports show the failed step as failed when its final journal event is missing.** The persisted run outcome resolves a step left at “Running” in Markdown and HTML reports. (#2473)
- Pending guaranteed-memory writes are reconciled after database migration and before the server accepts requests. Recovery pins the configured storage root and rejects stale paths outside it; startup fails if an intent cannot be recovered, instead of admitting another writer over an unresolved file. (#2643)
- Agent webhook delivery receipts and raw payloads now receive their documented retention sweep on boot and daily. A non-terminal work item keeps its receipt and payload regardless of age. (#2643)
- **Confirmed webhook stops appear as cancelled in run history.** Captured usage survives settlement and journal-write retries; only the dispatcher’s confirmed outcome can finish a work-owned run. Retrying a history write never reruns the agent. Existing contradictory historical records are left intact for investigation. (#2652)
- Shared ingress byte limits include immutable input from non-webhook work, so scheduled prompts cannot bypass the workspace budget. (#2643)
- Scheduled fires stop when their occurrence identity cannot be read, instead of falling back to a new wall-clock dedup key that can bypass an existing reservation. (#2643)
- Scheduled agents do not execute after a failed run-record write. The occurrence reservation and due timestamp remain intact because a lost response does not prove the write failed. (#2643)
- Webhook settlement writes the terminal run record with a bounded context independent of execution cancellation. A stop proven to precede process creation records `CANCELLED` without an invented exit code, instead of leaving a `RUNNING` record behind an already-cancelled work item. (#2643)
- All `RunAgent` callers now share the current per-agent serial runtime limit, including chat and webhook runs with different sessions. Waiting for an agent does not consume server execution capacity, cancellation abandons the wait, and unconfirmed detached processes retain both reservations until confirmed stopped. This process-local fence does not replace durable producer admission or the chat mailbox. (#2643)
- ⚠️ **Behaviour change:** Synchronous peer queries return `409` when agent or server execution capacity is occupied, instead of waiting for a reservation that may be held by their waiting parent. (#2643)
- Cancelling a webhook before its process creation gate has opened no longer needs a provider probe after `RunAgent` returns. This preserves proof that no process was created, including while waiting for the same agent's active chat. (#2643)
- Normal routine approval waiting now displays its explanation as a waiting status instead of a red failure alert; actual failures retain their diagnostics. (#2650)
- Confirmed stops of detached agent processes now return a terminal failure instead of claiming the process is still running. Partial chat replies remain available; unconfirmed detached turns close their WebSocket stream without claiming execution completion. (#2626)
- Schedule-list indexes now cover the ID tie-breaker, avoiding temporary sorting for equal start times.
- Routine step details again offer Test with captured run data. Folded transforms and map selection reach the same testing surface; external steps still require explicit replacement outputs. (#2647)
- **Routines Run and Plan controls follow your actual permissions.** Explicit Run grants allow one-time starts even for viewers; creating repeating schedules uses its separate grant. Existing plans require an admin to change, and removing a one-time start requires a manager. Unavailable Run explains the missing permission. (#2645)
- **Unsaved routine edits survive declined reloads and navigation.** The active Edit dialog now reuses the existing navigation guard; loading a saved draft alone does not warn, and discarding local edits preserves that draft. (#2644)
- Routine Edit again exposes approval questions and named decision actions, including approvals in nested loops and hooks. Changes remain drafts until publication. (#2637)
- **Agents return to online after simultaneous detached-run completions.** The last-hold decision now retires completed peers atomically, so two finishing runs cannot both skip the final presence update. (#2626)
- Detached runs retain admission and capacity until confirmed stopped, including after the monitoring deadline. Waiting admissions recheck the fence; each already-admitted run retains its own hold. Confirmed termination revokes and cleans per-run credentials and ends the watcher. (#2626)
- Confirmed detached stops close the run record; partial chat replies reach the inbox, and routine steps retain observed token usage and cost after detachment. (#2626)
- A detached still-running exec is no longer reported as a successful run and a succeeded work item. When the agent CLI's stream ends while the process lives on, RunAgent now monitors `ExecInspect` until the exec really terminates (resolving the run with its true exit code) and, only if monitoring exceeds its budget or the context ends, returns a typed `ErrDetachedStillRunning` that leaves the run at `running`. A bounded stop runs inside RunAgent's ownership boundary; when the stop cannot be CONFIRMED, the run slot transfers to a per-agent detached hold that refuses new runs for that agent (`ErrAgentDetachedBusy`) and keeps capacity occupied until its watcher confirms the runtime gone — a stop attempt is not a stop confirmation. Terminal events (the exec.command end journal entry, the agent's return to `online`) are emitted only after a confirmed end, never while the process may be alive. The webhook wrapper no longer rewrites the sentinel into `COMPLETED`; the dispatcher holds the attempt (heartbeat, lease, capacity) and polls the runtime until it is confirmed gone, stopping it before settling into reconciliation on the probe-limit and watch-expiry paths. Scheduler, chat, pipeline and direct-run callers treat the sentinel as nonterminal instead of FAILED. (#2626)

- **Reassigning a previously removed provider key works without a manual runtime restart.** Sidecar reuse now checks live credential counts as well as the original configuration fingerprint.

- **Provider logins remain usable after the sidecar’s periodic credential check.** The metadata endpoint now includes explicitly granted provider logins and drops them when access is removed, without adding them to the global plaintext token pool.

- **Z.AI Coding Plan usage is marked as subscription usage.** API-key authentication no longer labels Coding Plan calls as metered or their zero per-call price as a precise monetary estimate.

- **Solo agents now report model usage and observe credential revocation.** Initialize sidecar IPC for non-lead agents with no peers, preserving scope-bound authentication.
- The published OpenAPI document now names the fields the issue and agent list rows actually carry: `client_review_required` (emitted on every issue row since the durable Lead review landed) plus the optional `assignee_slug`, `code_links` and `execution` projections, and the agents' `ask_forms` / `suggested_prompts` (nullable, always encoded). `issueResponse` and `agentResponse` are pinned in the schema-keys contract test so a struct field without schema coverage fails the generator gate again. (#2623)

### Security
- Complete container environments no longer keep their image layers in the clear. The layers — copies of a crew container's root filesystem — were stored unencrypted in the shared environment store and uploaded unencrypted off-site, beside bundles that were themselves encrypted. Every layer is now encrypted with a key derived from its store generation's key (chunked XChaCha20-Poly1305, deterministic so a layer shared by many bundles is still stored once, named by the digest of the encrypted object); the generation key is sealed with age to the backup's recipients beside the store and off-site, and carried inside each bundle's encrypted payload, so restore, land and drill need only the backup identity. Removing a recipient starts a new generation. Layers stored by an older version stay readable for restore but are refused for off-site upload.
- ⚠️ **Behaviour change:** New backups are always encrypted. `POST /api/v1/admin/backups` answers `no_encrypt: true` with 400 and `crewship backup create --no-encrypt` fails before contacting the server, both explaining that agent home folders inside a bundle can hold credentials the vault never sealed. Use a passphrase or `--recipient`. Existing plaintext bundles still restore.
- Instance-wide settings are no longer changeable by the ADMIN of any workspace. Log level, rate limits, re-encryption, legacy resource pruning, Keeper's judge and evaluator models, notification providers, instance settings and feature-flag definitions now require an **instance administrator**: `CREWSHIP_OWNER_EMAIL`, anyone named as one, or, while neither exists, the owners of the oldest workspace. A CLI token needs the new `instance:admin` scope (or none) to reach them.
- Private chat lists, history, ranked conversation search and session subscriptions use the same audience check. Workspace operators retain their existing transcript sharing authority; unattributed work chats require an operator role and known machine provenance, while unknown legacy provenance is withheld. A missing or inaccessible chat history returns the same 404 response. (#2711)
- ⚠️ **Behaviour change:** Replaying a routine now records and revalidates the current operator's authority, including bulk replay. A replay whose operator loses create permission before execution is rejected instead of starting without an attributable principal. (#2711)
- ⚠️ **Behaviour change:** HTTP routine steps with `credential_ref` now stop before sending a request if the credential cannot be resolved. Public calls should omit the reference. Required credential checks block on store errors (HTTP 503) instead of silently allowing dispatch; confirmed missing credentials still return 422. (#2639)
- A routine run's invoking crew and agent now come only from a verified identity. `POST …/pipelines/{slug}/run` (JWT / CLI token) no longer reads `X-Crewship-Invoking-Crew` / `-Agent` — any member could stamp a run, the "From" crew on its approval card and the autonomy posture consulted before a standing trust grant fires with a crew of their choosing; such runs are recorded as user-driven with `invoking_user_id` set. The sidecar's internal run route additionally verifies that `invoking_agent_id` is a live agent of the invoking crew and that the crew belongs to the run's workspace, whatever token presented them (a master or workspace-bound token could previously name a crew from another tenant). Before a trust grant fires, the routine's author crew posture is honoured regardless of who invoked the run: a strict author's gate always waits for a human. Provenance stored before this change remains as recorded and is not retroactively verified.

### Added
- Backup catalog and restore records for instance administrators. `backup_catalog` gains `kind`, `plan_id`, `pinned`, `proof_level` (1 checksum, 2 contents checked, 3 test restore), `proof_checked_at`, `drill_result`, `drill_at`, `drill_report`, `incomplete` and `run_id`; every restore and dry run is recorded in the new `restore_reports` table with its full report and an `ok` / `partial` / `failed` result, and the restore response carries `result` and `report_id`. New routes: `GET /api/v1/admin/instance/backups/bundles`, `POST /api/v1/admin/instance/backups/bundles/pin` and `/unpin` (instance-audited), `GET /api/v1/admin/instance/backups/restores`. CLI: `crewship admin instance backups bundles | pin | unpin | restores`.
- `GET`/`PUT /api/v1/admin/instance/keeper/governance`, `GET /api/v1/admin/instance/keeper/requests` and `GET /api/v1/admin/instance/keeper/health`: the Keeper of every workspace for instance administrators. The PUT takes one, several or all workspaces, previews with `dry_run`, writes all or nothing and audits each workspace it changes; for all it also sets the defaults a new workspace starts with. CLI: `crewship admin instance keeper governance | set | requests | health`.
- Instance administration across workspaces, in the API (`/api/v1/admin/instance/…`) and the CLI (`crewship admin instance …`): add a person with access to any workspaces and a setup link to pass on, give or take access and change roles anywhere (OWNER included), create a workspace owned by someone else, hand a workspace over, delete any workspace, suspend and reactivate accounts, reissue or void setup links, name and remove instance administrators, and read the instance audit. A suspended account cannot sign in, refresh or use a CLI token, and its sessions end at once. The instance audit has its own table, so the record of a deleted workspace survives it. `crewship admin instance add-admin --local` names an administrator from the database host when nobody can sign in.
- Admin › People & workspaces replaces the Workspaces and Users tabs with one nested page built like Settings › Crew links: a panel with search, People / Workspaces / Access views, groups of people (needs attention, setup pending, locked, suspended, no workspace, instance admins) and the workspaces. A person's page manages their access to every workspace, sign-in, sessions, instance-admin status, data and suspension; a workspace's page manages its members, pending setup links, ownership and deletion. The Access view is a people × workspaces grid where each role can be changed in place. Old `?tab=workspaces` and `?tab=users` links land there.
- Admin shows only for instance administrators; `GET /api/auth/session` says whether you are one (`is_instance_admin`).

- OpenAI gains GPT-5.6 Luna (fast tier) on both the general API list and the Codex CLI adapter; the Codex default stays GPT-5.5. (#2614, issue #2613)

- Credentials: connect OpenCode Go and OpenCode Zen with separate encrypted API-key accounts, existing access assignments, and OpenCode model selection. Gateway calls use the sidecar with native model protocols; setup explains Go subscription limits and optional Zen balance overage. (#2618)

- Credentials: connect a Z.AI GLM Coding Plan subscription with its own encrypted API-key account, sidecar route and `zai-coding-plan/` model selection on the OpenCode runner. The plan is kept separate from metered Z.AI credit — no shared payer, no fallback — and remaining quota is never inferred from token counts. (#2621)

- Command palette: pages are searchable by name or slug in a **Pages** group — each row wears the page's icon and colour, names its folder or owning crew, marks a published application, and opens `/pages/<slug>`; the list is the same authorised index the overview draws, fetched on open. **Recent** is now kept per user and per workspace, and a page row is offered only while that page is still in the list just returned. History stored under the old shared key is cleared once, not migrated. (#2570)

- **CLI:** the routines run-detail and scheduling surface the UI had and agents did not — `crewship routine calendar [--from --to]`, `routine executions <run_id> [--after | --execution-id]`, `routine artifacts <run_id> [--after | --artifact-id | --download --out]`; `routine run --fire-at <RFC3339>`, `--pinned-version <n>` and `--async` (`Prefer: respond-async`, understands the `202 IN_PROGRESS` receipt, `--wait` follows it); `routine save --trigger-inputs key=value` (the `trigger.inputs` block the `409 schedule_conflict` hint names, which the CLI now prints); and `routine fixture-test --remote` to drive `POST …/pipelines/fixture_test` instead of the in-process test. A `routine run` 404 about a missing archive (`--pinned-version`) is no longer rewritten into a did-you-mean hint for the slug that was typed. (#2577)
- **Routine inputs and recovery rules are visible before starting work.** Run and preset forms show accepted types and ranges, inline accessible errors and restoration of recipe defaults. Recipe and historical step details describe configured checks and failure handling; run details expose retained evidence and recorded duration/attempt diagnostics without treating partial history as complete.
- **Credentials: the rotation grace window is consumed.** After an upstream 401 to a rotated credential's new value, the crew sidecar replays the request once with the previous value — only that credential's, only while the rotation is ACTIVE and unexpired; ending the grace early reaches running sidecars on the next successful metadata poll (60-second cadence) — and records the fallback as a journal entry naming the rotation. (#1882)
- **Operator model: newly extracted facts retain their source evidence.** The quote, the message it was said in, the source type and the time are stored beside the 1.5 KB model file, not inside it; `crewship privacy user-model list --provenance` and `show <field>` render them, `GET /api/v1/users/me/user-model` returns a `provenance` object per fact, and every delete path (opt-out, delete, forget, Art. 17 erasure) purges them. (#1693, #1669)
- CI: a **Dependency drift** check on any PR touching `pnpm-lock.yaml`, `go.mod` or `go.sum` posts a table of resolved direct-dependency changes and fails when a version moved without its `package.json`/`go.mod` spec changing — the shape that let `@sentry/nextjs` 10.72 in unrequested; the `deps-drift-ok` label downgrades it to a warning. (#2237)
- e2e: the PR browser gate answers a real `run_needs_human` card and reads the `inbox_acted` receipt off the issue — a test-only seed door (`CREWSHIP_E2E_FIXTURES=1`, refused in production, absent from the API spec) replaces the route-mocked inbox step. (#2403)
- Incoming webhook configuration in Integrations for routines, agents and Page panels, with explicit outgoing notification labels. Routine webhooks can select a GitHub pull request signature profile with content-based replay protection.
- **Routines read as an operator console.** The routine page says in one line which version is published, whether a draft is waiting and which version Run will use; "In one look" answers what you get, what you provide, who does the work, what is checked, when it needs you and what it can touch. Steps are grouped into phases from their declared dependencies, helper transformations fold into one row, `foreach` blocks nest, hooks show around the run, and recipes with more than twelve steps open on the map with one node per group. A new "Files this routine runs" card lists the scripts a recipe declares as a tree under the crew share, with the Files panel's read-only code editor beside it, and says when a declared file is missing or could not be checked (`files[].status`). Runs that could not finish explain the stopping point in plain words (`failure` on the run), what was kept and what was not done, and what to do next; the raw error stays under Technical details. The Routines overview is built from the dashboard's own pieces — attention strip, outcome tiles, run outcomes per day, running now, up next — and the catalog stays in the sidebar; runs are read in Activity's Routines lens. Month cells in the calendar show a day's first two starts and open the Day view. Plan rows say whether a schedule follows the latest published version or is pinned (`effective_version`, `version_pinned`). Publishing a draft, editing inputs, agent prompts and limits, and creating a routine (describe it to the lead, copy one as a draft, or build it with the CLI) are popups on the routine page; a slug with only a draft opens as a routine page that publishes into the first version. The in-browser recipe editor is gone — steps, checks, scripts and agent behaviour are authored with the CLI or by the lead and arrive as drafts to publish.
- **Routines is one workspace: catalog, calendar and execution history (#2460).** The routines page keeps its searchable explorer and opens a routine on its definition, its historical runs (each with the exact recipe it executed, its retries, foreach items and immutable outputs) and its archived versions; a **Calendar** (Day / 3 days / Week / Month / Year) shows planned and past starts and schedules from a date or hour click. Three read routes back it: `GET /api/v1/workspaces/{workspaceId}/pipelines/calendar`, `GET …/pipeline-runs/{runId}/executions` and `GET …/pipeline-runs/{runId}/artifacts`. A routine save can now carry `trigger.kind: "once"` with an RFC 3339 `fire_at` beside `schedule` and `manual`, and prepared start-form answers (choice, text, number, boolean, structured) are declared on the recipe and validated on the server before enqueue.
- **CLI:** `crewship memory inventory --agent|--crew` lists the current knowledge documents the server reads for an agent or a crew, with per-scope states; `crewship crew peer-conversations --agent` reaches the route's `agent_id` filter; `crewship chat room` is documented per subcommand and, like both, proved by an acceptance test that drives the built binary against the real router. (#2579)
- **CLI:** `crewship page project panel-history <slug> <panel> --publication` reads a panel's payload ring through the published application (the last `/pages/*` route with no CLI), and `crewship workspace update --pages-theme <json|@file>` sets the shared Page colours that until now only the Settings card could; `workspace get` shows them. The `page project` family gains a flag table per subcommand, `page action --publication` is documented, and the api-reference bundle format is corrected to `crewship-page-bundle/v1`. (#2581)
- **CLI:** `run insights --agent/--crew` scope the fleet aggregate to one agent or crew, `issue list --counts` prints the per-status totals (`X-Status-Counts`, as `{issues, status_counts}` in machine formats), and `onboarding proposal create --crew-icon/--crew-color` set the proposal's look, with `crew_color` now present in its output; `journal --crew` accepts a display name as the help always said; `run insights`, `runs.mdx` and `cli/run.mdx` agree the aggregate is ad-hoc-only, and `websocket.mdx` documents `done` metadata, the sender-only `agent_busy` frame, `provision.event`, `workspace.deleted` and `page.action.dispatched` (now allowlisted). (#2589)
- **Docs gates:** `docs-inventory -strict` now fails an API path no `crewship` command builds (exemptions with a reason in `scripts/docs-inventory/cli-parity-exemptions.txt`) and a CLI flag documented only under another command's heading (baselined in `flag-section-baseline.txt`, ratchet-only); `docs-surface-check` fails a heading with an unescaped `{param}`, which MDX renders as nothing. The integrated CLI fixes also remove seven temporary parity exemptions, eighteen obsolete flag-baseline entries and two repaired-heading exemptions. (#2576)
- **CLI:** `routine webhooks create --ingress-profile crewship|github`, a PROFILE column on `webhooks list`, and `routine webhooks fire <url|token> --secret … --body …` — a signed test delivery to the public dispatch URL in either profile, with the receipt printed back; the docs for the agent trigger's durable-ledger response (`202 {delivery_id, work_id, status, duplicate}`, `200 ignored`, 409/413/429/503), the pipeline dispatch body and status set, `--hmac-secret`, the GitHub URL suffix and the Incoming webhooks tab are brought up to date. (#2580)

### Changed
- The whole Admin works for an instance administrator who belongs to no workspace. Admin routes let an instance admin name any live workspace, member or not, and the instance-wide reads (stats for the whole instance, health, log level, rate limits, posture, the Keeper judge and models, legacy resources, notification providers, Keeper status) answer with no workspace at all; a page about one workspace's data asks for one. Overview, Runtime, Notifications, Limits and Security load without a workspace instead of spinning forever; People opens a person's profile and picks one of their workspaces for personal data; an instance admin with no workspace lands in Admin instead of the first-run wizard; `crewship admin instance …` needs no workspace selected. `GET /system/runtime` gives an instance admin the full host detail.
- Instance administrators are always named. The rule "while nobody is named, the OWNERs of the oldest workspace are admins" switched itself back on whenever the last named admin went; it is now a one-time bootstrap that names exactly those owners the first time anyone asks (recorded as `instance.admin_bootstrapped`) and never runs again. The last active instance administrator cannot be removed or suspended (409), checked inside the change so two admins cannot remove each other at once. `crewship admin instance add-admin --local` stays the way back on the host. `instance_admin_source` no longer reports `oldest_workspace_owner`.
- The Keeper watchdog defaults are a template: a workspace copies them when it is created (signup, the workspaces API, the instance route) and keeps its copy, so changing the defaults changes no existing workspace. A migration gives every existing workspace without settings of its own a row holding exactly what it ran on, so nothing changes on upgrade. "Defaults for new workspaces" is an operation of its own — `GET`/`PUT /api/v1/admin/instance/keeper/governance/defaults`, `crewship admin instance keeper defaults`, and its own page in Admin › Security — with a preview, a confirmation bound to it, and an instance audit entry. "All workspaces" on a setting's page means every existing workspace and no longer touches the defaults; `defaults_updated` is gone from the bulk save's response. What's on where shows the template as its first row.

- ⚠️ **Behaviour change:** explicit routine input bounds now opt into server validation even without a widget; the optional `absolute_path` format validates path syntax across run producers. Legacy type-only inputs retain their existing server contract. Explicit positive `outcomes.max_iterations` now caps worker/checker model-tier attempts instead of being ignored; zero/omitted preserves configured fallback traversal.

### Fixed

- Restricted workflow dispatch retries failed initial recovery with bounded backoff instead of remaining stopped until a server restart.
- Production builds use bundled JetBrains Mono fonts, avoiding Google font query failures during static export.
- Sidecar: observe SSE usage per event so long streams retain their final token totals; bound individual events and omit billing observations when an oversized event makes usage incomplete. (#2621)
- OpenCode: report missing managed-provider grants before launching the CLI; restart the credential sidecar as its owning UID and reject failed stops instead of accepting stale credentials. (#2621)
- Sidecar: flush small SSE chunks immediately so OpenCode and other streaming model responses arrive before upstream completion; reduce temporary allocations when parsing SSE usage. (#2621)
- **Deleting a routine now deletes its schedules with it (#2573).** The delete used to tombstone only the pipeline row: its schedules stayed enabled, kept a `next_run_at`, appeared in the plans list and calendar with an empty routine column, and fired into a load-failure alert every tick until the circuit breaker tripped. The soft-delete now disables and soft-deletes the routine's schedules in the same transaction (a schedule's optional wake probe is untouched — its absence has its own fail-open/fail-closed semantics), and the schedules list hides rows orphaned before this fix rather than presenting them as live plans.
- Integration validation: issue updates reject an assignee type without an assignee (and `issue create` refuses `--assignee-type` without `--assignee` the same way), preserving owner/delegate identity; backup response schemas accept the nullable diagnostic lists the server actually emits. (#2615)
- CLI: `inbox show` no longer prints resolve guidance for an item already in the `resolved` state — `inbox resolve <id>` can leave `resolved_action` empty, which the old hint condition mistook for an unresolved row.
- **Routines docs:** the api-reference now states the `409 schedule_conflict` + `hint` envelope on save, import and rollback, the `400` preset / never-archived-pin / activate re-validation on plans, `trigger.kind: "once"` with `fire_at` and `trigger.inputs`, the run body's `fire_at` / `pinned_version`, the `Prefer: respond-async` `202 IN_PROGRESS` answer, `execution_mode` on step_run and the list row's `step_count` / `head_version` / `status` / `last_run_outcome`; the guide's resume, tier-map, Plan-view, receipt-window and recipe wording match HEAD, and the busy-agent known-limit names the three uncovered producers. The `trigger.kind` refusals now name `once`. (#2578)
- Legacy routine errors are redacted in both workspace and per-routine run lists, before preview truncation can split a credential.
- Live routine lists receive the start notification after the run row is stored, so an immediate refresh can see the new run.
- Routine recovery passes only the run ID to chat and clipboard. Failure summaries omit free-form checker and validation diagnostics; stored errors, event previews and historical run-detail errors redact known credential patterns.
- **Agentless routine runs settle `SUCCEEDED`, not `FAILED` (#2420).** A run with no agent step (an `agentless: true` probe, or steps that are only script / transform / notify / crewship) had nobody who could report an outcome, so every clean completion was recorded `FAILED · no outcome reported`, `routine logs` printed an error on the happy path and every `SUCCEEDED`-keyed consumer (`crewshipd_successful_runs_total`, the quiet-runs digest) read zero. A run that had an agent (or a `call_pipeline`) and reported nothing keeps the strict `FAILED`. The §12 violation metric also now sees notify-step inbox items keyed `<run_id>:<step_id>`.
- ⚠️ **An unclassified credential type is no longer injected into the agent environment (#2246).** With Keeper off, the legacy env path selected credentials by `IsKeeperGated` alone, and the fail-safe row for an unknown type (`Delivery: DeliveryNone`) passed that test — so its plaintext reached the agent env despite `DeliveryNone`'s promise; three more selectors (the OAuth-shaped-value match, the MCP env-ref loop, the adapter API-key allowlist) never consulted the policy at all. Every selector now asks `Delivery != DeliveryNone` through one helper. **Behaviour change:** a legacy credential row that relied on the old fallback-as-SECRET treatment is now withheld in both Keeper states; the server logs a `WARN` naming the credential and the missing `credpolicy` row.
- **The approval gate's queue row no longer carries the raw prompt (#2250).** `agent_run` gates put 500 unscrubbed characters of the user's message into `approvals_queue.payload` as `user_prompt`. The gate's `args` are now `{agent_slug, agent_role}` only, and a scrubbed, bounded preview lives in `payload.review` for the person deciding. Because `args` is also the reward-tuning fingerprint, two runs of the same agent no longer hash into different cohorts — gate auto-tuning can reach its quorum for `agent_run` for the first time. Old `gate_reward_history` rows keep their hash and are never looked up again.
- **Docs: the user guides describe the UI at HEAD (#2585).** Inbox (the 280 px explorer with Needs action / Updates / History, the triage pane, hire Deny), Chat & Sessions (`app/(dashboard)/chat`, the Files / Team drawer, people rooms, notification sounds, file previews), Bottom dock (crews only), Quickstart and First crew (Issues, crew tabs, workspace-wide agents, dashboard zones), Crew journal (`mission_id`, resources strip, saved-view shape), `crewship setup`/`skill create` default model from the catalog; `docs/changelog/overview.mdx` gains the September 6–15 window; the `docs/ux` plan and audits carry a Status 2026-09-15 block.
- **Issues CLI and docs:** `crewship issue create|update --assignee-type user` sets the human owner (email or user id), `issue review --revision/--brief-revision` pin #2448's compare-and-set, `stop --hard` reports what Tier 2 actually does; `--force` is documented on `update` (not `create`), and the docs gain the work/hand-off/Lead-review contract, the Get Issue work and execution fields, the routine Start path, the four Review 409s, sessions/checkpoints/context pack, leases, the `take_over` hold, the waitpoint decider rule and the last `COMPLETED` leftovers. (#2587)
- **Docs:** the credentials API reference documents the five provider-pool routes (`GET`/`POST /provider-logins/pools`, `GET`/`PUT`/`DELETE …/{poolId}`) with the ETag revision contract, the OWNER/ADMIN-only visibility of provider accounts, the reveal fresh-sign-in and default-password gates, the `PROVIDER_LOGIN` re-login on `PATCH`, and the `REQUESTED`/`PENDING_APPROVAL` statuses; the workspace capability tables list all ten capabilities with `credentials:reveal` in the admin preset and OWNER/ADMIN default; the four-eyes "unknown initiator" case is described as failing closed; "account groups" is tied to `crewship credential pool`. Binary-driven acceptance tests cover `credential pool *`, `escalation supply`, `credential refresh` and `credential list --kind`. (#2588)
- **CLI:** `crewship me` / `now` "Pending approvals" was always empty (the fetch decoded a `data` envelope the approvals API never sends); `inbox get` now passes `source_missing` through and says whether a waitpoint/escalation can be resolved here; `seed verify` honours `--format yaml|ndjson` and the CLI config `format` like every other command; `approvals get` prints the row's real `decision_comment` / `timeout_at`; docs for backup verify completeness, `inbox_item_reads` in GDPR export/erasure, the `-f json` contract on mutating commands, `queued_reason`, and the mission-start `403` autonomy gate (#2584)
- Test collector accounting failures by their actual exit code and diagnostic; distinguish subprocess timeouts from expected input rejection instead of accepting any killed process. (#2610)
- **OpenAPI:** the hand-declared schemas are now held to the handler structs by a two-way field-set test, and the drift it found is corrected — `Run` gains `kind`, `mission_id`, `mission_identifier`, `crew_slug`, `pipeline_slug` and a required list; backup verify/restore gain their completeness, migration and journal re-sign fields; `Workspace` and its update body gain `approvals_retention_days`; the crew-assignments row is the one the handler emits (with `queued_reason`); the agent-webhook trigger declares its 202/200 receipts, plain-text errors and 409/413/429/503; approvals rows carry `routine_version`; `q`/`limit`/`offset` on crews, agents, credentials and agent chats and `run_id` on the journal are declared; and statuses written through `writeProblem`/`replyError` literals and the internal-error helpers are inferred (266 operations gain their 500). (#2583)
- Pages docs: every management endpoint's status table carries the #2561 rule (an unreachable page answers 404, the 403 rows apply only to a caller who reaches it), the guide's reach rule names the owning-crew, folder-sharing and workspace-grant paths, a Custom applications section explains draft → build → review → publish → withdraw and who may publish, backups document the `page-projects/` section, export/import documents the v2 bundle, and "Studio" no longer names a surface the product does not have (#2582)
- **Docs:** the configuration reference lists every YAML key (`storage.page_*`, `orchestrator`, `memory_root`, sidecar paths) and the three sidecar-side env vars; `internal.mdx` catalogues all 72 registered internal IPC routes including `/pipelines/drafts/*`, `/workspace/overview`, `/issues/{id}/work`, `/issues/{id}/comments` and `/pages/project`; the sidecar verb tables carry `/work` and `/comments`; `services_json` redaction and its effect on `crewship export` / `apply` are documented; and operators get a cosign recipe for published Docker images and the `:nightly` / `:main-<sha>` channels (#2586)

- Routine failure summaries describe exhausted model tiers without presenting the configured iteration ceiling as an observed attempt count.
- **Routine Edit keeps combined changes in the draft.** Editing a name and inputs together no longer changes the published recipe before saving the draft. Unavailable draft baselines block saves visibly; input edits preserve identity already authored in the draft, and unverified script files are labelled consistently in Edit. Draft conflicts are recognized by HTTP 409 rather than English error wording. Name, purpose and appearance changes to an unpublished copy remain in its draft until explicit publication.
- Routine rule summaries explicitly mark checker outcomes on legacy non-agent steps as unenforced, matching the live runner.

- Keep daily-compaction, run-count and wake-scheduler test fixtures valid across clock boundaries, and avoid a false CI error annotation in route-parity diagnostics.
- Rotation grace reconciliation checks exact active rotation IDs, including overlapping rotations. Operator-model evidence is shown only when it matches the current value; the provenance user foreign key has its own index.
- **Credential isolation documentation now states the runtime boundary accurately.** Directory ownership permits the intended agent to read its secrets; it does not isolate processes sharing UID 1001. Authenticated RBAC and ten-workspace acceptance tests verify API authority, with filesystem and mount isolation requiring separate runtime evidence.

- **Keeper documentation matches the code.** `docs/guides/keeper.mdx`, `architecture.mdx` and four sibling pages no longer claim more containment than exists: Keeper is off by default, gates two sidecar routes for `SECRET` credentials only, replies with a decision (never a value), L4's human step is the default profile rather than a law (`--escalate-from`), the behaviour watchdog is sampled detection that cannot undo a call, and a ruled escalation does not run anything. Two product defects the audit surfaced are filed as #2574 and #2575. (#2242)
- OpenAPI: the 53 component schemas no operation referenced are removed (547 → 494) behind a reachability gate, and ten routes now reference the accurate schema that had been orphaned (`SkillDetail`, `HireResponse`, `AgentCredentialList`, `LabelList`, `CredentialPage`, `RunResult`, `BulkReplayResult`, `DryRunResult`); DELETE routes that read a body now document it. (#1849)
- The `@sentry/nextjs` test-load crash is fixed upstream in 10.74.0 (getsentry/sentry-javascript#23789); the ceiling had already left `pnpm.overrides`, and the `vitest.config.ts` alias's docs now say it stays on its own merits. (#2235)
- **GDPR:** the Art. 17 erasure now unnames the subject on every workspace-scoped table the schema sweep found (~40 columns): credentials the subject created pass to a custodian with a `REATTRIBUTED` audit event, their trust grants and pending invitations are revoked, history columns are anonymised, and their saved views, notification preferences and deliveries are removed — one receipt key per table on the audit row. Chats, membership, peer consent and the accountability tables stay excluded and are listed as such. (#2308)
- **CLI:** `-f yaml` emits the same keys as `-f json` for every command — all 3,058 json-tagged fields in `cmd/crewship` carry a mirroring yaml tag, five tests that asserted the old lowercased keys are corrected, and a source-level guard fails on any new field without one. (#2119, closes the #1211 remainder)
- Four class-triaged non-atomic writes (Apple `CopyToContainer` bind-mount, `prompt save`, `eval baseline save`, seeded memory files) now go through the durable write helper; every remaining allowlist entry names its function and reader, and the crash-safe guard also sees `os.Create` / `os.CreateTemp`, which it had never matched. (#2124)
- Backup: five `BackupTables` entries no table backs (`agent_runs`, `hooks`, `routines`, `schedules`, `webhooks`) are removed — each was a silent no-op on every restore — and a schema guard now checks the list in both directions. (#2274, partial)
- OpenAPI preserves the incoming webhook signature profile in the final create request and endpoint list schemas, so generated clients can configure and recognize GitHub endpoints.
- Approval or signal delivery arriving while a routine is parking waits for the original execution to release its slot before resuming, preventing a decided run from remaining stuck in waiting.

- **Routine signals support machine output.** `routine signal -f json` and YAML output now return the run ID, event type and delivery result instead of a human sentence.

- Incoming webhooks use the shared Integrations explorer, overview and endpoint detail on desktop and phones. Creation opens from Add integration, target links survive reload, and Refresh reloads endpoints and receipts. Agent catalogs report whether a signing key is configured without exposing it; paged catalogs are fully read before counting endpoints.
- **Manifest:** a standalone `Project` can name a workspace agent as lead, `Project.status` uses the API vocabulary (`backlog|planned|in_progress|paused|completed|cancelled`; a bad value is a 400 naming the field instead of a 500), re-applying a `Label` is idempotent, and `Issue.status` is honoured on create — `POST …/issues` and `crewship issue create --status` accept a starting status. (#2426)

- **Label, project, milestone and bulk issue updates honor machine output.** Their CLI commands now emit the updated record or update counts for JSON and YAML output instead of only a human receipt.

- **Provisioning:** a cache hit is confirmed against the Docker daemon before it is reported, a container start on a missing image invalidates the memoised image list, and a message deferred to a rebuild backs off and stops after three consecutive rebuilds with a clear error — `docker rmi crewship-cache:*` no longer triggers 80+ provisions a second and a dead chat. (#2431)
- An agent re-saving a routine without a description no longer erases the stored one: the sidecar IPC save and the `save_routine` tool are PATCH-like (omitted preserves, `""` clears), matching the CLI and UI path. (#2405)
- Script and code step environments (1,024 entries), script arguments (256) and per-item foreach inputs (1,024) are bounded before allocation; an over-cap step fails naming the field and the maximum. (#2456)
- Pages: the access report (`page access`, `GET /pages/access`, `GET /pages/{slug}/access`) renders the `folder:<slug>` path for crew subjects named in a folder's sharing, not only for their members. (#2543)
- Tests: `TestWatcher_DebounceCoalesce` asserts on the union of paths across events rather than an exact event count, so a debounce-window split under CI load no longer fails it (#2486); the inbox, deliveries and follow-up delivery-state assertions name the guards that make the state final, so a future failure reads as a regression rather than a load flake (#2407, #2437).
- Pages management and denied data writes return the same not-found response for hidden and missing pages; explicit folder edit grants now explain that they also apply to workspace Viewers.
- Routine results use the database's 30-second contention budget when recording a completed step, instead of failing after five seconds while waiting for a connection. This records the existing execution; it does not repeat the action.
- Routine editors compare closing, reload and navigation against the saved draft. Unsaved edits are protected during browser history and app navigation; closing returns keyboard focus to Edit.

### Added
- **The two daily memory sweeps can be run now.** `POST /api/v1/admin/memory/user-model-sync` and `…/peer-card-sync`, with `crewship admin memory sync user-model|peer-cards [--all] [--dry-run]`; `--dry-run` extracts and reports without writing. Until now the only way to see a sweep was to be awake at 05:00 UTC. (#1702)
- **Agents: a credential-readiness verdict computed by the runtime's own rules.** `GET /api/v1/agents/{agentId}/credential-readiness` and `crewship agent credential-readiness <agent>` report whether a credential the runtime actually delivers authenticates the agent's model (`ready` / `missing` / `unknown`), reusing the orchestrator's delivery classification instead of a second copy in the browser. The agent overview warns "No model credential" from that verdict; the previous zero-length guard, which never fired on a workspace with any binding, is gone. (#2183, #2169)
- **A page has its own icon and colour.** From the page's Edit screen (Content → Icon and colour) or `crewship page create|update --icon <name> --color <key>`, using the crew icon set and palette a crew and a folder already use; both are refused by name outside the set. The list on the left draws the icon in its colour on every row with the freshness glyph always beside it, so the STATUS filter reads the state and never the colour. Stored on the page row, not in its document: a re-applied document, a rollback and an export bundle all leave it alone. `GET /api/v1/pages` and `GET /api/v1/pages/{slug}` return `icon` and `color` (`""` for none); `POST` and `PATCH` accept them, an omitted field keeps the stored value and `""` clears it.
- **A tab bar on phones.** Dashboard, Inbox and Chat sit on the bottom edge, with More opening the full navigation. The three are not a taste call: Inbox is the only navigation row in the product carrying a live count, the chat PRD has a section calling the mobile chat "written and unreachable — the cheapest large improvement available", and the dashboard is built as the aggregator of every other surface's urgent items. Issues was left out deliberately until its list view is responsive; its board measures 1088px wide on a 390px screen, so a tab would promote the strongest desktop surface as the worst mobile one.
- **Back closes an open drawer** instead of navigating the page out from underneath it — the sharpest mobile-web defect left in the app, fixed once in the shared sheet rather than at each call site.
- **Installable on a phone.** A web app manifest gives "Add to Home Screen" its own icon and name and drops the browser chrome. No service worker: Crewship cannot work without its backend, so caching the shell buys a faster blank screen.
- A route-transition skeleton, so tapping a destination no longer shows nothing until the next screen's own skeleton appears.

- **Routine webhook receipts can be read, and they expire.** A routine delivery leaves a receipt — its identity, the body's fingerprint and the pipeline run it produced — and until now the only way to see one was to re-send the delivery. `GET /api/v1/workspaces/{workspaceId}/routine-webhook-receipts` (and `/{receiptId}`) plus `crewship routine webhooks receipts list|get` read them, fenced to the workspace and paged at 100; `run_status` comes from the real run and is null when no run record is available — the receipt is written before execution starts, so the absence carries no reason and none is invented. Each receipt now records when it was accepted and deduplicates redeliveries for 30 days from then; a daily sweeper removes expired receipts, after which the same identifier is new work again, as the contract promises. Receipts recorded before this change are dated from the upgrade and keep the full window from there.
- **Agent memory tools write through the host's guaranteed ledger.** `memory.write`, `memory.append_daily` and `memory.read` over MCP, and `POST /memory/write` / `GET /memory/read` over the sidecar's HTTP surface, now reach the host's revision-checked ledger whenever the agent runs under a per-run capability — one revision history per file (`agent:<slug>/<file>`) whichever surface wrote it, where the MCP tools used to keep a second, unchecked one inside the container. The run is taken from the capability the call authenticated with, not from the request (a body naming another run is refused), and the host derives the attempt's generation itself. The model gets the revision, content hash, operation and mutation identity back as a second text item on every tool result, so a conditional write no longer requires guessing. `memory.write` accepts `expected_revision` and `first_write` (the explicit "no revision exists yet" precondition that lets a file be replaced under the contract the first time); `memory.append_daily` accepts `operation_id`, `date` and `at`, so a retry writes the same entry once. A write whose host answer was lost is reported unknown and never resolved locally; a retry under the same operation id is answered with the original result.
- **One owner for durable dispatch, and work that survives a crash.** An accepted agent webhook is now recorded together with the work it produces in a single transaction, so a process that dies between the commit and its response leaves the work queued and the sender's resend finds the same work instead of creating a second. A delivery ledger records agent webhook deliveries — including the ones a filter ignored, so a decision nobody can look up afterwards stops being indistinguishable from a dropped request. Duplicates return the original receipt with the work's current state; the same identifier arriving with a different body is a conflict rather than a guess.
- **Every agent run has its own runtime identity.** Two runs of one agent shared a tmux session name and every path derived from it, so starting the second killed the first, and could hand it the first run's environment. Session, arguments, environment, script, FIFO, exit file and signal channel are all per-run now, and cancel and terminal attach target a run rather than an agent.
- **A memory mutation contract.** `replace` had no expected revision, so a passage deleted between an agent's read and its write came back, and one nobody meant to touch disappeared. Supported writes now go through one path with declared removals, idempotent retries and crash recovery. The guarantee is a stated profile: a write that cannot be revision-checked is refused rather than performed and labelled.
- **GitHub and Standard Webhooks signature verification**, with GitHub's replay gap closed — it signs the body and not the delivery identifier, so identical verified bytes are treated as one delivery whatever identifier they arrive under.
- Webhook retention and ingress limits: a payload is kept while its work is unfinished however old it is, a duplicate of already-accepted work is admitted however full the queue is, and an expired payload is distinguishable from one that never existed so the interface can explain why a replay is unavailable.

- **A webhook now runs through the ledger from end to end, and a restart cannot run it twice.** A dispatcher declares the work types it can execute as (producer, domain) pairs and claims nothing else — `webhook` alone is not a work type, because the producer alone does not identify its execution engine, and a dispatcher that took the wrong one would not merely fail it but consume it. A dispatcher that declares nothing refuses to start. The server starts one dispatcher that owns execution: a delivery is claimed, its attempt records where its runtime will be before creating it, and the run is confirmed by asking the provider whether the process exists rather than by waiting for output — so an agent that starts and thinks silently is recorded as running instead of as never started. A cancel before anything started prevents the run; a cancel during one stops that run's own runtime, and a stop that does not take is reported as needing attention rather than as a cancellation nobody performed. A permission removed while work waited for capacity refuses it at dispatch. If the server is killed after a runtime exists and before it was confirmed, the restart finds the surviving process at the identity that was written down and leaves the work for reconciliation instead of starting a second one.
- **Work held on a person waits for that person.** An agent staged for review is neither allowed nor refused, so a delivery naming one is returned to the queue with its retry budget intact rather than being failed — an approval that arrives ten minutes later now finds work still waiting for it, instead of work that gave up. A cancel that arrives while the work is held is honoured at once rather than discarded with the attempt it was recorded on.

### Changed

- Tests are type-checked with no baseline: 183 diagnostics across 62 test files are fixed (harnesses missing required props, fixtures off the wire shape, untyped mocks; one product type, `TraceStep.if`, was missing) and `pnpm test:types` now fails on any error. (#2493)
- `internal/database` tests migrate once per test binary and copy a read-only template, so the suite no longer scales with the migration count — the migration tests alone went from a 10-minute timeout to 2½ minutes on the dev box. (#2551)
- **The database now commits with `synchronous=FULL`.** Work we have answered `202` for has to survive a power cut, and the previous setting only promised to survive a process crash. Measured cost is about 21 ms of fsync per acceptance commit, against a 500 ms budget.

### Fixed

- Agent stop now waits for runtime confirmation instead of merely changing the displayed status; direct agent execs have an isolated, stoppable process identity. A SIGTERM from an explicit agent stop is recorded as cancelled, preserving STOPPED instead of a later false ERROR; successful late completion and unrelated failures retain their outcomes.
- Pages folder Sharing now reports an unknown sharing state when refreshing the folder list fails, and restores the current audience after recovery.
- **Motion respects the system's reduced-motion setting.** Every Radix overlay — sheet, dialog, dropdown, select, popover, tooltip — animates through utilities that carried their own keyframes and so ignored the preference entirely. The pipeline graph's edge animations, the only continuous ones in the app, now stop as well.
- **The navigation drawer opens in 240ms rather than 500ms**, which was the slowest transition in the app on the gesture a phone repeats most. The two hand-copied drawer springs are now the shared one, and their backdrops fade with the panel instead of settling at their own rate.
- The crew bottom dock's tab strip fits the screen and scrolls; its scroll container had never activated because the row would not shrink below its contents. Its height is also capped to the viewport, so a tall panel chosen on a desktop no longer arrives on a phone taller than the screen with the canvas collapsed to nothing.
- Page content returns to the top on a route change. Content scrolls inside a container rather than the document, so the browser had nothing to reset and a new screen opened already scrolled down the last one.
- Log type chips scroll on one row on a phone instead of wrapping onto three.
- **Focusing a search field no longer breaks the page on iOS.** Anything you type into now renders at least 16px on a touch device. Below that iOS zooms the whole page on focus and does not zoom back out, so the page returns magnified and scrolled sideways — reported on Settings, where focusing the section search did exactly that. This is a floor, not a size: anything already larger is untouched.
- **Chat's search, export and command palette exist on a phone.** All three were mounted in the desktop branch only — not degraded there, absent — and the palette's other way in is a keyboard shortcut a phone has no way to press.
- **The drag handle on a bottom sheet drags.** It was a decorative bar advertising a gesture that existed nowhere in the codebase; dragging it down past a third of the sheet now dismisses, through the same guarded path as the close button, so a surface with unsaved work still asks.
- **Five tables no longer clip their columns on a phone.** Each sat inside a rounded wrapper whose `overflow-hidden` cut off everything past the fold, or had no horizontal escape at all — the columns were not hard to reach, they were gone.
- **The PR gate runs at a phone width.** No check in it did before, which is how a navigation missing seven destinations, a console with no mobile layout and a page-zooming search field all shipped green. It asserts no sideways scroll, the tab bar and its destinations, that More offers every rail destination, that back closes the sheet in place, and that nothing you can type into renders under 16px.
- **Explorer drawers open full height on a phone.** They were pinned inside the content column, so a modal drawer opened below the page's own toolbar and left that row lit up behind it, costing 77px of a 664px screen.

- **A cancel before the agent process exists is confirmed by protocol, and an unconfirmed process is never called stopped.** The webhook runtime learned where its agent was only at launch, so a cancel during a cold crew-container start could not be answered and work that had never reached an agent was parked for reconciliation — or, worse, a container start that completed afterwards launched the agent behind a confirmed cancellation. The orchestrator now asks a creation gate synchronously immediately before it creates the agent's exec, with nothing external between the answer and the creation. A stop recorded before that moment refuses the creation, so "stopped" is a fact rather than a probe result: a user cancel ends `cancelled`, a shutdown ends `retry_wait`, and the container start, the run record and the launch all refuse behind it. A creation the gate admits is recorded durably on the attempt (runtime phase `requested`) before it happens, and a write that fails refuses the creation. From then on nothing observed at the location proves the process did not run: an absent probe while the creation is in flight settles nothing, and a requested process that is gone without ever having been confirmed is an unknown outcome that stays in reconciliation — whatever the journal did with its telemetry, which is queued and never consulted for this decision. A run that completes before a late cancel is delivered is recorded `succeeded`, not `cancelled`. A stop after the agent is confirmed goes to the provider's probe as before, and a stop that does not take is still reconciliation.
- **A routine webhook redelivery is answered with its receipt even while the endpoint is throttled.** The per-token rate gate ran before the receipt lookup, so a sender retrying a delivery Crewship had already accepted was told `429 rate limit exceeded` about work that was sitting in the ledger — and a sender that believed that gave up on an event we already held. The lookup now runs right after signature verification and before every capacity check: a duplicate returns the original `run_id`, the same identifier with a different body is `409 delivery_conflict`, and an unreadable ledger is `503`, throttled or not. New deliveries are still refused when the limit is exhausted.
- Host memory mutations require a run capability matching the acting workspace, agent and requested run; a token for another live run of the same agent can no longer authorize the write.

- Graceful dispatcher shutdown no longer invents a user cancellation. Each supervisor settles its own attempt; ambiguous interrupted work remains available for operator reconciliation.
- `crewship work resolve` and its workspace API let an operator record an investigated outcome with a generation fence, reason, and explicit runtime-stop attestation, releasing reconciliation capacity.
- Agent webhook throttling preserves payload-conflict and database-unavailable responses. Queue item and byte limits are checked inside acceptance, independently of execution capacity.
- Routine webhook receipts no longer create phantom queued work or advertise ineffective work-item cancellation; their pipeline engine remains the execution owner.
- Agent webhook cancellation retains launch identity through HOME cleanup so production runtime probes can verify the stop.

- Dispatcher shutdown records reconciliation even when stopping a runtime exhausts its deadline, and cancels local supervision after recording the outcome. An unconfirmed external stop remains reconciliation.

- Host memory mutation and canonical-read routes refuse symlinked directories and keep file operations anchored to the opened parent, including locks and inline crash recovery. Replacing a memory directory during a request can no longer redirect host reads or writes outside it.
- Memory MCP writes now honor the runtime requirement for guaranteed memory. Until the host ledger bridge is available, both write tools return an error instead of silently writing through the legacy path.
- **`crewship work get -f yaml` no longer panics**, and the work commands print the same keys in YAML as in JSON. The detail payload embedded an unexported type, which yaml.v3 cannot reflect into, and the field names were being lowercased rather than read from their json tags — so a script written against one machine format silently disagreed with the other.
### Security

- **Legacy Page panel updates and rollback could overwrite panels the caller could not read.** Both current and target declarations now require visibility, concurrent definition changes return 409, and metadata replies retain sealed placeholders. Project check no longer names routines called only by hidden panels (#2502).

- **Page draft, archived definition and export reads could reveal panels hidden from the caller.** Whole-document authoring now requires visibility of every panel, including for agent project reads. Partial readers review source through separate endpoints that omit the definition; saves cannot silently remove withheld panels. ⚠️ **Behaviour change:** a Page write grant alone no longer permits these complete-document reads or replacements (#2502).

### Fixed

- **Agent turn-limit failures could appear only as a generic process exit.** Structured terminal failures now retain their original cause even with a nonzero exit, and the execution journal preserves the subtype and turn count when the raw output exceeds its capture limit (#2544).
- **`dev.sh status` now says when a workstation serves old code.** A `STALE:` line names the HEAD `web/out/` was built from when the repo has moved past it, or a running binary older than HEAD's commit, with the reload command to run — two dev slots were serving day-old frontends while looking healthy. `.env.local` also stopped gaining another `CREWSHIP_ALLOWED_ORIGINS` line and banner on every start (clone 3 had over a hundred).

- **Pages history hid source revisions before the first publication and offered live restore to partial readers.** Draft history is now reachable, restore respects document authority, and baseline conflicts retain their kind.

- **Routines rollback and re-enabling a plan now reject incompatible presets.** Rollback leaves HEAD unchanged on conflict; schedule writes and draft activation validate within their transaction, including wake inputs, and an expired run deadline stays failed in both the run and journal. Publish requires a change review and confirmation; live plans and budgets are managed outside the draft editor. Run discloses possible effects and schedule times name their zone (#2473).

- **Closing the Pages editor on an empty Page could leave keyboard focus on the document body.** Empty Pages now keep the same focusable heading as populated Pages.
- **Form boundaries and the Pages Filter label were hard to distinguish.** Shared controls now use a separate contrast token; CSS and application motion honor reduced-motion preferences, including loading spinners (#2499).

### Changed

- **The Pages editor is laid out like the rest of Crewship.** Edit no longer opens a rail of four sections beside a centred form — it opens the same shape as an issue: a header card with the Page's name, its folder and owner, and its state as pills; the dates and address in a strip behind a disclosure; then Content, Data & actions and History as cards in the main column with Properties and Access beside them. Every card is the shared detail card with an uppercase title band, panel states are pills, and the "General" table that printed the owner as a raw user id is gone. `?section=` in the address still scrolls to and focuses that card, and in-editor links ("Manage producer access", "Data & actions") still land on it. The Pages rail on the left stays where it was.

- **Routines is one list, a three-answer routine, a one-sentence run and a full-page editor** (#2519) — `/routines` showed a routine as seven cards, a Run tab next to the Run button, and an editor in a modal with the steps below the fold. Beside the explorer sidebar, the page now opens on one dense list whose row says what the routine does, how it went last time and how it runs, with a waiting decision as a banner first; a routine opens on What it does · Last time · Before you run, with the status chrome, metadata and access folded into one Technical details; the tabs read Overview / History / Plan / Versions and the run is an item of History; a run leads with its verdict and, when it failed, what to do next, with activity and attempts in one disclosure; Edit opens the recipe as a page (`?view=edit`) with the document in reading order and nothing live until Publish is confirmed. The Health tab is gone; the explorer sidebar stays, and the main panel no longer repeats its search and filters.

- **The dashboard fits one screen** (#2539) — it needed two: a hero heading that repeated the sub-bar, results as 90 px cards with an avatar and three lines each, three crew cards with sparklines, four KPI tiles mostly showing a dash, and a 220 px chart. Every tile keeps its facts in less height: Results & review are one-line rows (id, state, title, who and when, action); Your crews are rows in the column beside them; the agent run summary is one strip of four numbers; the run-volume chart is shorter; cards use 12 px padding and 12 px gaps. Nothing was removed except the heading, which the sub-bar already said.

- **The Pages list is grouped by owner.** The rail folds into Mine, the crews you belong to, the other crews and Owned by others, each with its count in the header and the owner named there once rather than on every row. Groups collapse and remember it per user and workspace; a search opens every group that matches and hides the rest until it is cleared; opening a page unfolds its group; and the arrow keys walk the rows, with Left and Right folding and unfolding. When the server reports how you reach each page, the filter gains a Shared with me switch (#2523).

- **Edit takes over the whole Page.** Pressing Edit now slides the editor in over the page instead of adding a row of tabs under its header: the sections sit in a rail on the left with one line under each name, the open section fills the rest, and the header names the way back and what viewers see meanwhile. The Pages list stays where it was, scroll and filters included, and returns on Back to page. The "Stop application / show panels" bar under an application Page is gone; the header carries an **Application | Panels** switch instead, shown only while an application is on screen — Panels closes the application in this tab and stops nothing for anyone else (#2515).

- **Frontend test fixtures now have a blocking type-check gate.** Existing diagnostic debt is recorded explicitly; new errors cannot silently enter while Vitest transpiles the tests (#2493).

### Added

- **Folders can be shared, and what a folder is shared with applies to every page in it.** A folder's permissions name a user, a crew, or everyone in the workspace as *can view* or *can edit* (edit implies view), and they apply continuously to whatever is in the folder right now: filing a page in a shared folder shares it, taking it out unshares it, and a page's own grants add to that but never take from it. *Can edit* renames the folder, edits the pages inside (subject to the same whole-document check as a page write grant), and takes pages out of the folder; it never moves a page elsewhere, deletes the folder, changes the sharing, or opens a panel owned by another crew. An entry belongs to the folder and outlives whoever set it. Only the owning crew's managers and workspace admins read or change a folder's ACL (`GET`/`PUT`/`DELETE /api/v1/page-folders/{slug}/acl`, `crewship page folder acl|share|unshare`; in the app, **Sharing…** on the folder's header menu opens the table, with the owning crew's managers as its fixed first row and **Everyone in this workspace** off until turned on); everyone else sees a `shared` label (`none`, `people`, `crews`, `people_and_crews`, `workspace`) on the folder — a globe in the rail when it is the whole workspace — and their own paths (`GET /api/v1/pages/{slug}/access/me`, `crewship page access <slug> --me`, the read-only **From folder** card in the editor's Access section). The page list's `reach` gains `folder:<slug>`. A move is fenced on the folder's `acl_version` (renamed from `grants_version`); the move dialog shows **After the move** — with names for the target's managers, in general for everyone else — and after a 409 re-reads the sharing and redraws it rather than retrying; several pages move in one all-or-nothing request that names the page a refusal is about (`POST …/pages:batch`, `crewship page move a b c --folder`, **Select** in the rail). A page grant accepts `subject_type: "workspace"` for read and write, never produce (`crewship page grant --workspace`). ACL changes are journalled as `page.folder_acl_changed` (#2533).

- **Pages can be grouped into crew-owned folders.** A folder has a name, an icon from the crew icon set and a colour from the crew palette; a page sits in at most one, and pages outside any folder are unfiled. Every page row and page document carries `folder` and `pages_version`, and the folder API (`crewship page folder list|create|show|update|delete|add|remove`, `crewship page move`) files and unfiles pages behind two version fences, refusing a stale one with 409 and the current pair. In the app the Pages list groups by folder — every folder you may read, empty ones included, with the count of its pages you can open, then Unfiled — with **Group by: Folder | Owner** in the filter panel; each row's ⋯ menu (hover, focus, Shift+F10) offers **Move to folder…** and **Remove from folder**, the editor's Properties card shows the folder with **Change…**, and New folder, Rename / icon and Delete live on the rail. A move sends both versions and, when either moved meanwhile, the dialog re-reads and asks again rather than retrying; every refusal is shown where the action was, in the server's words. Filing a page changes nobody's access; folder reads show each caller only the pages they already reach, and a folder is deleted only when empty. Folder changes are journalled (`page.folder_changed`, `page.folder_membership_changed`) (#2527).

- **A Page now says who reaches it, and how.** The page's access endpoint lists every user, crew and agent that reaches it with the paths that carry them — `owner`, `role`, `crew:<slug>`, `panel_crew:<slug>`, `grant:page:<level>` — and a subject endpoint answers the reverse question for one user, crew or agent. Both are read-only renderings of today's model: no new grant is defined. A crew the caller cannot see is never named — its paths collapse into one anonymous `panel_crew:withheld` row — and the cost is a fixed number of database statements whatever the workspace's size. `crewship page access <slug>` and `crewship page access --subject user:<id>` print them, and the editor's Access section gains a read-only "Effective access" card. Because the subject endpoint lives at `/pages/access`, `access` is now a reserved page slug: a document naming it is refused on create, import and update rather than creating a page nothing could read (#2528).

- `page project get --source-only`, also with `--revision`, reads shared source without requesting the full panel declaration.

- **The Pages list says how you reach each page.** Every row now carries `reach` — `owner`, `role`, `crew:<slug>`, `panel_crew:<slug>`, `grant` — so a client can group pages by ownership or show the ones shared with you, and `crewship page list` prints it as a `REACH` column. It describes you and nobody else. Listing a workspace now runs a fixed number of database statements whatever its page count (#2524).

- **One editor for a Page, and a screen for reviewing what an agent changed** (#2491) — the Pages toolbar carried five separate doors into one job: Settings, Edit, App preview, Source history and Publications, side by side, three of them behind the same icon. None of them was where the work happens, and for a Page with a custom application the actual work — deciding whether an agent's change goes live — had no screen at all. `Edit` now opens a routed editor in the page's content column with four named sections (Content / Data & actions / Access / History) and the Pages list still beside it; the address carries the section, so reload, Back, Forward and a shared link all land where they should. A Page whose application has a candidate newer than its live publication opens on a review of that change: definition changes derived by comparing the two documents (never a summary the agent wrote), a per-file source diff, a warning naming any routine whose definition moved since the last publication, the candidate's build state, and a consent that is bound to one candidate and one set of baselines and resets, visibly and with a reason, when any of them changes. An ordinary panel Page is a complete case rather than the same screen with features switched off: no empty application headings and no Publish that can never be pressed.

### Changed

- ⚠️ **Behaviour change: publishing a Page application now has to say what was reviewed.** `POST /api/v1/pages/{slug}/project/publish` requires `expected_definition_digest` and `expected_routine_digests`, and refuses with `409` and a named `conflict` when the live definition or a routine moved after the review. The three existing compare-and-swap points only fenced the publication counter, the draft revision, and a definition read moments earlier in the same request — none of them could tell that the baseline a person actually read had changed underneath them, so a panel restored by someone else during a review published silently. Publishing while the retained source behind the live publication cannot be read now takes `acknowledged_unavailable_baseline`, refuses with `409` and `conflict: "baseline"` without it, and records on the publication's receipt which of `verified` / `unavailable_acknowledged` / `initial_publication` it was — compaction legitimately reclaims old checkpoints, so the answer is a statement somebody makes and that is written down, not a block that can strand a workspace. `GET /api/v1/pages/{slug}/project/review` returns the snapshot those values come from — and with `?publication=N` it answers the same question for restoring a retained version, whose routines are the ones *that* version declares rather than the current draft's — and `crewship page project review` prints it; `crewship page project publish` and `rollback` fetch it themselves when the flags are omitted and print what they are attesting to.
- **A Page carrying a panel you may not see no longer hides four controls.** Edit, App preview, Source history and Publications shared one gate that went false on a single sealed panel, and the server would have answered three of them. Only replacing the whole document is refused now, with the reason stated beside the control; name, description, access and history stay reachable.
- **Producer tokens moved to Access, and say what they are.** Minting a webhook token is issuing a credential, so it sits with grants and public links rather than beside a panel's data. The list says a token is bound to one panel, that it carries no authority of its own — the server re-derives the issuer's current rights on every write — and reads `Not revoked` rather than a green `Working`, because that column knows only that nobody revoked it.
- **A Page says whether it has application source, not only whether it has published it.** The page object gains `has_project` beside `has_application`, and the project history entry gains `actor_kind`. The first is why a first publication could not be reviewed: `has_application` is "a publication exists", so a Page whose application had only ever been a draft reported no application at all and the editor showed it none of the candidate. The second is because the history list flattened a user id and an agent id into one opaque string with no way to tell which it was.
- **Republishing after withdrawing an application works.** A draft identical to a withdrawn publication was reported as already live, so the review offered no candidate and the recovery path was refused.
- **The review screen can only attest to what it showed you.** Its comparison came from the Page detail query while the publication attested to the review endpoint's digest, so while another author's change was propagating a person could approve a comparison against one definition and sign for another. Both documents now come from one authorized read on the review endpoint, and a change to either clears the consent. Consent is also unavailable until every piece of evidence has arrived — the candidate's source pending or failed used to leave the diff on "Reading…" while Publish stayed live — and panels you may not read are withheld from both sides of the comparison, with the screen saying it is partial.
- **Leaving the editor by any link asks about unsaved work.** Only the workspace switcher consulted the guard; the sidebar, the toolbar and the phone menu are ordinary links, so leaving for Routines dropped a half-typed form without a word.
- **History names three restores instead of one.** Restoring a panel version writes the live definition, restoring application source creates a draft and changes nothing live, and publishing a retained version moves the publication counter forward. They had one word between them.

### Fixed

- **The Docker image could report its version but fail to start.** Bundle the target-platform sidecar and agent entrypoint, configure writable non-root storage defaults, and verify boot, health and the embedded UI before promoting images. CI now requires the image check and all race shards; nightly publication is tied to verified commits and immutable artifact identities.

- **Editing a routine plan's target now re-checks its inputs against the recipe it will actually run.** Two gaps in the previous fix: unpinning a plan onto the current recipe validated its inputs against the *old* pinned version and then stored a plan the current recipe rejects, and repinning to another version without touching the inputs was not checked at all. An edit that changes the inputs, the pinned version, or the target routine is now judged as the plan it produces; disabling, rescheduling and renaming remain unchecked so a plan that predates the check can still be switched off. Pinning a plan to a version the routine never archived — on create, repin or retarget — is now refused naming the version, instead of storing an enabled plan with nothing to run; and an archive that cannot be read is an error, not a pass (#2496 follow-up).

- **A routine's schema can no longer change out from under a live plan through a side door.** The check that refuses a recipe an enabled, unpinned plan's stored preset can no longer satisfy ran only on Edit → Publish. `crewship routine save`, the agent save, an import and a manifest apply all walked past it and left the plan pointing at a recipe its preset no longer fits — a plan that looks healthy in the calendar and fails for the first time at its next firing. The check now runs on every door that changes an active recipe, inside the same transaction, so a refusal leaves the original recipe and the original plan untouched; the 409 names which plan to repair, on the import and agent doors too, where an entirely actionable refusal used to surface as a server error. Disabled plans, pinned plans, legacy untyped inputs and saves that do not touch the definition are unaffected (#2495).
- **A routine plan can no longer be saved with inputs its routine would refuse.** A plan's preset was only ever checked when the *routine* later changed, so a plan could be created or edited carrying values its target already rejects — an unanswered required question, a choice outside the declared options, a word where a number belongs — sit enabled in the calendar looking healthy, and fail for the first time at its next firing, with no run to inspect because the executor refuses before one exists. Creating a plan, editing a plan, and the trigger a routine save can carry now all check the preset with the same validation the run itself applies. `false`, `0` and an empty list remain answers rather than absences, extra inputs are still allowed, and a recipe whose inputs declare no form stays exactly as permissive as before (#2496).
- **A routine run you schedule for later runs the recipe you scheduled.** Starting a run with a delay, or through a debounce window, parked it without recording which published version it had been accepted against — so publishing an edit while it waited changed what it did when it fired, minutes after the person who started it had seen a receipt for something else. Every deferred start now pins the version that passed its preflight, the way a one-time scheduled start already did; a debounced burst keeps the first trigger's version, since coalescing makes it one trigger. A trigger that joins an open debounce window is judged against the version that window keeps, so inputs written for a newer recipe are refused with 409 rather than stored on a run that cannot use them, and the receipt reports the pin the row actually carries. `pinned_version` remains a one-time or immediate start's option — a delayed or debounced start names none. A routine without an archived version is refused with 409 until a version is published. The dispatcher claims the current queued payload atomically and respects a debounce window extended after its due-list read (#2500).

- **Routine plans show their input presets without opening an editor.** Recurring and one-time plans share a compact summary in Schedules and Calendar, with explicit empty presets, clipped text, and credential/file previews that omit contents, including file prefixes obscured by whitespace or invisible characters. Pending starts and planned calendar events now return read-only, redacted preset previews; run history remains distinct from planned starts.

- **Phones and tablets can reach the whole product.** The phone menu was built from its own copy of the navigation and had lost seven destinations — Inbox, Issues, Routines, Pages, Activity, Journal and Integrations. Both surfaces now read one definition, and the phone menu carries the Inbox unread count, which previously had no mobile home at all. The Admin Console gained the navigation sheet Settings already had, instead of a fixed 280px column that left a 390px screen 109px to render into. The Pages, Routines, Integrations and Credentials drawers now seal the page behind them rather than leaving the top bar live and the content scrolling underneath.
- **Touch sizing follows the pointer, not the window width.** Touch targets were written to apply below 640px while the app treats anything under 768px as a phone, so large phones and small tablets ran the mobile layout with desktop-sized controls. Sizing now keys on a coarse pointer, which also gives tablets real 44px targets in the desktop layout, including the collapsed navigation rail. Create-flow inputs grow to 16px on touch, so focusing one no longer zooms the page on iOS.
- **Layouts respect the browser's own chrome.** Viewport heights use `dvh`, so panels no longer end underneath Safari's collapsing toolbar, and the app opts into `viewport-fit=cover` — without it every safe-area inset in the stylesheet evaluated to zero, including the ones the create-flow and save footers already asked for. Dialogs cap their height and scroll, so a primary action cannot sit off-screen with the keyboard open, and popovers can no longer render wider than the screen or flush against its edge.

- Add offline routine step tests with explicit sample outputs and isolated schema validation (#2473).

- **A routine run whose caller goes away is recorded as cancelled, not failed.** The executor only recognised a cancellation that arrived through the Cancel button, so every other way a run's context ends early — a closed tab, a proxy timeout, a CLI deadline, a graceful shutdown — landed a `failed` row whose only stated reason was `context canceled`. Those runs minted an error fingerprint into the errors view, paged the failure notification and ran the `on_failure` hook, while the journal entry for the same instant already read `CANCELLED`. Cancellation is now classified by cause-independent evidence, and the recorded reason names the step the run stopped at (#2473).

### Fixed
- **Pages in unsupported browsers** (#2472) — show panels immediately in Safari, Firefox and mobile browsers, without waiting for application metadata or requiring a manual switch.

- Pages demo setup leaves time for a full compiler run and publication; invalid container resource limits no longer produce healthy snapshots.
- **Pages restart verification** (#2472) — require the real CLI publication/restart scenario in the Docker CI lane and use a runtime origin accepted by current configuration validation.
- **Page application history** (#2472) — use a fixed bounded allocation and verify zero, negative and oversized pagination limits are rejected.

- **List requests above the pagination cap return the maximum allowed page.** Keeper logs, checkpoints, approvals, eval runs, inbox, top spenders, runs, audit logs and persona history now clamp an oversized limit to their existing ceiling instead of falling back to a smaller default. Their effective pagination parameters remain documented in OpenAPI.

- **Deferred routine dispatch** (#2472) — preserve the scheduled occurrence when loading due runs, so rearming a one-time row receives a new dispatch identity instead of replaying the old run.

- Routines waiting for a decision resume their captured recipe after publication or restart, preserving the original form and effective step settings.

- Routines: comparison starts survive closing the page and recognize interrupted runs. One-time starts pin their accepted version and new start times no longer reuse an earlier run. Optional nested inputs remain optional; failed artifact capture no longer fails successful work or overwrites another attempt's evidence. Execution pagination remains available during polling, and schedule cancellation works while presets load.

### Changed

- Routines opens on a searchable list with visible purposes and step counts. Steps have optional human names. Edit is one recipe document with step-level Edit/Test tools; run failures show their reason and open the affected step.

- Routine authoring saves durable drafts, reviews publication changes, tests steps with explicit samples and compares archived versions with recorded run evidence. Run details group attempts and outputs by step. Proxy errors and obsolete draft loads preserve the user's work.

- Add typed human decision forms to routine waits, Inbox and CLI; preserve rejection and approved-answer recovery (N5, N10, N15; #2473).

- Routines: durable draft/publication API, CLI and agent tools with revision conflicts, schedule compatibility checks, and browser publication proof preservation (N1, N3, N6, N11; #2473).

### Documentation
- Document experimental Pages application installation, recovery, browser support and the verified limits of the initial release.

### Changed
- Crew and agent creation require an explicit AI provider choice in the UI. Matching runner installation starts automatically, including the first crew build and agents added during preparation.
- Agent and crew editors use focused sidebar sections with preserved drafts and mobile navigation. Model/provider/runner choices are visible with brand icons, run duration uses minutes, and crew network access has explicit provider-only, selected-host and open choices that match the existing API.
- Crew and agent Work tabs use shared concept icons and dashboard cards. Routines replaces the generic Automations link with crew-owned routine previews; issue and mission links preserve the selected team or agent.
- Agent overview removes the duplicate role/model/edit footer, moves monthly spending beside run metrics, and provides avatar and direct skills/access actions in a compact menu.
- Crews and agents share the Routines dashboard visual language, with avatar-based team browsing, server-side purpose search and name sorting, compact crew lists, real run outcome charts, and scoped work/access previews. Create/Edit forms and Memory now expose clearer icon-based navigation and actionable empty states.
### Fixed

- **An issue that ever ran could not be deleted** — `DELETE /api/v1/crews/{crewId}/issues/{identifier}` answered `500` with a raw `FOREIGN KEY constraint failed`, on a handler whose own refusal text promises that "a mistakenly created issue can always be got rid of". The cascade off `missions` is not self-sufficient: `assignments` outlive the issue by design (their `mission_id` is `ON DELETE SET NULL`) while `issue_executions` cascades away, so a surviving assignment was left pointing at a deleted execution through a `NO ACTION` key. Two further `NO ACTION` edges — `mission_tasks.issue_execution_id` and `issue_executions.review_task_id` — point at each other, so the order one cascade reaches them was load-bearing too. The delete now runs in a transaction that releases the pointer which outlives its target and defers the remaining checks to commit. Found by validating the endpoints #2448 added against a live server, not by a test.
- **Pages compiler review** (#2472) — normalize bootstrap default ports, atomically repair corrupt content-addressed snapshots without masking I/O errors, and report output overflow even after a successful worker exit.
- Agent inbox cost summaries query the actual ledger timestamp, including the beginning of the current month. Memory refresh also reloads personal data; exports identify their scope and report empty scopes and download outcomes. Crew navigation updates the selected canvas reliably. The placeholder agent container restart is replaced by a working, confirmed crew-level action with accurate next-run recreation feedback.
- Invalidated cache requests cannot overwrite newer results, and failed relation refreshes preserve known cached data. Historical collaboration no longer implies an automatic delegation trigger.
### Changed
- **Crews & Agents now separates Overview, Work, Team and Memory.** Create and Edit share the same agent and crew forms; advanced runtime settings remain available. Overview shows scoped run metrics, recent outcomes and conversations. Memory reads current knowledge independently of version history and exposes the signed-in user's preferences.
### Security
- ⚠️ **Behaviour change:** agent peer-profile endpoints now allow only the signed-in user's own profile, including for workspace administrators; administrator-wide exports retain their explicit administration gate. Personal profiles are excluded from general memory history and group-chat prompts. Personalization opt-out is checked before prompt assembly, and cross-crew user-model reads follow the authoritative workspace index.

- **Guided credentials and provider setup** (#2465) — direct type selection, consistent branded forms, text-file imports, colored tags and compact assignment previews. Save for later creates no delivery bindings; explicit assignment checks occupied slots. Partial saves retry incomplete writes, and provider re-login updates the existing account atomically while retaining assignments.
- **Credential and private-service protection** (#2465) — private service configuration is encrypted at rest and omitted from public/exported views; re-encryption supports the stored format. Credential disclosure refreshes authorization before returning values, and restricted approval details are scoped to eligible viewers.

- ⚠️ **Behaviour change: default administrator reveal permission** (#2461) — OWNER/ADMIN memberships without explicit capability overrides now receive `credentials:reveal`, as does the admin preset. Existing explicit sets (including revocations) remain authoritative. Workspace opt-in, human-session checks, scope, SEALED denial and audit remain required.

- **Credential demo shapes and bounded reveal** (#2461) — demo data adds branded JSON-file and ID/secret examples. Credential details link to reveal policy settings without bypassing permissions. Revealed values disappear after 30 seconds, on tab hiding, close or target change; stale responses cannot populate another credential's dialog.

### Added

- **Pages application Studio** — source editing, previews, reviewed publication history and declared routine actions. Panel-only Pages render immediately; temporary 503s preserve an open application, while withdrawal clears stale code. Desktop Chromium support and routine-definition changes are shown explicitly. Workspace appearance reaches applications without rebuilding them.

- **Pages application CLI and operations starter** — initialize, pack, save, build, review/publish, roll back and withdraw custom applications; inspect Git history, verify integrity and reclaim optional workspace history. Seed and collector examples are covered by real Docker and Node checks.

- **Pages application API** — workspace-scoped drafts, builds and reviewed publications, transactional action authorization, agent MCP authoring, recoverable storage quotas, integrity checks and protected backup/restore. Publication retries report the current live version.

- **Pages application foundation** — portable source projects, immutable bounded Git checkpoints, protected storage maintenance and an offline React compiler bound to the server release. API and authoring UI follow separately.

- **Provider account groups in Credentials** (#2440) — owners/admins can create, inspect, edit and remove account-set definitions with branded account selection, priorities and explicit cross-owner consent. Stale edits keep the draft instead of overwriting another administrator. Removed groups retain their provider accounts. Groups remain unassigned definitions until runtime pool binding is delivered.

- **Issues can move between people and agents** (#2449) — explicit handoff notes, current worker and next actions, recipient Inbox updates, human result submission, files and project milestones. Taking over pauses automatic work; revisions and operation receipts protect concurrent transfers. The detail brings results and conversation forward, loads long threads in pages, and distinguishes partial results or requests for input from completed work.

- **The issue work contract has its CLI half** (#2449) — `crewship issue review-policy` requires or drops human acceptance before an issue counts as done, and `crewship issue result` prints what one of an issue's runs reported back. Both endpoints existed with no command, so the web panel was their only door; the rule is that every endpoint gets one, because that is the contract an agent drives. Their acceptance tests run the binary against a real router, and so does `crewship issue work`, which had none.

- **Provider pool editing and removal** (#2440) — owners/admins can replace account-set membership and retire definitions through API and CLI. Revision checks prevent stale edits; retirement keeps provider accounts intact and blocks subsequent selection. Provider and authentication mode remain fixed. These operations manage definitions, not runtime assignments.

- **Chat file previews** — open PDF and raster images directly in the Files side panel, with PDF pages/zoom, authenticated agent and crew file access, download and return to the explorer. PDF.js assets are bundled locally; unsupported formats retain a download fallback.

- **Personal notification sounds** — five original short tones, separate Chat/Inbox choices, previews, volume and Do not disturb in Settings → Account → Notification sounds, with a desktop/mobile toolbar shortcut. Authorized fresh human messages and important unread Inbox items can alert after audio is enabled; focused reading, muted rooms, duplicate tabs and history reloads remain quiet.

- **Team demo seed** — Thomas, Paul, Peter, Anna, Sofia and Emma have real workspace roles, distinct bundled portraits and independently authored Chat messages. `seed team-chat` adds only this demo to an existing workspace; `seed --with-team-chat` and `./dev.sh seed` include it in a full demo. Private random credentials and stable room/message references support reruns without resetting users or replacing custom avatars.

- **Chat continuations** — Add people opens a fresh private group from a direct message; Invite agent explicitly opens a workspace channel with the selected agent. Original private history stays private. Atomic creation and durable retry IDs prevent duplicate rooms after uncertain responses, including backup/fork restoration.

- **Team Chat identity and activity** — profile portraits and agent avatars, room icons, day dividers, compact author groups and Markdown bring shared rooms closer to agent chat. Channel creators can subscribe to linked issue/routine journal updates; trusted Crewship cards never invoke agents. Explicit agent mentions receive a bounded, workspace-scoped work snapshot for status questions. Repeatable demo-account and live CLI scenarios cover real colleague messages, routine results and agent replies.

- **Chat room CLI** — `crewship chat room` manages human direct messages, private groups and mixed workspace channels, including members, agent mentions/jobs, message pagination, safe retries, mute and read cursors. Existing agent-session commands remain available under Chat.

- **Unified Chat** — agent sessions, direct messages and shared rooms use one Chat sidebar and New chat menu. Human room links open under `/chat`, with old links redirected compatibly.

- **Human direct messages** — open a colleague conversation from the workspace people picker and reuse the same private history on subsequent opens. Direct conversations keep their two original participants; ordinary groups and channels remain separate.

- **People and workspace channels in Chat** — create participant-only human groups or workspace-readable channels without an agent, manage participants, and keep ordered history with safe send retries. Unread conversation activity reaches the existing inbox through a durable outbox, with personal mute and read cursors. Channel agents join visibly and respond only to explicitly selected mentions through the existing assignment queue; private groups remain human-only because agent execution records are workspace-visible.

- **Provider pool definitions** (#2440) — owners/admins can create, list and inspect explicit account sets through the API and `credential pool create/list/get`. Creation requires credential write scope for scoped CLI tokens; cross-workspace members are rejected. This prepares pool management only: it does not assign accounts, enable runtime failover or add pool controls to the UI.

- **Credentials for clients** (#2428) — separate Add secret and Add provider flows, branded provider selection, provider-specific connection guidance, provider filters, and focused account details. Typed credential editing preserves existing values unless replacement is explicitly selected; access provenance, tags and assignment state are clearer. Provider administration is owner/admin-only in the console as well as the API.

- **Provider onboarding safeguards** (#2428) — completing device sign-in saves the chosen crew access, validates the complete code response, and uses only committed UI callbacks. Disabled data requests cannot restore stale account details. Empty subscription usage remains a valid array response. OpenAI/Codex defaults stay on GPT-5.5; Astra remains selectable for accounts with access, rather than being forced during onboarding.

- **Provider sign-in reliability** (#2428) — CLI imports reject conflicting OAuth options and oversized files; account summaries retain usage timestamps and explain restricted access or missing refresh configuration. Device-code waiting stops at expiry, and completed sign-ins retain their result across server shutdown.

- **Isolated provider refresh** (#2428) — run-start refreshers belong to their router and database instead of a process-global callback, preventing races and cross-instance credential refresh during concurrent server construction.

- **Legacy provider visibility** (#2428) — list filters use the same whitespace normalization as the credential-ID permission guard, so padded legacy provider names cannot expose admin-only account metadata in lists.

- **Provider-account notification privacy** (#2428) — refresh-failure alerts are addressed to current workspace administrators, not personally to a creator who may later be demoted. An upgrade backfill also restricts previously stored alerts, without deleting their history or changing unrelated inbox messages.

- **Provider-login API and CLI** (#2428) — normalized account storage, server-driven device sign-in, centralized refresh with stale-write protection, provider-specific account status, and usage attribution. `credential login`, status and refresh commands use the same server contract; bounded stdin imports accept complete auth files without truncation.

- ⚠️ **Behaviour change: provider account administration** (#2428) — only workspace owners/admins may administer provider accounts, including legacy provider API keys and CLI logins. Ordinary-secret capabilities remain separate. Agent credential/binding reads omit inaccessible metadata after delivery resolution; lower roles see only a provider brand in payer summaries. Imported Gemini refresh requires matching server-side OAuth client configuration and reports configuration-required status when unavailable.

- **Provider-login runtime foundations** (#2428) — adapter-specific Codex and Gemini auth-file delivery with server-retained refresh tokens, normalized login parsing and refresh clients, and credential-attributed usage storage. Generated auth files are withheld from the Files API. Google refresh requires an operator-supplied OAuth client matching the imported grant.

- **Codex runtime compatibility** (#2428) — route metered keys through the sidecar-backed model provider, recognize structured terminal errors, acknowledge MCP notifications with HTTP 202, and omit MCP endpoints blocked by crew network policy. OAuth refresh and device-flow libraries are included here; public onboarding and administration arrive in the dependent API/UI changes.

- **Demo use cases, one script each** (`scripts/demo/`, #2424) — the second version of the demo scripts. `scripts/walkthrough.sh` was one `set -e` checklist that stopped at its first failing line and could not run step six without steps one to five; it is now twelve self-contained use cases (`uc-NN-<slug>.sh`) run alone or all in order by `scripts/demo/run.sh`, each narrated for an audience, verified by assertions and honest about what it could not run: a use case whose need is missing (a model, a GitHub token) exits with the reason and the runner prints **SKIP**, never a green row. Memory recall, delegation, ephemeral hire with its approval, credential escalation answered by `crewship escalation supply`, the approval gate, a token-zero routine landing in the inbox, a wake-gated schedule holding on a real scheduler tick, eval tiers, GitHub token injection, and the legacy demo packs through `seed verify --pack`. `scripts/demo-test.sh` (CI `shell` job) ShellChecks the suite and drives the runner against stubs. Guide: `docs/guides/demo-use-cases.mdx`.
- **One client inbox at `/inbox`** — clearer action/update/history views, crew filtering, real issue-assignee avatars and routine identity, and message-first details. Saved `/inbox-v2` links redirect with their selection and filters intact. (#2435)

- **Dashboard results and review** — recent review issues and completed routines now open directly from the main overview, with real agent avatars and crew identity. Crew cards use their own colours, waiting approvals are separate from running routines, and system details are collapsed. (#2433)

- **Demo packs in `crewship seed`** — the external-source demo use cases: a **nightly CI watch** over the scheduled GitHub Actions workflows of `crewship-ai/crewship` (token-zero probe as the wake gate, Sonnet triage only when something is red or silently stale), a **docs-drift audit** of that repository's documentation against its code, and a **site replica** in which the engineering lead delegates the copy of `www.seznam.cz` across an analyst, a data engineer, a frontend engineer and a tester. Each pack is one crew, its deterministic scripts (with their own unit tests, run by `go test`) delivered to the crew's shared volume, its routines, its Page and its issues — the issues carry labels, and the cross-crew file hand-offs of the previous seed are gone (`/crew/shared` is per crew). Crew leads run on `claude-sonnet-5`, workers on `claude-haiku-4-5`. The default seed has since replaced the packs with the Harbor Goods business stories (#2700); the remaining pack catalogue (`ci-watch`, `docs-drift`) is legacy and reachable only through `seed verify --pack`.
- **`crewship seed verify`** — runs the selected demo end to end and checks the agents against the probes: delivered scripts byte-identical to the seed, the probe's verdict against an independent read of GitHub, the agent's `COUNTS:` line reconciled with the probe, no token in the report, the notification in the inbox and the Page panels written by that run. A pack whose requirement is missing is reported as skipped, never as green; `--strict` makes that a failure. The default target is now the business demo (#2700); this row-by-row contract applies to the legacy `--pack` selection.

### Changed

- **Two OSV advisories published overnight, cleared** — `sharp` 0.35.3 → 0.35.4 and, transitively, every `@img/sharp-*` platform sibling plus `@img/sharp-libvips-*` 1.3.3. The advisory (GHSA-rgj7-g3m4-5g8c, CVSS 8.9) is not in sharp's own code but in the libheif it bundles, so the override floor moves rather than a direct dependency. `google.golang.org/grpc` 1.83.1 → 1.83.2 (GHSA-2v4p-qf9q-27wj), an indirect module. Neither was introduced by a change here: both versions sat on `main` while the Security workflow was green, and the scanner reads a live advisory database, so the build went red without a commit. The remaining finding, `golang.org/x/crypto` 0.56.0 (GO-2026-5932), has no fixed version published and is Unknown severity, which the gate does not block on.

- ⚠️ **The Go language floor moved 1.26 → 1.27** — `go.mod`'s `go` directive, which is a promise to anyone building Crewship from source, not just a CI detail. It was held at 1.26 deliberately since #2060 and moved here because a dependency forced it: `shoutrrr` v0.19.0 declares `go 1.27`, and the go command refuses a main module whose floor sits below its dependencies'. Building from source now needs a 1.27 toolchain. `scripts/go-toolchain-pin.sh` still does **not** check this line — it is a separate decision from which compiler builds the release, and folding the two together would raise the floor silently on every toolchain bump.

- **Go toolchain 1.27.0 → 1.27.1, in all thirteen places that name it** — `go.mod`'s `toolchain`, the root `Dockerfile`'s `FROM golang:`, `GO_VERSION` in ten workflows and the literal `go-version` in `codeql.yml`. Dependabot's `docker-images` group bumps the `FROM` tag alone, which is the one Go version no pull-request check compiles with; `scripts/go-toolchain-pin.sh` failed the PR for exactly that reason and the rest were moved to match. The analyser pins were re-checked and stay put: `golangci-lint` v2.13.1 and `govulncheck` v1.7.0 both vendor an `x/tools` that already understands 1.27 syntax, so a patch-level toolchain bump does not move them (1.26 → 1.27 did).

- **Dependency updates for 2026-09-07** — the week's five Dependabot groups landed together, because two of them shared `pnpm-lock.yaml` and no merge order avoided rebasing the rest. Go modules (10): `age` 1.3.1→1.3.2, `go-jose/v4` 4.1.4→4.1.5, `go-containerregistry` 0.22.0→0.22.1, `klauspost/compress` 1.19.2→1.20.0, `moby/moby/api` 1.55.0→1.56.0, `moby/moby/client` 0.5.1→0.6.0, `shoutrrr` 0.18.0→0.19.0, `goldmark` 1.8.5→1.8.6, `x/crypto` 0.55.0→0.56.0, `modernc.org/sqlite` 1.57.0→1.58.0. npm production group (41, mostly transitive; the direct ones are `@sentry/nextjs` 10.70.0→10.73.0 and `@codemirror/state` 6.7.1→6.7.3) and `@types/node` 26.4.0→26.4.1. GitHub Actions: `anthropics/claude-code-action` v1.0.210→v1.0.216, `docker/setup-qemu-action` v4.2.0→v4.3.0.

### Fixed

- **Agent reply audio** — direct agent answers now play the selected Chat cue on successful completion, including while focused, and deduplicate against their Inbox projection. Saved audio opt-in reactivates on the next real interaction after reload. Sound settings are linked from the profile menu on desktop/mobile.

- **Create-only member provisioning** — automation can reject existing accounts before changing membership or account-setup tokens. The team seed and CLI create-only flag verify server support first.

- **Chat sidebar hierarchy** — one New chat entry, People/Agents/Team spaces sections and expandable per-agent sessions replace overlapping facet grids. Per-agent New session stays explicit, selection highlights are exclusive, and section/history expansion persists per user and workspace.

- **CLI automation output** — workspace creation, member provisioning and chat attachment upload now honor JSON/YAML/NDJSON output instead of mixing human-readable success text into scripts. Invalid attachment responses return an error.

- **`TestSessionMessagesWithStore` raced its own `TempDir` cleanup** (#2452) — `New()` spawns the catalog and runtime refreshers, which write into `<BasePath>/catalog-cache` on their own schedule; the test never stopped them, so `t.TempDir()` removed the directory underneath a live goroutine and cleanup failed with `directory not empty`. Latent since the refreshers landed and surfaced on the linux-arm64 runner, which is slow enough to lose the race. `t.Cleanup(s.StopBackground)` — the one-liner every other boot test in the package already carries, and the reason `StopBackground` binds to `bgCtx` in the first place.

- **The `@sentry/nextjs` version ceiling is gone, and the bug it hid is actually fixed** (#2444) — `pnpm.overrides` carried `"@sentry/nextjs": "<10.72.0"` since 2026-08-31. It never held: the override names one package, and `@sentry/server-utils` floats on its own, so Dependabot's lockfile regenerated it at 10.73.0 anyway and twelve suites stopped loading with `TypeError: The URL must be of scheme file` — every assertion inside them still passing, which reads like anything but a dependency problem. The fault is a vendored bundler plugin that picks its Node-vs-browser branch on `typeof document === 'undefined'`; under `happy-dom` a `document` exists, so it resolves its loader against `document.baseURI` and hands an `http:` URL to `fileURLToPath`. Production never saw it — `next build` and the server runtime have no `document`. The suite runs under `happy-dom`, so `vitest.config.ts` now resolves the SDK to the client build the browser bundle actually gets (the entry its own `browser` export condition names) and inlines it so Vite's resolver handles its extensionless `next/router` import. The ceiling came off; Sentry is on 10.73.0.

- **Gemini refresh configuration** (#2428) — remove bundled OAuth client credentials. Operators configure the matching client through server-only environment variables; missing configuration disables refresh without invalidating a stored user grant and is explicitly reported in account details.

- **Credential review hardening** (#2428) — reject oversized piped values even when the limit is followed by a newline; device-code sign-in no longer offers an owner change that is not saved; failed provider-account swaps attempt to restore the previous binding, refresh actual assignment state, and report failed recovery explicitly.
- **Provider account administration** (#2428) — provider accounts, including legacy provider API keys and CLI logins, are restricted to workspace owners/admins in both the API and console. Other roles see only the agent's provider brand. Agent credential/binding lists now respect credential visibility, tenant boundaries and deleted rows without exposing hidden binding winners in warning messages.

- **Codex silently lost every Crewship MCP tool** (#2428) — the sidecar acknowledged an MCP notification with an empty `200`, which carries no `Content-Type`; Codex's MCP client treats that as a fatal transport error, kills the worker and drops the server, so `crewship-memory`, `crewship-routines` and `crewship-notify` were announced at initialize and gone one message later, leaving only log noise. Notifications now answer `202 Accepted` with an empty body, as the streamable-HTTP transport asks. Claude Code's client tolerated the empty `200`, which is why the two adapters disagreed about whether Crewship's own tools exist.
- **A restricted crew no longer refuses two hosts a Codex run needs** (#2428) — `ab.chatgpt.com` (the feature-flag service Codex calls at startup) and `*.oaiusercontent.com` (session content) are OpenAI's own and are now on the default allowlist beside `chatgpt.com`, which is exact-match. Neither refusal was fatal, but each printed a proxy warning and a CLI error, so a working agent looked broken in its own transcript.
- **An MCP server the crew's network policy blocks is no longer written into the agent's CLI config** (#2428) — the sidecar already refuses to connect to it, so the config entry only made every CLI dial a host the container proxy rejects; Codex retried three times per run and printed a fatal transport error each time, which read like a Crewship failure rather than a crew policy doing its job.
- **Codex API-key runs never reached the sidecar** (#2428) — Crewship pointed Codex at the loopback proxy with `OPENAI_BASE_URL`, a variable the Codex binary no longer reads, so every request went straight to `api.openai.com` carrying the dummy key and ended in a 401 the sidecar never saw. Codex's built-in `openai` provider cannot be overridden either, so the route is now a per-run custom `model_provider` block (`base_url` on the sidecar's `/openai/v1`), the same mechanism already used for OpenRouter and OpenAI-compatible endpoints. An OpenAI login is also no longer mistaken for a Claude one: OAuth detection reads the provider, not just the type, so it is never written to `CLAUDE_CODE_OAUTH_TOKEN` or labelled "Anthropic Max".

- **`crewship run` and `crewship ask` no longer hang forever against a busy
  agent.** An agent serves one run at a time, and since #2269 a send that
  arrives while it is busy is bounced with a sender-only `agent_busy` event —
  with, by design, no terminal `done` after it: emitting one would travel the
  shared session channel and finalize the *winning* sender's live turn
  mid-generation. The web frontend renders that frame. Neither CLI event loop
  knew it, so both fell through and went back to waiting for a `done` the
  server had already decided not to send. Measured on dev3: two of three
  concurrent `crewship run` calls against one agent printed nothing for 200 s
  and exited only on the caller's own timeout, while the server logged both
  the rejection and the frame it sent. They now print
  `[busy] The agent is busy with another run right now.` and exit non-zero in
  under a second.

  `run` has **two** event loops — the streaming switch and
  `collectAgentStream`, which is what `--no-stream`/`--wait` select and which
  `routine iterate` shares — and the first cut of this fix patched only the
  first. The unit test passed and the live run still hung, because the test
  drove the path the flag did not select. Both loops handle the frame now, and
  both are pinned by tests; `collectAgentStream` is the strict case, since
  `runNoStream` passes it timeout 0 and there is no deadline to end the wait.
  The event name is one exported constant (`ws.AgentBusyEventType`) named by
  server, clients and tests alike, and the scripted-event test harness now
  builds frames from the server's own `ws.ServerMessage`/`ws.ChatEvent` rather
  than from the client's mirror of them — a client-shaped fixture is what let
  this stay green in CI while failing against every real server. Unknown event
  types are no longer swallowed in silence: under `--verbose` both loops name
  what arrived, which is how this was found.

- **The docs-drift pack turned its own graceful degrade into a hard failure.**
  `docs_audit.sh` deliberately exits zero when the scan cannot run, so the
  status page keeps a meaningful panel — but its two `fail()` paths wrote a
  panel with only `state` and `label`, while the routine projects
  `.panel.sha_label` out of that document with a `transform`. A transform whose
  field is missing does not degrade; it fails the run and takes the agent review
  and both page panels with it. So every recoverable scan failure destroyed the
  audit. The other two packs were immune because each builds its panel in one
  function used by every exit path; docs-drift had duplicated the literal and
  drifted. Every exit path now leaves through one `panel_for()`, and
  `sha_label` says `@ not checked out` rather than inventing a SHA or emitting
  an empty string the page would render as a blank row.
  `TestPacks_FailureOutputCarriesEveryProjectedField` derives the projected
  fields from the routine definitions and drives every pack's script down its
  failure paths, so the next pack cannot repeat it.
- **`crewship seed verify` reported a broken pack as green.** Without
  `SEED_GITHUB_TOKEN` it said `env SKIP — the pack is seeded but cannot run`
  and exited 0, while the seeded schedule had already fired that pack's routine
  and it had hard-failed, plainly visible as `FAILED` in `crewship routine
  list`. Verify never looked at what the workspace had already done. A `history`
  check now runs before the env gate — so a skip cannot hide it — and names the
  routine, run id, failed step and error. A transport failure reading the
  history is a `SKIP` with its reason, not a false green. The row is scoped
  to the current seed generation by the crew's `created_at`: `seed --nuke`
  recreates the crews but upserts the pipelines, so run history outlives the
  nuke, and without that scope a freshly seeded workspace verified red on
  failures belonging to a workspace that no longer existed. What the scope
  drops is stated in the PASS detail rather than filtered in silence, and an
  unparseable timestamp never buys a pass.

- **Every routine run was recorded as `FAILED`.** `DeriveOutcome` treats a clean
  completion that reports no §9.6 hand-off as `FAILED` with "no outcome
  reported" — right for an agent, which was asked for one, and impossible for a
  routine built from `script`, `transform`, `notify` and `crewship` steps, where
  nothing can ever report anything. Every routine run in a seeded workspace read
  `status=completed, outcome=FAILED`, `crewship routine logs` printed `Error: no
  outcome reported` on the happy path, and both `crewshipd_successful_runs_total`
  and the digest's `pipeline_runs WHERE outcome='SUCCEEDED'` counted zero
  routines forever. The strict default now applies only when the run actually
  contained a step that could report (`agent_run`, or `call_pipeline`, which
  fails closed); anything else settles `SUCCEEDED` with an empty reason. A
  routine that *does* carry an agent step and still says nothing is unchanged —
  that remains a real missing hand-off. Existing rows are not backfilled.
- **§12's violation counter could not see the violation it was written for.**
  `crewshipd_inbox_items_on_successful_runs` joined `pipeline_runs.id =
  inbox_items.source_id`, and its comment claimed "no other producer keys an
  item by a run id". A `notify` step keys its item `<run_id>:<step_id>`, so the
  join never matched and the numerator was structurally always zero. It now
  compares the run id against the prefix before the separator — equality on the
  extracted prefix, never a `LIKE`, so a run whose id merely prefixes another's
  is not miscounted. With this and the outcome fix in place the series reports a
  real, non-zero ratio on a seeded workspace, because the shipped packs *do*
  post an inbox message from a successful run. That contradiction between the
  packs and §12 is now measured rather than hidden, and is left for a decision.

- **`-f json` printed English prose on the commands that mint an identifier.**
  `--format` is a persistent flag, so every command in the tree advertises it,
  and the premise of this CLI is that agents drive it. `crewship issue create
  -f json` answered `Created issue ENG-14: ZZ fmt probe` — an agent had to
  regex its own identifier out of a sentence. None of the offenders was in
  `formatContractExempt`, and none would have qualified; the existing guard
  simply could not see them, because it only exercises commands it can invoke
  without arguments. A new guard covers every `create` in the tree plus a named
  ratchet of six issue mutations, and all 21 violations it found are fixed —
  `issue create -f json` now emits the object `issue get -f json` emits, so one
  parser handles both, and the human output is byte-identical. The wider
  population of mutating commands still off-contract is left to its own
  ratcheting programme rather than papered over.
- **Internal ids where a name belongs.** `routine list` printed a crew cuid in
  its AUTHOR CREW column, `cost` and `paymaster` printed `agent/<cuid>`, and
  `history` showed `?` for every routine run with a blank trigger. Slugs are
  resolved for the human formats; machine formats keep the ids a script joins
  on. An entity deleted since the run still shows its id, which is the honest
  answer rather than a guess.
- **`crewship issue activity` was unordered** — `created` could appear last —
  while `issue events` on the same issue was correctly seq-ordered.
- **Refusals that named no way out.** `keeper ask --credential` matched only a
  credential's env-var slot and answered "credential not found for name" for a
  credential plainly present in `credential list`; it now resolves slot, name
  or id and, when the credential exists but the agent cannot reach it, says
  exactly that and gives the `credential assign` command. A DONE issue refused
  both deletion and cancellation with no hint that `DONE → BACKLOG → delete`
  was open all along; both refusals now name the allowed targets and the
  shortest route. And `crewship inbox resolve` on a live waitpoint — correctly
  refused, because the decision has to reach the run — now prints the
  `routine waitpoints approve/reject` commands with the real token.
- **`crewship routine active` hid runs paused at a waitpoint**, though a run
  waiting for a human is in flight in every sense that matters. It now lists
  queued, running and waiting runs, with the state in a STATUS column.

- **The one documentation page the deployed index could never carry.** The
  scheduled `Documentation surface` job had been red on a count —
  "llms.txt lists 306 pages, docs.json declares 307" — which read as Mintlify
  lag and was not. `docs/manifest/README.md` was declared in the navigation and
  404 on the live site, because Mintlify does not publish a `README` basename;
  each merge that added a page moved both numbers and preserved the off-by-one.
  Renamed to `manifest/overview`, matching `cli/overview` and
  `api-reference/overview`. `checkServed` now names the pages it cannot find
  instead of only counting them — it had both sets in memory and threw the
  difference away, which is why one page hid behind a number for days.
- **The runtime-conformance harness ignored the gap registry it fills.**
  `KnownRuntimeGaps` records that podman below 5 drops supplementary GIDs and
  that upgrading is the only remedy; the harness failed the nightly build over
  exactly that, on a runner where it could not be otherwise. `ClassifyConformance`
  joins them: a documented gap is reported in full with its operator-facing
  detail but no longer reddens the build, an undocumented drop still does, and a
  control the runtime *honours* while the registry still calls it broken now
  fails as a stale entry — that registry feeds `doctor` and `/system/runtime`,
  so leaving it to rot tells operators their agents cannot read crew memory
  when they can.
- **Queued comments could start duplicate follow-up runs after an immediate completion.** Follow-up selection and claim attachment are now serialized before another completion callback can select the same batch. Agent execution remains asynchronous.
- **Starting another conversation with the same agent was hard to find and disabled in Commands.** Chat now has a visible New conversation button and a working New session command, selects a clearly labelled draft, and returns to Direct when starting from Issues or Routines. Unsent message drafts are restored for their author, and mention keyboard navigation no longer resets the selection or reopens after Escape.
- **Chat Files and Team could show empty or misleading panels.** Mobile Files now loads with error/retry states, Team replaces the empty More panel without a duplicate tab strip, and file Preview opens the editor or offers a download. File edits survive desktop drawer closing and panel tab switches; explicit discard actions ask before losing changes. Team shows crew members separately from agent collaboration, filters history before pagination, and refreshes on relevant realtime events. Agent links open the selected agent, and reconnect notices no longer cover header controls.

- **An answered agent request could stay marked as processing after a fast run finished.** Delivery persistence now catches up with a run that already completed, failed or was cancelled, while running and queued deliveries retain their lifecycle.

- **A routine `script` step ran against a sidecar nobody had started.** Every
  script step execs with `HTTP_PROXY=127.0.0.1:9119` — that proxy is where the
  crew egress allowlist is enforced — but crewship-sidecar was only ever
  started by the *agent* run path, which needs an agent. So on a crew whose
  container had not yet served an agent run, every script step that touched the
  network died on `connect to 127.0.0.1 port 9119: Connection refused`. #1473
  gave script steps the proxy (the security half) and left the liveness half
  open. It was deterministic on a fresh install, and it hit the demo first: the
  `ci-nightly-triage` pack runs its `script` probe *before* its `agent_run`, so
  a new workspace's very first nightly probe failed, and the probe's
  fail-loud-on-error rule (correct in itself) raised "Nightly CI — something to
  handle" about the platform's own bug — the exact inverse of the pack's
  "costs nothing on a quiet night" claim. The crew-agnostic half of
  `ensureSidecar` is now `settleSidecar`, with `EnsureCrewSidecar` as a second
  door onto the same check/reuse/restart sequence and the same #1220 lifecycle
  lock, and `RunScript` calls it before exec. A crew-started sidecar carries the
  full network policy and *no* credentials — a script step authenticates
  through its own `script.env` — so it is stamped `crew-only-no-credentials`
  and an agent run replaces it unconditionally rather than inheriting a sidecar
  that would inject nothing into its model traffic. The reverse never happens:
  a healthy agent-started sidecar is reused, never downgraded.
- **A crew can always run its agents** (#2429) — two defects behind "stdbuf: failed to run command 'claude': No such file or directory" on every wizard-built crew. mise now installs under `/opt/mise` instead of the agent's home — `/home/agent` is a per-crew named volume at runtime and hid every tool the image had put there — and the build puts the agent's tool directories (`/home/agent/.local/bin`, `/opt/mise/data/shims`) plus the matching `MISE_*` variables into the image `ENV`, `/etc/environment` and the runtime container env, so mise-installed tools resolve from the non-login exec the agent runs in; the runtime merges the aggregated PATH, the captured login PATH and the well-known tool directories into one instead of letting a captured login PATH replace the rest. And the adapter CLI is no longer the operator's job: every build reads the crew's agents' `cli_adapter`s, adds a mise tool (or an installer, for `droid`) for each CLI no declared feature provides, and runs `command -v` for every required binary as the agent user before the image is called ready — a miss fails the build with the binary named. The verified binaries are stored with the image and read by the dispatch gate (chat, issues, routines, container start): an image that is missing or not verified for a live agent's adapter is rebuilt before the agent runs, whichever path created the agent, and a plain base image with no features still gets the build its agents need; creating or moving an agent onto an uncovered adapter enqueues the rebuild immediately. A cache hit now returns the runtime contract instead of an empty one that was stored as NULL (which dropped the privileged flag, mounts and env of the previous build). `droid` installs into the image-resident `/opt/crewship/bin`. Cache keys changed (schema v3), so existing crews rebuild once.

<!--
  Backfill (#2086). The twenty-four entries between this marker and the next
  one chronicle eighteen PRs that merged with no changelog trace anywhere —
  more entries than PRs, because a PR that broke three separate things gets
  three. Written from their diffs, after the fact, rather than by their
  authors at the time. The `Changelog Guard` workflow now fails a PR that
  touches `internal/api/`, `cmd/crewship/`, `app/`, `components/`, `lib/`,
  `hooks/` or `stores/` without adding to this `## [Unreleased]` section —
  that section specifically, not the file, because it is the only one
  `RELEASING.md` cuts release notes from.

  The #2086 audit reported fifteen such PRs. Reading the window's merges back
  against this file turned up seventeen, and #2079 makes eighteen: it merged
  nineteen minutes after the audit list was cut (2026-08-26T20:52Z against the
  issue's 20:33Z), unchronicled like the rest, and it supersedes #2070 below —
  which is why leaving it out was not merely a gap but left a wrong entry
  standing with nothing to correct it. #2017, which the audit listed as
  missing, was already chronicled and is untouched.
-->

### Added
- **The two §19.3 service levels that had no series — scheduled fire punctuality and inbox items per successful run (#2396).**
  A scheduled run recorded only when it started; the occurrence it fired
  for survived only inside the idempotency key's hash, so "how late did
  this fire" was not a question the schema could answer. The schedule fire
  path now stamps that occurrence on the run as `pipeline_runs.due_at`
  (migration; NULL on every non-scheduled run and on runs from before the
  column), and `/metrics` reports `crewshipd_schedule_fire_punctuality_seconds`
  p50/p95 over the most recent scheduled runs. And §12's hard rule —
  a `SUCCEEDED` or `NO_CHANGE` run never creates an inbox item — is now
  measured rather than trusted: `crewshipd_inbox_items_per_successful_run`
  joins `inbox_items` to both run tables, with its two raw counts alongside.
  Both follow the #2380 conventions: a percentile or ratio with nothing to
  compute is absent, never a fabricated `0`. See
  [Prometheus metrics](/observability/metrics).
- **The web inbox renders the §12 action contract (#2398).** A `run_needs_human` card on `/inbox` now shows its `actions[]` as buttons — **Answer** opens a text box and Send delivers the text to the session that asked, **Take over** and **Dismiss** act at once (confirming first when the server marks an action irreversible) — each through `POST /api/v1/inbox/{id}/act`, the door `crewship inbox act` already used. The card resolves in place, no reload, and shows the receipt where the buttons were (the resumed run, `event #<seq>` on the issue's log, the agent version); a resolved card opened from History reads the same receipt back from `payload.receipt`. A `409 already acted on` refreshes the card to the other person's decision instead of erroring; a `409` undeliverable answer keeps the card open and shows the server's reason. `attention_class` is a badge on every card and row that carries one (Decision / Input needed / Review / Repair), and the kind pill names `run_needs_human` ("Needs a human") and the two trigger-failure kinds instead of "Update". `thread_key` is typed on the item and not yet read — the server already collapses rows on it, and the client-side grouping was left as it was.

- **A correction to a running agent is reflected in the next step, ahead of ordinary follow-ups (#2350, PRD §18 scenario 4).** A comment that arrives while an agent's run on an issue is still going is now classified a `correction` (the `stop > correction > normal` delivery priority the schema already reserved). When the queued comments are folded into the next run on that session, corrections lead the brief and are labelled `CORRECTION` with a header telling the agent to apply them first, so the next step reflects the correction rather than treating it as just another later comment. Delivery is at the next safe boundary (the next run on the session), not mid-token interruption of a turn already under way, which remains future work.
- **Acting on a NEEDS_HUMAN inbox card resumes the run (#2389, PRD §18 scenario 15).** `POST /api/v1/inbox/{id}/act` and `crewship inbox act <id> answer|take_over|dismiss`. `answer --input` posts your text as a comment on the issue and delivers it to the same agent session that asked; the run resumes from its checkpoint with the answer as its next delivery (one delivery, one run — queued if the session is mid-run). `take_over` and `dismiss` move the session to idle. Every action leaves an `inbox_acted` receipt on the issue's event log (who, action, the session's `agent_version`, and the delivery and run an answer produced) and resolves the card in place with the receipt under `payload.receipt` — the same thread, no new card. Acting twice is `409`. The card B6 raises now offers all three actions. Migration: `mission_activity`'s action CHECK admits `inbox_acted`.

- **The §19.3 service levels are computed series on `/metrics`, with a real percentile capability (#2380).**
  `crewshipd` had no way to compute a p50/p95 anywhere — no Prometheus
  client, no histograms, and SQLite has no `PERCENTILE_CONT` (F39). New
  collectors in `internal/server/metrics_domain.go` answer the delivery,
  continuation, duplication and human-comprehension questions §24.1 says
  actually get measured: delivery-ack and delivery-claim latency
  percentiles, lost deliveries, a duplicate-active-run canary, context-pack
  token-size percentile and compaction outcomes, checkpoint compliance
  counts, and outcome-routing counts with a violation canary. A percentile
  with zero samples in its window is absent from the scrape, never a
  fabricated `0`. See [Prometheus metrics](/observability/metrics) and
  `docs/guides/routines.mdx`'s Production notes.

### Security
- **The Keeper judges a credential ASK before it reaches a human (#2392).**
  A `CREDENTIAL` escalation raised as an ask (#2376) used to go straight to a
  person's inbox — the Keeper judged credential *use* and *access* but never the
  request to raise the ask, so an off-task or prompt-injected agent could spam
  credential requests at the operator. `CreateEscalation` now puts the ask to
  the same judge that guards access, over the declared name, type, tier and
  purpose and the agent's conversation (never a value — an ask has none), before
  anything is staged: **DENY** stages nothing, interrupts no one and returns the
  reason to the agent (recorded in the journal); **ESCALATE**, and any judge
  outage, stages and routes to a human with the judge's note attached;
  **ALLOW** stages as before. With Keeper off, ask gating is off and every ask
  reaches a human as it did. A *propose* (a value the agent generated) is not
  judged — it is a human approving a secret, not a request to grant one. Agent
  prompt, credentials guide and CHANGELOG updated; the `hosts` field remains
  review metadata (egress enforcement is tracked under EPIC #1001 M2b), and a
  handle-only credential stays a standing grant because every use of it already
  re-enters the Keeper-judged `/keeper/execute`.
- **A peer agent's "GO" cannot satisfy a waitpoint (#2388, PRD §18 scenario 10).** The waitpoint resolve door now takes an explicit actor and refuses an agent — a crew-bound internal token, a sidecar tool, any agent-facing route — and an unidentified caller, before the row is touched. The waitpoint stays pending for a person, the authed approve route answers `403` with `reason: waitpoint_decider_not_allowed`, and the attempt lands in the audit log as `waitpoint.decision_refused` naming the actor and the run (`crewship audit --action waitpoint.decision_refused`). The public token callback is the external holder's door and unchanged; the inbox card now states `who_can_act: ["role:MANAGER"]`.

- **A credential a human supplies to an agent is a grant, never a value the agent can read (#2376).**
  A `CREDENTIAL` escalation raised without a value stages a `REQUESTED`
  credential in the vault; the human fills it through the new
  `POST /api/v1/escalations/{id}/supply` — `crewship escalation supply <id>`,
  which reads the value from stdin and has no flag for it — and the agent
  is answered with the credential's name and `use: keeper_execute`. The
  value used to be encrypted into `escalations.resolution` and handed back
  to the agent in plaintext by the wait endpoint, landing in its stdout,
  transcript and model context; that column is no longer written for a
  `CREDENTIAL` escalation, historical rows hold `[credential submitted]`,
  and `/resolve` answers **400** to any resolution text on one. New
  `credentials.handle_only` marks a credential the agent may use but never
  read, enforced at the shared delivery loader on every path, Keeper on or
  off. Agent prompt, inbox card, escalation card and docs updated.
- **A handle-only credential supplied on a running server is usable at once, not only after a restart (#2391).**
  A handle-only credential's only usage path is `/keeper/execute`, which read
  the plaintext from the Keeper secrets store — a map loaded once at boot
  (`type='SECRET'` rows only) and never refreshed. Every credential from the
  #2376 ask→supply flow becomes `ACTIVE` after boot, so it was absent from the
  store and an `ALLOW` returned `500 credential not available in secrets
  store`: the agent was granted a credential it could not use until the next
  restart, and a handle-only credential of a non-`SECRET` type never entered
  the store at all. `/keeper/execute` now falls back to a live vault decrypt on
  a store miss — the same source, key and ciphertext every other delivery path
  already reads at request time — after the credential has been re-validated
  `ACTIVE`, assigned and lease-live, and refuses a pending sentinel. Fails
  closed either way; the store stays a boot cache.
- **`crewship issue update --force` follows the 409 the terminal-children rule
  sends (#2382).** #2377 taught the server to refuse moving a parent to
  DONE/REVIEW while a sub-issue is live and to say "retry with ?force=true";
  the CLI had no way to do that. It does now, and the override is recorded
  as the same receipt the API writes.

- **`crewship issue comment --mention` writes a real mention; `issue get` and `issue runs` stop hiding owner/delegate and mission attribution (#2321).**
- **The Track A live validation is on record, and the PRD says what it found (#2331).**
  `docs/prd/reports/track-a-live-validation-2026-09-03.md` lists, package by
  package, what each Track A change did on a factory-reset dev1 — including
  the two Stop defects (#2312, #2315) and the CLI gaps (#2313) that ten green
  test suites had not seen — and the PRD's A1 row, A1 status and §24.1
  coverage-trap section now cite them.

- **Stop now reaches a run that is still queued (#2317).** `issue stop`
  stamped only `PENDING`/`RUNNING` assignments, so a run parked as `QUEUED`
  — behind the agent's live run (#2269) or the crew budget — was missed:
  once the agent freed up, the pump started it and it landed `COMPLETED` on
  an issue that already read `CANCELLED` (seen live on dev1). Stop now stamps
  every non-terminal assignment, and the queued row is recorded `CANCELLED`
  without ever starting its exec.

- **Erasing a user left them named on four Pages tables (#1976).** The
  Article 17 cascade transferred the subject's pages and stopped, so
  `page_versions.author_user_id`, `page_grants.granted_by_user_id`,
  `page_public_tokens.created_by_user_id` and
  `page_webhooks.created_by_user_id` still carried the name of a person whose
  SAR ticket had been closed as "erased" — and the public links and inbound
  webhook tokens they had issued were still live. Every one of those columns
  already declares what should become of it when the human goes away (three
  `ON DELETE CASCADE`, one `SET NULL`), and none of them ever fired, because a
  workspace-scoped erasure deliberately never deletes the `users` row. The
  cascade now runs those declared actions itself, inside the erased workspace
  only: the page version keeps its history and loses its author, while the
  grants (including grants naming the subject), public `/p/{token}` links and
  webhook tokens are revoked by removal and stop working at once. The receipt
  and the `gdpr_actions` audit row gained a count per table with the verb in
  the key (`page_versions_anonymised`, `page_grants_removed`,
  `page_public_tokens_revoked`, `page_webhooks_revoked`); an anonymised row is
  not counted in `rows_deleted`, because nothing was deleted. Each revocation
  also writes the same journal entry the ordinary revoke path writes, so the
  operator can still see *which* page a crew lost access to and *which*
  integration the erasure just broke — carrying `fire_count` and
  `last_seen_at` with it, since the row that held them is gone, and
  deliberately never writing the subject's own id into a table the erasure
  cannot reach. `docs/security/gdpr.mdx` now states the contract the erasure
  keeps, and — equally important for anyone answering a strict RTBF request —
  the three kinds of row that still name the subject afterwards, plus the
  longer tail tracked in #2308.

- **The 1.0 known limits are written down where users read (#2299).** The
  issue-mentions, routines and issue-detail guides now say plainly what Track
  A deliberately left for 1.1: a busy agent is woken after its live run rather
  than interrupted, and a chat to it bounces `agent_busy`; the routine
  webhook and direct agent-run routes are not yet behind that guard; routine
  runs are missing from the Runs view (#2284); there is no cross-run
  continuity; Stop is cooperative; and `DONE`/`COMPLETED` are still two words
  for finished. The mentions guide also stops saying nothing is ever queued —
  since #2269 a mention of a busy agent is.

- **An issue's owner and its delegate are two columns, not one polymorphic
  assignee (#2297).** `missions` carried `assignee_type`/`assignee_id`, so
  delegating an issue to an agent overwrote the person who owned it — the UI
  then showed the agent where the owner had been, and unassigning left a
  stale `assignee_type` behind. `missions.owner_user_id` and
  `missions.delegate_agent_id` are now separate nullable foreign keys, both
  `ON DELETE SET NULL`; the migration backfills them from the legacy pair.
  Delegation writes only the delegate; `crewship issue start` refuses an
  issue with no delegate, or whose delegate is not a live agent, with a named
  400. The API returns `owner` and `delegate` objects beside the legacy
  fields, and the issue header and Properties panel render both. Unassign
  clears every one of the four columns.

- **The public mission-start route now checks the #1768 autonomy gate
  (#2258).** `autonomyGateApproved` was consulted from exactly one place —
  the sidecar-facing `POST /api/v1/internal/missions/{missionId}/start` —
  and never from the public `POST /api/v1/crews/{crewId}/missions/{missionId}/start`
  that `crewship mission start` calls. `applyAutonomyGateDecisionTx`
  deliberately writes no marker on the mission row when a gate is denied —
  the `approvals_queue` row is documented as the *only* door — so that
  guarantee held only for agent-triggered starts. Any MANAGER (the route's
  `roleCreate` requirement) could start a mission whose autonomy gate was
  pending or had been explicitly denied, including by an OWNER, simply by
  calling the public route instead of the internal one.

  The internal route's check — fail-closed on pending/denied/cancelled/
  timed-out — is now the shared helper `refuseUnlessAutonomyGateApproved`,
  and both mission-start handlers call it, so the two routes refuse
  identically and the next start-like route added does not repeat the
  omission. A privileged human override of a hold is a separate feature
  this does not add: it would need to be explicit and audited, not an
  accident of which handler a request reaches.

### Added

- **`DONE` is now the only word for "finished" on `missions.status`; `COMPLETED` is retired (#2383).**
  Issues moved to `DONE` while the mission engine's PATCH endpoint moved an
  orchestrated mission to `COMPLETED` for the identical REVIEW→terminal
  approval, sharing one column — a decision documented in
  `docs/prd/PRD-ISSUES-AND-ROUTINES-2026.md` §3.1/§23 (D20). `PATCH
  .../missions/{id}` now writes `DONE` for both mission types; a legacy
  `{"status":"COMPLETED"}` request is still accepted and normalized rather
  than rejected. A migration backfills every existing `COMPLETED` row to
  `DONE`, and the eight-plus defensive `status IN ('DONE','COMPLETED')`
  reads across milestones, projects, and cost metrics collapse to `DONE`
  alone. Scope is `missions.status` only — `assignments.status` and
  `pipeline_runs.status` keep `COMPLETED`/`completed` untouched, pinned by
  a dedicated regression test in each package.

- **The issues board moves without a refresh, resyncs a dropped frame, and a parent waits for its children (#2377).**
  `issue.session.state`, `issue.checkpoint.written` and `run.outcome` are
  now broadcast on the workspace channel (`internal/api/issue_session_realtime.go`)
  and registered on the client allowlist (`hooks/use-realtime.tsx`) —
  before this PR none of the three were ever emitted, so an issue's session
  panel and the Runs card's status pill went stale until a manual reload.
  A new `GET /api/v1/crews/{crewId}/issues/{identifier}/events?after_seq=`
  (`crewship issue events --after-seq`) reads the B1 event log by its own
  `seq` cursor rather than `created_at`, and a client-side gap detector
  (`hooks/use-issue-event-gap-resync.ts`) calls it whenever the next
  `issue.delivery.acked` seq it sees isn't exactly one more than the last —
  the WebSocket hub's non-blocking dispatch silently drops a frame under
  load, so registering a realtime type is not the same as never missing
  one (F43). Separately, §10.4's terminal-children rule: an issue with a
  non-terminal sub-issue or plan task can no longer move to `DONE`/`REVIEW`
  without `?force=true`, and forcing past one writes a receipt — the same
  status-change activity/event row, naming who forced it and which
  children were still open — rather than a silent override.

- **The reliability editor — every §13.2 field settable, a DST-safe fire
  preview, webhook edit in place (#2372, closes #2362).** Almost every
  schedule field the backend already carried (cron/timezone, catch-up
  policy, the wake gate, the circuit-breaker threshold, the version pin,
  enable/disable) had no UI door — the create form offered name, cron,
  timezone and inputs only, and PATCH already accepted the rest (F18). A new
  reliability editor dialog exposes all of it, wired to the existing PATCH
  `/pipeline-schedules/{id}`. Two gaps that genuinely had no door: (1) a
  next-five-fire-times preview, computed server-side by a new stateless
  endpoint (`GET /pipeline-schedules/preview?cron_expr=&timezone=&count=`,
  `crewship routine schedules preview`) built on the existing
  `pipeline.NextOccurrences` helper — proven against real IANA tzdata across
  both `Europe/Prague` DST transitions (spring: the nonexistent local hour
  is skipped entirely; autumn: the ambiguous hour fires twice, exactly one
  hour apart in UTC); (2) webhook editing (F21) — `PATCH
  /pipeline-webhooks/{id}` changes name, target, inputs_template, enabled
  and rate limit in place, with signing-secret rotation as one explicit,
  opt-in field (`rotate_secret`) and the token/public URL **never** rotated
  by this endpoint under any input (`crewship routine webhooks update`).
  Concurrency (`concurrency_key`/`max_concurrent`) is a routine-wide DSL
  field, not per-schedule, so the reliability editor shows it read-only with
  a pointer to the routine's own Editor tab rather than adding a control
  that would silently change every trigger of that routine at once.

- **The attention contract — server-side thread merge, versioned receipts, and a digest (#2378).**
  `inbox_items` gains real `thread_key` / `attention_class` / `actions_json`
  columns (PRD-ISSUES-AND-ROUTINES-2026 §12, work package B10) instead of
  the payload-only fields B6 introduced; `internal/inbox.WriteThreaded` is
  the one write path every attention-contract producer (the a4
  trigger-failure kinds, B6's `run_needs_human`, B8's routine receipts, and
  the autonomy-gate/webhook/schedule/automation escalations) shares — a
  second write under the same `(workspace_id, thread_key)` merges into the
  open card instead of raising a sibling, and `internal/inbox.
  ResolveByThreadOrSource` resolves a merged card via the thread when the
  caller's own `(kind, source_id)` isn't the row's stored identity. This
  fixes the exact duplicate the B8 live check found on dev1: one `routine
  save --draft` on a risky routine used to raise BOTH the governance
  "proposed for review" card and the B8 "trigger ready" receipt — they now
  share one thread and collapse to one card carrying both asks and the
  version. `routine_version` (nullable) lands on `approvals_queue` and
  `pipeline_waitpoints` (§9.8) so a decision about a routine's authored
  definition names the version it decided on, stamped by the autonomy-held
  agent-schedule path and by every `wait: approval` step. `internal/inbox.
  StartDigestScheduler` closes F30 — `user_notification_prefs`' `'digest'`
  state has been schema-legal and unimplemented since it shipped; every few
  hours it now refreshes one per-workspace card summarizing the quiet
  `SUCCEEDED`/`NO_CHANGE` runs from the last rolling day, skipping workspaces
  with nothing to report. `GET /api/v1/inbox` and `GET /api/v1/inbox/{id}`
  (and their CLI counterparts) now return the three new fields. `/inbox-v2`
  drops one of its two `GET /api/v1/inbox` calls (`active` + `resolved` used
  to each round-trip separately; both now come from one `state=all` fetch) —
  the approvals poll and the missions walk F28 also named are unchanged and
  stated as follow-up.

- **Atomic routine authoring — routine, version and trigger commit together (#2367).**
  `save_routine` (and the user/CLI/internal save endpoints) now accept an
  optional `trigger` block; `pipeline.Store.SaveWithTrigger` creates the
  routine, its version, and a cron schedule in ONE transaction — a bad cron
  expression or timezone rolls the whole save back, proven through the
  public API. The save response (and the routine-author skill's final
  message) names the trigger's first fire time. `"activation": "draft"`
  creates the trigger disabled and raises exactly one MANAGER+ inbox item
  whose payload pins the routine version it was created against;
  `POST /api/v1/workspaces/{ws}/pipeline-schedules/{scheduleId}/activate`
  (`crewship routine schedules activate <id>`) turns it on and resolves that
  item. `pipeline_schedules.activation` (new, nullable) distinguishes a
  draft awaiting its first approval from an ordinary disabled/breaker-tripped
  schedule. Webhook and automation-binding trigger kinds are not yet
  supported by this endpoint — only `schedule` and the explicit `manual`
  no-op.

- **One event log per issue, and a durable session per (issue, agent) (#2336).**
  `mission_activity` was a status-change audit table with no CHECK on
  `action`, no `workspace_id`, and two writers (`assignments_run.go`,
  `orchestrator/mission_tasks_completion.go`) that INSERTed straight into it,
  bypassing the shared emitter. It now carries `seq` (`UNIQUE(mission_id,
  seq)`, allocated by one race-free helper — `internal/missionactivity` —
  every writer goes through), a backfilled `workspace_id`, `payload_json`,
  `source_kind`/`source_id`, and a CHECK on `action`. A new
  `issue_agent_sessions` table (`UNIQUE(mission_id, agent_id)`) gives every
  (issue, agent) pair a durable cursor: a mention resolves or creates one
  rather than ever minting a second, pinned to the agent's config version at
  creation. `GET /api/v1/crews/{crewId}/issues/{identifier}/sessions` and
  `crewship issue sessions <identifier>` expose it. Foundations only
  (PRD-ISSUES-AND-ROUTINES-2026 §9.1/§9.2, work package B1) — no delivery/
  wake loop and no session-exclusivity index yet; that is B2/B3.
- **Issues, missions and an issue's runs page with `?limit=&offset=`, publish the total in `X-Total-Count` / `X-Limit` / `X-Offset`, and `?q=` searches on the server** — the board printed the size of the page it received (#2302).
- **An issue's runs carry `run_id`, `trace_id`, `agent_id` and `agent_slug`; `/api/v1/runs` rows carry `mission_id`, `mission_identifier` and `crew_slug` and filter by `?mission_id=`; `/api/v1/journal?mission_id=` accepts the issue identifier** — the issue → run → journal path had no ids to follow (#2302).
- **CLI: `issue list`, `mission list` and `issue runs` take `--limit`/`--offset` and end a table with "showing 1–50 of 1 015"; `issue runs` shows the run id; `history --issue ENG-4` and `journal --mission ENG-4` take the identifier; `mission list --crew X --search Y` now searches and counts on the crew-scoped list too** (#2302).
- **The issue detail lists every run with a status word and links the run, the agent, the crew and the issue's journal; the routine chip links `?slug=`** — it showed the newest run alone with a name nothing linked (#2302).
- **`/routines` and `/activity` keep their selection in the URL** — a reload resumes the routine or the walk, Back closes it, and a drill-down can be linked; `/routines?routine=` still lands; a bare `/activity?run=` resolves its routine from the journal; the run page links its routine, issue, agent, crew and journal, and the agent link no longer points at a dead route (#2302).
- **`/journal?mission_id=ENG-4` narrows the timeline to one issue with a clearable pill that links the issue; an expanded row links its issue; the Runs tab shows the issue each run worked on and links the crew** (#2302).
- **The crews screen says how big the fleet is, and what needs you (#2318).**
  `/crews` used to show the API's 100-row window as the whole workspace —
  "100 crews" on 103, and a deep link past the window said "not found". The
  explorer now reports the real total, groups crews by what needs a person
  (Needs attention → Running → Idle), folds every group after six, counts
  search matches and says when nothing matches. A crew canvas opens with a
  "Needs you" strip — rebuild pending, a credential whose CLI is missing from
  the image, an MCP server without a credential, an agent in error or waiting
  — each row with the one action that resolves it (Build now, Install, Connect,
  Inspect, Review). The agent's decision banner has its button, the Issues
  cell no longer links to a 404, the roster fits a phone, and the onboarding
  guide is no longer the first row of the fleet.
- **Crew tools on Integrations, and Connect (#2318).** Crew-scoped MCP servers
  lived on neither tab of `/integrations`; Tools (MCP) gains a Crew tools
  section listing each server with its crew, bound agents and auth state, and
  *Connect* binds a vault credential or an OAuth token to every agent in the
  crew. The page's rail now opens as an overlay on a phone. A crew's
  Settings → Integrations shows the auth state it used to leave blank.
- **Deleting and revoking ask properly (#2318).** Deleting a crew or an agent,
  removing a skill or a credential from an agent, deleting a notification
  connection and revoking or removing a Composio account no longer use the
  browser's `confirm()`. One dialog says what is lost, what is kept and where
  to recover; deleting a crew asks for its slug typed back; a failed action
  keeps the dialog open.
- **One status pill (#2318).** The agent canvas, the roster, the explorer,
  the notification connections and deliveries and the Composio accounts all
  read their state through the shared dot-and-word pill; raw enums (ACTIVE,
  pending_review, never_used) no longer reach the screen, and a connection
  whose delivery log the viewer may not read says "Not checked" instead of
  "Enabled".
- **List endpoints describe their window (#2318).** `GET /api/v1/crews`,
  `/agents` and `/credentials` return `X-Total-Count`, `X-Limit` and
  `X-Offset` (bodies unchanged) and take `?q=` for a server-side search;
  `crewship crew list`, `agent list` and `credential list` take
  `--limit`/`--offset` and end with `showing 1–100 of 103 · next page:
  --offset 100` in human formats.

- **The inbox reads as decisions, and it is never blank (#2314).** A row is a
  kind pill (Question, Link, Credential, Hire, Failed run, Missed run …), the
  question without the "Agent escalation:" prefix, the crew and the agent by
  name, the age or the expiry, and a verb. With nothing open the reading pane
  carries the triage — what waits, what expires today, by crew, what is live,
  the last decisions — and empty columns say what lands there. The detail
  names the agent and the crew as links, turns every identifier into a "Where
  this came from" link (chat, run, issue, routine, crew), shows the https
  address a LINK escalation asks to open and the name a credential proposal
  asks for, and says "An owner or admin decides this" instead of a role enum.
  A staged hire has Deny. The page has a SubBar with counts, a Live pill,
  History and Decide next.
- **Chat says who you are talking to (#2314).** The header is the agent — face
  with a status dot, name, status word, role, crew link, model label, skills ·
  credentials · runs — with Copy link instead of a raw session id. An empty
  conversation shows the agent card and "What <name> can do" from its skills;
  a routine step's empty transcript says so instead of "Start a conversation".
  The breadcrumb is Crews / <crew> / <agent> by name, never the slug and never
  the onboarding Guide's identifier. The column says "13 more with Riley ·
  Show all" from the server's total, and lists agents not yet talked to as
  rows with Start.
- **Escalation inbox rows say what they ask for, chats page, the Guide stays out
  of rosters (#2314).** The inbox payload carries `link_url` and
  `credential_name` (never the value); `crewship inbox get` prints them.
  `GET /agents/{id}/chats` honours `limit`/`offset` with `X-Total-Count`
  (`crewship chat list --limit/--offset`). `GET /agents` hides the setup
  crew's agent unless `include_setup=1` (`crewship agent list --include-setup`).
- **Duplicate deliveries collapse to one run, and a mention is acknowledged
  before any model call (#2337, #2338).** `mission_comment_mentions` is now
  also the delivery table (PRD-ISSUES-AND-ROUTINES-2026 §9.3, work package
  B2): `comment_id` is nullable, `event_id` links a delivery to the
  `mission_activity` row that raised it, and a new `state` column
  (`pending`/`claimed`/`consumed`/`failed`/`superseded`) tracks whether a
  run actually consumed the delivery — a separate question from
  `dispatch_state`, which only says whether the dispatcher created one.
  `UNIQUE(event_id, agent_id)` plus a claim/consume CAS (copied from
  `PendingRunStore.MarkFired`'s error-handling shape) means ten concurrent
  deliveries of the same event produce exactly one run. On comment, the
  server now writes the event and delivery and pushes
  `issue.delivery.acked` on the workspace channel before `dispatchOne` is
  ever called, so a human sees their mention was received without a
  refresh — even while the agent is still finishing a prior turn. Gated by
  the `issue_deliveries` feature flag, which degrades to the exact pre-B2
  dispatch when off. `mission_comment_mentions` keeps riding backups
  (`IntentInclude`) rather than switching to `notification_deliveries`'
  exclude-operational classification — the audit-trail cost of losing
  mention history outweighs the automatic-recovery benefit, so a delivery
  left `claimed` across a restore stays that way until B4's lease sweep
  ships (`internal/backup/intent.go`'s F37 comment on the table).
- **One active turn per session — a mention on a busy issue queues instead of racing a second run, and is folded into the next one for real (#2342).**
  A partial unique index, `idx_assignments_one_active_per_session` on
  `assignments(session_id) WHERE status IN ('PENDING','QUEUED','RUNNING')`,
  makes invariant I2 (PRD-ISSUES-AND-ROUTINES-2026 §9.4, work package B3)
  a database guarantee rather than a read-then-write check a fast second
  comment could still race past. `resolveOrCreateIssueAgentSessionTx` and
  `insertCappedAssignment` now run inside one transaction
  (`resolveSessionAndInsertAssignment`), closing the exact TOCTOU window
  §9.4 named between resolving a session and inserting its run. A second
  `@mention` that lands while the session's run is still `PENDING`,
  `QUEUED` or `RUNNING` never starts a second run: `insertCappedAssignment`
  turns the constraint violation into a typed `*sessionBusyError` naming
  the run already holding the slot, rather than a raw SQL error reaching
  the caller. Its delivery is left `pending`, not claimed by the run
  already in flight — that run captured its own task as a value at
  dispatch time and cannot see a comment that arrived after (there is no
  live-injection channel into a turn already in progress; steering a live
  turn is still future work), so claiming it there would mark the comment
  `consumed` before anything had read it. Instead, the moment that run
  actually finishes, `dispatchQueuedFollowUpsForSession`
  (`internal/api/issue_session_followups.go`, called from
  `finishAssignment` right after the existing B2 `consumeDeliveriesForRun`)
  folds every delivery still queued for that session into exactly ONE new,
  real dispatch — with their text in that run's own brief before its exec
  starts — and claims them under it, so they are marked `consumed` only
  once something has actually read them: two comments 2s apart produce one
  run and two consumed deliveries, and ten produce one run and ten.
  `docs/guides/issue-mentions.mdx`'s known limits and
  `docs/api-reference/issues.mdx`'s Sessions section say what changed.
- **A killed process's runs recover in seconds, not at the next restart, and never steal a live replica's run (#2348).**
  `assignments` gains `lease_owner`/`lease_expires_at` (PRD-ISSUES-AND-
  ROUTINES-2026 §9.4, work package B4): the process actually driving a
  RUNNING assignment stamps its identity and a lease deadline, then renews
  it every 20s from a heartbeat goroutine that wraps the agent exec —
  stopped automatically the instant the run ends, however it ends. A new
  sweeper (`AssignmentHandler.SweepExpiredLeases`/`StartLeaseSweeper`,
  copied from `harbormaster.StartTimeoutSweeper`'s ticker-plus-DB-sweep
  shape) reaps a RUNNING row within roughly one lease TTL of its owner
  going silent, through the same completion path (`failInterruptedAssignment`)
  the existing stuck-RUNNING sweeper uses. This is F8's actual fix, not
  just a faster timer: boot-time `RecoverInterruptedRunning` used to fail
  every RUNNING row older than the *recovering* process's own start time —
  sound for one process, and wrong for two, since nothing recorded which
  process owned a run. It now never touches a row whose lease a different,
  still-live process is actively renewing, no matter how long ago the
  recovering process itself booted; only a genuinely lease-expired (or
  lease-less legacy) row is recovered. `issue_agent_sessions.state` now
  actually moves with its runs — `pending`/`idle`/`awaiting_input`/`error`/
  `stale` → `active` on a claimed run, `active` → `idle` (completed or
  cancelled) or `error` (failed or lease-expired) once it ends — visible
  through `crewship issue sessions` and `crewship issue runs`, both
  unchanged endpoints. An ephemeral agent that expires mid-session
  (`ReconcileExpiredEphemeralSessions`, riding the same sweeper) closes or
  errors its session instead of leaving it rendered `active` over a ghost
  (F41). Folded in: `crewship issue runs`' `source` column mislabelled a
  B3 follow-up run `delegation` instead of `mention` — it only ever
  touched `mission_comment_mentions.claimed_by_run_id`, never
  `.assignment_id` (#2344).
- **An agent that wakes on an issue gets a bounded context pack instead of nothing, and can finally read the comment thread it was woken for (#2353).**
  `agent_session_checkpoints` (PRD-ISSUES-AND-ROUTINES-2026 §9.5, work
  package B5) is the structured `done`/`plan`/`facts`/`blockers`/`next_step`/
  `confidence` state a session-bearing run reports at the end of every run
  (enforced the way HANDOFF is enforced, with `parsed=false` recorded rather
  than guessed when a run does not comply); `GET .../sessions/{sessionId}/checkpoints`
  and `crewship issue checkpoints <identifier> [--agent]` read it back. Every
  session-bearing dispatch now assembles a §11.1 context pack — the issue
  snapshot, the session's latest checkpoint, and the `mission_activity` delta
  since `last_consumed_seq` (oldest-first, `#seq · actor · kind · text`) — and
  appends it to the run's brief inside the same `<untrusted>` fence (and
  Lookout injection scan) an ordinary mention comment already gets, closing
  F40 for stored content replayed into a later wake. The delta degrades to a
  terser one-line-per-event render rather than being silently dropped when it
  overflows its ~1200-token budget, and the path actually taken (`fit`/
  `summarized`/`truncated`) is recorded on the run
  (`assignments.context_pack_compaction`/`context_pack_tokens`) instead of
  only a journal entry, closing F14 for this new pack the same way. The
  session's `last_consumed_seq` only ever advances over the CONTIGUOUS range
  actually shown, never past a dropped event — a pack whose backlog is 200
  events is the same bounded size as one with 5, not 40x larger. The sidecar
  gains its missing comment-READ verb, `GET /issue/{id}/comments`, fenced the
  same way `GET /issue/{id}` already is. Mid-run delivery of a follow-up
  through the steering queue (F3) is out of scope for this package and is
  tracked separately as B3b (#2350).
- **The outcome contract — one routing table, not a guess per consumer (#2358).**
  `outcome` (PRD-ISSUES-AND-ROUTINES-2026 §9.6, work package B6) lands on
  both run tables — `assignments` and `pipeline_runs` — as a CHECK'd column
  with the seven-value vocabulary (`NO_CHANGE`, `SUCCEEDED`, `WORK_CREATED`,
  `PARTIAL`, `NEEDS_HUMAN`, `FAILED`, `CANCELLED`), parsed from the agent's
  EXISTING structured hand-off — the `---CHECKPOINT---` block a session-
  bearing run already emits (B5), or the `---HANDOFF---` block a mission-task
  run emits — rather than a second, invented block. A run that ends cleanly
  but reports no recognised outcome is recorded `FAILED` with `error_message`
  set to `"no outcome reported"`: an absent outcome is a bug, not a silent
  success. The §9.6 routing table is implemented once
  (`internal/orchestrator/outcome.go`) and used by every consumer:
  `NEEDS_HUMAN` raises exactly one `run_needs_human` inbox item with a §12
  action contract and moves the issue session to `awaiting_input` — the
  transition B4 named as unreachable without this column; `NO_CHANGE` and
  `SUCCEEDED` create no inbox item; the terminal `run.*`/`assignment.*`
  journal entries carry it. `issue runs` / `crewship issue runs` and the
  routine run surfaces (`GET .../pipeline-runs/{id}`, `run-records`,
  `crewship routine records`) all expose it.
- **Hard termination — Tier 2 stop signals the run's own process, not the crew's shared container (#2363).**
  `crewship issue stop` (and `POST .../issues/{identifier}/stop`) gains an
  opt-in `--hard`/`?hard=true` (PRD-ISSUES-AND-ROUTINES-2026 §10.3, work
  package B7): after the existing Tier 1 cooperative stamp lands, every
  `RUNNING` assignment it reached gets its live exec resolved to an OS pid
  (`ExecInspect`, now exposed as `provider.ExecPIDProvider`) and that pid
  signalled — `SIGTERM`, then `SIGKILL` after a short grace period — from a
  brand-new exec into the *same* container. There is still no `docker kill`
  on the container itself, because one container is shared by the whole
  crew; only the one resolved pid is ever touched, so a sibling agent's own
  exec keeps running. `assignments.exec_id`/`exec_container_id` persist
  which exec is a run's live process the moment it starts;
  `hard_stop_at`/`hard_stop_result` and a new `assignment.hard_stopped`
  journal entry record what was signalled and the result
  (`TERMINATED_TERM`, `TERMINATED_KILL`, `ALREADY_EXITED`, `NOT_FOUND`,
  `UNSUPPORTED`, `ERROR`). The Tier 1 stamp always lands first and
  independently, so a run that races the signal — or a provider that
  cannot support Tier 2 at all — still ends `CANCELLED` (outcome
  `CANCELLED`, B6) either way.
- **The setup wizard reads like a product, not a form (#2305).** Real brand
  marks for the toolchains, a Before-you-start checklist, Claude Code as the
  one fully supported toolchain with the experimental ones behind a disclosure,
  a live hint that tells an account API key from a CLI token, and a Guide chat
  that opens on a greeting with starter prompts in the chosen language. Every
  disabled Continue/Launch says why, Skip asks first, an unreachable Guide is
  explained, and a reload after Create keeps Launch reachable without deploying
  a second crew. The proposal card shows the crew's icon and every agent's
  full name, role and model.
- **One model catalog for the binary and the web (#2305).** `config/models.json`
  is the only list of models Crewship offers; the Go curated set, the Guide's
  crew-sizing tiers, housekeeping models, routine execution tiers, the
  `crewship setup` defaults and every web picker read it. The Go side no
  longer offers gpt-4o or gemini-1.5 while the web offers GPT-5.5 and
  Gemini 2.5; the onboarding picker offers every curated Claude model with
  Sonnet 5 recommended.
- **The Guide can see the workspace and give a crew a face (#2305).** A
  read-only `workspace_overview` tool (backed by
  `GET /api/v1/internal/workspace/overview`) returns crews with agents, icons
  and models, routines, pages, open issues and credential providers by name.
  The proposal marker may carry `crew_icon`/`crew_color`, validated against
  the crew icon vocabulary; the card and the created crew take that look.
- **A dashboard that answers in order (#2305).** A bridge strip (fleet, spend,
  runs, what waits on you, next run), attention rows with a verb each, fleet
  cards with the crew icon, agents with status dots, spend and a run sparkline
  — priority-ordered, capped at six and folded for a fleet of a hundred — a
  live journal ticker under Running now, four KPIs, a work snapshot with the
  issues board, the pages strip and a system grid. Spend is the metered
  ledger and says "not metered" rather than "$0.00".
- **Shared UI primitives for every screen (#2300).** One status pill
  (`StatusPill` + `formatStatus`), one map of where every object lives
  (`entityHref`, `refHref`), one inline empty state, a promoted sparkline, a
  paging hook that reads the new `X-Total-Count` header, and 44px tap targets
  in the sidebar kit under a coarse pointer. The paging convention
  (`?limit&offset`, `X-Total-Count`/`X-Limit`/`X-Offset`) ships with its
  server helper and CLI list footer (#2302).
- **Pages name their silent producers; Admin findings carry an action (#2304).**
  A page header links its owner crew and every producer behind a panel that
  has never been produced. Each admin posture finding shows what to do about
  it, and a crew or member count over the licensed limit turns red and states
  the consequence.
- **`crewship admin seed-inbox` fills the inbox with one row of every kind.**
  The inbox has no create endpoint — every row is written by a producer, so a
  fresh workspace shows an empty inbox and there is no way to see how the
  views, facets and reading pane behave against real variety. Reviewing the
  surface against two rows is guesswork. Rows go in through `inbox.Insert` and
  `harbormaster.Enqueue`, the same writers the real producers use, so what
  lands is shaped like production data rather than hand-built SQL that agrees
  with whatever the UI expects. Host-side like the rest of `admin`, behind the
  same `--local` gate, and everything it writes carries a `seed_` source id so
  `--clear` removes exactly what it added and nothing else.
  `TestSeedInboxRows_CoverEveryInboxKind` fails when a kind is added to
  `inbox.AllKinds` without a seed row — otherwise the next person reviewing
  the inbox never sees that kind and concludes it works.

- **Saved views and a real URL contract on `/journal` (#2209).** A dashboard
  is returned to, not explored, and the journal was the one surface a query
  could not be kept on: `crewship saved-view create|list|update|delete` had
  shipped for months and `/journal` could not read or write one, so the only
  way to hold `routine:nightly-digest outcome:failed` was a browser bookmark
  — which lost the search box, because the URL mirror wrote `time`, `crew_id`,
  `agent_id`, `trace_id`, `severity`, `mute` and `tab` but never `q`. A shared
  "here is the failure I found" link arrived without the query that found it.
  The Runs tab mirrored nothing at all, so its window, status, trigger and
  page number could only be handed over as a list of buttons to press.

  `q` and the four Runs filters (`run_window`, `run_status`, `run_trigger`,
  `run_page`) are part of the URL now, filter changes `push` so Back steps
  back through them instead of leaving the page, and a saved-view chip row
  above the tabs reads and writes the same server-stored bookmarks the CLI
  does — `--shared` included, no backend change. Wrap, sort, dedup, refresh
  cadence and the stats-rail collapse deliberately stay per-user preferences:
  a link should not re-style the recipient's journal. Documented in
  [the journal guide](docs/guides/crew-journal.mdx#shareable-views).

- **The dashboard leads with what needs a human (#2185).** The landing page
  was a wall of tiles that answered "what exists" before "what is stuck". It
  now opens with a "Needs your attention" strip — approvals waiting, failed
  runs, crews held for capacity, credential gaps — each linking to the surface
  that can act on it, above a Running-now / Up-next pair, the run KPIs
  (completed, success rate, ledger spend, p95), a run-volume chart grouped by
  crew, and fleet health per crew.

  `hooks/use-dashboard-data.ts` gains the queries behind it (run insights,
  crew spend, crew service inventory, capacity holds) with the workspace gate
  and non-ok-to-empty mapping the existing hooks use, so a failed panel is an
  empty tile rather than an error state. The 24h / 7d / 30d selector drives
  every windowed query from one place.

  Windowed KPIs read agent runs (`/api/v1/runs`, journal-backed) while
  Running-now reads routine runs, so on a workspace with only one kind the
  other reads zero. That is faithful to the API rather than a bug in the page,
  and it is called out here because the two sit side by side.

- **The lifecycle-hook registry has a screen (#2162).** `/api/v1/hooks` has
  had full CRUD and a CLI since the engine landed and no web UI at any role —
  while a `shell` handler runs `sh -c` on the crewshipd host with a 30s
  timeout and no container around it, and #2137 wired ten events that
  previously registered but never fired. Settings → Workspace → Lifecycle
  hooks lists every hook with its event, handler, target, crew scope and last
  result, and carries the per-hook enable switch. The row is readable by every
  workspace member, matching `GET /api/v1/hooks`; the switch renders for
  ADMIN+, matching the write tier. Three things the screen refuses to fake:
  `blocking` is read off the event rather than the row, so a post-event that
  carries `blocking: true` in the database reads `n/a` instead of promising a
  veto the dispatcher never asks for; `pre_tool_call` rows are marked retired
  with the reason, because `ValidateEvent` refuses the event and those rows can
  never fire; and a failed read says so rather than rendering an empty
  registry. Registration, editing and a workspace-wide pause are not included —
  the last has no endpoint at all.

- **An approval can say what it would approve (#2160).** Every pending
  approval in an inbox rendered the same row. The title was the first line
  of the wait step's `approval_prompt`, which is authored boilerplate, so a
  credential rotation, a bucket deletion and a replica scale-out all read
  `"Approve this production action?"` and could not be told apart — and
  nothing on the row said what any of them would do. The concrete action
  lived in the run's inputs and never reached the inbox.

  Two author-declared fields on the wait step. **`approval_title`** is the
  one line the row shows, templated like `approval_prompt` is, so
  `"Approve: {{ inputs.action }}"` renders a different row per run. Omitting
  it keeps the old behaviour, so routines written before it are unaffected;
  the rendered title is secret-redacted and truncated on the same path the
  fallback is, because a template can just as easily interpolate a token as
  an action. **`risk_level`** is `normal` or `destructive`, and marks an
  approval whose action cannot be undone by re-running it — the row and the
  decision card both carry it.

  Both are declared, never inferred. A heuristic that reads the prompt for
  "delete" is wrong in both directions, and the direction that matters —
  calling a destructive action ordinary — fails silently. An unrecognised
  `risk_level` is rejected at save time rather than being read as `normal`.

  The seeded `approval-gate-demo` routine now declares a title, so the
  behaviour is visible on a fresh workspace.

- **Five read routes had no CLI command; now they do (#2147).** The run
  *list* was the one pipeline-run sub-resource missing a command — `logs`,
  `tree`, `metadata` and `signal` all had one, `GET
  /workspaces/{id}/pipeline-runs` did not — alongside its `changes`
  sub-resource (the Activity dock's Changes tab, a run's crew container's
  git diff) and three fleet-wide reads with no CLI surface at all.

  **`crewship routine runs-all`** lists runs of any status across every
  routine in the workspace (`--status`/`--since`/`--limit`), distinct from
  the existing `routine runs <slug>` / `routine records <slug>` (one
  routine's history) and `routine active` (in-flight only, no filters).
  **`crewship routine changes <run_id>`** joins `logs`/`tree`/`metadata`/
  `signal` as a run-scoped sub-resource; a run with no resolvable crew or
  whose crew container isn't a live git repo degrades to a plain-English
  "no git changes" and exits 0, matching the API's own degrade behaviour
  rather than erroring.

  **`crewship agent status`** and **`crewship agent load`** cover the
  fleet-wide agent-status histogram (`GET /agents/crews-status` — despite
  the route name, it counts *agents*, not crews) and the per-agent
  active/pending/token-budget breakdown behind it (`GET /agent-load`).
  Homed under `agent` rather than `crew status`, since the payload is an
  agent metric and `crew status <slug>` is already a different, slug-scoped
  shape. **`crewship system crewshipd`** probes the crewshipd sidecar
  daemon's own health (uptime, connections) over its Unix socket — a
  distinct process from the one `system health` already reports on (the API
  server itself).

- **`crewship auth pair` issues a device-code, closing a CLI↔route
  asymmetry (#2147).** `POST /api/v1/auth/pair/redeem` had a CLI caller
  (`crewship login --pair --code=…`) but the two endpoints that ISSUE a
  code, `POST /api/v1/auth/pair/start` and `GET /api/v1/auth/pair/poll`,
  had none — the CLI could redeem a pairing code it had no way to mint. The
  reverse-direction pass over `cmd/crewship/cli_route_contract_test.go`'s
  extractor that found this (`TestRoutesWithNoCLICaller`,
  `cli_route_orphan_test.go`) puts the honest count at 35 registered routes
  with no CLI caller at all, after excluding `/api/v1/internal/*` sidecar
  IPC and the browser/inbound-token surface; this PR closes two of them.

  `crewship auth pair` mints a code, prints the paste-elsewhere
  `crewship login --pair --code=…` snippet, and by default polls until the
  code is redeemed, expires, or `--timeout` (default `9m`, under the
  server's 10-minute TTL) runs out — a timeout is always a non-zero exit,
  never a tick. `--no-wait` returns immediately after issuing the code;
  `--adapter` tags it with a telemetry-only adapter hint. `--format json`
  reports `code`, `expires_at`, `status`, `paired`, and `waited`.

- **A provider is now a credential, and two new ones can be created (#2051).**
  The sidecar's LLM proxy routed on a hardcoded three-arm `strings.HasPrefix`
  switch over `/v1`, `/openai` and `/gemini`. It now routes on a compiled-in
  descriptor table (`internal/llmroute`, longest bounded prefix wins), and
  `credentials.provider` is carried end to end — into the sidecar boot payload,
  the credential loaders, the ledger key and the scrubber — so a provider is a
  row rather than a branch.

  Two arrive with it: **`OPENROUTER`** (`/llm/openrouter`, credential required,
  probed live against `GET https://openrouter.ai/api/v1/key`) and
  **`OPENAI_COMPAT`** (`/llm/openai-compat`, upstream read from the credential
  itself, unpriced). Every future provider is confined to `/llm/…`; the three
  legacy prefixes keep their exact paths and strip behaviour, pinned by eleven
  golden fixtures of the byte-identical outbound request.

  `crewship credential create` gains **`--base-url`** (required for
  `--provider OPENAI_COMPAT`, rejected for every other provider) and
  **`--auth-token-stdin`** (also on `credential rotate`), so an operator
  token never reaches the process table. Two local commands read the route
  table with no server: **`crewship provider route list`** and
  **`crewship provider route show <provider>`**. `/health` gains
  `provider_creds` and `config_fingerprint` beside — not instead of — the
  three legacy `*_creds` counters.

  ⚠️ **Behaviour change: proxied agent calls start billing for real.** See
  *Changed*, below. This is the release's most consequential line and it
  reaches operators who changed nothing.

- **One shell for every create surface, and a `/design` route to audit them
  (#2056).** Twelve create entry points that had each grown their own dialog
  are now one kit (`components/layout/create-surface.tsx`): four fixed widths,
  a bottom sheet below `sm`, ⌘↵ to submit, and a discard guard on Esc, overlay
  and header-close. `/design` is the scaffolding that tracks the migration and
  the browser-vs-CLI parity gap — it holds no data, calls no API, has no CLI
  command, and is meant to be deleted with `components/features/design/` once
  its table is empty. It is linked from the sidebar under System so the gap is
  visible rather than filed.

  Three things became reachable from the browser for the first time:
  **importing a crew manifest** into New crew (parsed client-side, and it names
  what it cannot create rather than pretending — "This file also declares 2
  agents and 1 credential", pointing at `crewship apply -f`); **per-agent
  tools and notification channels** on New agent; and **creating a label from
  the issue modal**. The crew wizard is four steps, not five — Runtime folded
  into Container — and "Empty crew" is now "Start empty".

  ⚠️ **Behaviour change: New crew now defaults to `network_mode: "free"`.**
  The wizard's initial state flipped from `restricted`; the server-side
  default in `internal/database/crew_defaults.go` is untouched, so anything
  that creates a crew *without* stating a mode still gets `restricted`. Only
  the wizard's pre-selection moved, and the copy beside it now says what free
  means ("Any host, plus your private network and localhost. Cloud metadata
  stays blocked.").

- **Multi-provider phase 1: two codecs, an embedded catalogue, and the CLI to
  see them (#2016).** `internal/llm`'s three-arm switch became a registry of
  `ProviderSpec` rows read by the aux-slot builder, the Keeper validator, the
  console picker and the error message that tells an operator what they may
  type. Three ids are registered — `anthropic`, `openai`, `ollama` — and
  lookup is case-insensitive, which the old switch was not while `internal/api`
  carried the uppercase enum one layer up. The two hand-written HTTP clients
  became configurable codecs, so any OpenAI-compatible backend (DeepSeek,
  vLLM, llama.cpp, Ollama's `/v1` shim) is a preset rather than a new file.

  A trimmed [models.dev](https://models.dev) snapshot ships embedded — eight
  providers, ~650 KB, refreshed by `go generate ./internal/modelcatalog/...` —
  and becomes the third step of the rate lookup, below the hand-verified table
  and its `<provider>/*` wildcard so `ollama/*` and `local/*` stay free.
  Three local commands read all of it with no server, token or workspace:
  **`crewship provider list`**, **`crewship provider check`** and
  **`crewship model price`** (which prints *which* lookup step produced the
  rate). `crewship model list` gains `--source auto|live|catalog` and
  `--search`, and answers offline for providers the server cannot reach.

  ⚠️ **Behaviour change: an evaluator slot can move provider, and a call
  within budget can now trip a cap.** See *Changed*, below.

- **Run a routine from a slash command, with a form for its inputs (#1987).**
  A routine may opt in with a `spec.slash` block (`enabled`, `label`,
  `label_cs`, `icon`); it then appears as `/<slug>` in the chat palette and in
  `crewship shell`, opening a typed form built from the routine's declared
  `inputs` — widget and coercion chosen from each input's JSON type, help text
  from its description, defaults formatted losslessly. In the REPL the same
  thing is `/<slug> key=value key=value`.

  A new **`routine.run`** capability decides who may ask, so a MEMBER can
  invoke a routine without being promoted to MANAGER
  (`crewship workspace member capabilities grant <user> routine.run`;
  it is in the `power` and `admin` bundles). Everything else still applies to
  an admitted caller — governance status, credential and integration
  preconditions, spend caps, concurrency.

  Three limits are worth knowing. The run endpoint is **synchronous**, and the
  REPL drives it through the CLI's 30 s default timeout, so a longer routine is
  cancelled client-side unless `CREWSHIP_HTTP_TIMEOUT` is raised. The
  routine's **output is not shown on either surface** — you read it in the run
  records. And the catalogue is capped at 50 routines, ordered by popularity,
  with a slug that collides with a platform command (`routine`, `issue`,
  `skill`, `credential`) dropped.

  `spec.slash` was documented before this and silently dropped by
  `crewship apply`, so export→edit→apply *stripped* a block set from the
  dashboard. It now round-trips. `crewship shell` also gains the server
  catalogue at all: `LoadServerSlashCommands` had no production caller, so the
  REPL half of the slash feature did not previously exist.

- **A page can be published, webhooked, exported, imported and deleted from
  the browser (#2054).** Those were CLI-only. New settings cards cover public
  links (with expiry and password; revoked rows are kept with their withdrawal
  time rather than vanishing), webhook mint/revoke, export and delete, plus
  revoking every access level for a subject in **one** DELETE — three
  sequential revokes leave a window open in between. Import renders a 422
  refusal as the worklist that caused it, not a toast.

  `crewship page create` gains **`--owner crew/<slug>`**, create-only on
  purpose: `page update` never sends it, so re-applying a manifest can never
  be a silent transfer of ownership. `crewship page get` now prints the
  authored half of each panel — `tab`, `public`, wake gates, `on_fail`,
  `refresh`, action count — which `--format json` already carried. The demo
  seed ships four pages, one per producer door (script, routine, agent,
  webhook) instead of showing one door of the four.

- **The wake-time system prompt now shows its own memory budget (#2135).** Every
  tier injected into a session's opening prompt — `Pins`, `Crew`,
  `Workspace`, `Agent` — now reports how many bytes of its allotted
  slice it used and what percent that is, plus a `Total` line, in a new
  `[MEMORY BUDGET]` block placed right before `[MEMORY INSTRUCTIONS]`. The
  wording matches `memory.write`'s existing overflow-guidance usage string
  byte for byte, unit included (`<used> of <cap> bytes, <pct>%`): both
  meters count `len(string)` bytes, and the budget these tiers are
  actually enforced against is itself byte-denominated, so "bytes" is the
  only label that describes what is measured and capped — an earlier
  draft of this meter said "chars" while still counting and enforcing
  bytes, which reads as accurate for pure-ASCII content but is wrong for
  anything else (this product carries Czech text throughout). A
  percentage that would round down to 0% for real, non-zero usage now
  floors to 1% instead. When the budget forced a tier's trailing content
  to be dropped — previously silent — the meter now says so by name
  (`Truncated to fit: Agent — trailing content in it was dropped, not
  just hidden.`), and truncation itself is now rune-aligned so a cut can
  never sever a multi-byte UTF-8 character and hand the model invalid
  text. A separate `Read incomplete: Workspace` clause covers a distinct
  failure the truncation notice can't: a stalled or slow workspace
  filesystem read that times out mid-scan, which previously came back
  indistinguishable from "there just wasn't much workspace memory" — the
  model is now told the read did not finish rather than being left to
  assume it saw everything. The default 15,000-byte budget, the per-tier
  allocation ratios, and the truncation policy itself are unchanged; this
  only makes the existing behaviour visible to the model, honestly.

- **`crewship auth profile` — the one self-service profile mutation with no
  CLI command (#2147).** `PATCH /api/v1/users/me` (edit your own display
  name) has existed alongside `auth passwd` and `auth avatar` since #867.1,
  but had no CLI surface. `crewship auth profile --full-name "Jane Doe"`
  fills the gap, printing the updated profile and honoring the global
  `--format` flag like every other reporting command.

- **Three more endpoints get the CLI command the "every endpoint gets a
  command" rule requires (#2147).** `crewship feature-flag` could list,
  delete, enable, disable and inherit a flag but had no way to create or
  update the definition itself — `POST`/`PATCH /api/v1/feature-flags` were
  reachable only via the web UI, a direct API call or a manifest `apply`.
  `crewship feature-flag create` and `crewship feature-flag update <key>` now
  wrap them; `update` sends a partial `PATCH` carrying only the flags you
  passed, matching the contract `admin memory-config set` already
  established. Two admin console reads also had no client: `crewship admin
  workspaces` (`GET /api/v1/admin/workspaces` — the current workspace with
  member/agent/crew counts) and `crewship admin memory-stats` (`GET
  /api/v1/admin/memory/stats` — `memory_versions` totals, byte counts and
  distinct-blob counts, broken down by tier and by agent), the companion read
  to `admin memory-config`. All three are ADMIN+ (`canRole "manage"`) and, per
  #2109, target the server the CLI is authenticated against rather than a
  local database file.

### Changed

- **The New agent dialog can create a workspace-wide (crewless) Agent; only a Lead still needs a crew (#2170).**
  `requiresCrew` was the literal `true` in `create-agent-dialog.tsx`, so every
  agent created from the browser had to be given a crew — while
  `agents_create.go:137` only rejects a missing `crew_id` for the `LEAD` role
  and `crewship agent create --crew` has always been optional. The three
  surfaces disagreed on what the product allows, and the browser was the
  strict one. The Crew field is now optional for an Agent — the picker
  carries a "Workspace-wide (no crew)" row that clears a preselection, the
  empty-workspace banner no longer tells an Agent author to go make a crew
  first, and the dialog posts `crew_id: null` — while a Lead keeps the
  required marker, the disabled Create button and the "Create a crew first
  — leads need one" hint. A crewless agent already had a home in the UI:
  `/crews` lists it under **Unassigned**. Tests cover both branches and fail
  on the literal.

- **Docs stopped contradicting the code on rollback, concurrency, and the
  monthly budget; the waitpoint approve-default asymmetry is now
  documented instead of silently differing (A5) (#2289).** No API or CLI behaviour
  changed. `docs/cli/routine.mdx` said `routine rollback` "creates a new
  version on top of HEAD" — it doesn't; `Store.Rollback` only repoints
  `head_version` (no version row is inserted), matching the CLI's own
  `--help` text, which the doc now matches too. `docs/guides/routines.mdx`
  and `docs/guides/routines-cookbook.mdx` said two same-`concurrency_key`
  requests "queue" (or "wait, or 429") — `RunRegistry.Acquire` always
  rejects the second immediately with `429` + `Retry-After`; it never
  queues or waits. That's a different mechanism than deferred dispatch's
  `--debounce-key`, which genuinely coalesces and was already documented
  correctly elsewhere — both docs now say so explicitly, and the
  concurrency-gate docs now also note it has no cross-replica
  coordination (single-process only). Separately: the authed
  `POST .../pipelines/waitpoints/{token}/approve` defaults an omitted
  `approved` to **false** (deny) while the public
  `POST /api/v1/waitpoint-tokens/{token}` callback defaults it to **true**
  (approve) — undocumented anywhere before this. Both defaults are kept
  as-is (an existing test, `TestApproveWaitpoint_NoBody_DefaultsToApprovedFalse`,
  already pins the authed default, and the public default matches its
  documented `trigger.dev wait.forToken` design) but are now spelled out
  with the security reasoning in `docs/api-reference/workspaces.mdx` and in
  both handlers' doc comments — send `approved` explicitly rather than
  relying on either default. And `MonthlyBudgetUSD` (`GET`/`PATCH
  .../pipelines/{slug}/budget`) is reporting-only — it has zero references
  in `internal/pipeline/executor.go` and never blocks a run; the enforced
  gate is the DSL's per-run `max_cost_usd`. The field name reads as
  enforcement, so rather than a breaking rename, every surface that shows
  it now says so unmissably: a `<Warning>` on the API reference, and a
  line printed by `crewship routine budget get/set/summary` and its
  `--help` text. Also fixed a stale comment in `internal/database/database.go`
  that still said `busy_timeout(5000ms)` next to the DSN pragma that has set
  `busy_timeout(30000)` since the earlier login-lockout fix.

- **The inbox column is the shared explorer now, and its filters are
  answerable.** `/inbox-v2` had a 190 px rail holding three nav rows and a
  permanent "all sources connected" block, plus three raw `<select>`s. Two of
  those three could not be honoured: "type" filtered on which of the three
  fetches a row arrived in — a client-only field, with an invented "grouped
  incidents" member — and "subject" was harvested from whatever rows happened
  to be loaded, meaning three different things at once (sender for inbox rows,
  a raw user id for approvals, agent name for missions). "Priority" is a real
  column for inbox rows only; `approvalEntry` and `missionEntries` synthesise
  it for the other two. None of the three reached the server, so a filter
  could never find a row that had not already been downloaded.

  The column is rebuilt on `components/layout/sidebar-kit` — the same
  explorer Routines, Issues, Crews and Pages use, and the same one the OLD
  `/inbox` was already built on before v2 hand-rolled its own chrome. The
  three views are a `SidebarSection` of `SidebarRow`s with counts, the way
  Routines carries its status buckets; the filter is the kit's
  `SidebarFilterPopover`, which — unlike the dropdown Routines hand-rolls —
  stays open when a facet is picked, so two facets can be combined in one
  visit. Active facets come back as removable `SidebarActiveChip`s. The
  column collapses to `w-9` like the others, and is full-width on a phone,
  where a fixed column left a dead strip beside it.

  The facets are type (the seven values of `inbox.AllKinds`, plus "approval
  gate" and "mission signal" named for what they are rather than for the
  endpoint that answered), deadline (from the real `timeout_at`, and a
  deadline further out than today answers to neither bucket rather than being
  folded into "today"), and unread. Subject and priority are not offered:
  a filter has to be answerable. Counts are exact because the feed is fully
  loaded — a comment on `facetCounts` says so, and says they must move to a
  server-side GROUP BY the day it is not.

- **A `/journal` Timeline row says who acted (#2208).** The row carried a 3px
  severity bar and a colour-coded text pill and nothing else — no avatar, no
  crew icon, no entry-type glyph. The agent name appeared only where an emit
  site happened to write it into the summary string. None of it needed
  fetching: the avatar seed and style, the crew icon and colour, and an icon
  for all 127 entry types were already in the browser and already refreshed on
  realtime events, rendered only inside the two scope dropdowns.

  The row is now seven columns — severity, time, an 18px agent avatar beside a
  15px crew icon, the entry-type icon with the full dotted `entry_type`, the
  summary, the age, the chevron. An agent the lookup cannot resolve is seeded
  from its id rather than left blank. The summary drops a leading
  `"<agent>: "` when the prefix names the agent now in the avatar, and takes
  back some of the 40px the identity columns cost it. Long entry types
  ellipsize — the catalog's median is 18 characters and its tail runs to 41 —
  with the full string on the cell's `title` and in the expanded detail.

  The avatar is gated on `actor_type`, not on whether `agent_id` is set. Four
  common entry types — `chat.user_message`, `container.snapshot`,
  `conversation.compacted`, `sidecar.stale` — emit a `user` or `system` actor
  *with* the agent id populated, because the agent is what the event is about
  rather than who caused it. Those rows get the labelled glyph, with the agent
  named in the label, so a human's message is never captioned with an agent's
  face.

  Three signals that were colour-only are now also text: severity carries a
  visually-hidden level (the bar was `aria-hidden`, and the word appeared only
  after expanding), the entry-type group carries its name, and the disclosure
  gets `aria-expanded` plus `aria-controls`. The disclosure is the chevron
  button rather than the row container — with the detail rendered inside a
  `role="button"`, the detail's own trace/agent/crew jumps were nested
  interactive content and the button's accessible name grew to include the
  entire payload JSON.

  The stats rail's "Top agents" showed shortened uuids behind a flat slate
  swatch, six agents reading as one series, with the avatar-carrying lookup
  already mounted. It renders the avatar and the resolved name, and each bar
  takes a seed-derived hue.

  `LogRow` is memoized and the virtualized list's `itemContent` no longer
  allocates a fresh closure per item per render, so a keystroke in the search
  box stops re-rendering every mounted row.

- **`/design` is gone; its audit is now a tracked document (#2165).** The
  create-surface unification proposal shipped as a page inside the product —
  no data, no API, no CLI command — and its own header said to delete it once
  the audit it carried had no rows left to fix. It is removed with rows still
  open, so the evidence moved to `docs/prd/create-surface-parity.md` rather
  than leaving with the code: all 65 ledger rows with their severity,
  reference and `fixed` history, the twelve-door divergence table, the token
  drift counts and the sweep. The document is headed with the audit date and
  the source commit so it cannot be mistaken for a regenerated report. The
  route, `components/features/design/`, the sidebar row and the `design`
  concept icon go with it, and 26 comments that cited the page as their
  specification now cite a section of the document.
- **The per-tool MCP toggle now says what it does (#2168).**
  `mcp_tool_bindings.enabled` was documented and labeled as if disabling a
  tool blocked it. On the self-hosted/legacy MCP path it never did: the
  sidecar gateway's `CallTool` has no per-tool check, so a "disabled" tool
  could still be called directly — the flag only decided whether the tool's
  name was listed in the agent's `[CONNECTED INTEGRATIONS]` prompt block.
  `crewship integration tools enable/disable --help`, the API reference, and
  the legacy integrations UI (behind `NEXT_PUBLIC_LEGACY_MCP_INTEGRATIONS`,
  default off) now say this is advisory, not access control — Composio-
  routed integrations remain the exception, enforced through Composio's own
  `allowed_tools` scope. No behaviour changed; only the claim about it.

  **Twelve of the 65 rows did not survive re-verification, and §7 of the new
  document says so.** Forty were re-read against the tree before extraction by
  six parallel audits, each asked to return FALSE / TRUE-BUT-DELIBERATE /
  TRUE-DEFECT rather than to confirm. Three were simply wrong — sidecar
  services are writable through `crewship apply`, `AssignToCrewDialog` has
  assigned a skill to a whole crew since the first skills sprint, and the
  missing `mcp_tool_bindings` cascade was fixed by migration `20260826190607`,
  three days *after* the row claiming it was written. Four had gone stale when
  the Issues create fields shipped in #2056. One cited an event,
  `pre_tool_call`, that does not exist and never could. Three more were real
  but graded `blocker` when they are documented decisions — raw MCP sits behind
  `NEXT_PUBLIC_LEGACY_MCP_INTEGRATIONS` by an intent stated in `cec5fc7a`,
  Pages panels are producer-fed by specification, and the Composio default
  connector ships with its flag off — and are re-graded in place.

  The rows stay, marked rather than rewritten: deleting a claim you got wrong
  turns an audit's own errors into a record of progress. Two things are worth
  carrying forward. A ledger nobody re-reads decays at a rate this one can now
  measure. And "the UI cannot do this" and "we decided the UI should not do
  this" rendered identically in a table with no column for intent, which is how
  three settled decisions came to be tagged as release blockers — including the
  one `CODEX-WORK-ORDER-RELEASE-1-0.md:610` records as still open.

- **⚠️ `/chat` is a list of conversations, not a tree of agents (#2069).**
  ⚠️ **Behaviour change: the left column navigates between conversations, and
  the per-agent "New session" control it replaced is gone.** The old surface
  put the roster in the primary navigation and made you pick an agent to reach
  the thing you came for — seven agents at two lines each, most with nothing to
  open, in front of the one row anybody wanted. Threads are now the top level,
  newest first, with the agent's face carrying the attribution its own row used
  to; agents nobody has talked to fold into a single "not started yet" row. The
  facets are All / Unread / Live: "Done" is gone because it read `ended_at`,
  which nothing writes, and "Live" now reads the agent's status off the
  workspace event stream instead of a column frozen at page load. Deep links
  are unchanged — `/chat/<slug>?session=` is still the shape every "Open chat"
  link and `crewship open` builds, and switching threads is a `replaceState`
  rather than a route change, so the dashboard chrome no longer rebuilds to
  look at a different name.

  The transcript changed with it: fixed gutters with agent and user avatars,
  reasoning closed by default, and the hover actions hidden until you want
  them. Chain of thought is no longer rendered open — it is available, not in
  the way. The **Files** panel hides internal files behind an explicit toggle,
  and — the reason it is in this section rather than the next — files it lists
  now actually open. Agent-written files are owned by the container's UID and
  crewshipd runs as the host user, so `List` succeeded on the directory while
  every `Read` took `EACCES`; the panel listed a full tree and answered "file
  not found" for every entry in it. Downloads now replay through the crew
  container on a permission error, the way saves have since #922, and a file
  that exists but cannot be read reports that instead of claiming to be
  missing. Four published chat guides described the surface this replaces and
  have been rewritten against the one that ships.

- **⚠️ Proxied agent calls start billing for real (#2051).** ⚠️ **Behaviour
  change: budget warnings and hard stops that have never fired on a crew can
  fire on the first deploy.** Every LLM call an agent made through the sidecar
  proxy recorded **zero tokens and $0** since the proxy was built:
  `parseLLMUsage` switched on a lowercase provider name while the proxy handed
  it the uppercase `ProviderType`, so no proxied response body was ever parsed
  — Anthropic wrote $0 rows, OpenAI and Gemini wrote none at all. Codec and
  ledger key are now separate fields on the route spec and both are correct.

  Nothing got more expensive. The spend was always there and was being
  recorded as nothing, so a ceiling that looked generous against $0 may be
  below a normal day. Before deploying, check `budget_limits` for any crew
  running proxied agents. Historic rows are **not** backfilled, so a rollup
  spanning the change is not comparable across it.

- **⚠️ `PATCH /api/v1/credentials/{id}` returns 400 where it returned 200
  (#2051).** An endpoint-backed credential holds a `{baseURL, apiKey, headers}`
  object; every other kind holds an opaque value. A PATCH that moves the
  credential across that line — `provider` to or from `OPENAI_COMPAT`, or
  `type` between `ENDPOINT_URL` and `API_KEY` — silently re-interprets bytes
  it did not send, so `value` must now be sent in the same request. A PATCH
  carrying a `value` also validates the endpoint URL for the first time, which
  it only ever did on create; a PATCH that used to accept
  `http://169.254.169.254/v1` now refuses it.

  Two smaller edges from the same PR. `credentials.provider` is folded through
  `credprovider.Canonical()` on every write, so a client that POSTs
  `provider: "github"` now reads back `"GITHUB"` — unrecognised strings are
  still stored verbatim, trimmed. And several `credential create` argument
  errors moved from a bare exit 1 to `cli.ExitValidation` (**exit 2**): a
  `--type`/`--auth-token` mismatch, a malformed `--header`, a missing
  `--value`. A script that branches on exit 1 will see 2.

  `OPENAI_COMPAT` is deliberately **not** validated on create — Crewship does
  not dial an operator-supplied endpoint from that path — and prints a warning
  saying so instead of "Key validated successfully". (#2057 later gave it the
  test it could safely have; see *Fixed*.)

- **⚠️ Rate ceilings moved, and an evaluator slot can change provider
  (#2016).** ⚠️ **Behaviour change: a call that used to sit inside a spend cap
  can now trip it.** Four fallback ceilings were below what the embedded
  snapshot says the provider actually charges and were raised — `openai`
  $20/$80 → **$150/$600**, `google` $2.50/$15 → **$4/$120**, `xai` $2/$6 →
  **$4/$12**, `mistral` output $6 → **$7.50** — and two rows were added
  (`openrouter`, `amazon-bedrock`). Models that previously billed at **$0**
  because nothing in the table named them (unknown OpenRouter slugs, hosted
  models with no row) now bill at a real or ceiling rate. The over-estimate is
  deliberate: under-billing weakens the budget signal exactly when it matters.

  Separately, `LoadAuxiliaryModels` now points each auxiliary slot at the
  first registered provider **whose key env is actually set**, before env
  overrides. An instance holding only `OPENAI_API_KEY` used to get six slots
  hardcoded to Anthropic that each failed at first use; it now gets working
  evaluators on OpenAI. An instance holding both keys keeps Anthropic —
  declaration order breaks the tie — and an instance holding neither keeps the
  shipped default and still errors loudly.

- **⚠️ A crew whose mise shims do not resolve now fails to provision (#2070).**
  ⚠️ **Behaviour change: a provision that used to succeed can now fail.**
  `mise reshim` exits 0 whether or not the shims it wrote point at anything.
  On crews provisioned before #1787 they pointed at a `mise` binary the agent
  could not read, and a dangling symlink is skipped **silently** by PATH
  lookup — so the pin served whatever the base image shipped. Measured on a
  real crew: `config.toml` pinned `terraform = "1.9"`, the agent ran
  `Terraform v1.15.7`, and nothing was logged anywhere.

  `InstallMiseTools` now verifies every shim resolves and returns
  `ErrMiseInstallFailed` naming the broken ones when they do not. Crews
  created before 2026-08-07 carry stale shims and **do not self-heal**, so
  expect their next provision to fail rather than quietly serve the wrong
  toolchain. Crews declaring no mise tools are untouched, and an empty shim
  directory is not treated as a failure. `docs/manifest/crew.md` gains the
  PATH ordering that makes a pin effective.

- **Crew template slugs are unique per workspace, not globally (#2028).**
  `crew_templates.slug` carried a global `UNIQUE` declared in v23; v26 added
  `workspace_id` and never rescoped it, so the column naming the owner played
  no part in deciding whether a name was free. Two workspaces could not both
  hold a template called `backend-team`, and — worse — a user template holding
  a builtin's slug made the seeder's `UPDATE` match nothing and its
  `INSERT OR IGNORE` collide, so that builtin was **never seeded again, ever**.

  Migration `20260820124407_crew_template_slug_workspace_scope.sql` rebuilds
  the table behind two partial unique indexes —
  `(workspace_id, slug) WHERE workspace_id IS NOT NULL` and
  `(slug) WHERE workspace_id IS NULL`. A single non-partial
  `UNIQUE(workspace_id, slug)` would not do: SQLite treats NULLs as distinct,
  so every builtin would be unique to itself no matter how many shared a slug.

  The old constraint was doing undeclared work — it guaranteed the six
  read/write sites matched at most one row, which is why four of them used
  `QueryRow` with no tie-break. The rule is now written down: **a workspace
  template shadows the builtin of the same slug, for that workspace only**,
  expressed as `ORDER BY (workspace_id IS NULL) LIMIT 1` in a shared constant.
  The tenant predicate was retightened at the same time: `is_builtin` has no
  `CHECK` tying it to `workspace_id`, so a row owned by one workspace could
  carry `is_builtin = 1` and match for every tenant — unreachable while the
  global UNIQUE stood, expressible the moment it was split.

  **Upgrade note.** The rebuild cannot fail on duplicate slugs: the old
  constraint is strictly stronger than both new indexes. It does drop one row
  class — a template whose `workspace_id` names a workspace that no longer
  exists. Such a row is an FK orphan the schema's own `ON DELETE CASCADE` says
  should not exist, and copying it would abort boot with
  `FOREIGN KEY constraint failed (787)` naming neither the table nor the row.

### Fixed
- **`crewship admin reencrypt` reaches `failed: 0` again on a database that ever answered a credential ask (#2408).** The rotation walk still listed `escalations.resolution` for `CREDENTIAL` escalations, but since #2379 that column never holds an envelope: the migration rewrote every historical answered ask to the plaintext marker `[credential submitted]`, supply resolves with `NULL`, and expiry, cancel and auto-resolve always wrote plaintext prose there. Every such row counted as `failed`, the CLI exited non-zero, and the runbook's "failed=0 ⇒ retire the old key" gate could never be met. The column is out of the inventory; the rows are left exactly as they are.
- **Hosted OpenAI auxiliary calls now use `max_completion_tokens` (#2015).** The OpenAI registry, provider constructor, and `crewship provider check` now agree on the current Chat Completions output-limit field, while generic OpenAI-compatible endpoints retain their legacy-compatible `max_tokens` default.
- **Reactions and feedback submitted immediately after a streamed assistant reply now use the persisted message ID and survive a chat reload (#2122).**
- **Hard stop (`--hard`) now actually ends the run — it was signalling a pid that doesn't exist inside the container (#2366).** #2363's Tier 2 mechanism resolved the run's exec to an OS pid via `ExecInspect` and signalled that pid from a new exec into the container — but that pid is in the HOST pid namespace, not the container's, so the in-container `kill` found no such process and silently signalled nothing (found live on dev1: a hard-stopped run's journal read `hard_stopped -> error`, and the run only ended when the agent finished on its own, ~27s later). Tier 2 now ends the run's own tmux session instead (`tmux kill-session -t agent-{slug}`, a container-visible identity every agent run already owns), escalating to a process-group `kill -KILL` on that session's own pane pids if it's still alive after the grace period — never a host pid, never a container-level operation, and never a sibling agent's session. `hard_stop_result`/`hard_stop_at` are now also exposed on `GET .../issues/{identifier}/runs` and `crewship issue runs -f json`, so a live check can confirm a hard stop landed without reading the journal.
- **The Journal resource strip no longer invents a disk reading or hides an
  empty metrics window behind four dashes (#2223).** The backend has never
  emitted disk usage, so the unfed DISK gauge is gone; CPU, memory and network
  remain, while a 30-minute window with no samples now says so explicitly.
  Loading and request failures keep distinct states, and aggregate metrics no
  longer coerce a missing first network-rate sample to `0 B/s`.
- **`crewship routine save` no longer erases a routine's description when `--description` is omitted; an explicit empty value still clears it (#2373).**
- **The Docker image builds again (#2328).** The backend stage did not copy the `config/` package that #2305 introduced for the model catalog, so `go build` inside the image failed on every branch since. `config/` is copied now, and a test (`scripts/dockerfile-sources`) fails whenever a root-level package the binaries import is missing from that stage.
- **Two GET routes were invisible to the read-scope invariant, the same
  "assumed out of scope by registration helper" blind spot the invariant
  exists to catch (#2144).** `route_read_scope_invariant_test.go` scanned
  `r.mux.Handle("GET …")` and `r.authedAdmin("GET", …)` but not
  `r.authedMut(` — recorded as "246 uses, zero reads" — which was wrong:
  `GET /api/v1/admin/keeper/judge/models`, `GET /api/v1/memory/export`, and
  `GET /api/v1/approvals{,/{id}}` all register that way and were absent from
  `scanReadRoutes()` entirely, not merely unclassified. Proved by a
  throwaway test asserting `scanReadRoutes()` returns those two keys — it
  failed on main. The scan now keys on the verb (`authedMutReadLine`,
  `authedSelfMutReadLine`) rather than trusting a helper's name, mirroring
  the mutation invariant's `wrapperMutationLine`. All four routes were
  checked by hand: `authedMut` always composes
  `RequireAuth(RequireWorkspace(...))` regardless of the declared role, so
  they are scoped by the identical chokepoint as `wsCtx` — `judge/models`
  reads no workspace-scoped rows at all, `memory/export` additionally fences
  its `crew_id` inside the handler (`TestMemoryExport_CrossWorkspaceCrewIs404`),
  and the two `approvals` routes read `workspaceID` from the same
  `RequireWorkspace`-populated context. `TestReadRouteScanFindsTheRealSurface`
  now also floors the `authedMut`-scanned count so the regex going blind
  again fails the build.
- **Paymaster no longer under-bills Gemini 2.5 Flash, Gemini 2.5 Flash-Lite, GPT-5.4 nano, or long-context GPT-5.5 calls (#2013).** The hand-verified rate card now matches the providers' published prices, including GPT-5.5's conservative >272K-token tier, and its catalogue-drift guard has no remaining stale-row exceptions.
- **`review-status.sh` reported `reviewed` when CodeRabbit's only activity on
  the head commit was a bodyless reply inside an existing thread, not a read
  of the diff (#2145).** A `COMMENTED` review with an empty body was promoted
  to `reviewed` whenever its inline comments fell inside the review's own
  time window — but that window doesn't distinguish a NEW thread (a real
  finding) from a REPLY inside a thread a human already started. Seen on
  #2128: a real `CHANGES_REQUESTED` review landed on an old head, two later
  re-review requests came back rate-limited, and CodeRabbit's only reply on
  the new head was a reply-wrapper — yet its `commit_id` named the head, so
  it outranked the throttle. The classifier now reads GitHub's
  `in_reply_to_id` on each inline comment and only counts one with none set
  — a genuinely new thread — as evidence of a read; a bodyless review whose
  comments are all replies now classifies as `empty-review`, same as one
  with no comments at all. A fixture reproducing #2128's exact shape
  (`CHANGES_REQUESTED` on an old head → bodyless reply-wrapper `COMMENTED`
  on the new head → rate-limit notices) failed on main (`reviewed`) and now
  reports `throttled`; the #2038/#1729 fixtures this shares logic with are
  untouched and stay green.
- **A recent-order sort could put the earlier of two invocations first, in
  the same second, for pipelines that had never raced a clock before
  (#2294).** `internal/pipeline/store.go` wrote `created_at` / `updated_at` /
  `last_invoked_at` with `time.RFC3339Nano`, which trims trailing zero
  fractional digits — two instants in the same wall-clock second can then
  serialise to strings of different width, and `List`'s
  `ORDER BY COALESCE(last_invoked_at, created_at) DESC` compares them as
  TEXT: `Z` (0x5A) sorts after `0` (0x30), so a shorter, more-trimmed string
  can sort AFTER a longer one even though it encodes an earlier instant.
  Pinned with a deterministic (clock-injected, not raced) test reproducing
  the issue's own collision — `…18.1Z` (05:38:18.100000000) versus
  `…18.10001Z` (05:38:18.100010000, 10µs later) — which failed on main for
  both the `created_at` and `last_invoked_at` write paths.
  `internal/pipeline` now writes every timestamp through the existing
  `internal/tsformat` package (fixed 9-digit fraction, #990) instead of
  `time.RFC3339Nano` directly, and a new migration
  (`20260903190851_pipelines_timestamp_fixed_width`) pads every existing
  `pipelines` and `pipeline_versions` row to match, so an old (trimmed) row
  and a new (fixed-width) row compare correctly against each other.
  `internal/pipeline/waitpoints.go` and `idempotency.go` carry the same
  `time.RFC3339Nano` pattern under an explicit `tsformat:allow` and are left
  alone here — see the PR for why each is judged safe on its own terms.
- **`GET /api/v1/oauth/callback` answers its error branches with
  `application/json`, matching what the spec has always declared (#2102).**
  Every error branch used raw `http.Error`, which writes
  `text/plain; charset=utf-8`; the generated OpenAPI document declares
  `application/json` for every non-2xx response on every route (#1919), on
  the grounds that both error helpers route through `writeJSON` — `Callback`
  reached for neither, so it was the API contract gate's one remaining
  "Undocumented Content-Type" finding. All nine error branches now go
  through `replyError`, the same helper the sibling `Initiate`/`Exchange`
  handlers in the file already use; the success branch's deliberate
  `text/html` (a browser following the OAuth redirect) is untouched.
- **`crew-ai-suggest` no longer hands back agent names or slugs
  `POST /api/v1/agents` refuses (#2204).** Follow-up to #2197/#2200:
  `validateSuggestion` gave `agent_role` a post-condition — every value an
  accepted suggestion carries is a literal the create endpoint accepts —
  but never extended it to name or slug. A suggestion like
  `{"name":"Q",…}` passed validation and the wizard's very next call died
  with `400 name must be 2-100 characters`; `slugify` never capped its
  output either, so a long, space-free name could derive a slug over the
  50-byte cap. Both bounds are now checked against the same
  `agentNameMinLen`/`agentNameMaxLen`/`agentSlugMinLen`/`agentSlugMaxLen`
  constants `agents_create.go` enforces (agents.go now defines them once,
  shared by both call sites) rather than restated numbers, so the two
  cannot drift.
- **`crewship backup` defaults its bundle directory under the instance's own
  data dir, not a home directory shared by every instance on the host
  (#2262).** `backup create`/`verify`/`inspect`/`restore` resolved their
  default location as `Home()+".crewship/backups"` regardless of
  `CREWSHIP_DATA_DIR`, the env var every other piece of per-instance state
  (`DATABASE_URL`, `CREWSHIP_BOLT_PATH`, `CREWSHIP_SOCKET_PATH`, storage)
  already honours. Several isolated instances run by the same user on one
  host — three dev clones, any number of ephemeral test instances — shared
  one bundle directory, and a `restore` that picked up another instance's
  bundle by name landed foreign data into a live database. The default now
  resolves under `$CREWSHIP_DATA_DIR/backups` when the env var is set,
  falling back to `~/.crewship/backups` only when it is not; `--output` /
  `output_dir` still override it explicitly.
- **A fetch failure on the issues board now renders as an error, and the
  board says when it's showing a partial page (#2286).** `fetchIssues` used
  to be `try { if (res.ok) setIssues(...) } catch {}` — any non-2xx response
  or thrown fetch left `issues` exactly where it was (`[]` on first load),
  indistinguishable from a genuinely empty workspace. The fetch now lives in
  `hooks/use-issues-list.ts`, which always resolves to loading, a typed
  `error`, or populated `issues`; the board renders a dedicated error panel
  with a retry action instead of going blank. Separately, the board fetched
  at most 100 rows with no total exposed anywhere, so a 101st issue was
  silently invisible — `GET /api/v1/issues` now reports the filtered total
  and whether the page was partial via `X-Total-Count`/`X-Has-More` response
  headers (the JSON body is unchanged, so no existing client breaks), and
  the board shows "Showing N of TOTAL issues" with a "Load more" action.
  `crewship issue list` prints the same footer and gains `--offset` to page
  past `--limit`.
- **A 403 on the issues board's request is now reported as a specific,
  actionable error instead of a request that took the whole board down
  looking indistinguishable from empty (#2285).** Observed on dev1: a
  transient 403 — the shape a scoped agent/CLI token failure takes
  (`AuthKindCLIToken`, `internal/api/middleware.go`, documented as the
  credential "an agent, CI job, or script holds") — silently emptied the
  board. `useIssuesList` classifies a 403 separately from a 401/5xx/network
  failure and names the likely cause (a scoped token, possibly transient)
  in the error message, with a retry action, rather than rendering an empty
  board that looks like a workspace with no issues.
- **A live issue.created/issue.status_changed/etc. event still never
  repainted the issues board — completing #2257's client half (#2257,
  #2310).** #2310 registered the board's issue.* realtime subscriptions for
  the first time, but wired the debounced refetch to `onRefresh`
  (`OrchestrationPageShell.fetchData` — missions/crews/agents/connections),
  never to the board's own separate `issues` state
  (`useIssuesList`/`fetchIssues`, #2285/#2286 above). So the subscription
  fired, Graph/Timeline data moved, and the issues board itself stayed
  stale until a manual reload — exactly the symptom #2257 shipped to fix.
  The wiring is now `hooks/use-issue-board-realtime.ts`, unit-testable
  without mounting `OrchestrationLayout`: it calls both `fetchIssues` (the
  board's pagination-preserving refetch) and `onRefresh` (still needed for
  Graph/Timeline/Activity), debounced together, and also refreshes issues
  on `realtime.reconnected` — which had the identical gap.
- **A deploy-window blip no longer wedges the avatar-backfill latch shut for
  the rest of the browser session (#2203).** `apiFetch` synthesizes a 503
  whenever a request 401s and `/api/auth/token/refresh` is itself
  transiently unavailable — a 5xx, a network throw, or its own 10s abort —
  which is a routine event during an API restart, exactly when several tabs
  are re-rendering. #2199's latch treated a run of these identically to a
  genuinely broken endpoint (the #2196 case) and stopped asking for the rest
  of the JS session, recoverable only by a full reload. A run of 5xx or
  transport failures now closes the rail for 60 seconds instead of
  permanently, and still spends its budget; a run of 4xx (other than 403,
  which already has its own refusal handling) still latches for the
  session, since that is a property of the endpoint rather than of the
  minute.
- **A suggestion or follow-up chip clicked twice can no longer send twice
  while its session is still being created (#2121).** The chip handler read
  `isStreaming` — a prop that cannot change until a send produces a render —
  before awaiting `ensureSessionForSend()`, so two clicks landing inside a
  draft session's create window both passed the guard and both sent; these
  chips bypass `useMessageSubmit`, so the #2075 double-submit latch never
  covered them. Unlike the composer's identical-duplicate case, a second
  chip is a different question, so the fix disables the chip rail for the
  duration of the create (extending the existing streaming disable
  backwards) rather than latching or silently dropping it.
- **Clearing a crew's issue prefix from the web UI now actually clears it,
  and the field accepts the same 16-character prefixes the API always has
  (#2118).** The Issue prefix control sent `{"issue_prefix": null}` on
  clear; the server decodes a JSON `null` as "field absent" and the write is
  gated on the field being present (`crews_update.go`), so the PATCH
  silently no-opped and the value reverted on the next render with no error
  shown. `""` is the documented clear — it already worked from the CLI
  (`crewship crew update <crew> --issue-prefix ""`) — and the panel now
  sends it too. The field's 5-character cap and hint text are also raised to
  the API's actual limit (`^[A-Za-z0-9_-]{1,16}$`, since #2035).
- **The issues board now moves on its own instead of only on a manual
  reload (#2257).** Every status-transition endpoint — the human and agent
  PATCH, and the review-approve/request-changes/stop workflow actions — now
  broadcasts a dedicated `issue.status_changed` event (`{id, identifier,
  crew_id, status, from, to}`) alongside the existing `issue.updated`, and
  `issue.created`/`issue.deleted` now carry `crew_id` too. The `/issues`
  board (`OrchestrationLayout`) subscribes to the full issue.* event set for
  the first time and reconciles rather than trusts: a change to the crew
  currently in view triggers a debounced refetch, a change the active crew
  filter can prove is off-screen is skipped, and a socket reconnect always
  refetches so a dropped connection can't leave the board permanently wrong.
  The decision logic is `components/features/orchestration/issue-realtime.ts`,
  unit-tested independently of the component.
- **The realtime allowlist stopped silently dropping most of the documented
  event vocabulary (#2125).** `hooks/use-realtime.tsx`'s
  `VALID_REALTIME_TYPES` had drifted from `docs/api-reference/websocket.mdx`
  — 40 workspace-channel event types the server already emits (projects,
  milestones, integrations, feature flags, triage rules, recurring issues,
  the escalation terminal states, and more) were silently discarded by
  `handleMessage`, with no error and no log. All of them are now
  registered, a Vitest parity gate
  (`hooks/__tests__/realtime-allowlist-docs-parity.test.ts`) reads the
  documented vocabulary straight off that doc page and fails if the
  allowlist ever misses one again, and a dropped frame now logs a
  `console.warn` once per type (not per frame) instead of vanishing. No new
  subscribers were added for the 40 types — registering them is the durable
  half of the fix; wiring a consumer per surface is separate, future work.
- **Routine runs now reach `GET /api/v1/runs` and the Runs view (#2284).**
  The endpoint aggregated `journal_entries` under `trace_id IS NOT NULL AND
  entry_type LIKE 'run.%'` — a filter a routine run's `pipeline.run.*`
  entries structurally could never match, since `internal/pipeline/journal.go`
  stamps `actor_id` to the run's own id and never sets `trace_id` at all
  (#2291 made the Runs view's header stop overclaiming this; this is the read
  fix behind it). `journal.ListRuns` and `journal.GetRunByID` now group on
  `COALESCE(trace_id, actor_id)`, admitting `pipeline.run.*` rows alongside
  `run.*` ones, and tag every row `kind: "agent" | "pipeline"` so a caller
  can tell the two apart — `crewship run list` shows a KIND column. A
  cancelled routine run (which reuses `pipeline.run.failed` — there is no
  dedicated `pipeline.run.cancelled` entry type) reports `CANCELLED`, not
  `FAILED`. Deliberately not widened: `GET /api/v1/runs/insights` and the
  `stats` tile embedded in `GET /api/v1/runs` itself still aggregate ad-hoc
  runs only — unifying cost roll-ups and correlation across the two engines
  is a separate decision this PR did not make.
- **A run is now attributable to the issue that caused it, including
  delegation hops and mention dispatches (#2279).** `assignments.mission_id`
  is the direct link between a run and the issue it belongs to, but neither
  of `AssignmentHandler.Create`'s two real callers — the sidecar's
  `handleAssign` and the routine dispatcher's `crewshipBody` — ever set it,
  so every delegation hop made from inside a mission task, lead-planning, or
  mention-dispatched run created an assignment with `mission_id = NULL`,
  invisible to `issue runs` and to Stop's live-run match alike. `Create` now
  derives `mission_id` server-side when the body omits it: every synthetic
  mission chat is created with the mission's own id as the chat's primary
  key, so an existence check against `missions(id)` for the assignment's
  `chat_id` is the exact FK precondition `mission_id` needs, not a
  heuristic. Stop's own match now prefers `mission_id` directly over the old
  `chat_id`/`group_id` heuristic, keeping that heuristic only as a fallback
  for rows created before this change. `GET /issues/{identifier}/runs` and
  `crewship issue runs` now return every run attributed to the issue —
  mission tasks, mention-dispatched runs, and delegation-hop runs alike —
  instead of only the mission-task rows a join could already reach.
- **Automations refuse event types and payload keys that could never fire
  (#2271).** `event_type` was checked for shape only, so a well-formed nonsense
  type saved with 201 and matched nothing forever. It is now checked against
  a generated registry (140 entry types), with a drift test, and the error
  names valid alternatives. `payload_equals` keys are validated for the event
  types whose payloads are known; for the rest the error, the CLI help and the
  guide say plainly that no key validation is possible, because no
  payload-schema registry exists.
- **A webhook or automation that fails to start a run is now visible, not
  just logged (#2282).** Schedules already raised a journal entry and an inbox
  card when they failed; a webhook fire failure wrote a database row only,
  and an automation whose enqueue failed left nothing but a log line. Both
  now emit a journal entry on every failure and one inbox card — kinds
  `webhook_fire_failed` and `automation_enqueue_failed`, routed to the
  `routines.missed` channel category — once three consecutive failures show
  the path is broken rather than a blip. A run that started and then failed
  is not counted; it already has its own failure entry.
- **Shipped surfaces stop claiming what they cannot show (#2291).** The Runs view's
  header no longer says it spans routine runs — `GET /api/v1/runs` excludes
  them by construction, so the honest label is the fix until the read side
  changes. The three issue lifecycle events the server already emitted
  (`issue.created`, `issue.deleted`, `issue.started`) now reach the browser
  instead of being dropped by the realtime allowlist, and a guard test fails
  when an emitted issue event is left unregistered. A schedule that the
  circuit breaker disabled now shows its reason, failure streak, catch-up
  policy and wake statistics — read-only; the editor is separate work.

  **Two regressions in the first cut of this fix, found in review and fixed
  in the same PR.** First, the registry generator only scanned
  `internal/journal/types.go`'s const block, but at least eleven real,
  emitted entry types are declared ad hoc in the packages that emit them
  (`page.public_view`, `page.webhook_issued`, `keeper.rule_auto_tuned`,
  `policy.changed`, and seven more) — so the "closed" registry rejected
  event types that genuinely fired, and `automation create --event
  page.public_view` (which worked before this feature existed) started
  returning 400. The registry is now generated by scanning every
  `journal.EntryType` value declared or used under `internal/` and `cmd/`,
  not only `types.go`'s const block (`internal/journalgen.ScanTree`); the
  drift test does the same scan and fails the build if an emitter anywhere
  uses a value the registry lacks. Two call sites that wrote their entry type
  as a bare string literal with no `EntryType` token anywhere (a shape no
  scanner can find soundly without false-positiving on every unrelated
  `Type:` field in the codebase) were changed to a typed const instead, the
  same shape every other ad hoc entry type already used.

  Second, `PATCH` re-validated the rule's *effective* (merged) event_type and
  routine_slug even when the request body carried neither, so a sparse
  `PATCH {"enabled": false}` on a rule whose target routine had since been
  soft-deleted returned 400 with no way out but `DELETE` — `Store.Update` and
  `Store.ListActive` both deliberately tolerate a dangling routine reference,
  and `PATCH` now does too for whatever it did not touch. The event_type
  registry check and the `payload_equals` key check moved into
  `Automation.Validate()` itself (the single gate every writer already used,
  including `internal/api/pages_wake.go`'s page-wake-gate reconciler, which
  writes with raw SQL and relies on `Validate` to keep its rows honest) — so
  `PATCH` no longer duplicates a load-and-merge the store already does, and
  the wake-gate path is covered by the registry check for the first time.
  Also: `automation.depth_exceeded`'s curated payload-key set was missing
  five keys a third emitter (`internal/pipeline/journal.go`) writes
  (`chain_origin`, `edge`, `pipeline_id`, `pipeline_slug`, `run_id`); and
  `mission.comment` was removed from the curated map entirely — it has two
  emitters with disjoint payload shapes, so no single key set is correct for
  it, and a wrong rejection of a real key is worse than no validation at all.

- **`backup verify` no longer calls a short bundle VALID (#2009).** Verify
  only ever checked the payload's SHA-256 against the manifest — integrity,
  not completeness — so a bundle that dumped zero rows for a table (a
  scoping bug, corruption, or a hand-edited manifest) still reported
  `✓ VALID`. Bundle creation now records each table's row count in the
  manifest (`contents.table_row_counts`), and for an **unencrypted** bundle
  `verify` compares the payload's actual counts against it, reporting
  `INVALID` on a divergence instead of passing silently. An **encrypted**
  bundle's completeness still cannot be checked here — `verify` deliberately
  never asks for a passphrase, which is what lets it run unattended against
  a whole directory of nightly bundles — but the CLI and API now say so
  explicitly (`completeness_checked: false`, with a reason) instead of
  implying the check happened. `crewship backup restore --dry-run`, which
  already decrypts, makes the same comparison and reports it as
  `payload_row_count_mismatches`, plus a second, separate comparison —
  `rows_inserted_shortfalls` — for what actually landed on the target. A
  bundle written before this change carries no recorded counts and is
  reported the same honest "not verified" way, never as a false pass or a
  new failure.

  `payload_row_count_mismatches` is now taken BEFORE a `--as-workspace` /
  `--as-crew` fork does its own bookkeeping (re-signing the journal chain,
  adding the restoring admin to `workspace_members`) — those rows are the
  restore's own doing, not the bundle disagreeing with its manifest, and
  counting them the same way made every ordinary forked restore report the
  bundle as suspect. `rows_inserted_shortfalls` no longer names a table
  whose "shortfall" is INSERT OR IGNORE working as designed: bundled skills
  reseed with the same IDs on every boot, a user `crewship backup restore`
  reconciles onto a matching target account by email intentionally no-ops
  on insert, and (once `issue_counters` re-keying, #2034, lands alongside
  this) two crews sharing an effective prefix collapse a pre-#1797 bundle's
  counters onto one row before insert — discounted by exactly how many rows
  that merge folded away, not excluded outright, so a genuine
  `issue_counters` shortfall (an unresolvable crew, a real collision) still
  surfaces. And the warning text for both now follows which one fired —
  `rows_inserted_shortfalls` is about the *target*, not the bundle, so it
  no longer tells the operator to treat the bundle as suspect — and says
  "more" rather than always "fewer" when a table landed extra rows rather
  than too few.
- **The crew's shared credential store had no agent dimension, so one member's
  endpoint credential answered another member's model call (#2052).** One
  sidecar serves a whole crew container, and `CredStore.Select` took a provider
  and nothing else: the credential a model call got was whichever one a
  round-robin counter landed on, not one the calling agent had been granted.
  While every provider had a fixed vendor upstream, that decided only whose key
  paid. `OPENAI_COMPAT` takes its upstream FROM the credential, so it also
  decided where the prompt went — agent A's traffic to agent B's gateway,
  authenticated with B's key, with B's host allowlisted by #2051's union so
  there was not even a `403` to notice. `docs/architecture.mdx` had described
  the store as one "an agent can only read credentials its `agent_id` was
  granted" throughout; that was the intent, never the code.

  Every credential now travels with the crew members it was granted to, and the
  store refuses to serve one to anybody else. The calling agent is resolved
  from its own per-agent route token (#812), which the orchestrator derives per
  agent and which cannot be forged — it is an HMAC under a key the container
  never sees. It can, however, be READ: crew members share one container and one
  uid, and each member's token sits in its own environment and MCP config, so a
  determined peer can present a sibling's. This is least privilege inside a
  shared trust domain, which is what #2052 asks for — a crew is already one
  trust domain — and not isolation from a hostile peer. A member holding no
  credential for
  the provider is refused with `503 no credential available` — a loud refusal
  beats a silent crossover — and a caller whose identity cannot be established
  at all (a sidecar running without route identity) is served crew-wide
  credentials only, never one scoped to a named agent.

  The grant you already made is the scope: a credential linked to the crew, or
  bound at crew or workspace scope, reaches every member and stays available to
  all of them; one granted to named agents reaches only those. Ownership is
  computed per CREDENTIAL rather than per delivery, so every member of a crew
  produces the same boot payload for the same credential — a value that differed
  per member would move `sidecarConfigFingerprint` and restart the crew's shared
  sidecar on every alternation between agents, which is the thrash #1160
  removed. A grant covering every member of the crew is crew-wide in effect and
  is delivered as such, which is the shape `autoAssignCredentials` leaves every
  template-created crew in — so for a crew with no per-agent grant the payload
  is byte-identical, the fingerprint does not move, and no running sidecar
  restarts on upgrade. A crew that DOES hold a credential granted to a strict
  subset of its members — the crews this fixes — gains agent ids in its payload,
  and its sidecar restarts once; an in-flight run there sees the existing
  fingerprint-mismatch `503` and retries.

- **An invited member could not authenticate with the CLI at all (#2259).**
  `lookupCLIToken`'s SELECT scanned `u.full_name` into a plain `string`, but
  the column is nullable and `workspace member invite` creates the user row
  without one — so `Scan` failed with "converting NULL to string is
  unsupported" on the very first CLI call from a freshly invited
  MEMBER/MANAGER/ADMIN. The auth middleware then collapsed that lookup error
  into the same generic 401 `session_invalid` every bad-token case gets, so
  the error pointed at the wrong thing and made it look like the token, not
  the row, was the problem. The query now reads `COALESCE(u.full_name, '')`,
  matching the idiom `auth_recovery.go` already used for this exact column.
  Separately, `RequireAuth` no longer reports every lookup failure as an
  invalid session: only the sentinel `errInvalidCLIToken` (unknown, revoked,
  expired, tier-mismatched, or not-found token) maps to 401 now, and any
  other lookup error — a query/scan/driver failure — is logged with its
  underlying cause and answered with a 500, so a bug like this one names
  itself instead of requiring a live repro to find.
- **Every forked restore (`--as-workspace` / `--as-crew`) of a bundle
  containing a live mission aborted on a `mission_activity` foreign-key
  violation (#2260).** The error named the wrong row. `RemapIDs` regenerates
  every primary key so a fork can land beside its source, and it had
  correctly rewritten `mission_activity.mission_id` to the fork's brand-new
  mission id — but `missions.trace_id` is `NOT NULL UNIQUE` with no workspace
  in the key, and the source mission on the same instance was still holding
  the bundle's value. `RestoreDump` inserts with `INSERT OR IGNORE`
  (deliberately, so re-restoring a bundle is idempotent), so the forked
  mission did not fail loudly on that collision — it was dropped in silence,
  and its correctly-remapped activity rows landed pointing at a parent that
  never arrived. The deferred `foreign_key_check` then blamed the child. Since
  essentially every workspace has run a mission, this made `--as-workspace`
  unusable in practice. A fork now regenerates identity, not merely primary
  keys: `forkRegeneratedColumns` in `internal/backup/remap.go` declares the
  columns that are unique per *instance* rather than per workspace, and pass 1
  mints a fresh value for each — for `trace_id`, the source value's prefix
  (`mission-`, `issue-`, `tr_`) is kept and only the identifying tail is
  replaced, the same shape `internal/api` writes. Columns that are unique only
  within a workspace stay untouched on purpose: `missions.identifier` was
  rescoped to `UNIQUE(workspace_id, identifier)` by #1733, so the fork keeps
  the issue identifiers a team already knows. Nothing stores a mission's
  `trace_id` by value elsewhere — the `trace_id` on `journal_entries` and
  `eval_runs` is an agent *run* id — so regenerating it breaks no reference.
  Two tests: the reproduction, and an every-table fork that synthesises a row
  into 102 of the 109 `BackupTables` entries and requires each remappable
  table to gain exactly the rows the bundle carried. That second test found
  seven more tables losing every row to the same class of collision
  (capability tokens with a hashed twin, and unique keys over columns nothing
  remaps); they are pinned by name in the test and filed as #2274.
- **Restoring a bundle taken before the `issue_counters` re-key silently
  dropped every counter row (#2034).** `#1797` re-keyed `issue_counters`
  from `crew_id` to `(workspace_id, prefix)` — the first non-additive
  column change the restore path had met. A bundle taken before that
  migration carries `{crew_id, next_number}`; `crew_id` has no column on
  the new table, so it was dropped from the `INSERT`, the statement
  degenerated into `INSERT OR IGNORE INTO issue_counters (next_number)
  VALUES (?)`, and the `NOT NULL` on the two new key columns turned the
  drop into a constraint violation `OR IGNORE` swallowed — the restore
  reported success having landed nothing. Mostly self-healing (the
  allocator reseeds a missing counter from the highest identifier already
  restored under that prefix), except for a crew whose issues had ALL been
  deleted before the backup: its counter was the only remaining record of
  how far it had counted, so the crew restarted at 1 and re-used
  identifiers people and external systems still reference. Restore now
  resolves each row's crew — from the bundle's own `crews` table, or the
  target's if it already exists there — to its workspace and effective
  prefix, and writes the counter under the current key; two crews sharing
  an effective prefix collapse onto the higher `next_number` rather than
  either individual value, so the allocator can never re-issue an
  identifier that already exists. A row whose crew cannot be resolved
  anywhere still cannot be honestly guessed at, so it falls through to the
  counted, reported column-drop warning (`columns_dropped` /
  `dropped_columns`) restore already surfaces for schema skew in general
  (#2108).

- **The feedback API docs still described the security hole #1213 had
  already closed (#1617).** `docs/api-reference/feedback.mdx` and
  `docs/guides/feedback.mdx` said `POST /api/v1/feedback` fell back to the
  caller's most-recent workspace when `chat_id` was omitted, and one bullet
  stated outright that "message_id ownership is not enforced" — the exact
  cross-tenant message-existence oracle #1213 closed by requiring
  `message_id` to resolve to a real, visible row in `conversation_messages`
  (#1208). #1617 investigated the resulting 404 as a possible router bug —
  POST/DELETE register through `authedSelfMut`, GET through the plain
  `r.mux.Handle` beside it — but the route was never broken; the docs were
  just stale. Corrected both pages, and added
  `internal/api/feedback_route_test.go` (drives POST/GET/DELETE through the
  real router) plus `cmd/crewship/acceptance_feedback_test.go` (drives
  `crewship feedback create|list|delete` against a real server) so a real
  registration regression on this route family fails loudly instead of
  reading like this one did.
- **A second run for a busy agent no longer kills the first (#2269).** The
  per-agent exclusivity that already guarded chat sends is now shared with
  `/assign` and `@mention` dispatch as `AgentRunLock`. Before, a second
  concurrent run for one agent reused the tmux session `agent-<slug>` and the
  exec wrapper's opening `kill-session` terminated the first run and deleted
  its fifo and exit file. A dispatch that loses the lock is queued behind the
  live run (back of the crew FIFO) and drained by the existing completion
  pump — it is not failed, and the crew is pumped so a freed budget slot
  goes to the next eligible row. A queued row now says why (`queued_reason`:
  `crew_budget` or `agent_busy`) instead of leaving that to a server log. A
  chat message to an agent that is busy on an issue now bounces with
  `agent_busy` instead of colliding with it.

  **Known limit.** The lock is taken by chat sends, `/assign`, `@mention`
  dispatch, the agent cron and a routine's `agent_run` step. It is **not yet**
  taken by the inbound agent webhook route, the direct agent-run route or the
  peer-query path; a run started through one of those can still collide with
  a live run for the same agent.
- **Inbox read state is now per user, not shared (#2296).** `PATCH
  /api/v1/inbox/{id}` with `state=read` wrote the shared `read_at` /
  `read_by_user_id` columns on `inbox_items` with `COALESCE(existing, now)` —
  the first person to open a role-targeted item (e.g. a MANAGER escalation
  every MANAGER can see) marked it read for every other recipient too, so a
  second manager's inbox silently dropped an item they never saw. A new
  per-`(item, user)` table, `inbox_item_reads`, is now LEFT JOINed in, and the
  `state` every response reports (`GET /api/v1/inbox`, `GET /api/v1/inbox/{id}`,
  and the unread count) is computed for the calling user — `resolved` stays
  workspace-shared, `read`/`unread` does not. The old shared columns are kept
  and still written the same way as before; they now answer a narrower,
  separate question ("has anyone dealt with this") rather than deciding
  `state`. `inbox.Upsert` resurrecting an item back to unread now also clears
  every caller's per-user read marker, so a refreshed item reads as unread
  again for everyone, not just the caller who triggered the refresh.

  On a fork (`backup restore --as-workspace` / `--as-crew`) inbox items
  themselves do not land — `inbox_items` is UNIQUE(kind, source_id)
  instance-wide (#2274) — so a read marker for one of them has no parent.
  The restore now skips such a marker instead of aborting on the deferred
  foreign-key check, and reports the skip in `rows_inserted_shortfalls`.

- **Stop now actually stops the next step, and a late failure report still
  reads as cancelled (#2295).** `POST /issues/{identifier}/stop` cancelled the
  issue's row and its pending tasks, but a run already `RUNNING` when Stop
  was called kept executing to completion and, if it finished with an error
  after the stop, the websocket broadcast and the mission comment both
  reported it as a failure (`assignment_failed`, "encountered an issue") —
  the opposite of what the operator who clicked Stop asked for. Stop is Tier
  1 (cooperative): there is no kill primitive for a shared crew container, so
  a run mid-exec is not interrupted. What changed is that the contract is now
  actually enforced end to end. In one transaction, Stop stamps
  `assignments.cancel_requested_at` on every live assignment for the issue.
  `runAssignment` checks the stamp before spending anything on the row —
  before the container exec, before the LLM call — so a run that has not yet
  started never starts. `finishAssignment` checks the same stamp again when
  an already-`RUNNING` run eventually completes, and now the check runs
  *before* the websocket broadcast switch and the mission-comment block are
  reached, not only before the `status` column write: a late `COMPLETED` or
  `FAILED` report is recorded and announced as `CANCELLED` either way, and
  `mission_activity` gets a dedicated `task_cancelled` action instead of
  reusing `task_failed`. No further step is scheduled for the issue. A hard
  kill that interrupts a run mid-exec remains a separate, not-yet-built
  capability.

- **Stop now reaches a run a mention started on an issue that was never
  started (#2320).** A mention (`@agent` on an issue's comments) can dispatch
  a run while the issue itself is still `BACKLOG`/`TODO` — #2279 attributes
  that run to the issue the same way a mission-task run is (`mission_id`,
  with the `chat_id`/`group_id` fallback) — but `POST
  /issues/{identifier}/stop` refused with 400 for any status other than
  `IN_PROGRESS`/`REVIEW`, so the one door meant to reach every run
  attributed to an issue (#2295) stayed closed for exactly the runs a
  mention starts: the agent kept running with no cooperative stop
  available from the issue. Stop now checks for a live attributed
  assignment before refusing: when the issue is not `IN_PROGRESS`/`REVIEW`
  but has at least one, it stamps `cancel_requested_at` on it exactly as
  before and leaves the issue's own status untouched — it does not
  promote the issue to `IN_PROGRESS` or move it to `CANCELLED`, since the
  issue itself was never started. It still refuses with the original 400
  when the issue is neither in flight nor has any live run to reach. The
  response now also reports `runs_stopped`, the count of assignment rows
  the call actually stamped.

- **A routine no longer evicts your conversations from the chat column
  (#2244).** Four code paths insert into `chats` and only one of them is a
  conversation: a person opening a thread, a routine minting **one chat per
  step**, an issue running its work, and an agent delegating to another agent.
  `GET /agents/{id}/chats` returned all four in one activity-ordered list with
  no way to narrow — and because the endpoint pages, that was not clutter but
  eviction: five rows per routine run meant a person's newest conversation was
  outside the result set within two nights, before any client-side filter could
  see it. The endpoint now takes `?kind=direct|routine|issue|agent`, applied
  inside the statement *before* `LIMIT`, and answers `?counts=1` with per-kind
  totals in `X-Chat-Kind-Counts` so a column can label the buckets it is not
  fetching. Every row carries its `kind`. The partition lives in one place
  (`internal/chatkind`) as both Go and SQL, with `direct` written as the
  negation of the other three — an origin nobody has thought of yet stays
  visible rather than vanishing from every list at once. The pipeline runner
  now stamps `ROUTINE` (it stamped nothing) and titles a step chat with the
  routine's name instead of its id; a migration backfills existing rows,
  guarded on `created_by IS NULL` as well as the runner's own title shape.
  Every surface that needed to tell these apart had been asking
  `created_by IS NULL`, which answers "does this row have an owner" and not
  "did a person open this" — two questions that stopped being the same in both
  directions, since `POST /agents/{id}/chats` stamps a creator *and* accepts an
  origin, and deleting a user nulls the creator on every chat they opened.
  `crewship chat list --kind` narrows the same way, with a `KIND` column in
  place of the raw `ORIGIN` token.

- **The chat column's "New conversation" asked nobody who (#2141).** It called
  `onStartConversation(roster[0])` — whichever agent `/agents` happened to
  return first — so the one button on the column silently made the only
  decision it exists to take, and a *second* conversation with a chosen agent
  could not be started from the UI at all. It now opens a picker over every
  agent, not only the ones with no history.

- **A forked restore left the journal hash chain unverifiable (#2226).**
  `crewship backup restore --as-workspace <slug>` returned success and produced
  a workspace whose `VerifyChain` reported *every* restored row as tampered —
  the exact false positive the chain work was built to avoid, fired by the
  admin integrity endpoint on the very next check. `RemapIDs` regenerates the
  identity columns the entry's keyed HMAC commits to (its own `id`, and every
  FK column SQLite reports — `workspace_id`), while `seq`, `prev_hash` and
  `entry_hash` rode through the bundle verbatim, so each stored hash still
  attested to values the row no longer held. A second, independent break sat
  beside it: `journal_chain_checkpoints.workspace_id` carries no `REFERENCES`
  clause, so the remap's FK pass never rewrote it while pass 1 still
  regenerated the row's primary key — every forked restore wrote a duplicate
  checkpoint into the **source** workspace's audit state and left the fork with
  none, turning a legitimately compacted gap into what reads as a malicious
  mid-chain delete.

  A forked restore now re-signs the chain under this installation's key, the
  way the v152 migration's `backfillJournalChain` already does for a chain it
  legitimately rewrote, and re-points *and* re-MACs the compaction checkpoints
  under the new workspace id (`journal.CheckpointMAC` frames the workspace id,
  so moving the row without re-signing it would have covered nothing). The fork
  therefore starts at a **new genesis** — it verifies clean, but it attests to
  this instance from the restore onward and no longer links back to the
  source's history, so it does not get one silently: a `backup.chain_resigned`
  entry is written at the tail of the new chain, inside the chain it describes,
  naming the source workspace, the bundle digest and the counts. The CLI, the
  restore API response and the `backup.restore` audit row report the same two
  numbers. A restore that cannot re-sign the chain now fails before writing
  anything rather than landing an unverifiable fork; there is no branch that
  skips the re-sign. A plain or `--replace` restore remaps nothing, re-signs
  nothing, and is unchanged.

- **A chat journal entry kept the first 240 characters of every message you
  sent, in a row that cannot be erased (#2229).** #2215 left `chat.user_message`
  bounded rather than emptied: its payload and summary both carried a scrubbed
  240-character preview, on the argument that the message *is* the entry. That
  bounded the exposure without closing it. The scrubber is defence in depth and
  not a boundary — it cannot match a value nobody registered — so a token pasted
  at the *start* of a message sat well inside the preview and reached a
  hash-chained, append-only table that erasure requests deliberately skip.

  The entry now records a measurement instead of the message: `chat_id`,
  `agent_slug` and `length_chars`, with a summary reading
  `user → morgan: 312 characters`. There is deliberately no digest of the
  message beside it — for a short message a digest is a verifier for the pasted
  token — so `chat_id` is the reference, and the message itself stays in the
  chat, which **can** be erased. Expanding a Timeline row now offers **Open
  chat** to get there, which nothing did before. Two consequences: free-text
  journal search no longer reaches any part of a user message, and the entry's
  `content` and `truncated` fields are gone rather than emptied.

- **The journal stored the prompt text of every run, verbatim and forever
  (#2215).** `exec.command` recorded the CLI argv, and the argv carries the
  run's whole system prompt plus the verbatim user message; `chat.user_message`
  stored the message body uncapped, while its own summary was capped at 240
  characters. Both land in a hash-chained, append-only table that erasure
  requests deliberately skip, and the Timeline tab that renders them is not
  admin-gated.

  Scrubbing could not close this, and #2205's scrub was never going to: the
  credential scrubber is defence in depth, not a boundary — it cannot match a
  value nobody registered and whose shape it does not know, so a token pasted
  into agent chat survived it. The prompt-bearing values are therefore no
  longer written. `exec.command` now carries a bounded, typed payload — the
  argv *shape* with the prompt elements replaced by a placeholder naming the
  element and its length, plus the adapter, model, tool profile, container,
  exit code, duration, and a digest and length of the prompt — which answers
  "what ran, and with which prompt" without storing the prompt. A measured
  entry drops from about 43 KB to under 1 KB. What remains is capped, with an
  explicit `truncated` flag. `chat.user_message` is scrubbed and capped to the
  same 240 characters its summary always was — superseded by #2229 above, which
  ships in this same release and removes that text entirely — and the run's
  process log line takes the same sanitised argv. The #2205 scrub is kept and
  still runs on what is left.

  Two UI readers were fixed with it: the Journal card's terminal line and the
  run rail's detail line both read a key the orchestrator never wrote, so they
  were blank for every agent exec. Both now accept either payload shape.

  Three behaviour notes. `crewship journal --query` searches summary and
  payload, so free-text search now reaches the first 240 characters of a user
  message and no part of a prompt. `chat.user_message` is bounded rather than
  emptied — the message is what that entry is for — so within those 240
  characters the scrubber is still the only control. And `chat.agent_response`
  still keeps up to 8 KB of the agent's scrubbed reply and `exec.output_chunk`
  its scrubbed stdout, so an agent that quotes its prompt back still writes
  that text to the journal.

- **The `exec.command` journal entry wrote the CLI argv unscrubbed (#2205).**
  All three emit sites recorded the agent CLI's argv verbatim. That argv
  carries the run's whole system prompt and the verbatim user message, so
  every entry was a large payload of prompt text that no member-facing
  surface was filtering: the Timeline tab is not admin-gated, and Export
  writes every loaded payload to a file in one click.

  The sibling `exec.output_chunk` emit already scrubbed, under a comment
  stating the reason: the journal is hash-chained and append-only, so whatever
  lands in a payload can never be redacted afterwards, and the GDPR erasure
  cascade deliberately skips `journal_entries`. The argv needed it at least as
  much, because it carries text a *human* typed — a credential pasted into
  agent chat had nothing between it and permanent storage. Every argv element
  now goes through the run's own credential scrubber before the entry is
  written, and two guard tests (one behavioural over all three emit paths, one
  static over the emit sites themselves) fail if a future site writes the raw
  argv.

- **The client half of the approvals contract accepted a shape the server
  never sends.** `ApprovalsHandler.List` writes `{rows, status, count,
  has_more}` as a map literal — all four keys on every response — and the
  generated spec requires all four. `approvalListResponseSchema` required only
  `rows`. `useApprovals({loadAll: true})` pages until `has_more` is false, so
  an envelope missing that key read as `undefined`, the walk stopped after one
  page, and the UI presented the first 200 rows of approval history as the
  whole history with no error anywhere. All four are required now. Every list
  fixture in the hook's tests was hand-written and none was a real envelope,
  which is why nothing caught it; they go through one helper that builds what
  the handler actually writes.

- **Decided approvals were filed under Archived instead of Decisions.**
  `isArchivedNotDecided` looked for the decider on `entry.inboxItem`, but the
  two entry constructors are disjoint — `inboxEntry` sets `inboxItem`,
  `approvalEntry` sets `approval`. Every decided approval therefore had no
  decider to find and was classified as archived noise, which is precisely the
  mislabelling the function exists to prevent. It reads either field now, and
  `timeout` — the approvals queue's spelling of its own sweep, distinct from
  the waitpoint `timed_out` already listed — counts as not-a-decision.

- **Schedule advisories outranked real gates in the inbox bell.** The bell's
  "Needs a decision" bucket filtered on `isActionableInboxItem`, which answers
  "is there a source action behind this row?" and rightly says yes to a missed
  occurrence or a tripped circuit breaker. The bell asks the narrower question
  its heading promises — is an agent parked until a human answers? — and
  nothing is parked on either. They move to Recent, where the bucket's own
  comment always said they belonged.

- **Inbox deep links stopped working after the first render.** `?item=` and
  `?agent=` were read into `useState` initializers, and the route stays mounted
  across a same-route navigation. Leaving `/inbox-v2?item=x` for the bare route
  kept row x in the reading pane — a link naming no row is a request to show no
  row, and answering it with the previous one is how the wrong request gets
  decided — and `?agent=riley` after `?agent=casey` kept filtering on casey.
  Both now track the URL for the life of the route, and neither overwrites a
  search the user typed or a row they clicked.

- **`source_missing` could not say "checked, and the source is live".** The
  detail read computes whether a waitpoint or escalation still has a row that
  can decide it, and the pane offers a way out of an orphaned row on the
  strength of it. As `bool` with `omitempty` the false arm was unsendable: a
  live gate and a list row that never ran the probe were the same empty space
  on the wire. It is a pointer now, so the detail read states both answers and
  the list still states neither.

- **`limit` and `offset` were published as strings on `/inbox` and
  `/approvals`.** Both handlers `strconv.Atoi` them and reject anything that is
  not a non-negative integer, so the document promised generated clients a
  contract the server does not honour.

- **`crewship admin seed-inbox` collided with itself.** Both identifier
  families derived from `time.Now().Unix()`, so a second run within the same
  second re-minted the same run id and failed on the primary key — or, with no
  pipeline to hang the run on, re-used every source id, where `inbox.Insert`
  dedupes silently while the success line still claimed sixteen rows written.
  One nanosecond-derived suffix per invocation, carried by both families, with
  the `run_seed_` and `seed_` prefixes `--clear` matches on left intact. Its
  `--clear` flag is also documented now, which is what the strict docs gate was
  failing on.

- **The approvals API answered in a shape no browser could read.**
  `harbormaster.Request` carried no JSON tags and was serialized straight onto
  the wire, so `GET /api/v1/approvals` returned `"ID"`, `"Kind"`, `"Status"`,
  `"CreatedAt"` — while `lib/types/approvals.ts` and the generated OpenAPI spec
  both declared snake_case. Every non-empty response failed `safeParse`, so
  `/approvals` and the inbox's approval feed rendered zero rows behind
  "Malformed response from /api/v1/approvals". Only the Go CLI worked, because
  `encoding/json` matches field names case-insensitively on decode — which is
  also why every Go test passed: they all decoded into structs. The struct now
  carries snake_case tags, `DecisionComment` serializes as `decision_comment`
  (the column name, and what the OpenAPI schema already documented), and
  `TimeoutSecs` — documented as in-memory-only, but leaking to clients as a
  constant `0` — is `json:"-"`. `TestApprovals_WireShape_IsSnakeCase` asserts
  the emitted keys rather than what a Go decoder can recover from them.
  `docs/api-reference/approvals.mdx`, which had documented the PascalCase
  shape as a known quirk, is updated with it.

- **Four inbox rows advertised a decision they could not take.** Each was a
  button that called an endpoint the row could never satisfy:

  *Autonomy-gate holds.* `writeAutonomyHold` writes a `kind=waitpoint` row
  whose `source_id` is a crew, agent or mission id — never a
  `pipeline_waitpoints` token — so the generic Approve/Deny resolved to
  `/pipelines/waitpoints/{crew_id}/approve` and 404'd every time. The decision
  lives in the approvals queue and the row already carries `approval_id` in
  its payload; it is decided there now. (The inbox's cross-source dedupe
  suppresses the approvals row this one projects, so until this fix the only
  working surface was hidden and the broken one was what remained.)

  *A decision whose source is gone.* A waitpoint whose run was pruned, a hire
  already swept, an escalation whose `escalations` row was deleted: the source
  endpoint 404s and the inbox PATCH answered 409 "use the source endpoint", so
  the row could never leave Needs action and never reached History. The PATCH
  guard now makes the same exception for waitpoints it already made for
  source-less escalations, and `BulkPatchState` uses the same predicate rather
  than the escalation-only one it had drifted to.

  *The Archive button that knew nothing.* The client guessed whether a source
  still existed by looking at the payload — wrong in both directions. The
  detail read now answers it (`source_missing`), using the same probe the
  PATCH guard uses, so a live decision still offers no Archive and an orphaned
  one does.

  *Retry on a failed run.* It read `payload.pipeline_slug`, which the producer
  never writes, and fell back to `sender_name` — the SCHEDULE's name — posting
  `/pipelines/{schedule name}/run`. The `!slug` guard never fired because
  `sender_name` is always set, so the user got a red toast and the row stayed.
  Retry now needs a real slug, and a Retry that cannot run no longer resolves
  the row as "cancelled" behind the user's back.

- **History stopped calling archived noise a decision record.** One click on
  the grouped advisory card's "Archive 6 updates" put six curator advisories
  into History under a heading that read "Decision records" — telling the
  reader six decisions had been made when none had. History now splits into
  Decisions and Archived. Archiving is not deciding; the PRD says History
  holds both, not that they are the same thing.

  `scripts`-free cross-check, driving the CLI against the same server the
  browser reads: for each kind, `crewship inbox list --kind <k> --all` must
  agree with the facet, the kinds must sum to the unfiltered total, and the
  facet vocabulary must not have drifted from `inbox.AllKinds`.

- **Journal search said "no entries match" over a result set that was not
  empty (#2206).** Three defects in the same search box, each producing a
  false empty answer. Free-text search wrapped the whole input in one FTS5
  phrase literal, so it was an ordered phrase rather than a set of terms:
  on a live instance `morgan session` found 56 rows, `session morgan` found
  0, and `morg` found 0 against a corpus where `morgan` occurs 1,140 times.
  Terms are now quoted individually and `AND`-ed, with a prefix `*` on the
  last one — word order stops mattering (`session morgan` → 119, same as
  `morgan session`) and a half-typed word still matches (`morg` → 1,140).
  Quoting every term preserves the operator neutralisation the phrase form
  bought: `AND`, `OR`, `NOT`, `NEAR(...)`, `*`, `summary:x` and stray quotes
  stay literal search text and can neither restructure the query nor error
  it out.

  `agent:` and `crew:` in the search box — and `crewship journal --agent` —
  bound their value straight into a SQL equality on the id column, so the
  box's own placeholder example (`agent:viktor`) and `--agent morgan`
  returned zero. Both parameters now accept an id, a slug or a display name,
  resolved inside the caller's workspace by the API, so the UI, the CLI and
  direct API callers all get it. A reference that resolves to nothing is
  still matched against the id column, so a deleted agent's id keeps
  reaching its history and a typo stays unmatchable rather than widening to
  the whole workspace; an ambiguous display name matches every hit.

  The timeline's client-side matcher also re-applied the tokens the server
  had already bound, filtering the server's own rows back out (`agent:`
  reads the entry's `agent_id`, which is a UUID, against the name the user
  typed). It now narrows only on what the backend could not bind, and its
  free-text matching reaches the payload, which the server's index has
  always covered.
- **Three Logs filter chips could never appear, and 65 entry types had no
  chip at all (#2207).** The Crow's Nest type-chip row seeded its per-group
  counters from a hand-kept list that had fallen three groups behind the
  eighteen the UI defines, so counting an `audit`, `provisioning` or `chat`
  entry incremented a counter that did not exist — `NaN`, which fails the
  `count > 0` test the row uses to decide what to render. Those three chips
  were unreachable no matter how many such entries were loaded, and the
  visible chips' totals under-reported. The list is now derived from the
  render order, so it cannot drift again.

  Scanning the backend for every entry type it can emit finds 139, of which
  65 had no group: they rendered grey with a raw dotted-string pill, and
  because muting a chip is pushed to the server as an `exclude_entry_type`
  filter and the catch-all group has no type list, they could not be filtered
  out of a busy workspace's 5,000-entry window at all. Two new chips take the
  families that had nowhere to go — **routine** (the fourteen `pipeline.*`
  types plus the two `automation.*` refusals that explain why a routine did
  not run) and **page** (all fifteen `page.*` types, including publishing,
  public views and webhook credentials). The rest join the existing chips:
  memory, credentials, approvals-and-trust, notifications, provisioning and
  runtime freshness, missions, runs, chat, skills, system. The twelve the
  frontend's entry-type list had never carried — among them
  `page.owner_transferred`, `page.published` and
  `onboarding.proposal_applied` — gained an icon and a place in the activity
  sidebar's facets. `memory.priority_changed`, emitted as a bare string
  literal since it shipped, is now a named constant on the Go side, so the
  entry that records who changed a compaction-surviving marker is visible to
  anything that reads the backend's declarations.

  `hook.dispatch_error` was in the server-side `system` exclusion list but
  not in the client's type→group map, so muting System dropped it on the
  server while the client still called it ungrouped. The two maps now agree,
  and a test asserts it in both directions. `docs/guides/crew-journal.mdx`
  billed roughly ninety types as the "full entry-type catalog"; it now lists
  all 139 with the chip each one filters under.

- **Clicking a run in `/journal?tab=runs` moved the address bar and nothing
  else (#2209).** The row handler pushes `/journal?tab=timeline&trace_id=<id>`
  — the same pathname, so the App Router re-renders the page without
  unmounting it. Every URL-derived value was read once at mount
  (`useMemo(…, [])` or a lazy `useState` initialiser) and nothing re-read
  `searchParams`, so the tab stayed on Runs, the trace focus stayed empty, and
  the user was left staring at the runs table while the URL claimed Timeline.
  Every in-app link into `/journal?…` from an already-mounted journal was
  equally inert, as was the "click a row → open trace" hint promising it.
  The URL is derived state now rather than a mount-time copy, so the page
  follows it. Verified in a browser: `tab=runs` → row click → Timeline with
  the trace pill, no full page load.

- **The journal Timeline degraded permanently on a real workspace (#2210).**
  Four faults on one data path, each invisible on a quiet instance.

  *A dropped SSE stream never came back.* On the first `onerror` the hook
  closed the EventSource, fell back to 5 s polling and never reached for the
  stream again — only a filter change or a page reload restored the live tail,
  and the badge read "Polling" for the rest of the session with no explanation
  and nothing to click. It now reconnects on jittered exponential backoff
  (1 s doubling to a 30 s ceiling, equal jitter so tabs knocked offline by one
  server restart do not retry in lockstep), stops polling the moment the
  stream is back, and the badge is a button that retries immediately and
  re-reads the head.

  *The polling backfill silently lost the gap it existed to cover.* The
  watermark was set when the effect mounted and only ever advanced from
  *polled* entries, never from ones the stream had already delivered — so a
  stream that dropped after a busy hour re-requested from page-load time and
  got back one 50-row page, discarding everything in between with nothing
  saying so. The watermark now advances from stream entries too, each poll
  walks up to 4 cursor pages to close a deeper backlog, and a backlog deeper
  still surfaces as "Entries missing" rather than vanishing. `lastError`,
  which the hook had always computed and the page had always thrown away, is
  now on the badge.

  *Prepending a live entry was O(n), per event.* Each `prependLive` scanned up
  to 5,000 buffered entries for a duplicate id and copied the whole array; the
  page's 250 ms batch then called it once per event, so a 50-event flush was
  ~250k comparisons and 50 array copies before React rendered once.
  `prependLive` takes an array: one pass, one update. `ResourcesStrip` was not
  batching at all — for `container.metrics`, the highest-volume entry type in
  the product — and now shares the batching hook.

  *Two filters missed the partial indexes built for them, and a third had no
  index at all.* SQLite uses a partial index only when the query's predicate
  *implies* the index's, and a single-value `IN` does not: the Timeline sends
  exactly one severity, so `severity IN ('error')` never matched
  `idx_journal_ws_sev_ts … WHERE severity IN ('warn','error')` and scanned the
  workspace partition instead. `priority IN ('high')` missed
  `idx_journal_entries_priority … WHERE priority != 'normal'` the same way.
  And `run_id` — `(trace_id = ? OR actor_id = ? OR run_id = ?)` — could not be
  index-unioned at all, because `actor_id` had no index (`idx_journal_actor_ts`
  is on actor_*type*), which made every `/journal/count?run_id=` scan the
  whole workspace partition since `Count()` emits no `LIMIT`. Migration
  `20260831093500_journal_filter_indexes.sql` adds unconditional
  `(workspace_id, severity, ts)` and `(workspace_id, priority, ts)` indexes plus
  a partial `(workspace_id, actor_id, ts)`, drops the now-redundant
  `idx_journal_entries_priority`, and keeps v146's tiny partial severity index,
  which still wins the two-value errors-and-warnings shape. Every plan change
  is pinned by `EXPLAIN QUERY PLAN` assertions against a seeded, `ANALYZE`d
  database — an index whose plan nobody checked is worse than none, because it
  looks like the problem is solved.

- **`crewship apply` planned a `COORDINATOR` agent as creatable and then the
  server refused it (#2195).** The standalone `kind: Agent` validator kept
  `COORDINATOR` in `validAgentRoles`, so a manifest carrying that role passed
  `--dry-run` with a green `Plan: 1 to create` and the real apply failed with
  `400 agent_role must be AGENT or LEAD`. The role was retired in v0.1
  (`internal/api/agents.go`, pinned by `agents_test.go`); the comment in the
  validator acknowledged the server rejects it and kept the value anyway, so
  that a future server rollback would stay a one-line change. That option was
  never exercised and its price was paid on every run — and a dry-run plan is
  the artifact CI checks. The validator's own enum error made it worse by
  advertising `COORDINATOR` among the values to use, so a user who mistyped
  the role was handed a fix that fails at apply.

  Validation now refuses the retired role before any request, in any casing,
  with `agent_role COORDINATOR was retired in v0.1 and the server rejects it;
  use LEAD` — the message #2191 gave `crewship agent create --role`, one layer
  over. The enum error for other bad values lists only `LEAD, AGENT`. Third
  surface of the same retired role, after #2166 (create-agent dialog) and
  #2189 (`crewship agent create --role`); #2197 covers the crew wizard.

- **Agent avatars never actually got stored, and `/crews` re-tried the failed
  writes on every load (#2196).** The backfill that hands the server a
  rendered avatar for an agent that has none has never stored a single one
  since it shipped. Its `PUT /api/v1/agents/{id}/avatar` carried no
  `workspace_id`: the route resolves its workspace from the query string, a
  path segment, or the `X-Workspace-ID` header, and the client had none of the
  three, so every write was refused with `400 workspace_id is required` before
  the handler ran — eight of eight agents, on every view of `/crews`, with
  `avatar_url` still `null` a day after a seed. The workspace id is now
  threaded from the component into `queueAvatarBackfill`, and a missing one
  skips the write entirely instead of sending a request that cannot succeed —
  the rule the read path (`agentAvatarURL`) has always applied. `/onboarding`
  supplies its own workspace id, because that route never loads the workspace
  store and its Crewship Guide avatar would otherwise be skipped.

  The same function also refunded its per-page-load budget for any non-403
  failure, so a permanently failing endpoint consumed no budget and the page
  re-attempted the full allowance every load, forever. A run of failures that
  are not permission refusals now stops the backfill for the session, the way
  a run of 403s already did, and a failed write spends its budget. Avatars
  still render from their seed throughout; nothing on screen changes when a
  backfill fails.

- **The create-crew wizard could offer a crew it was then unable to create
  (#2197).** `POST /api/v1/crew-ai-suggest` asks a model for each agent's
  `agent_role` and constrained it in the prompt only. `validateSuggestion`
  checked the crew name, the agent count, the required fields, the slugs and
  that exactly one agent was `LEAD` — never what the other agents claimed to
  be. A model answering with a role the platform retired in v0.1, a plausible
  completion given the word "coordinates" sits in the instruction for the
  sibling role, produced a suggestion that passed validation, rendered as a
  lineup preview with that role on a badge, and failed at creation:
  `POST /api/v1/agents` answers `400 agent_role must be AGENT or LEAD`.

  Suggestions are now validated against the same set the create endpoint
  accepts. A role outside it fails the suggestion the way a missing field
  does, so the wizard can no longer show a lineup carrying a role it cannot
  build. (Roles only — `validateSuggestion` still checks names and slugs for
  presence rather than length, so a suggestion remains a draft to review.)
  Casing and surrounding whitespace are normalised rather than refused — the
  same role written the way a model writes JSON — and an omitted role becomes
  `AGENT`, the default the create endpoint already applies.

  Three renderers printed whatever token arrived, and no longer do: the
  wizard's lineup preview, the agent roster and the crew canvas roster all
  present an unrecognised role as an ordinary agent, which is the one thing
  the form behind them can deliver. Stored agent rows predating the retirement
  stop carrying a badge for a role that no longer exists. The crew-template
  and AI-suggest response types narrowed to `"AGENT" | "LEAD"`, so a third
  value has to be added deliberately — a test catches that, not the compiler,
  because each renderer takes the field as a plain string on purpose.

  Fourth surface of the same retired role, after the create-agent dialog copy
  (#2166), `crewship agent create --role` (#2189) and the standalone `Agent`
  manifest validator (#2195).

- **`crewship crew suggest --goal "…"` could never succeed on any server
  (#2201).** The command posted `{"goal": …}` and
  `POST /api/v1/crew-ai-suggest` decodes `{"description": …}`, so the handler
  always saw an empty string and answered `400 description must be at least 10
  characters` — a message naming a field the CLI has no flag for, on a request
  that never reached a model. It now posts `description`; the flag stays
  `--goal`, which is what `docs/cli/crew.mdx`, the OpenAPI request schema and
  the web crew wizard already agreed on.

  A goal outside the endpoint's 10–2000 bytes of UTF-8 is now refused locally,
  naming `--goal` and exiting `2` — the same code the server's `400` maps to,
  so moving the check between tiers does not change what a script sees (the
  #2189 precedent). `--goal is required` moves to that exit code too; it
  previously exited `1`.

  Both layers now say **bytes of UTF-8** where they used to say "characters".
  The bound has always been `len(string)`, so the old wording was a promise the
  check did not keep — harmless at the minimum, where a non-ASCII goal only
  ever passes more easily, but wrong at the maximum, where a CJK or emoji
  description is refused at roughly a third of the 2000 the message named. The
  limits themselves are unchanged; only `POST /api/v1/crew-ai-suggest`'s two
  `400` message strings and the docs are.

  The bug survived CI because the only test of the payload asserted the CLI's
  own spelling — `strings.Contains(body, "\"goal\":\"grow the userbase\"")` —
  against a stub server that answered `200` to any body, so it passed
  *because* the key was wrong. That assertion now decodes the posted body with
  `api.CrewAISuggestRequest`, the struct the handler itself decodes into, and
  a new acceptance test drives the built binary against a real `api.NewRouter`
  to the endpoint's `422` for a workspace with no Anthropic key — the furthest
  point reachable without spending tokens, and one step past where the bug
  died.

- **`go test ./internal/api/...` was red on every dev clone, and green in CI
  (#2188).** `TestEveryCredentialLoader_SplitsTheEndpointObject` walks the
  repository from its root and skipped `.git`, `node_modules`, `web`, `vendor`
  and `testdata` — but not `.claude`, which holds the agent worktrees parallel
  sessions leave behind as complete copies of the tree. The guard classifies
  files through `notUpstreamDelivery`, a map keyed by repo-relative path, so a
  copy at `.claude/worktrees/agent-x/internal/api/credentials.go` matched no
  key and was reported as a brand-new unclassified credential loader — one
  bogus finding per classified file per worktree, so the package could not be
  made green locally. CI has no worktrees and never saw it, so the failure
  existed only on developer machines, where it reads as a security regression
  until the `.claude/worktrees/` prefix on every path gives it away.

  The same omission is now closed in the two other repository walks,
  `internal/hooks/dispatch_site_test.go` and
  `internal/pipeline/cel_module_path_test.go`. Neither was failing: their
  assertions are not keyed by path, so a copy that satisfies the rule
  satisfies it under any prefix. Both were re-walking one whole tree per
  worktree to answer for one, and would have started failing the day either
  grew a path-keyed exemption.

  The regression test builds a synthetic tree containing
  `.claude/worktrees/agent-*/internal/api/credentials.go` and asserts the walk
  does not return it. Asserting the skip list itself would pass against a walk
  that listed `.claude` and descended into it anyway.

- **`crewship agent create --role COORDINATOR` warned that it was setting the
  role, then the server refused it (#2189).** The role was retired in v0.1 and
  the handler answers `400 agent_role must be AGENT or LEAD`, but the CLI
  printed *"COORDINATOR role is deprecated; use LEAD instead. Setting role
  anyway."* and forwarded it — and the function's own comment claimed the value
  was still accepted for back-compat with v1 templates. So the one audience
  that path existed for, somebody applying an old template, was told their
  value would be honoured and then got a server refusal naming neither the
  template nor the deprecation they had just been warned about. The CLI now
  refuses it locally with `COORDINATOR was retired in v0.1 and the server
  rejects it; use --role LEAD`. Every other value still goes to the server,
  which owns what is valid — this is a removal of one false promise, not a new
  client-side role validator. Companion to #2166, which removed the same dead
  promise from the create-agent dialog.

- **A missing field on one response took down the whole dashboard (#2185).**
  `series_labels` is typed as required on the timeseries response, but the
  type is a claim about the wire and `fetchOr` validates nothing, so a 200
  with an unexpected body reached `Object.entries(undefined)` inside a
  `useMemo` — a render-time throw that unmounts the page rather than the one
  chart it belongs to. The line above it already tolerated a missing
  `bucket.series` for the same reason.

- **The run-volume chart never refreshed (#2185).** `useInvalidateDashboard`
  invalidated two fixed-param timeseries keys that nothing mounts, and never
  the key the page actually uses — `invalidateQueries` compares the params
  object by deep equality, so the window-dependent key could not match. The
  KPIs and Running-now updated from the realtime path while the chart beside
  them stayed frozen until a remount or a window switch.

- **The attention strip dropped items past the third (#2185).** The badge
  reported the true count, but the order is fixed, so on a workspace with
  approvals, failures and capacity holds a credential gap could never render
  — and neither it nor a capacity hold is reachable through the strip's
  "Open Inbox" link. The remainder is now named, with its links, rather than
  only counted.

- **The dashboard reported green over failures it could not see (#2185).**
  Three states were rendered as one. The attention strip said "All clear ·
  There is nothing blocking your crews right now" whenever `attentionItems`
  was empty — including while the inbox was still loading, and permanently
  when the inbox fetch failed, which for an RBAC-gated workspace is a 403 the
  hook does not retry. The Runtime capacity signal read a green "Available"
  when its fetch failed, because `capacity?.enabled === false` is also false
  for a null response, so a dead admission-control endpoint looked like
  healthy capacity. And the Services row painted "6/6 running" in success
  green while two of five crews had never been reached.

  Each now has the third state it needed: unknown is not clear. And the strip
  says so even when it does have something to show: `capacity` and
  `credentials` come from their own endpoints, so the list can be non-empty
  while the inbox — which carries approvals and failed runs — was never read,
  and a confident count over that is the same defect one layer up.

- **The dashboard rendered another workspace's crews (#2185).**
  `GET /api/v1/runtime/capacity` is deliberately instance-scoped — the host is
  a property of the instance — and the attention strip rendered
  `held[0].detail` verbatim. On an instance with more than one tenant that put
  one workspace's crew detail on another's dashboard, and counted their held
  starts in its badge. Holds are now filtered to this workspace's crews.

  The same filter fixes the count: `admission.Hold` is appended per held
  *start*, so five queued starts on one crew read as "5 crews waiting for
  capacity". It is deduped per crew now.

- **The dashboard showed money that is not money (#2185, #2193).**
  The "Actual cost" tile is removed. On a flat-rate subscription the marginal
  cost of a call is structurally not a number — paymaster's own type says so,
  forcing `CostUSD` to 0 and confidence to Unknown for `BillingFlatRate` — and
  the tile rendered a ledger figure with no confidence badge, which the same
  file explicitly forbids. On the workspace it was built against, 25 routine
  runs carrying $0.83 of adapter-reported usage produced zero ledger rows,
  because routine runs on the subscription adapter never reach the metered
  path; the tile showed $0.00 and, with a budget set, a progress bar that
  filled far slower than reality. The reasoning is left at the call site so
  it is not re-added without it. #2193 tracks the four other places the same
  figure is still printed with a `$`.

- **An approval could outlive the run it belonged to, and approving it did
  nothing (#2163).** A routine run parked on a `wait` step and then marked
  `interrupted` left its waitpoint `pending`. The inbox kept offering the
  decision, the approve endpoint accepted it and returned
  `{"approved":true,"ok":true}`, the row flipped to `resolved` — and the run
  stayed interrupted, so the approved action never ran. The operator was told
  they had approved a production change that did not happen, and the audit
  trail recorded the approval.

  Not an exotic race. The commonest way in is ordinary: edit a routine while
  one of its approvals is pending, and the next restart refuses to resume that
  run because the definition hash no longer matches — which is the drift gate
  working correctly. Every such refusal stranded an approvable gate.

  `CancelWaitpointsForRun` already existed for exactly this ("used when a
  parked or blocking run is cancelled or dies") and was wired to the explicit
  -cancel path only. It now hangs off the status transition itself rather than
  off its callers: `resume.go` marks runs interrupted from five places and the
  boot fallback from two more, and an invariant enforced at seven call sites is
  one the eighth will miss. The cascade fires only when the guarded write
  actually moved the row, so a run that finished between the resume scan's read
  and the write keeps its waitpoints.

  Rows that already carry the defect are repaired at boot rather than only
  stopped from recurring, since every install upgrading into this fix still
  holds them: `CancelOrphanedWaitpoints` settles any pending waitpoint whose
  run is terminal or whose run row is gone, and logs a non-zero count. The
  existing recovery scan already reported these as `stranded_pending` and did
  nothing about them.

- **The app shell clipped the last 64px of every page that had a wide
  descendant (#2156).** `SidebarInset` renders `<main>` as a flex item
  (`w-full flex-1`) with no `min-w-0`, so it kept `min-width: auto` and could
  not shrink below its content's min-content width. A page wide enough pushed
  it past the 64px icon rail: the inset measured a full viewport wide while
  starting at x=64, and everything past the right edge went off-screen.

  Nothing on the path scrolls horizontally, so there was no scrollbar to
  reach the overhang — it was clipped, not scrolled. On `/activity?run=<id>`
  that cut the run stat strip's `COMPOSED` column, the right edge of the
  steps rail, and the account menu in the top bar, which read "DU D". At a
  1600px viewport the inset measured 1600px starting at x=64 (overflowing to
  1664) where `/inbox` correctly measured 1536px; both are 1536px now.

  The regression test is geometric rather than a class assertion, because the
  markup was always correct and only the layout was wrong: jsdom sees nothing,
  and an overflow check on `<html>` finds nothing either, since there is no
  overflow — only clipping.

- **The inbox detail pane's jump control named a destination and went
  nowhere (#2157).** `jumpFor` returned `{ label, icon }` and no href, and
  the pane rendered it as a plain `<Button>` with no `onClick`: it worked out
  which destination to name, named it, and did nothing when clicked. All
  three variants were dead — `Open chat`, `Open <identifier>`, `Open run` —
  and `Open run` is the only control on the pane for reaching the run an
  approval describes, so a reviewer reading a waitpoint had no way through to
  its activity.

  It survived because the test asserted `jumpFor(...)?.label` and nothing
  else: the derivation was right the whole time and the integration was
  missing, so a test of the return value went green against it. The new spec
  asserts the rendered DOM — an `<a>` carrying an href.

  `chat_url` is attacker-influenced payload, and the guard against an
  off-origin jump lived in `kind-actions` only. `jumpFor` had none, so it
  would return `Open chat` for an absolute URL — harmless while the button
  was dead, and not harmless the moment an href was added. The guard is now
  one exported function both call sites share, since two copies of a security
  check drift and the copy without it was the one deciding whether a
  destination got named at all. Identifiers are URL-encoded into the path and
  the query.

- **A long approval message pushed the decision off the screen (#2160).**
  An inbox item's `body_md` had no height limit of any kind — for a waitpoint
  it is the whole approval prompt, which for a model-drafted change plan is
  several hundred words of unbroken prose. The card grew to fit it and pushed
  the run ladder, the identifiers and the footer below the fold, so the reader
  who most needed the buttons was the one who had to scroll furthest from
  them. Long bodies now clamp with an explicit "show the whole message"; the
  full text stays in the DOM so find-in-page and copy still reach it.

- **A field added to a routine step body could ship without its schema
  (#2160).** `TestRoutineSchema_AllFieldsCovered` reflected over `DSL` and
  `Step` only, never over the step bodies — which is where fields are
  actually added. A Go field with no matching property in
  `schemas/routine.v1.json` passed CI green while `additionalProperties:
  false` silently rejected every routine that used it for anyone validating
  against the published schema. The guard now walks every step body,
  derived from `Step`'s own pointer fields so a new body type is covered the
  day it is declared. It immediately caught one live instance:
  `NotifyStep.Category` (shipped with the notification taxonomy) had no
  schema property, which is fixed here.
- **A fresh agent with no credential looked identical to a healthy one
  (#2169).** The agent overview's Credentials cell warned only when a
  credential's status was not `ACTIVE`, which never fired for the
  zero-credential case — an agent with no explicit grant and nothing
  inherited from its crew showed a quiet empty list, and its first run
  failed with no warning anywhere on the way there. The cell now flags a
  genuinely empty credential set with an explicit "No credential
  assigned" row; an agent that legitimately inherits a crew-scoped
  credential (`grant_source: "crew"`) still resolves to a non-empty,
  `ACTIVE` array and stays quiet.

- **The create-agent dialog no longer promises a "Coordinator" role it
  cannot deliver (#2166).** The empty-workspace banner, the crew-required
  validation hint, and the crew field's hint text all told the user they
  could set an agent as a workspace-wide "Coordinator" needing no crew — a
  role `CreateSurfaceChoice`'s Role picker has never offered; it is AGENT or
  LEAD, full stop. A user in a brand-new workspace, the exact moment the
  empty-crews banner fires, followed the product's own instructions into a
  dead end. All three strings now describe what the form actually does.
  Whether to let the UI create a crewless AGENT (the API already allows one
  for non-LEAD roles, and `crewship agent create --crew` is optional) is a
  separate capability decision, filed as #2170.

- **`claim-issue.sh` produced permanent phantom locks in the majority of
  cases — measured at 19 of 35 live claims, with 6 issues double-claimed
  (#2107).** Two compounding bugs. First, the RELEASE parser cancelled a
  CLAIM only when both clone and branch matched it; CONTRIBUTING says to
  claim an issue *before* the first commit, i.e. before the feature branch
  exists, so the ordinary claim → work → release sequence posts the RELEASE
  from a different branch than the CLAIM and the cancellation never fired.
  Second, `detect_branch` recorded a `git worktree`'s auto-minted
  `worktree-agent-<hash>` branch verbatim, which guaranteed that mismatch for
  every well-behaved worktree session and told a reader nothing besides. A
  lock that stays stuck more than half the time trains sessions to reach for
  `--force`, and forcing a live claim looks identical to forcing a dead one.
  Cancellation now matches on clone identity alone — a release from clone X
  ends X's open claims regardless of branch, and a release naming neither
  clone nor branch still ends everything, unchanged. `detect_branch` now
  refuses a `worktree-agent-*` value, preferring the upstream/tracking
  branch when one is already configured and otherwise falling back to the
  worktree path, which does not change between CLAIM and RELEASE.

- **The crew-scoped file download served the exact bytes the agent door had
  just been taught to refuse (#2142).** #2069 added a check to
  `GET /agents/{agentId}/files/download` denying the six generated per-agent
  files that hold resolved MCP credentials, but that check had exactly one
  call site. `GET /crews/{crewId}/files/download` reads the identical
  crewshipd storage — the same `<crewID>/<agentSlug>/.mcp.json` key resolves
  on either door — and forwarded it unguarded, so the same 0600 credential
  bytes any workspace role with read access was refused on one URL were
  served whole on the other. The check now also runs in crewshipd's single
  download funnel, which both HTTP doors proxy through, so a future caller
  that reaches it inherits the denial rather than needing to remember to add
  it again.

- **Agent file downloads no longer expose generated MCP credentials (#2069,
  #2140).** Crewship writes resolved HTTP headers and process environment
  values into each CLI's native MCP config with mode `0600`. The Files API's
  new container-side read fallback could nevertheless read those bytes as the
  agent UID and return them to any workspace role with read access. Downloads
  now reject the six exact generated config paths before IPC, while ordinary
  dotfiles and user-authored skills below `.codex/`, `.gemini/`, and similar
  directories remain available.
- **The agent's raw stdout+stderr capture reached the audit journal without
  passing through the credential scrubber (#2133).** `streamOutput`'s
  end-of-stream `exec.output_chunk` emit wrote `captureBuf` — the process's
  raw combined output — straight into the journal payload. `wrapScrubHandler`'s
  stream scrubber only ever sees parsed `AgentEvent`s; `captureBuf` is a
  second, separate raw-byte capture read directly off the process's
  stdout/stderr, so it bypassed the scrubber entirely. A credential an agent
  printed — its own, or one echoed back by a poisoned tool result — landed in
  a hash-chained, append-only journal row that can never be redacted after the
  fact. The capture now runs through the same `internal/scrubber` the rest of
  the outbound path uses, seeded with the run's own loaded credential values,
  the same way the adapter-exec-error path already scrubs its copy of this
  same raw output. `total_bytes` and `truncated` still describe the raw
  stream and are computed before scrubbing, since redaction changes the
  string's length.
- **`pre_tool_call` was a hook event you could register that would never
  fire.** `crewship hooks create --event pre_tool_call` (and the matching
  `POST /api/v1/hooks`) returned 201 and listed the hook as enabled and
  healthy, but nothing in the platform ever called `hooks.Dispatch` with
  that event — Crewship drives agent work by parsing the stream a driven
  CLI (Claude Code, Cursor, ...) emits, so by the time a tool call is
  observable the tool has already run; there is no "before the tool runs"
  interception point to hook. (`post_tool_call` fires after the tool runs
  and, since the dispatch-gap fix below landed in this same release, now
  reaches user-registered hooks — see the Hooks guide's coverage table.)
  `pre_tool_call` is no longer a valid `--event` / `event` — the CLI and
  the API now reject it the same way they reject any other unknown event
  name, echoing the same list of legal ones. The `hooks.EventPreToolCall`
  Go constant stays defined so a `hooks_config` row created before this
  change still lists, toggles, and can be edited via `PATCH` for any
  field other than `event` — the store only re-validates `event` when a
  write actually changes it, so a legacy row isn't frozen out of every
  edit just because its event predates this change. (That check reads the
  row's current event first, so the `UPDATE` it guards now also matches on
  that event — a concurrent write that moves a legacy row onto a valid
  event can no longer be undone by a stale update putting the retired one
  back.) It still never dispatches.

  ⚠️ **Behaviour change:** a script or manifest that registers a
  `pre_tool_call` hook now gets a 400 instead of a silently-dead 201.

- **Ten more hook events registered cleanly and never fired — the same
  defect class `pre_tool_call` was, minus the one that had no possible
  fix.** `pre_task_delegation`, `post_task_delegation`, `post_tool_call`,
  `pre_llm_call`, `post_llm_call`, `pre_memory_write`, `post_memory_write`,
  `pre_peer_conversation`, `post_peer_conversation`, and
  `on_budget_exceeded` were all declared in `hooks.AllEvents`, accepted by
  `crewship hooks create` / `POST /api/v1/hooks`, and reached by zero
  `hooks.Dispatch` calls anywhere in the tree — a registered hook listed,
  toggled, and looked healthy while never once running. Unlike
  `pre_tool_call`, a real dispatch point existed for every one of these
  ten; each is now wired to it:

  - `pre_task_delegation` / `post_task_delegation` — `AssignmentHandler.runAssignment`, the one function every delegation door (sidecar `/assign`, its retry pump, the mission engine, and `@mention`) converges on.
  - `post_tool_call` — `postToolCallObserver.Observe`, decoupled from the built-in behavior monitor's governance/sampling gate so a user's own hook fires on every observed tool call regardless of that monitor's settings.
  - `pre_llm_call` / `post_llm_call` — a new outermost layer in `llm.Middleware`'s caller chain, wrapping every `Complete` and `Stream` call.
  - `pre_memory_write` / `post_memory_write` — `Consolidator.Run`, around the automated `learned-*.md` write the background consolidator makes with no human in the loop (an agent's own `memory.write` tool call runs inside the sidecar container, which has no database connection to dispatch from, so that path is not covered — see the [Hooks guide](/guides/hooks#coverage-status)).
  - `pre_peer_conversation` / `post_peer_conversation` — `QueryHandler.Create` / `finishQuery`, the sidecar's `/query` peer-question path.
  - `on_budget_exceeded` — `paymaster.Enforce`, alongside the `budget.exceeded` journal entry it already wrote on a hard/tiered budget breach.

  `internal/hooks/dispatch_site_test.go`'s `TestEveryOfferedEventHasADispatchSite`
  — added by the `pre_tool_call` fix as a source-scan invariant, but left
  logging rather than failing on these ten known gaps — now fails CI if
  any offered event ever loses its dispatch site again.

  ⚠️ **Behaviour change:** a `Blocking: true` hook registered against any
  of these ten events previously had no effect no matter what its handler
  returned. It can now actually refuse the operation it's attached to
  (`pre_task_delegation` refuses the delegation, `pre_llm_call` refuses
  the LLM call, `pre_peer_conversation` refuses the peer question,
  `pre_memory_write` refuses the consolidator's write) — a workspace with
  such a hook already registered will see it start enforcing on upgrade.

- **Newly wired observation hooks could delay operations, report zero LLM
  cost, and observe stale peer-query state.** `post_*` and `on_*` events now
  always dispatch asynchronously; new or edited observation hooks reject
  `blocking: true`, while legacy rows with that flag are safely treated as
  non-blocking. The paymaster returns its estimated cost to the LLM hook
  layer (not only to the ledger), HTTP and shell handlers receive the LLM
  provider/model/cost fields, and `post_peer_conversation` fires only after
  the terminal query state is committed.

  Getting the cost to that hook layer meant `paymaster.recordFromResponse`
  now returns the enriched `CallResponse` rather than computing its numbers
  into locals — so the cost/confidence/timestamp the ledger records are the
  same values every layer *above* paymaster sees. Two visible consequences
  beyond hooks, neither a ledger change (`Record` already forced the
  flat-rate invariants on disk): the OpenTelemetry LLM span's `cost_usd`
  attribute now carries the backfilled rate-card estimate instead of the
  provider's raw — usually zero — number, so spans and the ledger finally
  agree; and `Confidence` comes back populated (`precise`/`estimate`/
  `unknown`) where it used to be empty. Dashboards that charted span
  `cost_usd` will show non-zero where they showed nothing.

- **Two of the new gates called a broken hook a policy refusal.** `Dispatch`
  distinguishes a hook deciding *no* (`*hooks.BlockedError`) from the hook
  registry being unreadable or a handler being broken (`*hooks.DispatchError`)
  — #2138 introduced that split precisely so gate call sites could report the
  two differently. The new `pre_task_delegation` and `pre_peer_conversation`
  gates collapsed them: a subagent hook with no handler installed, or a
  webhook whose lookup failed, marked the assignment `FAILED` with
  "pre_task_delegation hook blocked", and answered a peer query with `403`
  plus the raw error (which wraps the underlying DB error) in the response
  body — sending the operator hunting for a policy that does not exist, and
  telling the caller it was refused when nothing refused it. Both still fail
  closed, because a gate that cannot be evaluated is not a gate that passed;
  they now say which happened, and the peer-query path answers `500` with a
  generic body rather than `403` with the cause.

  The check is also *ordered*, which the first pass of this fix got wrong.
  `Dispatch` returns `errors.Join(dispatchErrs..., blocked)` when one blocking
  hook fails to run and a **later** one blocks, so the joined error satisfies
  `errors.As` for both types. Asking about `BlockedError` first reported a
  tidy policy refusal and silently discarded the fact that another hook never
  executed at all — the half an operator actually has to go fix. `DispatchError`
  is now checked first at both gates.

- **`post_task_delegation` announced a delegation the database did not yet
  agree had started.** The dispatch sat immediately before `UPDATE assignments
  SET status='RUNNING'`, so a handler that read the row back could find it
  still `PENDING` — for an event whose entire meaning is "this delegation
  began". It now fires after the transition, the same rule `finishQuery`
  already follows for `post_peer_conversation`, and on `context.Background()`
  like the other `post_*` sites so a cancelled caller cannot drop the
  observation during the registry lookup.

- **A forked mission could never run a task.** `Fork` wrote the mission, its
  tasks and its checkpoint, but not the synthetic `chats` row that
  `assignments.chat_id NOT NULL REFERENCES chats(id)` requires — the row the
  normal mission-create path stamps in the same transaction. The fork itself
  reported success; the failure surfaced later, as a `FOREIGN KEY constraint
  failed` the first time the orchestrator tried to dispatch one of the copied
  tasks. It went unnoticed for the feature's whole life because the package's
  tests built their own fixture schema with no `chats` table at all, so the
  constraint could not fire. Those tests now run against the real migration
  chain, which also surfaced a second case seeding an assignment against a
  chat that did not exist.
- **Erasing an operator model reported success while leaving a readable copy
  behind (#2131).** The user model is stored per crew, at
  `crews/{crewID}/shared/.memory/users/{slug}.md`, but its index row is keyed
  `UNIQUE(workspace_id, user_slug)` with `crew_id` merely informational — and
  the consolidation sweep recomputes that `crew_id` as the operator's
  *most-active* crew. So a crew change moved the row's pointer forward and
  wrote a fresh file, without ever removing the one it left behind. All three
  erasure triggers — the self-service `DELETE /api/v1/users/me/user-model`
  (`crewship privacy user-model delete`), the admin GDPR subject-access
  cascade, and the daily sweep's own opt-out purge (`consolidate.SyncUserModel`)
  — reconstructed a single expected path from a current `crew_id`, so each
  reached only the newest copy and reported deletion while every prior crew's
  copy stayed on disk and readable by that crew's agents. Erasure now
  enumerates the crew directories that actually exist and removes the slug's
  file from each, rather than trusting one row's idea of where the file
  should be — including the opt-out path, which the first pass of this fix
  had not yet reached.

  A second defect in the same fix: the two API surfaces widened the delete
  from one directory to N but still swallowed a per-directory failure into a
  log line, deleting the index row unconditionally either way — so a single
  crew directory that could not be cleared (permissions, a stray non-empty
  path) still came back `200` (self-service) or `202` full-success (admin
  cascade), the identical "erasure reports success while a copy survives"
  bug one level up. Both now surface a real partial failure — `500` from the
  self-service delete, `207 Multi-Status` from the admin cascade — and leave
  the index row in place when a directory could not be cleared, rather than
  deleting it and making the survivor unfindable by the next retry (this
  code is reached by looking the row up in the first place).

  Not changed: an operator moving to a new crew still starts from an empty
  model there. Carrying content across would cross the same per-crew boundary
  the erasure fix deliberately does not treat as one address space, and that
  is an isolation decision to make explicitly, not a side effect of a
  deletion fix.

  Known remaining gap, not fixed here: each crew's sidecar keeps its own FTS5
  search index (`index.sqlite`) alongside `.memory/`, rebuilt from whatever is
  on disk at container startup and every 60 seconds while the container runs.
  The host-side erasure above never opens that file. A crew whose container
  is running clears itself on its next tick; a **dormant** crew — typically
  exactly the one the operator has since left — keeps the erased content's
  search chunks until its container is next started. See
  `docs/security/gdpr.mdx` for the proposed fix.

- **Backups were silently short, and `--replace` deleted through the same
  wrong filter (#2008).** `DiscoverScopedTables` recorded the *shortest*
  reverse-foreign-key chain from each table to `workspaces` and built a `WHERE`
  from it, without ever asking whether the column it landed on was nullable. A
  filter on a nullable column omits every row where that column is NULL. The
  bundle is written, `crewship backup verify` passes — it only checks the
  payload's SHA-256 against the sealed bytes — and the rows are simply absent
  at restore.

  Seven tables lost rows that way. `mission_tasks` through
  `assignment_id` lost **every task nobody had claimed**; `crew_mcp_servers`
  through `workspace_mcp_server_id` lost **every server a crew configured for
  itself**; `page_versions` through `author_agent_id` lost **every version a
  human saved**; `agent_credentials` and `agent_mcp_bindings` through
  `credential_id` lost every binding with no credential; `page_panel_data` and
  `page_panel_alerts` lost every panel not fed by a routine and every lapse on
  a panel with no `on_failure`.

  It was not even stable. `reverseFK` was built by ranging over a Go map, so
  two equidistant parents raced to claim a child and **the same binary against
  the same schema produced different filters on consecutive runs** — one run
  lost `mission_tasks`, the next lost `crew_mcp_servers`. And
  `discoverScopedTablesTx` in `replace.go` was a verbatim copy of the same
  walk, which is the one deciding what a `--replace` restore **deletes**.

  The walk now minimises `(nullable hops, total hops)` over the whole path,
  relaxes to a fixed point rather than doing a shortest-path sweep, and breaks
  every remaining tie deterministically. The `replace.go` fork is deleted.

  **Bundles written before this are still short and nothing detects it** —
  `Verify` compares a checksum and the manifest records no per-table row
  counts. That gap is #2009, and it is called out as a `<Warning>` in
  `docs/guides/backup.mdx`.

  ⚠️ **Upgrade note.** Migration
  `20260820074400_issue_counters_crew_not_null.sql` rebuilds `issue_counters`
  to make `crew_id` genuinely `NOT NULL`. There is no `DELETE` statement, but
  the copy is filtered and the original is dropped, so two row classes are
  **discarded and not recoverable in place**: rows with `crew_id IS NULL`
  (which name no crew, hence no workspace and no prefix, and which no code
  path reads) and rows whose `crew_id` names a crew that no longer exists
  (FK orphans that would otherwise abort boot with SQLite error 787). Every
  counter naming a live crew is carried across with `next_number` intact. No
  action is required before upgrading beyond the ordinary one — keep a copy of
  the database file.

- **The timeline's "Restore" restored nothing and said it had (#2070).**
  `POST /api/v1/…/checkpoints/{id}/restore` is non-destructive by design and
  says so in its own doc comment: no rows are mutated, no containers are torn
  down, no memory is rewound. It computes a **preview** and journals it as one.
  The dropdown item said `Restore` and, on any `res.ok`, raised
  `toast.success("Mission restored to checkpoint")`.

  What it threw away is the part that mattered. The response carries
  `warn_divergence` — the journal entries strictly newer than the checkpoint
  cursor, which is precisely the work a real rewind would have to abandon —
  and the handler discarded the body unread. The item is now labelled
  **Preview restore**, the body is parsed, and the result says
  "Restore preview — nothing has been rewound", naming how many later events a
  restore would abandon and that rewinding is not implemented yet.

- **`pins.md` and `learned-*.md` could be read empty (#1994, #2021).** All
  three writers opened with `O_CREATE|O_APPEND` and then wrote, which leaves
  the file on disk at **zero bytes** between two syscalls. The flock above them
  guards `<name>.lock`, so it serialises writers and does nothing at all for
  the three readers that take no lock: the memory audit watcher, the
  proposal-diff endpoint, and **agents reading their own learned rules**.

  A reader landing in that window got an empty file instead of the previous
  good contents — an operator's entire pinned set momentarily gone from the
  file the agent reads. It is not a rare race: reproduced at 101/300 and
  100/300 runs for the two consolidator writers on the six-hourly tick, and
  55/300 for the approve path. It also produced a CI failure that looked like
  a data race and was not, because `os.ReadFile` of an empty file returns a
  non-nil zero-length slice and the poll loop accepted it.

  All three now build the file in memory and go through
  `memory.WriteFileDurable` (tempfile → fsync → atomic rename → fsync parent).
  Append-only semantics are preserved verbatim, so hand annotations in
  `pins.md` survive, and `appendRules` pays nothing for it — it already re-read
  the whole file after every append to hand back the audit blob, and that read
  simply moved ahead of the write.

  Two corrections rode along. The exists-check read *every* `stat` failure as
  "absent", which under a whole-file replace would write the first-run header
  over content it never read; only `fs.ErrNotExist` qualifies now. And the
  canonical path is refused if it is a symlink — `os.ReadFile` follows one, and
  its target's bytes would have become the prefix of what was written back into
  the crew's learned rules.

  The guard that should have caught this class **had gone blind**:
  `crash_safe_writes_invariant_test.go` matched `os.OpenFile(` while these
  packages open through `*os.Root` handles, so every root-anchored write in
  them was unscanned and two allowlist entries had been matching nothing.
  Widened to `\.OpenFile\(`.

  Named side effect: the rename resets the file mode to `0o644`, so an
  operator `chmod` on `pins.md` no longer survives a consolidation tick.

- **Two Keeper aux slots were settable, validated, rendered — and read by
  nothing (#1986).** The **`curator`** slot was described everywhere, including
  in the console, as governing skill review *and memory consolidation*. The
  consolidator never read it: the summariser was built once at boot straight
  from `KEEPER_OLLAMA_URL` + `KEEPER_MODEL`, bypassing the slot, the resolver
  and the override store. So an instance with an `ANTHROPIC_API_KEY` and no
  Ollama logged "memory consolidation disabled" at boot while the Judge models
  card reported `curator` as configured and healthy — consolidation silently
  did not run, and mid-conversation compaction fell back to plain truncation on
  the same unadvertised wiring. Consolidation now resolves the slot per run,
  through the standard middleware stack so it still appears in the cost ledger,
  with the boot-time `KEEPER_*` client kept as a fallback so a local-judge
  install does not *lose* consolidation.

  The **`run_summary`** slot's timeout bounded nothing. `Router.RunVerdict()`
  returned provider and model and discarded the budget, and both production
  call sites hand the verdict a background context — so the operator's number
  sat on the card beside four rows where the identical control worked, while a
  hung provider could keep a verdict call outstanding indefinitely. The
  deadline is now applied in the one place both call sites share, and covers
  the model call only: a verdict answered at 19.9 s of a 20 s budget is not
  generated, billed and then dropped on the floor.

  ⚠️ **Behaviour change:** `crewship keeper aux set run_summary --timeout 45s`
  and `keeper aux set curator --provider …` now do something. The shipped
  `run_summary` default moves 15 s → **20 s**, because the first real deadline
  on a call must not be tighter than what it had been running under — it
  matters most on a fully local judge. Consolidation itself is a documented
  exception and stays on the provider's client timeout: it is batch work over
  hundreds of journal entries, and a 20 s cut-off would kill every local-model
  consolidation mid-flight.

- **One unrenderable chat message took down the whole page and dropped the live
  session (#2024).** There was no error boundary anywhere in the chat tree, so
  a throw while rendering a single turn propagated to the route segment
  boundary, which replaces the entire page with "Something went wrong". In
  practice that meant the chat client unmounted, every turn's state was
  discarded, a half-typed composer draft was lost, and the **WebSocket of the
  very session that had just degraded was dropped**. The shipped trigger was
  `TypeError: value.trim is not a function` — CLI init metadata is forwarded
  verbatim, so a key holding a string in one CLI release holds an object in the
  next, and a type assertion catches nothing.

  Now only that one message is replaced, inline in the transcript, with a card
  saying the rest of the conversation is unaffected and the session is still
  live. The boundary's reset keys include a **content** digest, not just
  `turn.id`: a streaming turn mutates in place under a constant id, so keying
  on identity alone would have wedged that message on the error card until a
  full page reload, even after the following tokens rendered perfectly. Keyed
  on content, a garbled message heals itself as soon as the next token arrives.

- **A page's `public` flag was silently cleared by reading it (#2054).** The
  panel wire shape was built from a record with no `public` column, so the flag
  travelled inward only. `crewship page export | crewship apply`, a hand-edited
  `page get -f json`, or the editor's own PATCH therefore **unpublished every
  public panel**. The published link kept resolving and rendered an empty page,
  and the next `crewship page publish` refused the page for having no public
  panels — pointing the operator at entirely the wrong thing.

  Five more from the same PR. A `metric.v1` sparkline drew straight through
  its gaps: the schema says a `null` marks a producer-known gap, and the
  renderer filtered nulls out of the array entirely, which also slid every
  later point leftwards and compressed the window's own time axis. A wake gate
  told the woken agent to run `crewship page set` — a binary that does not
  exist in the container it wakes in — and now names the sidecar `PUT` with
  `curl`. `crewship page set` threw away the 429's body, printing a bare rate
  limit instead of the reason, the scope ("this panel" and "this workspace"
  have different fixes) and the retry delay. **`-f quiet` was broken on all six
  page listings** — each hand-rolled a `tabwriter` table, which ignores the
  format, so `crewship page links x -f quiet | xargs` was fed column headers.
  And `crewship page rollback --to 0` answered "`--to <seq>` is required",
  because 0 is the flag's zero value; it now says what is actually wrong —
  versions are numbered from 1.

- **`OPENAI_COMPAT` was the one LLM provider that could not be tested, and it
  reported success (#2057).** Because such a credential is stored as
  `type = API_KEY`, it fell past every provider arm in `probeProviderInner` to
  a default that failed an `ENDPOINT_URL` type check and returned
  `{Valid: true, Error: "No validation available for this provider"}` **without
  dialling anything**. The operator pasted a base URL, pressed **Test**, got a
  green tick, and found out the endpoint was unreachable when an agent run
  failed. It is the provider where this matters most: the endpoint is the one
  part of it Crewship does not control.

  ⚠️ **Behaviour change:** `crewship credential test-stored <name>` and
  `POST /api/v1/credentials/{id}/test` now return a real failure for an
  unreachable host, a broken TLS chain, a wrong path prefix, or an endpoint
  serving no model list. The probe deliberately tests **reachability, not
  authentication** — it sends no `Authorization`, no stored key and no custom
  headers, because whoever holds `update` on a credential can repoint its
  `baseURL`, and sending the secret would turn Test into an exfiltration
  primitive. The unauthenticated body path (`POST /credentials/test`, no
  workspace and no role floor) still does not dial at all and says so.

- **The Add-MCP wizard's "Test" tested nothing and could not fail (#2078).**
  Its handler was a 400 ms `setTimeout` that set `ok: true` — no socket, no
  read of any field it claimed to check, and no failure path at any input. A
  typo'd endpoint, a command that does not exist, a host that is down: green
  tick every time.

  It is removed rather than wired, because it cannot be wired from where it
  stands: both real probes begin by selecting the transport, endpoint and
  command **out of the database**, and the wizard tests before it creates.
  There is no draft-test route for MCP as there is for credentials and
  notification channels. In its place the step says connectivity is checked
  after the server exists, and names the two surfaces that do it — the
  **Test connection** button on the server's row, and
  `crewship integration crew test <crew-slug> <integration-id>`.

- **A first integration grant silently revoked it from every other agent
  (#2070).** A workspace integration with **zero** agent bindings resolved for
  every agent; the moment any agent got one it flipped to opt-in and everyone
  else lost it — with no warning, no audit line and nothing on the
  integration's own page. It had been reachable only through
  `crewship integration bind`; the new create-agent form put a switch on it.
  #2070 could not reach the resolver, so it warned beside the switch, by name,
  which integrations were about to flip — warning rather than preventing,
  because making a first grant is legitimate.

  **Superseded inside this same unreleased window by #2079, below.** The
  audience is now a stored column instead of a row count, so a grant made on
  that form costs no other agent anything, and #2079 deleted the warning
  #2070 added. Nothing shipping here asks an operator to hesitate before a
  first grant; read the two entries as one story, not two.

- **An MCP server's audience is a stored column, not a binding count (#2079,
  closes #2072).** `ResolveAgentIntegrations` decided who could use a
  workspace MCP server by counting rows in `agent_mcp_bindings`. "Available to
  every agent" was never a stored state — it was the *absence* of bindings, so
  it evaporated the moment that absence ended: one
  `POST /api/v1/agents/{id}/integrations` anywhere in the workspace flipped the
  server to opt-in and revoked it from every agent relying on the default.

  `default_access` (`all` or `bound-only`) on `workspace_mcp_servers` and
  `crew_mcp_servers` replaces the inference, and **both** resolvers read it:
  `ResolveAgentIntegrations` (the console and `crewship integration resolve`)
  and `resolveAgentMCPServers` in `agent_config.go`, which is what the
  container actually gets. Fixing only the first would have shown an operator
  an access list the agent does not have — and the runtime copy was the worse
  of the two, because its binding count was not workspace-scoped at all, so a
  binding in a *different* workspace could revoke a server here. Both fail
  closed: only the exact string `all` opens a server to unbound agents. A
  binding is now purely additive — a credential, a config override, an
  opt-out — and cannot change what any other agent resolves.

  The audience is now sayable and visible:
  `crewship integration access <id-or-name> <all|bound-only>`, `--access` on
  `integration add` / `integration crew create` / `integration crew update`,
  `default_access` on the API, an `ACCESS` column on both `integration list`
  tables, and the integration's detail sheet naming it outright ("Available
  to: Every agent in the workspace" / "Bound agents only").

  Same pass: `mcp_tool_bindings` had no referential integrity, so deleting an
  integration stranded its per-tool toggles forever. Its `mcp_server_id` is
  polymorphic across two ID spaces, so a literal foreign key is not
  expressible; three triggers stand in for one — two `BEFORE DELETE` cascades
  and a `BEFORE INSERT` that rejects a toggle naming a server that does not
  exist — and the rows already orphaned are swept.

  ⚠️ **Behaviour change: the upgrade moves nobody's access, but the old side
  effect is gone for good.** Migration `20260826190607_mcp_default_access`
  defaults the column to `all` and then pins every server that already carries
  an agent binding to `bound-only`, freezing each server at the audience it
  effectively had — nothing is granted and nothing is revoked at upgrade time.
  After that, only an explicit change alters who can use a server. Anything
  that relied on binding one agent to keep a server private must now say so:
  `crewship integration access <id-or-name> bound-only`.

  ⚠️ **Behaviour change: a replace-mode restore now clears that workspace's
  per-tool toggles.** `mcp_tool_bindings` is deliberately excluded from
  backups, and `crewship backup restore --replace` deletes and re-inserts the
  workspace's server rows; the new cascade trigger takes the toggles with them,
  where before they survived by being orphaned and were then silently
  re-adopted by the re-inserted row. Toggles default to enabled, so a cleared
  set means every tool is on — re-disable the ones you want off with
  `crewship integration tools disable`.

- **The mission fork button called a route that does not exist (#2056).** It
  posted to `POST /api/v1/missions/{missionId}/fork`; the route is
  `POST /api/v1/checkpoints/{checkpointId}/fork`. Every fork 404'd, and the
  404 was rendered as the friendly *"Not yet wired to backend"* — so a broken
  call read as an unbuilt feature. It now forks and navigates to the new
  mission, and a 2xx that carries no new mission id is surfaced as an error
  rather than as success.

  The checkpoint id it passed was wrong too: it fell back to the journal row
  id, which could only ever 404. The id is now read from where the journal
  actually writes it, and Restore is **disabled** when there is none rather
  than firing a request that cannot succeed.

  Also from #2056: chat reactions moved off `localStorage` onto three real
  endpoints, so a reaction survives a different browser (the legacy
  `crewship-reactions` key is dropped on load and **not** migrated); the crew
  slug field enforces its rule as you type instead of 400-ing three steps
  later; the crew wizard's "Never" auto-stop actually means never, rather than
  omitting the field and inheriting the 4-hour default; New project stopped
  sending a summary and labels that the endpoint binds nowhere and silently
  discarded; and popovers inside dialogs scroll instead of clipping.

- **New routine had no Cancel on two of its four screens (#2076).** The
  `entry` and `fork` modes — one of which is the screen the dialog opens on —
  rendered an empty footer strip where every other create surface in the
  product puts Cancel. Esc, the header × and an overlay click always worked, so
  it was never a dead end; what was missing was the affordance, in the one
  place the shell's own contract promises it will always be. The hint reads
  `Esc to cancel` rather than the default `⌘↵ to confirm · Esc to cancel`,
  because ⌘↵ genuinely does nothing on a screen whose action is a row.

- **The crew and agent canvas tab strips said "tab" without meaning it
  (#2026).** They were plain buttons carrying `aria-selected`, which is not
  allowed on a button's implicit role — so the one fact the markup tried to
  convey, *which section you are on*, was dropped by the screen reader and
  raised an axe `aria-allowed-attr` violation. There was no tablist, no
  labelled strip and no tabpanel. All three now exist. Separately, the admin
  console's content pane was a scrollable region with no focusable child, so on
  the default Overview section a **keyboard-only admin could not scroll it at
  all** and anything below the fold was unreachable; and the chat crew link was
  distinguished from surrounding text by colour alone, at a token below the
  4.5:1 contrast floor.

  **Known gap:** the canvas tab strips still have no arrow-key roving focus —
  each tab is its own Tab stop. CodeRabbit raised exactly this on the PR and it
  merged unimplemented. Its sibling #2025 shipped that pattern for the Pages
  strip, so the two now differ.

- **Every Pages tab was announced without the panel it reveals (#2025).** The
  buttons carried `role="tab"` and the groups carried `role="tabpanel"`, and
  **nothing linked them** — so a screen-reader user activating a tab heard
  "tab, selected" and then had to hunt the document for whatever had appeared,
  which is the entire thing the tabs pattern exists to prevent. The two halves
  are now joined by id, and the strip gained full keyboard orchestration:
  arrow keys cycle, Home/End jump, and roving `tabIndex` makes the whole group
  one Tab stop instead of one per tab. There is no axe rule for a tab missing
  `aria-controls`, which is why this went unnoticed; the guard is explicit
  assertions instead. The bar is also suppressed entirely on an error, where
  stale cached data used to render it above a body that mounted no panels — a
  screenful of dangling `aria-controls`.

<!-- End of the #2086 backfill. Entries below were written with their PRs. -->

### Fixed

- **An agent-created mission dispatched its first task straight into a
  `FOREIGN KEY constraint failed` (#2139).** `assignments.chat_id` is
  `NOT NULL REFERENCES chats(id)`, and the mission task dispatcher inserts
  every assignment with `chat_id` set to the mission's own id —
  unconditionally, with no fallback. Three of the four mission-creating doors
  stamp that synthetic `chats` row themselves (`mission_handler_mutate.go`'s
  `Create`, `issue_handler_workflow.go`'s `Start`, and
  `internal/cartographer/fork.go`'s `Fork`, fixed independently in #2128,
  same root cause, different door). `InternalMissionHandler.Create` — the
  sidecar endpoint an agent uses to plan its own mission — was the one that
  didn't, so an agent-authored mission's first task hit the FK on every
  dispatch attempt, and `scheduleReadyTasks` turned that into a silently
  `FAILED` task rather than surfacing it — a mission whose tasks all failed
  for a reason nothing in the task list explained.

  Fixed twice, deliberately. `Create` now stamps the chat row itself, in the
  same transaction as the mission row, mirroring the other three doors. And
  the dispatcher — the one place every mission's assignments are actually
  written, regardless of which door created the mission — now creates the
  row lazily if it is missing, before either assignment insert. Two doors
  have now independently forgotten this row in production; a per-door insert
  is correctness at the source but does not close the class, so the
  dispatcher checks for itself too, at the cost of one indexed lookup per
  dispatch in the common case where the row already exists.

- **The `admin` family answered from a different database than the server you
  pointed it at.** `openAdminDB()` resolved `~/.crewship/crewship.db` and
  ignored `--server`, `CREWSHIP_SERVER` and `--profile` entirely, while its own
  comment claimed it "mirrors the resolution logic of the server" — false on
  every host where crewshipd runs with its own `DATABASE_URL`, which is every
  development clone (`file:./crewship.db`), every container and every
  multi-instance box. `crewship admin list-users` against a populated server
  printed `(no users — run 'crewship seed' …)` and exited **0**.
  `db migration-status` reported an unrelated schema version under the heading
  `Database:`. `memory log` / `memory show` audited an audit chain that was not
  the one under audit — and the two routes that answer those questions,
  `GET /api/v1/admin/memory/versions` and `…/{id}/content`, had no CLI command
  at all.

  `list-users`, `memory log` and `memory show` now read the server, through the
  routes that already existed. Everything with no route — `reset-password`,
  `promote`, `invalidate-sessions`, `sessions list`, `memory restore`,
  `db migration-status`, `db repair-ledger`, `db restore-snapshot`,
  `keeper eval` — names the file it resolved and **refuses to run when a server
  is named**, unless you pass the new `--local`. A server on `localhost` is not
  an exemption: the old rule warned only for a *remote* target, on the
  inference that a server on this host must use this host's data directory, and
  that inference is exactly the hole this was reproduced through.
  `db migration-status` and `keeper eval` also honour `DATABASE_URL` for the
  first time.

  The read-only diagnostics were the last holdout and are fixed with them:
  `crewship doctor` (the schema, consent and DSN checks) and
  `crewship telemetry status` opened `~/.crewship/crewship.db` regardless of
  `DATABASE_URL`, so on a dev clone they reported on a file the running
  instance had never written — the #2086 defect surviving inside the command
  you run to diagnose #2086. They resolve `DATABASE_URL` now. They are
  deliberately **not** gated: a diagnostic reports on the host you run it on,
  and one that switched itself off because `CREWSHIP_SERVER` was set would be
  unavailable exactly when something is wrong. What replaces the refusal is
  naming — the `db migration version` row and `telemetry status` both print the
  path they read and where it came from.

  **Breaking for scripts, in two different shapes.** The gated commands refuse
  only when something names a server, so `--local` is newly required from a
  shell that exports `CREWSHIP_SERVER`, on a machine that has run
  `crewship login`, or under a `--profile`. `admin list-users` is **not** gated:
  it branches on `--local` alone, so it now goes to the server and needs a login
  *unconditionally* — including on a fresh host with no CLI config and no
  `CREWSHIP_SERVER`, where it previously printed the table without one. That is
  the locked-out-operator case, and it is deliberate: a command that fell back
  to a local file whenever the login failed would be #2086 with an extra step,
  answering "who exists on the server" from a file that may belong to a
  different instance. Both failure paths name the fix in their own message, and
  the fix is one word — `crewship admin list-users --local` is the old
  behaviour, asked for explicitly. (#2086)

- **`crewship resume <chat-id>` never worked, and the guard that should have
  caught it could not see two thirds of the CLI.** `resume` asked for two flat
  chat routes — `GET /api/v1/chats/{chatId}` to find the agent that owns a
  chat, and a workspace-wide chat list for the picker — neither of which the
  router has ever registered. The lookup 404'd on every invocation and the
  user was told `could not determine agent for chat <id>`; the picker's 404
  fell through to a `/runs` fallback that was therefore the only code path
  that had ever run. Both now call routes that exist: the agent lookup walks
  `GET /api/v1/agents` → `GET /api/v1/agents/{agentId}/chats`, which is the
  only way a chat is addressable, and the picker reads `GET /api/v1/runs`
  directly, deduplicated so several runs of one chat no longer fill it with
  duplicates of the same session. No new server route was needed. The
  CLI↔route contract test is what should have failed years ago, so its
  extractor was hardened first: it now resolves paths assembled into a local
  (including with `+=`), the `api_helpers.go` wrappers, `Do`/`NewRequest`/
  `StreamSSE`/`StreamNDJSON`, package-level path consts, path helpers whose
  own parameters are filled from the call site (so `proposedPath(id,
  "approve")` is checked against the route registered for *approve* rather
  than collapsing to an unregistered `…/{}/{}`), and forwarders discovered
  from source rather than listed — 1013 call sites checked against
  the router's real registrations, up from ~450, with the vacuity floor moved
  to match. Two bounds this walk carries are now named in the errors and the
  docs rather than left to be discovered: an agent's chat list is a hard 100
  most recent with no page parameter, so an older chat must be resumed by
  run-id, and a 403 on every agent is reported as an access failure instead
  of exiting not-found with "chat not found".

- **A CLI render that failed mid-stream said only "broken pipe".** The
  formatter's JSON, YAML and NDJSON renderers returned the encoder's error
  untouched, and what usually reaches that return is a *write* failure — a
  closed pipe from a `| head -1`, a full disk — whose text names neither the
  format nor the fact that output was being serialised at all. Each renderer
  now names itself, and the NDJSON slice path names the row index, so a partial
  stream says how much of it a consumer already received. The context is added
  once at the renderer rather than at the four routing helpers and the ~110
  direct call sites above them, so the message reads the same whichever of them
  produced it. `gopkg.in/yaml.v3` flattens the cause into its own error type
  before we see it, so `errors.Is` cannot reach through a YAML render error —
  the text survives, and a test pins that difference rather than leaving it to
  be rediscovered.

- **`crewship agent logs` could not print a log line for any agent.** It kept a
  second reader of its own that decoded the route's JSON *array* into a
  `map[string]interface{}`, so every invocation died on `cannot unmarshal array
  into Go value of type map[string]interface {}`; it also sent its line count as
  `tail`, a parameter the handler has never read (it is `limit`), and printed
  the container's stdout unsanitised. The duplicate is gone — the subcommand now
  delegates to the same `runAgentLogs` behind the top-level `crewship logs`.
  Consolidating them exposed a shared ceiling: the slug scan behind *every*
  agent lookup read `GET /api/v1/agents` with no `limit`, so it saw only the
  route's default first 100 rows and answered "agent not found" for an agent
  that exists past them. The scan now sends the route's own ceiling (`limit=500`),
  and a CUID goes back to the single-resource `GET /api/v1/agents/{id}`, which
  has no ceiling at all — so `agent runs`, `agent get` and `run` are uncapped
  too, not just the log commands. `GET /api/v1/crews` paginates identically and
  the crew resolver had the same unqualified read, so it got the same ceiling
  lifted; a workspace past **500** still needs an id rather than a slug, since
  500 is where both routes stop. (`GET /api/v1/projects` has no `LIMIT` at all,
  so the project resolver needs nothing.)

- **`crewship project get`, `project milestone list|create` and
  `skill proposed list|approve|reject` refused the slug their own help
  advertised.** Each pasted the argument straight into a route that keys on the
  id, so the documented invocation came back "not found" while the CUID form
  worked. All of them now resolve slug-or-id through the shared reader, which
  costs one request for a CUID and carries the "Did you mean" / "Available:"
  hints on a miss.

- **`crewship memory status` reported failure as success.** A scope that could
  not be opened printed SQLite's own `unable to open database file (14)` — a
  string that names neither the path nor the cause — and the command returned
  zero regardless, so `crewship memory status || handle_it` was dead code in
  every script that had it. Failures now exit 3 when no scope could be read, and
  the message names the directory it tried and which of the causes it was: the
  path is missing, a file sits where the directory belongs, or the directory is
  there and unreadable. That last one needed a real probe — `os.Stat` succeeds
  on a directory the caller cannot enter and reports `IsDir()`, which is exactly
  the uid-1001 container case the wording describes. `memory reindex` now
  creates the index directory it is asked to build in, because "build an index
  with `crewship memory reindex`" was advice that looped back into the identical
  error; it still refuses to invent a missing *base* path, since that is a typo,
  and answers 3 there like `status` does. Where it cannot create the directory —
  a base path that exists but is not writable — it now says so and names the
  parent, rather than dropping the `mkdir` error and letting the check behind it
  report the directory as merely missing, which is the wording that advises
  running `crewship memory reindex`: the command that had just failed.

- **A port-expose URL on Colima returned a bare `502` and explained nothing.**
  The capability-URL proxy dials the crew container on its Docker bridge IP,
  which is reachable only where crewshipd shares a network namespace with
  dockerd — true for Docker Engine on Linux and for OrbStack, false for
  Colima, Rancher Desktop and Docker Desktop, where the bridge exists only
  inside a VM. Every request timed out and rendered as `bad gateway`, leaving
  the one useful fact — the target address — visible only in the server log,
  which is not where a self-hoster debugging their own setup looks. The 502
  now names the target, and when a *dial* into a private address was
  blackholed it offers VM routing as one of the two situations that look
  identical from the proxy's side; a refused connection proves routing works,
  so the runtime is not blamed there, and neither is a slow response, which
  is no longer classified at all. The constraint is now documented on the
  port-expose API page and the `expose` CLI page. The unreachability itself
  is unchanged — this is diagnosis, not support for those runtimes.

- **A dead escalation sat under "Waiting on you" forever, as two rows.**
  `scopeOf` recognised exactly one terminal `payload.state` — `resolved` —
  but a `peer.escalation` also ends as `expired` (the deadline answered it)
  and `cancelled` (an operator withdrew it). Both carry the same entry type
  and the same `refs.escalation_id` as the ask, so each one missed twice: the
  terminal row was filed as a *fresh* ask, and it closed nothing, leaving the
  original `pending` row open beside it. Two escalations nobody could still
  act on produced four permanent entries. The terminal set is now explicit
  (`resolved`, `expired`, `cancelled`) and a test scans the Go emit sites, so
  a fifth state cannot be added to the API without this list hearing about it.
  A state the classifier has never seen is still treated as *open* —
  unrecognised is not the same as answered.

- **Clicking "Waiting on you 1" opened a list of five.** The Overview card
  counts open asks over the whole window; the Waiting scope it links to
  refetched with `entry_type` set to the ask types alone. The *answers* —
  `approval.granted` / `denied` / `cancelled` / `timeout` and
  `keeper.decision` — are filed under the Security facet, so they were
  excluded server-side, and the client-side join that retires an answered ask
  had nothing to join against. Approvals and keeper requests could therefore
  never be retired in that scope, and a grant arriving live could not retire
  one either, because the stream shares the query. The waiting fetch now asks
  for both halves; the answers never reach the feed, because the same
  narrowing files them under Completed. Because the journal pages by a fixed
  row count from the newest end, those extra rows would otherwise have pushed
  the oldest open asks out of the window — hiding them instead of listing
  them — so the Waiting scope alone now pages to the API's 500-row ceiling.

- **An exec on Apple Containers could be reported as running forever.** Both
  exec paths spool the CLI's output into memory, so `os/exec` gives the child
  a pipe and copies out of it in a goroutine — and `cmd.Wait` blocks on that
  goroutine until every write end of the pipe is closed. A descendant the
  `container` CLI leaves behind holds one, so a single orphan wedged `Wait`
  for its whole lifetime. Nothing recovered from that on its own: the exec
  entry is marked finished only after `Wait` returns, so `ExecInspect`
  answered "still running" indefinitely and the sweeper never reclaimed the
  entry. Waiting on the pipes is now bounded, and the command's real exit
  status is still what the caller sees.

- **A crew's issue prefix could mint an issue at an address no route can
  reach (#2035).** `crews.issue_prefix` had no charset or length check on any
  write path — `PATCH /api/v1/crews/{crewId}` stored it verbatim, and the only
  branch was `""` → `NULL`. The prefix becomes the leading half of the issue
  identifier, and that identifier is a **single URL path segment** on around
  twenty routes: get, patch, delete, comments, attachments, relations. So
  `--issue-prefix "A/B"` filed `A/B-1`, an issue that exists, lists, and can
  never be opened, and a space, `%`, `#` or `?` each broke the same segment
  their own way. The prefix must now match `^[A-Za-z0-9_-]{1,16}$` on write,
  with a 400 that names the field and states the rule; `""` still means "clear
  it". Validated on the API rather than in the CLI, so the web UI is covered
  by the same guard. **Prefixes already stored are not migrated and not
  refused on read** — they keep minting exactly what they mint today — but a
  prefix outside the rule cannot be written again, so a crew holding one has
  to move to a valid prefix the next time it changes.

- **A restore dropped columns your schema does not have, and said nothing.**
  Applying only the columns the target has is what lets a bundle from a newer
  Crewship restore onto an older instance, and every migration this project
  had written was additive, so the dropped column was always one the target
  genuinely did not need. A migration that *re-keys* a table breaks that
  assumption: a bundle taken before `issue_counters` moved from `crew_id` to
  `(workspace_id, prefix)` carries a key column the new table does not have,
  the statement degenerates to `INSERT OR IGNORE INTO issue_counters
  (next_number) VALUES (?)`, and the `NOT NULL` violation that follows is
  swallowed by `OR IGNORE`. No error, no row, and `rows_inserted` counts a
  row that never landed as nothing at all — indistinguishable from a bundle
  that never carried it. Restore now counts every discarded value, names each
  `table.column` and how many rows carried it, and warns; `--dry-run` reports
  the same skew before anything is written. The drop itself is unchanged —
  what is gone is the silence, which is what made this shape of loss
  (#1437, #1444, #1973) discoverable only months later.

- **44 commands advertised `-f json` and did not honour it.** `--format`/`-f`
  is a persistent flag on the root command, so every one of the ~800 commands
  prints `Output format: table|json|yaml|ndjson|quiet` in its help — and the
  platform's premise is that agents drive this CLI, which means that flag is
  what the pipelines depend on. A sweep of the whole tree found four ways it
  was broken, all of them silent and all exiting 0:

  - **34 reporting commands never resolved the format at all** and printed
    human text — sometimes ANSI-coloured — under `-f json`. Among them
    `config show`, `config validate`, `notify status`, `telemetry status`,
    `server current`, `crew status`, `crew config --show`, `persona view`,
    `persona history`, `lint`, `logs`, `db migration-status`,
    `admin sessions list`, `memory search`, `memory status`, `backup metrics`,
    and eleven of the `routine` family.
  - **Nine more resolved it and wrote prose to stdout first**, so the JSON was
    real and the *stream* still would not parse. `digest enable` printed nine
    advisory lines and then handed `AutoHuman` an empty human renderer.
  - **Empty lists came back as `null`, not `[]`.** Go marshals an unfilled
    slice as `null`, so a list command answered `[]` on a populated workspace
    and `null` on an empty one — `crewship prompt list -f json | jq '.[]'`
    worked in development and failed on a fresh install. Fixed once, in the
    shared `cli.Formatter`, rather than at each call site.
  - **Two commands owned a local flag named `format`**, which shadows the root
    persistent flag *and takes its `-f` shorthand with it*. `crewship memory
    search … -f json` therefore did not fall back to human output — it failed
    with `unknown shorthand flag: 'f'`. `routine get` accepted `-f json` and
    rejected `-f yaml` and `-f ndjson` outright.

  Human output is byte-identical throughout; the machine formats are what
  changed. Machine payloads also stop inheriting the human view's display
  truncation, so `routine active -f json` carries the full run id (the table
  cuts it at 24 characters, and a truncated id fed back to `routine cancel`
  is a 404) and `routine versions -f json` the full definition hash.

  Four guards keep it from recurring: two walk the entire command tree and
  fail the build on a new offender, one ratchets the remaining
  mutation-receipts-on-stdout population downward, and one keeps the exemption
  table from rotting. (#2086)

- **`crewship memory search -F` is deprecated.** It survives as
  `--output-format`, a differently-named alias, so existing scripts keep
  working; taking the name `format` back would re-break `-f` on that command.
  It warns and will be removed.

- **`crewship routine get --format human|json` is now the global flag.** The
  local flag is gone, so all five formats work. `--format human` still renders
  the human report. `--format xml` no longer errors — an unrecognised format
  renders as human, uniformly, the way it does on every other command.

- **`crewship routine versions show` no longer prints a non-JSON body to
  stdout and exits 0.** A 200 whose body does not parse is now an error that
  names the problem, which is what the command's own help ("pipe to jq")
  promises.

- **The machine error envelope disagreed with itself across formats.** A
  failing command emits `cli.ErrorEnvelope` on stderr under
  `-f json|yaml|ndjson` — every command but `crewship wait`, which owns its
  run-outcome exit codes and prints plain-text `[wait] error:` diagnostics by
  design — and it carried `json:` tags only, so the same
  failure came back as `exit_code` under json and `exitcode` under yaml, with
  `status: 0`, `detail: ""` and `extensions: {}` added on the yaml side
  because `omitempty` went with the tag. A caller that branches on the exit
  code found nothing at that key in one of the two formats it was told were
  the same data. The failure side now matches the success side (#1211).

- **`crewship routine webhooks create -f yaml` crashed.** The result is an
  anonymous struct embedding the webhook row beside the public URL, and the
  embedded field carried no tag: `encoding/json` flattens that, yaml.v3 nests
  it under the type name — and because the row type was unexported, yaml.v3
  could not reflect into it at all and the command panicked with a stack
  trace. Making the command honour `--format` is what turned a latent shape
  error into a reachable crash. Four more of the same shape (`activity`
  export, `model price`, `notifychannel create`, `provider check`) are fixed
  with it: each embedded type is now exported and inlined in both formats. The
  static guard that caught the first instance only looked at embedded fields
  that *already* declared `json:",inline"`, so an untagged one — the actual
  failure mode — was invisible to it; it now checks every embedded field in a
  json-tagged struct.

- **`digest enable --crew <slug> -f json` emitted prose before the document.**
  The routine-creation path prints a server-side dry-run progress line, and it
  went straight to stdout, so on the one invocation that creates the routine
  the machine output was a sentence followed by an object. It goes through the
  same note buffer as the rest of the command's human output now.

- **`server current -f json` could return terminal escape codes in a value.**
  `directory_override_hint` became a machine field in this change while still
  being built with the colour codes the human line wants around it. The field
  is plain text now and the colour is applied by the renderer.

- **Four commands rounded large numbers into their own machine output.**
  `backup metrics`, `backup canary`, `integration tools refresh` and
  `routine versions show` decoded the server's document into
  `any`/`map[string]any` before re-encoding it, and `encoding/json` makes
  every number a `float64` on the way in — so anything past 53 bits (a
  nanosecond timestamp, an id) came back rounded, and the command silently
  edited the document it was asked to relay. `routine versions show` is the
  one that matters most: it returns a routine's stored DSL, and a limit or an
  id that comes back subtly different is a definition that no longer matches
  the hash it was stored under. They pass `cli.RawJSON` through instead, which
  is byte-identical under json/ndjson and decodes via `json.Number` under
  yaml. `crew config --show` took the same treatment for the stored config
  blobs it echoes.

- **`-f yaml` named fields after Go identifiers on the payloads this sweep
  newly reaches.** Exporting the embedded types above stopped `-f yaml`
  crashing on `provider check`, `model price`, `notifychannel add`,
  `activity` export and `routine webhooks create` — which promoted their keys
  from unreachable to part of the machine contract, and yaml.v3 was deriving
  each one from the lowercased Go field name (`pricing_key` as `pricingkey`,
  `input_tokens` as `inputtoks`, `per_mtok` as `permtok`). Every field on
  those payloads now carries a matching `yaml:` tag. Two result payloads that
  were anonymous structs (`routine webhooks create` and `url`) are named types
  now, and `notifychannel add`'s too, because the key-parity guard cannot
  cover a type it cannot name — and that guard now fails the build when an
  inlining payload is missing from its list, which is how these were found to
  be missing from it in the first place.

- **Upgrading threw finished users back into the setup wizard.**
  `onboarding_skipped_at` was added without a backfill, and
  `OnboardingHandler.Status` reads a NULL there as "this completion was
  interrupted, reopen it". Sound on a fresh install; on an upgrade every
  pre-existing completion is NULL by construction, so anyone whose workspace
  happened to hold no agents — they pressed Skip, or they finished properly
  and later deleted their crews — was sent back to step one, and Status
  *persisted* the downgrade rather than merely rendering it. Backfilled: a
  completion recorded by a build that had no such column is, by definition,
  not one this build may reopen.

- **An OpenAI or Google workspace got a Claude model id.** The marker template
  the Guide is told to emit interpolated its suggested model from
  `providerRuntimeDefaults` (`gpt-5.5`, `gemini-2.5-pro`) while
  `validateCrewModel` checked against `llm.CuratedModels`, which contains
  neither. The Guide emitted the id it was handed, the validator missed it and
  substituted the Anthropic default, and the crew was created as
  OPENAI + CODEX_CLI + `claude-sonnet-5` — every field valid, the combination
  unrunnable at the adapter on every run. Both now read the same catalogue.
  A provider whose models live on the operator's own daemon (Ollama and
  anything self-hosted) is told to omit the field instead of being handed a
  Claude id to copy.

- **A crew name in Czech, Greek or Japanese could discard the whole
  proposal.** `crew_name` was still length-checked with `len()`, which counts
  bytes — the same fault fixed for `role`, one field over. 120 bytes is about
  60 accented characters, so an ordinary non-ASCII crew name silently dropped
  the entire marker and no card ever appeared. Counted in runes now.

- **`GET /system/runtime` reported `in_use` only to unprivileged callers.**
  The onboarding wizard gates its Crew step on that field and blocks Continue
  unless it is exactly `true`. It worked only because the probe sends no
  workspace context and so never resolves a role; an owner who did would read
  `undefined` and be stuck permanently behind a re-check button that could
  never clear. Present on both branches now.

- **The token landed after CLI pairing went to the wrong workspace.**
  `GET /api/v1/workspaces` sorts `created_at DESC` while every onboarding
  handler resolves the user's membership `ASC`, so taking the first row wrote
  the freshly paired credential to the *newest* workspace for anyone who
  belongs to more than one — and `autoAssignCredentials` links workspace
  credentials to agents at deploy time, so the crew launched with none and
  could not be repaired afterwards. The frontend already sorted for this
  reason; the CLI now does too.

- Wake automations compiled from an agent-authored page recorded the agent's
  id in `automations.created_by`, a user-attribution column with no foreign
  key to catch it.

- **The Credentials filter panel shut itself after every pick.** Each facet
  called `setFilterOpen(false)` on select, so combining a brand with a scope
  meant reopening the menu between them, and a facet held exactly one value —
  a switch wearing a filter's clothes. The rail now uses the shared
  `SidebarFilterPopover` from the sidebar kit, the same panel Issues runs on:
  the panel stays open, each facet carries its own reset row, and Escape
  closes it. `CredentialFilters` facets are lists, so values inside a group OR
  and the groups AND — "any Anthropic or GitHub certificate this crew can
  reach" is now one pass through the panel.

- **The MCP OAuth client never told an authorization server which MCP server
  a token was for, and never checked which authorization server actually
  answered.** Two MUSTs from the MCP authorization spec were both absent:
  the RFC 8707 `resource` indicator was never sent on the authorization
  request or the token request, so a token minted for one connected MCP
  server carried no audience binding an operator running that server could
  be stopped from replaying against another; and the RFC 9207 `iss`
  parameter an authorization server returns on the redirect was read
  nowhere, so nothing defended against a mix-up between the several
  authorization servers Crewship's MCP connections talk to by construction.
  PKCE and RFC 9728 protected-resource discovery were already in place —
  discovery just discarded the two fields (`resource`, `issuer`) that make
  the other two RFCs possible, instead of ever recording them.

  Both are now carried through the connect flow: `AutoConnect` persists the
  discovered protected-resource `resource` and authorization-server `issuer`
  on the credential (`oauth_resource`, `oauth_issuer` — new columns, empty
  for every credential connected before this and for the plain
  Google/Slack/GitHub-style provider catalogue, which never had a resource
  to discover), `resource` is sent on the authorization request, the code
  exchange, and both background and just-in-time refresh requests whenever one
  is known, and `Callback`/`Loopback` reject the
  redirect before ever exchanging the code if `iss` is absent or does not
  match. Discovery itself now fails closed when an authorization server's
  metadata omits `issuer` — RFC 8414 makes the field REQUIRED, so a server
  that omits it gives the mix-up defence nothing to check against, and
  Crewship's whole reason to check `iss` at all is that MCP servers are
  third-party-operated and not trusted by default. A provider without Dynamic
  Client Registration can now continue the same discovered flow with an
  operator-supplied client ID (and optional secret); the server repeats
  discovery and persists its resource and issuer instead of sending the
  operator through the generic credential form that discarded both.

  **Known gap, not fixed here:** the manual "paste the redirect URL/code"
  fallback (`Exchange`, used when the automatic redirect can't reach
  Crewship — private IP, firewall) still doesn't validate `iss`, because the
  frontend only ever extracted `code` from the pasted URL. It still sends
  `resource` on the token request.

- **`crewship inspect` always printed `tool calls: 0`, no matter how many
  tools the run actually invoked.** The footer counter recognized a journal
  entry as a tool call when `entry_type` was `tool_call` or started with
  `tool.` — neither of which the journal ever writes. A run's individual
  tool invocations are journaled as `run.agent_span`
  (`internal/journal/types.go`), the leaf of the run's drillable trace tree,
  and matched neither check, so the counter stayed at zero on every run that
  used tools. The `errors:` counter beside it had the same blind spot from
  a different angle: a failed tool call is journaled at severity `warn`, not
  `error` (`internal/pipeline/agent_span_emit.go` deliberately does not
  escalate a span failure to the run's own error severity), so a run whose
  only failures were failed tool calls also reported `errors: 0`. Both
  counters now recognize `run.agent_span` entries directly, reading the
  span's own `status` field for the error count.

### Added

- **A database write looked exactly like `ls` in the run trace.** Sub-span
  kinds were derived from the tool NAME alone, and every shell call is the
  same tool — so `psql -c "delete from orders"` and a directory listing both
  rendered as an anonymous `bash` row, and the one question a trace exists to
  answer ("what did this run touch?") had no answer for infrastructure. Shell
  calls and MCP calls that reach a datastore now carry their own `db` kind and
  name the engine (`postgres`, `redis`, `mysql`, `mongodb`, and a dozen more)
  in `attributes.tool`, so the row shows the store's own mark rather than a
  terminal glyph.

  Classification reads the first executable of the command — past leading
  `VAR=value` assignments, a bare `sudo`, quotes and any directory prefix —
  and stops there. It deliberately does not split on `&&`, `|` or `;`, or
  descend into subshells and here-docs: doing that correctly means
  implementing shell quoting, and doing it *incorrectly* is how
  `echo "psql is great"` becomes a database span. Anything the shallow parse
  misses — `cd /app && psql …`, an engine not on the list, an MCP server
  called `prod-db` — keeps its old `bash` / `mcp_tool` kind. Under-classifying
  is the designed failure: a span that renders as a shell call is recoverable,
  a span that lies about what it touched is not.

- **The Go toolchain pins are now checked against each other on every PR, and
  the image can no longer download a compiler behind their back (#2064,
  partial).** Thirteen files name a Go version and nothing verified they
  agreed. One of the thirteen is the root `Dockerfile`, which is built by
  `release.yml` and `nightly.yml` and by nothing that runs on a pull request —
  so `FROM golang:<ver>`, the compiler for the shipped binary and a line
  Dependabot bumps on its own, was the one pin structurally beyond reach of
  the checks meant to catch it. #2060 was that bump: taken alone it would have
  released binaries built by 1.27.0 while every CI pin and the vuln gate
  stayed on 1.26.6. It was caught by hand.

  `scripts/go-toolchain-pin.sh` parses `go.mod`'s `toolchain` directive, the
  Dockerfile's `FROM` tag, `GO_VERSION` in ten workflows and the literal
  `go-version` in `codeql.yml`, and fails naming the file and line of every
  disagreement. It runs in CI's `Shell` job, which a Dockerfile-only PR does
  reach — `paths-ignore` never covered `Dockerfile`. `GO_VERSION` is in the
  set deliberately: `golangci-lint` and `govulncheck` are pinned *to* it, so a
  CI toolchain that drifts from the image is the vuln gate grading a compiler
  that is not the one shipping. `go.mod`'s `go` directive is deliberately
  outside it — the language floor is a separate promise and stays at 1.26.

  The Dockerfile now states `ENV GOTOOLCHAIN=local` in its Go stage. The
  official golang-alpine images already default to it, so nothing changes
  today; the point is that an inherited upstream default is a fact that
  happens to hold rather than an invariant, and written down it survives a
  base-image swap and can be checked. `local` and not a version literal:
  `local` makes the `FROM` tag the sole authority and never downloads, where
  the default `auto` fetches whatever `go.mod`'s `toolchain` line names, and a
  literal `GOTOOLCHAIN=go1.27.0` would be one more copy to keep in sync that
  fails backwards — a forgotten update would silently *download* the old
  toolchain and undo a base-image bump with every check still green.

  Worth stating because it is the reason the check is static: under `local`
  the `toolchain` directive is ignored outright, so `toolchain go1.27.1`
  against a `golang:1.27.0-alpine` base builds with 1.27.0 and exits 0. Only
  the `go` directive can fail a build, and that one stays at 1.26. No image
  build, not even nightly's, would ever report this drift — it has to be read
  off the source.

  This closes the specific hazard from #2060, not the general one. A
  PR-triggered image build — the other half of #2064 — remains open, so
  breakage that only an actual `docker build` can surface (a missing `COPY`
  as in #849/#886, a `pnpm prisma generate` regression, the `web/out` release
  gate from #1567) is still first caught by nightly.

- **`crewship oauth` — the connect flow had no CLI at all.** Six registered
  endpoints (`providers`, `initiate`, `exchange`, `loopback`, `discover`,
  `auto-connect`) were reachable only from the dashboard, so connecting an
  integration was the one setup step an agent could not perform.
  `crewship oauth connect` runs the loopback leg and then **waits for the
  credential to reach `ACTIVE`**, because there is no completion endpoint and
  the credential's status is the only truthful signal — a wait that runs out
  exits non-zero and names the status it is stuck in rather than printing a
  tick over tokens that never arrived. `oauth authorize` + `oauth exchange` is
  the leg for a browser that cannot reach the API host, and `exchange` sends
  the `--state` token, which is what lets the server recover the PKCE verifier
  it stored; the web UI omits it, so that path fails against any provider that
  enforces PKCE. `oauth auto-connect` treats the server's
  `status: "needs_client_id"` — a `200` that creates nothing — as a failure,
  and prints the `auto-connect --oauth-client-id` retry to run instead.

- **`crewship credential create --type OAUTH2` could not set the OAuth app.**
  `POST /api/v1/credentials` has accepted `oauth_client_id` and its endpoints
  since the flow was written; the CLI exposed none of them, so an `OAUTH2` row
  could only be minted through the web UI and `crewship oauth` had nothing to
  operate on. New `--oauth-provider` fills the authorize URL, token URL and
  scopes from the same catalogue `crewship oauth providers` prints;
  `--oauth-client-id/-secret/-auth-url/-token-url/-scopes` cover a provider the
  catalogue does not carry. The row is created empty and `PENDING`, no value is
  invented for it, and nothing is probed — there is no token yet to probe. The
  flags are refused on any other `--type`, where the server would have dropped
  them silently, and refused alongside `--value`/`--value-stdin`, which would
  otherwise fill the same column twice and discard one of the two. Filing a
  token obtained elsewhere as `--type OAUTH2 --value <token>` is untouched.
  `--oauth-client-secret-stdin` keeps an app secret out of `argv` — it outlives
  every token it issues, and an argument is readable by anything that can see
  the process table. Both refusals key off the flag being *named*, not off it
  carrying a value, so an explicitly empty source cannot slip past them and be
  dropped in silence; and both are decided before anything reads stdin, which
  is what makes `--value-stdin --oauth-client-secret-stdin` a refusal instead of
  a race between two readers over one stream.

- **`crewship consolidate proposed` — the human half of memory consolidation.**
  `consolidate run` triggered the extraction; the four review endpoints
  (`explain`, `diff`, `approve`, `reject`) had no CLI, and `explain` and `diff`
  had no consumer anywhere — not even the web UI, which only wires the
  approve/reject buttons. `approve --diff` fetches the preview *before* it asks
  to confirm, which is the pairing the server's byte-equality guarantee between
  preview and write was built for. `reject --reason` says out loud that the
  server does not persist the reason yet, rather than implying an audit trail
  that is not there. The help names both things the API cannot tell you:
  proposals only exist under `CREWSHIP_CONSOLIDATE_HITL=1`, and since no
  endpoint lists them, the id comes from
  `crewship inbox list --kind memory_consolidation`.

- `crewship onboarding proposal create --agent "Name:Role"` (repeatable)
  names a bespoke roster, so the CLI can finally reach the branch the Guide
  actually takes. `--template-slug` is no longer required — give one or the
  other. The role is split on the first colon only, because a role is a
  sentence and routinely contains more.

- **Everything the onboarding Guide built belonged to the Guide.** A routine
  or page authored during setup was attributed to `_crewship-setup`, the
  server-created crew the Crewship Guide itself runs in, because the sidecar
  injects `author_crew_id` from its own IPC config — the gate that stops
  Crew B claiming to be Crew A, correct for every crew except the one whose
  entire job is building for others.

  `author_crew_id` is not a label. `internal/pipeline/egress_gate.go` checks
  a routine's HTTP steps against the AUTHOR crew's allowlist, so a routine
  written to poll `seznam.cz` was gated on the Guide's network policy and
  could only be unblocked by widening the Guide; `internal/pipeline/executor.go`
  runs agent steps in the author crew's container, so the work ran as the
  Guide rather than as the crew meant to do it; and the Guide's own
  `autonomy_level` is `full` (it must be — it creates Pages), so a person's
  routines took up permanent residence in the most privileged crew in the
  workspace, outliving onboarding by months. Pages had a fourth version of
  the same fault: a panel names its producer as `agent/<slug>`, and
  `discover_capabilities` could only see the Guide's own roster, so pages
  built at setup pointed their panels at the Guide.

  A `kind='setup'` crew may now name the crew it is authoring FOR
  (`target_crew_slug` on `/internal/pipelines/save`, `/internal/pipelines/test_run`
  and `/internal/pages/save`; `crew` on the `save_routine`, `save_page` and
  `discover_capabilities` MCP tools) and, in exchange, may own nothing at
  all. Both halves are load-bearing: without the second, naming a crew is
  an option the model forgets to take and the orphans come back. The
  exception stays narrow — an ordinary crew naming another crew is still
  403, the same cross-crew escalation the original gate exists to stop, and
  the target must be a non-setup crew inside the workspace the caller's
  token is already bound to. Ownership ordering (crew first, then its work)
  is now enforced by the slug simply not resolving rather than by the
  prompt remembering, and the refusal lists the workspace's real crew slugs
  because a slug is derived server-side and the Guide never sees what its
  proposed name became. The autonomy gate continues to ask about the ACTOR,
  not the owner — a brand-new crew defaults to `guided`, and holding a page
  the Guide is plainly permitted to create would leave setup unable to
  finish its own job.

- **A crew's first message could be answered by total silence when its
  devcontainer needed a build.** The server deferred the message (streamed a
  `crew_provisioning` build card, returned the `ws.ErrCrewProvisioning`
  control-flow sentinel) and relied on the CLIENT to notice the build
  finished and resend — but completion was only broadcast on the workspace
  realtime channel, fanned out to whoever happened to be subscribed at that
  instant. A client that hadn't yet opened its second WebSocket connection,
  hadn't resolved `workspaceId`, or had simply closed the tab never saw the
  frame, and the HTTP poll backstop only sped up once it observed the very
  signal it had just missed. On a cache-hit build (~90ms) the completion
  frame was routinely gone before anything was listening.

  The server now owns the resume. `chatbridge.Bridge.HandleChatMessage`
  attaches the deferred send to the crew's provisioning job
  (`api.ProvisioningHandler.AttachPendingMessage`); the job's own completion
  point runs — or fails — it directly, streaming the outcome on the chat's
  own session channel (`hub.BeginSessionRun`), the one channel a client is
  always reliably subscribed to. At-most-once is structural, not a flag: the
  job tracks at most one pending message per chat (a manual resend or a
  second deferred send on the same chat while the build is still running
  *coalesces* onto the latest content instead of queuing a duplicate), that
  slot is drained atomically with the job's terminal-state transition, and
  the bridge's existing per-chat run exclusivity (`tryMarkRunStart`) means a
  resumed run racing a live manual send never persists twice — whichever
  loses gets `ws.ErrAgentBusy` and stays silent rather than double-answering.
  A failed build now surfaces a real `error` chat event instead of silence or
  a false success.

  The client-side auto-resume (a `useProvisioningStatus` poll that called
  `sendMessage` again once a crew's status flipped to `completed`) is
  removed — it was the unreliable mechanism this fix replaces, and the test
  that shipped it (`onboarding-setup-chat.test.tsx`, stubbing
  `useProvisioningStatus`/`useWorkspace`/`RealtimeProvider`) proved the
  client's wiring against a working feed and never exercised the race at
  all. The "Resend now" button survives as a manual fallback only, safe even
  mid-build because of the coalescing above.

- **A crew created by onboarding could not run an agent at all, and had not
  been able to since 2026-04-15.** Four `INSERT INTO crews` statements omit
  `devcontainer_config` — the two onboarding paths, recipe install, and the
  agent-facing `CreateCrew`. A crew with no config was refused by the
  provisioning gate, never had an image built, and fell through to bare
  `debian:bookworm-slim`. The agent then died with `exit 127`,
  `stdbuf: failed to run command 'claude': No such file or directory`.

  Commit `8780f3c4` (PR #154) deleted the pre-provisioned agent-runtime image
  and switched the platform default to bare Debian, adding these columns with
  no backfill. Seed data got its own config six weeks later; the templates
  never did — which is why `./dev.sh seed` produced working crews and the
  wizard did not, and why four months passed before anyone noticed.

  The default is applied where the config is **read**, not at the four write
  sites. Adding it to the INSERTs is the obvious fix and the wrong one: this
  repo has already paid for that lesson twice (`internal/crewstart` exists
  because thirteen callers each assembled their own config and three forgot
  `CachedImage`), and a read-time default cannot be missed by a creation path
  that does not exist yet.

  Three readers are deliberately NOT defaulted: the crew editor (a GET-merge-
  PATCH would silently freeze the default into every crew the first time an
  operator toggled a security flag), backup collection (a restore must
  reproduce what was stored), and the manifest export that reads them. A crew
  running on the default reports `devcontainer_config_defaulted` so it is
  visible rather than silent.

- **The chat said "an error occurred processing your message" while the server
  was building the crew's image.** The provisioning handshake returned an error
  purely as a control-flow sentinel; it was logged at ERROR and rendered as a
  generic failure stacked under the informative build card. It is now a typed
  sentinel (`ErrCrewProvisioning`), logged at Info, and the user is told the
  environment is being built once and to resend.

- **An agent whose container lacks its CLI now says so.** Adapter-exec failures
  had no classifier: `exit 127` reached the user as "agent exited with code 127
  — check the journal for details", while the one fact that resolves it — the
  binary is not installed — sat in the container's stderr and was discarded.
  Failures are now typed, the container output rides the error event as
  metadata, and a missing binary is distinguished from a crash.

- **A credential could not be checked, and was reported as valid.**
  `probeProviderInner` short-circuited every `sk-ant-oat` token with "OAuth
  token accepted (cannot validate via API)" having contacted nothing — and that
  claim was disproven by `probeAnthropicOAuthToken` forty lines away in the
  same package. It backs `/credentials/test`, the "Test now" button and
  `crewship credential test-stored`, so for the one credential type onboarding
  accepts, every tool anyone had answered "fine" without asking. The CLI
  carried its own copy of the same wrong assumption and skipped before it even
  reached the server.

  Probing is now shared, and it has three outcomes rather than two: accepted,
  refused, and **could not ask** — which is rendered as neither. The probe also
  uses the model the user actually chose; it hardcoded a cheap Haiku, so a
  token with no entitlement to the chosen model passed onboarding and failed on
  the first message.

- **"I could not determine whether the image is present" no longer reads as
  "the image is missing."** `ensureImage` collapsed an errored `ImageInspect`
  into "absent" and told the operator to reprovision a crew whose image was
  never gone. The error-distinguishing variant already existed one function
  below and was unused.

### Added

- **A container-boot conformance test that needs no API key.** The sidecar's
  `/health` is served from in-memory state, so a real container, a real sidecar
  and a real health probe cost nothing to run. It asserts uid 1001 resolves,
  `claude --version` succeeds inside the container, and `/health` answers 200 —
  the exact facts the four-month regression broke. ~9 s warm; it belongs on
  every PR, because a nightly cannot protect a branch that has already merged.

  Deliberately not modelled on the existing runtime-conformance harness's
  four-byte ELF stub: that shortcut is right there, where nothing execs the
  sidecar, and exactly wrong here, where the sidecar booting is the point.

- **Tabs on a page (#1935).** A panel may declare `tab: Odezva`, and the page
  grows a bar under the breadcrumb — several screens instead of one long
  scroll. One optional key on the panel and **no `tabs:` block**: adding a tab
  is one word on the panel that needs it, and there is no second list that can
  disagree with the panels about which of them exists. Bar order is first
  appearance in the panel list; a panel that declares none lands on the first
  tab; a page where nothing declares one has no bar and renders exactly as it
  did before.

  A tab HIDES panels, which is why this is not only a layout feature. Every tab
  carries the **worst freshness state of its own panels** — `failed` over
  `stale` over `never_produced` over `fresh` — as a glyph beside its name and
  never as colour alone, and the page's own freshness summary is computed over
  **every** tab rather than the visible one, so it does not move when the tab
  does. Without both, a critical panel could sit failing on the third tab while
  the page read fine, which is the silent-old-numbers failure the freshness
  contract exists to prevent.

  A tab whose panels are all sealed to a reader still appears on that reader's
  bar, carrying its placeholders: the page has the same shape for everyone, and
  a bar that reflowed per viewer would disclose, by what it left out, whose data
  was on it. `tab` therefore rides on the sealed placeholder too — page
  structure, like `span`, never the panel's data.

  The selected tab is in the URL (`/pages/sit?tab=odezva`). **Print ignores
  tabs**: paper cannot be clicked, so a printed page renders every tab's panels
  in bar order under their tab names, with no bar. On a phone the bar scrolls
  sideways rather than wrapping. A tab name that is blank, longer than 32
  characters, carries a control character, collides with another differing only
  in case, or is the ninth tab on a page, is refused at save with the reason.

  Carried end to end: YAML → CLI → API → the manifest kind (including drift
  detection, on sealed panels too) → `page export`/`import` → the in-app editor.
  The editor was **dropping `icon:` on every save** the same way it would have
  dropped `tab:` — `PATCH` replaces the panel set wholesale, so a key the editor
  does not mention is a key the save deletes — and both now round-trip.

- **Attachments on issues — and the agent working the issue can read them
  (#1768).** Attach a crash log, a screenshot, a repro bundle or a diff to an
  issue over the API (`GET`/`POST` `…/issues/{ident}/attachments`,
  `GET`/`DELETE` `…/{attachmentId}`), over the CLI (`crewship issue attach` /
  `attachments` / `attachment` / `detach`), or from an agent through its
  sidecar (`GET`/`POST /issue/{ident}/attachments`,
  `GET /issue/{ident}/attachments/{id}`). The agent half is the point: a file
  an agent cannot read is decoration, and until now the only way one reached an
  agent was a human pasting its contents into a comment. Every attach and detach
  goes through the shared issue-event emitter, so it lands on the timeline **and**
  in the journal — which is what makes it notifiable.

  Content reaching an agent is treated as attacker-controlled: both the file's
  **text** and its **filename** are wrapped by `internal/untrusted` before they
  leave the handler (`ignore previous instructions.txt` is a shorter payload than
  the file, and it shows up in every listing). Binary comes back base64, budgeted
  at 512 KiB, text at 128 KiB, both with an explicit `truncated` flag — a silent
  truncation is worse than a refusal.

  The type is resolved from the file's **extension** against an allowlist; the
  request's own `Content-Type` is discarded, because honouring it is how a stored
  file becomes stored XSS served from your own origin. `.html` and `.svg` are
  absent deliberately. Downloads carry the resolved type plus `nosniff` and
  `Content-Disposition: attachment`.

  Blobs are content-addressed at
  `attachments/<workspace>/<sha[0:2]>/<sha>` — every component derived from bytes
  we computed, so a filename of `../../../etc/passwd` is stored as the label
  `passwd` and path traversal is not expressible rather than merely refused.
  Identical bytes are de-duplicated **within a workspace and never across one**:
  a cross-tenant shared blob would make workspace erasure undecidable and would
  turn write-time de-duplication into an existence oracle. Deletion is
  reference-counted, so removing a file from one issue never removes it from
  another that carries the same file. Cascade deletes (an issue hard-deleted)
  never reach that refcount, so `crewship issue delete` runs a reclaim pass
  derived purely from the table.

- **Issue attachment and forge-link writes support machine output.** `issue attach`, `issue link` and `issue relink` now print the stored record for JSON and YAML output, including its ID, without a human receipt on stderr.

### Changed

- **Go toolchain moved 1.26.6 → 1.27.0, and every place that names it now
  agrees (#2060).** Dependabot bumps the root `Dockerfile` alone, which is the
  one Go version no PR ever exercises — the image is built only by `release.yml`
  and `nightly.yml`. Taken by itself that bump would have shipped release
  binaries compiled by 1.27.0 while all eleven CI pins, `go.mod`'s `toolchain`
  directive and the `Go Vuln Scan` gate stayed on 1.26.6, so the published
  artefact would have been the only thing built by a toolchain nothing had
  verified. The pins move together instead: `GO_VERSION` in ten workflows,
  the literal in `codeql.yml`, and `toolchain go1.27.0` in `go.mod`. The `go`
  directive stays at 1.26 — the language floor is a separate promise to
  consumers and nothing here needs 1.27 semantics.

  No advisories are cleared or introduced by the move; govulncheck reports zero
  either side of it. This is a build-toolchain change, not a security fix.

  Two analysis tools had to move with it, both for the same underlying reason:
  they vendor a copy of `golang.org/x/tools`, and an `x/tools` older than the
  standard library it is asked to analyse dies on syntax it does not know.
  `golangci-lint` goes v2.1.6 → v2.13.1 — v2.1.6 answers a 1.27 target with 908
  phantom `typecheck` errors on valid code, and v2.12.2 panics outright.
  `govulncheck` goes v1.1.4 → v1.7.0, panicking the same way
  (`unexpected expr: *ast.KeyValueExpr`). Both pins are now documented as
  coupled to `GO_VERSION` and must be re-checked whenever it moves.

  The govulncheck failure is worth recording because of *how* it presents: it
  is not reproducible on demand. v1.1.4 only builds SSA for packages the
  vulnerability database hands it candidate symbols in, so the same tree
  scanned clean on one run and crashed on the next — measured here at one of
  each. A green local scan is therefore not evidence that the pin is
  compatible. What holds the line is the run step's existing rule that any
  exit code other than 0 or 3 is a hard failure, so a crashed scan reports as
  a broken gate instead of falling through as "no vulnerabilities found".

- **The builtin crew templates ship models that are not being retired.** All
  twelve template files pinned dated snapshots — `claude-sonnet-4-20250514` on
  43 agents, `claude-opus-4-20250514` on one, `claude-haiku-4-20250514` on
  three — and those ids retire on 2026-06-15. Every crew the onboarding wizard
  can deploy was seeded against a model with an end date, on the first screen a
  new install ever shows.

  The bump is per tier, not a blanket replace: the threat modeller keeps its
  Opus, the secrets sweeper and the documentation writers keep their Haiku, and
  everything else moves to Sonnet. A template's model choice is a cost decision
  someone made deliberately, and flattening 47 pins onto one model would have
  quietly repriced twelve crews.

  A test walks the YAML exactly as the seeder does and holds two lines for
  every agent in every template: no dated suffix, and the id must appear in
  `llm.CuratedModels("anthropic")`. Bare aliases are the convention here —
  a dated id pins a snapshot that will be withdrawn, and the alias will not.

- **The onboarding preview no longer names a model of its own.** Five
  hardcoded `"Claude Sonnet 4.6"` strings sat in the preview component, so the
  same screen could show the picker's model, the template's model and the
  preview's model and have all three disagree. It resolves one id through
  `getModelLabel` now — the same function the rest of the UI labels with.

- **First-run now asks for the password twice.** `/bootstrap` creates the one
  account that owns the workspace, before any session exists, and a typo was
  only discoverable at the next sign-in — by which point the way back in is a
  password reset a fresh install may not be able to send. `/signup` already
  confirmed; this brings the more consequential form in line.

- **Pairing the CLI is no longer a dead end.** Step 3's green line reads "CLI
  paired. You can finish below or jump to `crewship setup` in the terminal",
  and Launch stayed disabled until a token was pasted into the browser — so
  the terminal route it offers was unreachable. The client gate was stricter
  than the server: `validateOnboardingCredential` returns nil on an empty
  value, so launching without one is a supported path and the CLI lands the
  credential afterwards. Browser mode still requires it, because there is no
  terminal there to add it from later.

- **Step 3 asks one question, then its consequence.** "How will you work?" was
  asking two unrelated things on one screen — how the human drives Crewship,
  and which credential the agents use — and ran off the bottom of the viewport
  doing it, while the two steps before it fit in a third of it. The server says
  as much in its own comment: `pairing_mode` "drives how the human works, not
  the agents".

  With a CLI in the picture the second question has a second answer, so in CLI
  mode the credential block collapses to one line — "Add the token in the
  terminal", with "Or add it now" to expand it — and the toolchain picker moves
  inside, because choosing a toolchain only means something once a key is being
  pasted. Browser mode has no terminal to fall back to, so there it stays open
  and required, with no terminal instructions at all. The whole step now fits
  above the fold.

  An empty token is a valid answer once paired; a half-typed one is not, and is
  rejected rather than stored as a credential that loads but never works.

- **The Claude Code model picker offers only what has been verified with the
  adapter, and is pinned to the backend's curated list.** It was a third independent copy of "which models
  exist", alongside `internal/llm/models_curated.go` (which the backend already
  serves at `GET /api/v1/models`) and the CLI's own adapter defaults — three
  lists, three different contents. The Go list is the source of truth now, and
  a test parses it to enforce that the picker never offers an id it does not
  carry.

  What the picker offers is deliberately narrower than curated: Claude Code
  lists Sonnet 5 and nothing else, because that is what has actually been run
  end to end with the adapter. An earlier version of this list was populated
  from Anthropic's published catalogue, which offered five models of which one
  was tested — publishing a model is not the same as having verified it.
  Widening the list means verifying the adapter first.

  Superseded aliases still answer at the API and can be set through the CLI
  or the API — they are just not offered as a starting point. They keep their
  display names through a label-only table: `getModelLabel` resolves by
  scanning adapters, so without it an existing workspace on
  `claude-sonnet-4-6` would have silently relabelled to "Claude Sonnet 4.6
  (Cursor)" — the only other adapter that registers it.

  `crewship setup`'s adapter defaults had drifted to Sonnet 4.6 while the web
  picker moved on, so the two setup paths for the same adapter handed out
  different models. They match again — which matters more now that the wizard
  points paired users at the terminal path.

- **Sign-up and the first-run admin screen join the split shell, and the setup
  wizard stops moving underneath you.** `/signup` and `/bootstrap` were centred
  cards next to a split `/login` they link to directly; both now mount
  `AuthSplitShell` with the animated mark and their own panel copy.

  Onboarding deliberately does **not** get the brand panel. It already has a
  live preview of the workspace and crew you are building, which is worth more
  than a logo, so it gets the same visual language applied to what is already
  there: the cropped mark in the lockup, and the preview on a surface of its
  own — tinted toward the brand with the mark as a watermark — where it used to
  be `bg-muted/20`, within a hair of the form column, so the split read as one
  page with a hairline down it.

  The pane is lit rather than decorated: an inset highlight on the edge the
  two panes share, and the ground falling away beneath it. The first attempt
  reached for a large soft brand-blue radial glow, which is what every AI
  product has shipped since 2024 and read as unserious next to a form people
  have to fill in carefully. Depth is what makes a split read as two panes.
  Stacked below `lg` the highlight moves to the bottom edge, because that is
  where the seam actually is.

  **The unauthenticated forms are usable with a thumb.** The shared `Input` is
  `h-9` and `Button`'s default size is `h-9` — 36px, under every touch
  guideline there is — and sign-in, sign-up, first-run and setup are the
  screens most likely to be met on a phone. A `.touch-form` scope raises them
  to 44px, keyed on `pointer: coarse` rather than on viewport width: width
  missed the iPad, which is over any phone breakpoint you would pick and still
  a finger. `components/ui` is untouched, because the same controls sit in
  dense authenticated tables where 44px would wreck the row rhythm.

  Two more phone fixes: the crew empty state reserved a full card's height on
  a screen where the preview is below the form and off-screen while you type,
  and it told you to pick a crew "on the left" when stacked there is no left.
  The adapter step's token label and its help link stacked into a run-on at
  390px; they sit on separate lines there now.

  Two fixes found by walking the wizard on a nuked instance rather than by
  reading it. **The lockup drifted between steps** — the form column was
  centred as a whole, so the logo and stepper slid as the step content changed
  height, measured at y=101 on Workspace, y=137 on Crew and y=66 on Adapter.
  Both columns are top-anchored now; measured steady at y=71 across all three.
  And **the preview's empty state was a thin strip**, leaving the pane looking
  ~85% empty on step one — which reads as a failed render, not an empty state —
  and making the layout jump when the real crew card arrived. It now reserves
  that card's height and says what will land there instead of pointing at a
  control.

- **The sign-in screen is now a split, with the brand mark animated on the
  right.** `/login` was a centred card on a flat gradient. It is now a
  two-pane shell: the form in a readable column on the left, and on the right
  the Crewship mark blown up until the panel is its tile.

  The mark moves because it is **taken apart, not redrawn**. The logo is one
  `<path>`, but that path is three subpaths — three sails. `lib/brand-mark.ts`
  splits them so each carries its own motion, and the geometry on screen stays
  byte-identical to the logo we already ship. Two of the three subpaths begin
  with a *relative* `m`, chained to wherever the previous sail ended, so the
  split walks the path tracking the current point and rewrites those movetos
  as absolute; lifting them out verbatim would silently pile the sails at the
  origin. The split runs at module load rather than into a checked-in
  generated file, so a redrawn logo cannot leave a stale copy behind.

  Each sail runs three independent sines — bob, swell about its foot, heel
  about its foot — on periods that do not divide into each other, so the loop
  never visibly repeats and the sails never sync into a pulse. A specular
  sweep is clipped to the live union of the moving sails, built from the same
  matrices that fill them, so it cannot drift off the mark.

  `prefers-reduced-motion` settles the canvas to one composed frame and
  schedules nothing; a hidden tab cancels the loop; and where there is no 2D
  context the panel falls back to the shell's CSS gradient rather than to a
  blank rectangle. Below `lg` the panel becomes a short brand banner above the
  form — the headline is hidden there, because over a 12 rem banner it ran
  straight through the sails.

  `<CrewshipLogo tight />` crops the viewBox to the mark's own bounds. The
  default 1024 box is the *tile's* box — the silhouette fills about 62% of its
  width and 58% of its height, and the rest is padding the squircle needs.
  Shown without a tile that padding is most of the element, which is why the
  sign-in lockup's 28px mark read as a few grey pixels with no legible sails.
  The lockup now uses the bare cropped mark at 36px. The tight mark is not
  square (about 1.07:1), so size it on one axis and let the other follow.

  None of the auth logic moved: `safeRedirectPath`, the
  `/system/setup-status` first-run gate, the four banner states and the
  signup-allowed flag are untouched. `SAIL_PATH` moved from
  `components/branding/crewship-logo.tsx` to `lib/brand-mark.ts` and is
  re-exported, so importers are unaffected.

### Fixed

- **Deploying a crew template links credentials for the agent's own provider.**
  `autoAssignCredentials` filtered the workspace's credentials with a hardcoded
  `provider = 'ANTHROPIC'` while the agents it links them to carry whatever
  provider their template pinned. For an Anthropic crew the two agreed by
  accident and nothing looked wrong. For any other provider the query matched
  nothing and every agent in the crew deployed with **zero credentials** — no
  error, no failed request, just a crew that does not work; and a workspace
  holding an Anthropic key handed that key to a Google agent, which is worse,
  because it loads and then fails at call time.

  It reads the agent's own `llm_provider` now and falls back to `ANTHROPIC`
  only when the column is empty, matching the default the write side applies.
  A lookup that errors leaves the agent unlinked rather than guessing. The
  onboarding wizard reaches this path for every builtin template, so it was one
  adapter choice away on the most common flow in the product, and nothing
  covered it.

- **The wizard's model choice reaches the crew it deploys.** Picking a model on
  step 3 did nothing for four of the five crew options: `req.LlmModel` was read
  only by the branch that builds a blank or single-agent crew, so every builtin
  template deployed with the model its YAML pinned and the select was
  decoration. `deployCrewTemplate` takes the override now.

  It applies **only when the chosen provider matches the agent's** — writing a
  Gemini id onto a `CLAUDE_CODE` agent breaks it outright, which is worse than
  the template's default. An override with no resolvable provider is ignored
  for the same reason, and the zero value deploys the template verbatim, which
  is what every other caller passes.

- **The first-run window is documented as it behaves.** Three source comments
  and the changelog stated bootstrap closes five minutes after `crewship
  start`. It does not: it stays open until an admin account exists, and the
  finite window is opt-in through `CREWSHIP_BOOTSTRAP_WINDOW` for instances
  reachable from the internet before anyone claims them. One of the comments
  named a symbol that is not in the tree. Four docs pages also said the closed
  endpoint answers 403 where the server answers 410, as did an assertion in
  `e2e/onboarding-fresh.mjs` — the code was right in every case and only the
  prose and one stale check were wrong, which is the kind of drift that gets
  believed because it is checked in.

- **`e2e/onboarding-fresh.mjs` runs past its 24th check.** A module-scope
  `const URL` shadowed the global constructor, so `new URL(...)` threw partway
  through and the eleven checks after it had never executed — in a script that
  reports its own pass count, which made a truncated run look like a short one.
  Nothing in CI runs this script, so it went unnoticed; it completes now, 37
  checks against a fresh database. Two of the newly-reachable checks were
  themselves stale: the 410 above, and a `console.anthropic.com` link no
  onboarding component renders any more (the step deep-links into the adapter's
  own CLI-auth docs, deliberately not to the API-key page, because onboarding
  rejects raw API keys).

- **A failed `crewship apply` no longer reports success.** Apply is fail-fast,
  so on an error the counters describe a *prefix* of the plan — but they were
  printed under the word `Applied:` regardless, with the error on a later line.
  A production run that uploaded none of its ten crew files reported
  `Applied: 7 created, 3 updated` and was filed as done; the routine went on
  running against the stale script the deploy existed to replace.

  `Applied:` is now reserved for a run that finished. A failed run prints
  `FAILED after N created, …  — the manifest was NOT fully applied.` and then a
  `NOT APPLIED` block naming the item it died on and every item behind it that
  was never attempted. The counters say how far the run got; only that list
  answers the question the operator actually has, which is *which of them
  landed*.

- **`crewship apply` stops silently dropping routine DSL fields.** `spec:` was a
  closed struct and the wire body an 11-key allowlist, so `guardrails`,
  `integrations_required`, `concurrency_key`, `max_concurrent`, `outputs`,
  `display_name`, `agentless`, `hooks`, `eval`, `resources`, `execution_tier`
  and `parallelism` were dropped between the file and the server — no error, no
  warning, no plan diff. The allowlist was justified by a comment claiming the
  server rejects unknown keys; `pipeline.Parse` is a plain `json.Unmarshal` and
  does not, so it bought nothing.

  The export half was the dangerous one: `crewship export` decoded the *stored*
  definition through the same struct, so a field set via `routine save` or the
  dashboard vanished from the exported YAML and the next `apply` **deleted** it
  from the live routine. An `agentless: true` token-zero guarantee could be
  revoked by editing an unrelated line.

  `spec` now carries an inline catch-all, the pattern its own steps have always
  used, so any `routine.v1.json` key rides through in both directions. Typed
  fields still win every collision, and `schedules`/`webhook` still stay out of
  the definition. Because a typo is now forwarded rather than dropped, apply
  warns at plan time for every `spec` key the DSL has no field for.

- **The crew-file 409 names a command that exists.** Overwriting a file under
  `/crew/shared` on a stopped crew answered "start the crew and retry", which
  reads as `crewship crew provision` — a command that builds an image and, on a
  cache hit, reports `provisioned` while the container stays `stopped`.
  Following the message reproduced the 409. It now names `crewship crew start`
  (below) and rules out the wrong turn it used to invite. `crew provision` says
  `provisioned (container image ready)` and points at the same command, for the
  same reason.

### Added

- **`crewship crew start <crew>` — start a crew's container on purpose.** There
  was no way to. `crew provision` builds an image and stops; the container was
  only ever created lazily by the crew's first agent run, so the only route to a
  running crew was to run an agent at it with a throwaway prompt — spending
  tokens for a side effect. That gap is what made the crew-file 409 unanswerable.

  `POST /api/v1/crews/{crewId}/container-start` runs the same three steps the
  dispatch path runs before an agent — EnsureProvisioned, then the crew's full
  resolved config, then `crewstart.Start` — so a crew started this way is the
  crew a run would have started: its provisioned image, its mounts and limits,
  its declared sidecars. That sequence is copied rather than reinvented on
  purpose; `internal/crewstart` exists because thirteen call sites once each had
  their own idea of what starting a crew meant and disagreed invisibly.

  Idempotent (starting a running crew returns its container and exits `0`, so a
  deploy can start-then-write without branching), synchronous (the caller's next
  action depends on the answer), and it provisions a cold crew first rather than
  starting it onto the bare runtime image. Degradation the start survived — a
  provider with no sidecar support — comes back as `notices` and is printed, not
  logged.

  It reports the start to the orchestrator's idle-TTL reaper. Every other
  `EnsureCrewRuntime` caller gets that for free because an agent run follows and
  reports the activity; this is the first path whose whole purpose is a start
  with no run behind it, so an unreported container would have outlived its
  `container_ttl_hours` until crewshipd restarted and rediscovered it.

  It verifies rather than asserts. `EnsureCrewRuntime` is get-or-create and
  normally restarts a stopped container, but not always — after two
  consecutive stops it can return the id of a container that is still
  `exited`. Answering `"status": "running"` there would be the very defect
  this command exists to fix in `crew provision`, so the handler polls the
  runtime before reporting success and returns `502` if the container never
  comes up. (A known sequence — stop, stop, refused write, start — still fails
  to restart; it is now a loud failure instead of a silent one, and is pinned
  as `xfail` in `scripts/test-harness/test-crew-lifecycle.sh`.)

  The CLI waits up to 20 minutes (`--timeout` to change it) rather than the
  client's 30-second default. The default would not merely time out: Go's client
  cancels the request, which cancels the handler's context, which tears down the
  image build it was waiting on — leaving `context deadline exceeded` and no
  container on exactly the never-provisioned crew this command exists to rescue.

- **`crewship crew stop <crew>`.** The counterpart to `crew start`. Until now a
  crew container could be started deliberately but only stopped by accident —
  an idle TTL expiring, or a network-policy edit dropping it as a side effect —
  so an operator who started three crews to land a restore had no way to give
  the memory back.

  `POST /api/v1/crews/{crewId}/container-stop` proxies to crewshipd, which
  already stops the runtime AND the crew's declared sidecars in one operation.
  Reimplementing the sidecar half here would be a second, slightly different
  teardown, which is how one once reached into another tenant's Postgres
  (#1732). Named volumes survive, so data does. Stopping an already-stopped
  crew succeeds, and the crew is dropped from the idle-TTL reaper's
  bookkeeping so it no longer logs an expiry for something a human stopped.

  Because container memory and CPU limits are fixed at create time, stop-then-
  start is also how a resize takes effect on a running crew.

- **`crewship apply` warns at plan time when a crew it writes files into is
  stopped.** Files under a crew's shared tree are owned by the container user,
  so overwriting one needs the container up; against a stopped crew the save
  answers 409, and because apply is fail-fast that lands mid-run, after earlier
  resources are already committed. The plan knows both halves twenty seconds
  earlier, so it now says so — naming the crew, the file count, and
  `crewship crew start <crew>`.

  Advisory, not an error: the crew may be started between the plan and the
  apply, including by whoever is reading the line. A probe that cannot answer
  stays silent rather than warning on a guess, and a crew being created by the
  same apply is never warned about.

- **`crewship apply --no-delete`.** Refuses any run whose plan contains a
  delete, before a single request is issued, printing what it would have
  destroyed. Sync mode makes deletion the default for anything that fell out of
  the manifest, and some deletions are not a rollback away: removing an agent
  takes its memory and its Composio OAuth binding with it, and that binding is a
  browser consent no manifest can replay.

  It deliberately outranks `--yes` — `--yes` is the flag every automated
  invocation already carries, so a guard it could switch off would not be one —
  and it fails `--dry-run` too, so the rehearsal and the performance agree.
  This turns "this apply deletes nothing", previously a claim a human made by
  reading a plan carefully enough, into one CI can check.

  Enforced twice, against two different plans: once by the CLI against the plan
  it rendered, and again inside `manifest.Apply` against the plan it builds from
  its own fresh read immediately before executing it. Only the second one closes
  the window — a resource that disappeared server-side between the two reads
  adds a delete the rendered plan never showed, and `--yes` (which every CI
  invocation carries) would have waved it through. SDK callers get the same
  guarantee via `manifest.Options{NoDelete: true}` → `ErrDeletesRefused`.

### Changed

- **`OTEL_EXPORTER_OTLP_ENDPOINT` is treated as the base URL it is, and
  `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` is honoured (#1870).** The standard
  says the generic variable is a base URL for every signal and the signal
  path is appended to it — including when it already carries a path. We
  appended only when there was no path, and ignored the signal-specific
  variable entirely.

  Two consequences. A backend documenting a project-scoped prefix, such as
  Langfuse's `/api/public/otel`, expects spans at
  `/api/public/otel/v1/traces`; we posted to the bare prefix, where a
  collector answers 200 and drops the payload — indistinguishable from
  working. And an operator who set `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, the
  correct way to pin an exact URL, was not listened to at all.

  **If you configured a bare prefix, traces move** — to where the backend
  wanted them. A path that already ends in `/v1/traces` is not doubled, so a
  fully-written-out endpoint is unaffected. To pin any exact URL, use
  `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`.

  The startup line now prints `traces_url` — the resolved destination, signal
  path included — instead of the configured endpoint. Logging what was
  configured is what let a misrouted exporter read as healthy for a release.

- **The OTLP endpoint keeps its own `/v1/traces` default.** opentelemetry-go
  1.45 changed `WithEndpointURL`: a URL with no path of its own used to fall
  through to the exporter's default signal path, and now resolves to `/`. Since
  `OTEL_EXPORTER_OTLP_ENDPOINT` is a base URL — that is the standard, and what
  our setup guide tells you to configure — every collector would have started
  receiving spans on its root route, where a 200 and a discarded payload look
  exactly like success. `telemetry.Init` appends the signal path itself now, so
  the upgrade is invisible to operators and the SDK's default stops mattering
  to us. An endpoint that already carries a path keeps it verbatim, as before.

  The setup guide also claimed the SDK appends `/v1/traces` to a project-scoped
  prefix such as `/api/public/otel`. It never did, in any version — if you
  configured a bare prefix, set the full URL your backend documents.
- **WAL checkpointing moved off the request path.** Every commit appends
  frames to the `-wal` sidecar, and SQLite folds them back inside whichever
  write transaction happens to cross the threshold — so the cost landed on a
  random agent. The daemon now disables the inline autocheckpoint
  (`database.WithManagedWAL`) and runs a dedicated checkpointer that does the
  work on a goroutine nobody is waiting on. At 100 concurrent agents, three
  runs per policy, p99 write latency went **26.1 ms → 8.9 ms** and the WAL
  ended at 0 instead of 13.6 MB.

  Two findings are recorded in `internal/database/checkpoint.go` because both
  contradict the obvious guess: a `PASSIVE`-only checkpointer is **worse than
  doing nothing** (it folds frames back but never resets the `-wal` file, which
  grew to 98 MB), and the win comes from *who pays* for the checkpoint, not
  from checkpointing more often. Only the long-lived daemon disables
  autocheckpoint; short-lived CLI commands keep SQLite's built-in behaviour,
  and the pairing is enforced by a test.

- **The port-exposure purge no longer stalls every writer.** The sweeper runs
  every 30 s and issued one unbounded `UPDATE`, so its cost scaled with the
  backlog: measured at 41 ms of held write lock for 5,000 rows and **486 ms
  for 50,000**, with a concurrent live write blocked for 449 ms. That is the
  same sweeper whose lock hold took logins down on 2026-05-25 and is why
  `busy_timeout` was raised to 30 s. It now drains in bounded batches,
  releasing the lock between each, and logs the remaining backlog if it ever
  stops at its iteration cap.

  Bounding is right here because the job is *frequent* and its backlog grows.
  It is the wrong move for a large infrequent job: chunking a daily
  20,000-row sweep measured **worse** (150 ms → 405 ms total, live-writer p95
  4.1 ms → 21.5 ms), because re-acquiring the write lock costs more than the
  shorter holds save. Both numbers are in the code comment so the pattern is
  not copied blindly.

- **The two audit tables that grew forever now have retention windows
  (#1887).** `credential_audit` and `audit_logs` were the only tables in the
  schema with no pruning at all — `pipeline_runs`, `inbox_items` and
  `journal_entries` are all swept, these two never were. `credential_audit`
  gains a row on every credential read by every agent; on a dev instance with
  almost no real use it was already the second-largest table in the database.

  The defaults differ deliberately. `credential_audit` keeps **90 days**,
  matching the pipeline-run window — it is operational telemetry, and the
  answer an operator actually reads (`last_used_at`, the `last_used_ips` ring)
  lives on `credentials` and is untouched. `audit_logs` keeps **everything**,
  because it is the compliance trail and `docs/security/gdpr.mdx` says audit
  records have to survive the operator's own retention obligations. Crewship is
  self-hosted: that duty is theirs to know, so the mechanism ships and the
  decision does not. Both are overridable per workspace, where `NULL` means
  "use the default" and `0` means an explicit "keep forever" — a distinction
  `run_retention_days` does not make, because nobody has a legal duty to retain
  a pipeline run.

  Upgrading never deletes anything on its own: the migration pins every
  workspace that already existed to an explicit "keep forever", so the 90-day
  default only ever applies to workspaces created after it. Otherwise the first
  restart after the upgrade would have swept a year of credential history away
  before the API that sets the override was even listening.

  The sweep deletes in bounded batches so no single statement can stall every
  writer, and says how much backlog is left if it stops at its cap. Since
  `audit_logs` is unlimited by default, it also warns when a workspace has no
  window and the table passes a million rows — an operator should hear about
  that from a log line, not from a full disk.

- **The credential audit view stops sorting the whole table to answer one
  page (#1889).** `credential_audit` had no `workspace_id`, so scoping it to a
  tenant meant joining through `credentials` — a shape no index could serve.
  SQLite either walked the table in time order probing `credentials` for every
  row, or gathered the entire matching set and built a temporary B-tree to sort
  it before `LIMIT` threw almost all of it away; the page's `COUNT(*)` then ran
  the same join again. That cost grows with the table, and this is the one
  audit table with no retention sweep at all.

  The column is now carried directly, with
  `(workspace_id, occurred_at DESC)` behind it, matching how `audit_logs` and
  `keeper_request_events` have always worked. The single writer derives the
  value from the credential inside the same `INSERT`, so it cannot disagree
  with the row it describes and no caller has to know the workspace to write an
  audit row. Existing rows are backfilled. No behaviour change — the same rows
  come back.

- **Sixteen foreign keys indexed, thirty-two deliberately not (#1890).** With
  foreign keys enforced, deleting a parent row scans every child table whose
  referencing column does not lead an index — once per deleted row, holding the
  write lock. 48 columns were in that state. The ones now indexed are those
  where the parent is genuinely hard-deleted *and* the child table grows;
  `DELETE FROM missions WHERE crew_id = ?` drove three of them on its own,
  because it deletes many missions in one statement and re-checks every child
  of `missions` for each.

  The 32 skipped are the interesting half. Nine reference `users`, and nothing
  in the tree hard-deletes a user row — so an index there is write cost with no
  delete to accelerate. The rest are settings and small config tables where a
  scan costs nothing. Both exclusions are pinned by tests, so they stay
  decisions rather than oversights, and a ratchet makes the remaining count
  visible if a new table adds foreign keys nobody sized.

- **A task whose assignment link failed is now FAILED, not stranded (#1892).**
  `scheduleTask` inserted the assignment and then linked it to the task in two
  separate statements. A failure between them logged a warning and reported
  success, leaving the task `IN_PROGRESS` with no assignment — a state
  `resolveReadyFromTasks` never re-picks, so the work sat there forever with no
  operator-visible symptom. Both writes are now one transaction, and a link
  failure surfaces as a failed task. The dependent-task cascades
  (`unblockDependentTasks`, `failDependentTasksRecurse`) also stopped issuing
  one standalone `UPDATE` per row: each level is now a single batched
  transaction, so a mid-cascade failure unblocks nobody instead of half the
  graph.

- **`presence.Track` no longer fabricates a transition.** The prior status was
  read and the new one written in two statements, so a losing writer could emit
  `online → busy` for a transition that had already happened, or report a
  `prev` that was never the state it overwrote. The journal is consumed as a
  transition log and is hash-chained, so a wrong `prev` is worse than a
  redundant row. Read and write now share one transaction; the journal emit
  stays outside it.

- **Eleven redundant indexes dropped
  (`20260810120000_drop_redundant_indexes`).** Each was a leading-prefix
  duplicate of a longer index on the same table, so the planner could never
  choose it while every write still maintained it — on `missions`, `chats`,
  `assignments`, `credentials`, `journal_entries` and others.
  `idx_journal_trace_id` and `idx_journal_trace` turned out to be the same
  index under two names. A schema invariant test now fails the build if the
  shape is reintroduced.

- **One attachments table, and `chat_attachments` is gone (#1768).** The schema
  carried two attachment tables that no product code had ever read or written —
  `chat_attachments` and `workspace_files` (both migration v57) — while the chat
  composer's live attachment path wrote blobs and **no metadata row at all**, so
  a chat attachment had no recorded size, checksum, MIME type or uploader and
  could not be listed or deleted through any API. The new `attachments` table
  replaces `chat_attachments` (dropped in the same migration) and holds all owner
  kinds through an exclusive-arc foreign key, so a row can never decay into an id
  that resolves to nothing. `ProxyHandler.AgentChatAttachment` now writes its row;
  the chat blob's location is deliberately unchanged, because
  `/output/<agentSlug>/attachments/…` is the agent-visible contract.

  `workspace_files` is **not** dropped here: it is a path→metadata index rather
  than an attachments table, and three v144 timestamp-regression guards use it as
  their canary. Removing it belongs with #1768 item 8, together with moving those
  guards.

### Fixed

- **Two crews with the same issue prefix no longer wedge each other (#1797).**
  An identifier is `<prefix>-<n>`, where the prefix is the crew's
  `issue_prefix` or the first three letters of its slug — so `engineering` and
  `engine` both derive `ENG` with nothing configured. The number came from a
  counter keyed **per crew**, while identifiers are unique **per workspace**, so
  both crews minted `ENG-1` and the second one's insert was rejected.

  It was not a one-off 500. The counter increment and the issue insert shared
  one transaction, so the rejection rolled the increment back too: the losing
  crew asked for the same identifier on every subsequent create and **could
  never file an issue again**, with no message naming the cause. Any workspace
  with two such crews had one of them silently out of service.

  The counter is now keyed on `(workspace_id, prefix)`, which is the namespace
  it feeds. Two crews sharing a prefix share one sequence and interleave
  (`ENG-1`, `ENG-2`) instead of colliding — no validation to remember at each
  write site, and no legitimate crew refused for its name. The migration
  collapses colliding counters onto the highest of them, which also unwedges a
  crew that was stuck, and seeds each prefix above the identifiers it has
  already minted so a crew that changed its prefix cannot restart into an
  existing range. The two duplicate identifier generators (the REST create and
  the agent/recurring path) are now one.

- **`crewship crew update --issue-prefix` (#1797).** `issue_prefix` has been
  accepted by `PATCH /api/v1/crews/{id}` since v38 and had no CLI flag at all;
  it was reachable only from the web UI. Pass an empty string to clear it and
  fall back to the slug.

### Security

- **cel-go can receive security updates again (#2067).** It had stopped, and
  nothing said so. cel-go renamed its module: `v0.31.0` declares
  `module github.com/google/cel-go`, but `v0.32.0` and everything after declare
  `module cel.dev/cel-go`, served from a different origin repository. v0.31.0 —
  where we were — is therefore the last release reachable under the import path
  we used, and Dependabot cannot cross a rename because doing so means editing
  source. It failed the whole `go_modules` job with `go_module_path_mismatch`
  instead, in a job log nobody reads, on every run since at least 2026-08-24.

  This matters more than a stale pin because CEL evaluates expressions that
  come from pipeline definitions, and because the *advisory* channel was
  affected too: a future advisory would be published against `cel.dev/cel-go`
  and would not have matched a requirement naming the old path. The gate meant
  to catch a stale dependency was looking at the wrong name for it.

  Imports move to `cel.dev/cel-go` and the module to v0.32.0. No behaviour
  change is intended — the two paths serve identical content for the same tags.

- **A crew no longer starts on a known-stale runtime image, whichever way the
  host got there (#2006, #2019).** ⚠️ **Behaviour change:** a start that used to
  succeed can now fail.

  Crewship pulls the runtime image **by digest** and then re-creates the
  `repo:tag` alias itself, because everything downstream — `ContainerCreate`
  included — addresses the image by tag. When that re-tag failed and an older
  copy of the tag was still on disk, the tag kept pointing at the **old**
  manifest: the container ran the old image, and the `provisioning.step` journal
  attested the newly pulled digest as verified. The journal half is fixed first
  — the digest recorded is now read back off disk, so a run is never attributed
  to a manifest it did not execute, and no digest at all is recorded when the
  daemon answers 404 for the tag. A read-back that *fails* is not read as a 404:
  a timeout says nothing about what the tag resolves to, so the decision falls
  back on what was proved before the pull.

  Execution is now fixed too. That state is bit-for-bit the state a **failed
  pull** over a stale local copy reaches, which has refused to start since
  #1825 — so one route stopped the fleet while its sibling shrugged and started
  the wrong image with an error log. Both routes now go through one decision:
  refuse by default, with the existing host-wide opt-out
  `CREWSHIP_ALLOW_STALE_RUNTIME_IMAGE=1`, and the error names both digests, what
  happened, and how to fix it properly. This route is the more recoverable one —
  the manifest you wanted is already on disk and merely unnamed — so the error
  hands over the exact `docker tag` that names it.

  **Who is affected:** a host whose registry answers the digest check while its
  local tag resolves to something else. An air-gapped or offline host is not
  affected (no digest answer, so nothing is provably stale) and neither is a tag
  that is simply absent. **If a start now fails**, re-pull or run the `docker
  tag` the error prints; if you would rather run the older image than stop the
  fleet, set `CREWSHIP_ALLOW_STALE_RUNTIME_IMAGE=1`. The opt-out relaxes
  execution only — it still journals the **local** digest with
  `payload.pinned: false`, because a tamper-evident log that attests a digest
  which never ran is worse than one that records nothing.

- **Go toolchain bumped 1.26.5 → 1.26.6, clearing eight advisories (#1959).**
  Seven were in the standard library and reachable from real call paths —
  `crypto/tls` post-handshake message flooding (GO-2026-6090), `net/http`
  missing `ReadHeaderTimeout` on the unencrypted HTTP/2 check (GO-2026-6089)
  and its IDNA Punycode label handling (GO-2026-5026), quadratic
  `net/url.resolvePath` (GO-2026-6218), unbounded recursion in `encoding/xml`
  (GO-2026-6088) and `encoding/asn1` (GO-2026-5972), and JavaScript regexp
  context tracking in `html/template` (GO-2026-6091). The eighth,
  GO-2026-6222, was excessive memory allocation decoding VP8L in
  `golang.org/x/image`, reachable from avatar upload, and is fixed by that
  module's 0.44.0 → 0.45.0 bump.

  Dependabot proposed the toolchain move in the `Dockerfile` alone; the
  version is pinned in **thirteen** places (`go.mod`, the `Dockerfile` and
  eleven workflow pins), and only moving them together changes what the
  released binary and CI are actually built with. `govulncheck ./...` now
  reports zero.

  The govulncheck allowlist is emptied in the same change. Its five entries
  were all `docker/docker` advisories, and that module left the graph when the
  container provider moved to `github.com/moby/moby` — a dead entry would have
  silently re-accepted those IDs had it ever returned transitively. The
  allowlist arm of the gate now has unit coverage in
  `scripts/security-yml-test.sh`, extracted verbatim from the workflow the way
  the scheduled-report gate already was.

- **Capability tokens are hashed at rest (#1888).** `port_exposures.token` and
  `pipeline_webhooks.token` were stored in the clear and looked up by equality.
  Neither `/exposed/{token}/…` nor `POST /api/v1/webhooks/{token}` has any
  authentication in front of it — by design, the token *is* the authorization
  — so anyone who could read the database file walked away with every live
  exposure URL and every configured webhook on the instance. Both columns now
  carry a SHA-256 digest and are resolved by digest, the way `cli_tokens` has
  worked since Patch J.

  **Existing tokens keep working.** The migration hashes the cleartext already
  in the row rather than rotating it: invalidating would have broken every
  published exposure URL and every already-configured sender, on every
  instance, and nothing suggests the cleartext leaked. What changes is that the
  cleartext is then overwritten — neither column can be dropped (both are
  `NOT NULL UNIQUE`, which SQLite's `DROP COLUMN` refuses, and one is still
  named by the create path) so each holds `redacted:<row id>` afterwards.

  **The digest is unkeyed SHA-256** (hex, behind an `sh1:` scheme prefix), not
  an HMAC. A key protects a digest whose input space is small enough to
  enumerate offline; both of these tokens are 32 bytes of `crypto/rand`, so the
  preimage search is 2^256 wide either way and a key buys nothing. It would
  have cost a great deal: an earlier revision of this work keyed the digest off
  `ENCRYPTION_KEY`, and the documented master-key rotation
  (`CREWSHIP_ENCRYPTION_KEY_VERSION` + `ENCRYPTION_KEY_V2` +
  `POST /admin/reencrypt`) **retires that variable as its final step** — after
  which every presented token would hash under a different scheme than every
  stored digest, with the cleartext already overwritten and nothing to recover.
  The keyed `hk1:` scheme never shipped and is not supported; a **dev instance**
  that ran the earlier revision must re-create those webhooks and re-request
  those exposures.

  A row the backfill cannot hash is no longer stranded either. The backfill
  continues past a failed `UPDATE` (SQLite has one writer; a moment of
  contention used to abort the loop and 404 every remaining webhook until the
  next restart) and, while any row still holds cleartext, the webhook lookup
  falls back to it — bounded to rows whose digest is missing, and re-hashing
  each one it resolves. On the exposure side, an `ACTIVE` row whose hashing
  failed is hashed at boot and keeps serving; one that nothing can resolve is
  flipped to `EXPIRED` instead of being reported live with a future expiry.
  Revoking an exposure now drops it from the registry by row id when the row
  carries no digest — the previous fallback read a column that always holds
  `redacted:<id>`, so a revoke could answer `200` while the capability URL kept
  reverse-proxying into the crew container until the process restarted.

  One behaviour change follows from it: a webhook's token is now **shown once**,
  in the create response. `GET`/`PATCH` and the list endpoint no longer return
  it, because it is no longer recoverable. A webhook whose token was lost has to
  be re-created, and `crewship routine webhooks url <id>` now says so and exits
  non-zero instead of printing `…/api/v1/webhooks/` with nothing after the
  slash.

  For port exposures the cleartext never reaches disk at all: the create path
  writes the spent marker and the digest directly, rather than inserting the
  live token and redacting it a moment later. That window was short — one
  request — but a crash, a WAL checkpoint or a backup taken inside it captures
  a working capability URL, which is the whole exposure being closed. If the
  process dies between the insert and the registry write, the row is left
  resolving for nobody, which is the right direction to fail.

  `pipeline_waitpoints.token` is **not** covered. It is the same kind of
  secret, but it is also that table's primary key, the handle
  `inbox_items.source_id` and a WAITING run's `waitpoint_token` carry, and the
  value `GET …/pipelines/waitpoints` reads back out of the column to rebuild
  the public callback URL. It is a retrievable shared secret by contract rather
  than a show-once credential, so hashing it means redesigning that contract
  first; tracked separately.

- **`workspace_members.role` is constrained to the roles that exist (#1893).**
  `crew_members.role` has carried a `CHECK` since v99; the column deciding what
  a member can do across a whole *workspace* carried nothing and would accept
  any string. The API validates today, so this is defense in depth — but the
  read tier is where it would have mattered: `canRole`'s write tiers switch
  over the known roles and deny anything else, while its `read` tier accepts
  any non-empty string. Write fails closed, read fails open, and only the
  schema can refuse the value independently of whichever write path appears
  next.

  Enforced with `BEFORE INSERT` / `BEFORE UPDATE` triggers rather than a
  `CHECK`, because SQLite cannot add one without a full table rebuild — not a
  trade worth making on the table that decides workspace ownership. The
  difference is deliberate: a stored legacy row keeps working and is refused
  only when something tries to write it back, where a rebuilt `CHECK` would
  have refused to apply at all and failed the boot.

- **The escalation wait endpoint now scopes to the caller's token binding.**
  `GET /api/v1/internal/escalations/{id}/wait` loaded the escalation by id
  alone, with no workspace or crew predicate — and when the escalation's type
  is `CREDENTIAL`, that handler **decrypts the resolution and returns the
  secret in the clear**. A crew-bound (`crwv1`) sidecar token could therefore
  wait on another crew's escalation, in another workspace, and be handed its
  plaintext the moment a human approved it. Both halves leaked: an
  already-`RESOLVED` foreign escalation returned immediately, and a foreign
  `PENDING` one long-polled and was delivered on resolve.

  The lookup now carries the predicate its sibling `CreateEscalation` has
  used since PR-F24: crew-bound callers match their own `crew_id` exactly (a
  sibling crew in the same workspace is as foreign as another tenant, which
  is what `crwv1` tokens exist to enforce), workspace-bound callers match
  their workspace, and the unbound master token stays unrestricted. A refusal
  is the same `404` as an unknown id rather than a `403`, so the endpoint is
  not an existence oracle.

- **The Docker API surface the server can reach is now specified, published
  and gated (#1826).** The server talks to Docker directly, which is
  root-equivalent on the host. `DOCKER_HOST` already let an operator put a
  filtering proxy in front of that, and `docker/docker-compose.prod.yml`
  already shipped one — but nobody had ever derived the endpoint list behind
  it, and it was wrong: **`COMMIT` was missing**, so crew provisioning behind
  the proxy we ship would have failed with a `403` on `POST /commit`, and the
  BuildKit path (`BUILD` + `SESSION`) was unaccounted for entirely.

  The real surface is **31 Engine API endpoints** — not the 25 previously
  assumed. `ContainerCommit`, `ContainerPause`, `ContainerUnpause`,
  `CopyFromContainer`, `ImageList`, `ImageRemove`, `Info`, `Ping` and
  `ServerVersion` were all reached and unlisted; `ContainerLogs` and
  `NetworkRemove` were listed and never called. `scripts/docker-api-surface`
  re-derives the list from the call sites on every CI run and fails on drift in
  **both** directions — a new call nobody declared (the proxy would deny it in
  production) and a declared endpoint nobody calls (we would be asking
  operators to grant a permission we do not need). It also catches a package
  newly importing the Docker SDK, and a subprocess executed with `DOCKER_HOST`
  pinned, which is a second client of the same socket that no compile-time
  check would see.

  New guide: [Docker Socket Proxy](https://docs.crewship.ai/guides/docker-socket-proxy).
  It is deliberately unflattering about the ceiling. The proxy filters URL
  paths and never request bodies, so it **cannot** block `Privileged: true` in
  a `ContainerCreate` — the workspace `allow_privileged_credentials` gate stays
  the real fence. Its granularity is a path prefix, not an endpoint:
  `CONTAINERS: 1` also opens `POST /containers/prune` and
  `POST /containers/{id}/update` for every container on the host. And the verbs
  we genuinely need (`ContainerCreate`, `ExecCreate`/`Start`/`Attach`,
  `CopyToContainer`) are most of what an attacker would want. What it does
  remove is real — image build, `commit`, swarm, plugin install, `/system`
  prune, registry auth — and that is the claim the page makes, no larger.

- **Internal tokens are now bound to a crew, closing the
  credential-metadata enumeration leak (#1159).** The `?crew_id` scope on
  `GET /api/v1/internal/credentials` (#1031) was opt-in and fail-open: a
  workspace-bound `X-Internal-Token` holder could omit `crew_id` (get the
  whole workspace's credential metadata) or forge a sibling crew's id and
  enumerate it. A per-crew sidecar now receives a **crew-bound** token —
  `crwv1.<workspace_id>.<crew_id>.<hex(HMAC-SHA256(master, ctx ||
  workspace_id || crew_id))>`, `internaltoken.DeriveCrewToken` — carrying
  the workspace binding (PR-F24) plus a crew binding. `requireInternal`
  rejects a `?crew_id` that disagrees with the token's crew (403) on every
  internal route and exposes the bound crew via
  `InternalTokenCrewFromContext`; the credential listing scopes to that
  cryptographic crew in preference to the forgeable query parameter. The
  loopback exemption for the crew-less in-process `TokenSyncer` is
  connection-based (`r.RemoteAddr`), never header-based. Crew-less runs
  fall back to the workspace-bound `wsv1` token unchanged. A follow-up
  audit pins the closure end-to-end — real derived token → `requireInternal`
  → handler, from a Docker-bridge origin — and adds a sentinel for the one
  surviving residual: a crew-less (workspace-bound) caller still gets its
  own workspace's credential metadata, because that is the token's true
  scope and because an empty listing would make the sidecar's credential
  reaper evict every provider key the container booted with.
- **Privileged crews now emit a provision-time WARN (#1032).** A crew
  provisioned with `--privileged` (e.g. DinD) collapses the UID 1001/1002
  boundary that isolates the sidecar's IPC token and injected credentials
  from the agent process. The full remediation is out of scope; the log
  line surfaces the trust downgrade in ops the moment such a crew is
  provisioned.

- **`POST /workspaces/{id}/skills/generate` spent the wrong tenant's Anthropic
  key.** The handler took its workspace from `r.PathValue("workspaceId")`, but
  `RequireWorkspace` resolves the tenant with `?workspace_id=` taking priority
  over the path — so the two could disagree. An OWNER of workspace A could send
  `POST /api/v1/workspaces/<B>/skills/generate?workspace_id=<A>`: the middleware
  validated A's membership and let the request through, then the handler
  evaluated A's role against workspace B and looked up, decrypted, and spent B's
  Anthropic API key. It now reads `WorkspaceIDFromContext`, the only value
  membership was ever checked against. A source guard
  (`TestNoHandlerReadsWorkspaceFromPath`, AST-based, allowlist with reasons)
  fails the build on any new handler that re-reads the path, so the class is
  closed rather than the one instance.

- **Six write paths persisted foreign-workspace references.** `project_id` and
  `milestone_id` on issue create/update, `project_id` on recurring-issue
  create/update, `crew_id` and `project_id` on triage-rule create/update, and
  `lead_id` on project create/update all went into their INSERT verbatim. This
  is the #1471 class on the columns that fix did not reach: the caller never
  requests the foreign row, they name it, and the read path resolves it — so an
  issue listing rendered another tenant's project name, and a triage rule could
  route this tenant's incoming issues into another tenant's crew on every match.
  `assertFKInWorkspace` now carries a per-table membership query (it previously
  supported only `agents` and `crews`, and projects/milestones were documented
  as "deliberately not listed", which is why those handlers validated nothing),
  and `fkInWorkspaceOrReject` makes a call site one line. Found by the new
  cross-workspace fence matrix rather than by review.

- **An agent could escape its crew's `autonomy_level` by creating a new crew
  (#1768).** Six `/api/v1/internal/*` routes let an agent create something that
  keeps acting after the request ends — a crew, a persistent agent, a mission,
  a cron schedule, a skill — and none of them consulted the calling crew's
  policy. Each handler justified skipping the check with a claim about its
  caller ("enforced upstream") rather than a check; nothing ran it. The sharpest
  consequence: `POST /internal/crews` never set `autonomy_level`, so the new
  crew took `DEFAULT 'guided'` (migration v101) — an agent held to `strict`
  could create a `guided` crew, create an agent inside it, and act there
  unbounded. **Two things close that, and neither is the blocking:** `strict`
  now refuses `crew_create` outright, and an allowed crew **inherits the
  creating crew's autonomy level** instead of the column default, so no created
  crew is ever more permissive than its creator. That property — not any
  particular cell of the decision matrix — is what closes the escape, and
  `TestAutonomyInvariant_ChildCrewNeverOutranksCreator` pins it across all four
  levels of the creating crew so a future re-tuning of the matrix cannot
  silently reopen it. Every arm (refused, held, allowed) writes an audit row
  carrying `decision`, `autonomy_level` and `policy_action`; there is no silent
  allow. When the policy resolver is unwired the gate holds rather than
  proceeding — a wiring bug fails closed.

### Changed

- **A `container` CLI call that finished microseconds before its deadline no
  longer reports a timeout (#2030).** The `internal/provider/apple` half of the
  process-group fix below is a user-visible behaviour change, not only an
  internal cleanup. `killProcessGroup` is `runCLIWithin`'s `cmd.Cancel`, and it
  used to return a bare `ESRCH` when the process group emptied between the
  lookup and the signal — the case where the command finished in the instant its
  deadline fired. `os/exec` wraps any error from `Cancel` other than
  `os.ErrProcessDone` as `exec: canceling Cmd: …` and, because the command
  itself exited 0, hands that to `Wait`; `runCLIWithin` then saw
  `ctx.Err() == DeadlineExceeded` and reported
  `container …: timed out after 20m0s`, throwing away output the command had
  already produced. That `ESRCH` is now mapped to `os.ErrProcessDone`, which
  `os/exec` treats as "the process already finished, don't inject a needless
  error", so the call returns its real stdout and a nil error. Callers or
  operators matching on the old timeout string for these races will stop seeing
  it — those calls were successes misreported as timeouts.
- **Agent-driven creation is now gated on the crew's `autonomy_level`, and on
  the default level (`guided`) some of it blocks (#1768).** This is a
  behaviour change on default settings, not only a bug fix — a crew that has
  never had its policy touched will see agents stopped where they previously
  were not.

  On `guided`, **`POST /internal/crews` and `POST /internal/agents` are
  blocking**. The row is still written, but inert: a new crew is pinned to
  `autonomy_level=strict` (so nothing can be created inside it) and a new agent
  is written `status=PENDING_REVIEW` (so the chat bridge will not start it).
  The call answers `202 Accepted` with `pending_review: true` and an
  `approval_id`. The operator gets a **blocking, ADMIN-addressed inbox
  waitpoint** and a row on the approvals queue.

  Release a held item with `crewship approvals approve <id>` (or deny it, or
  the `/approvals` page — `POST /api/v1/approvals/{id}/decide`, OWNER/ADMIN).
  Approving flips the sentinel: the agent becomes `IDLE`, the crew is restored
  to **the creating crew's** level — never higher. **Denying does not delete
  anything**, it just never releases, and so does letting the hold lapse: the
  seven-day timeout leaves the artefact inert rather than turning into a green
  light.

  On `guided`, **missions and cron schedules are not blocking**. They proceed
  and leave a non-blocking inbox notice: a mission creates no principal and is
  pinned to the caller's own crew, and a schedule stays an operator-editable
  row (`PATCH .../pipeline-schedules/{scheduleId}`), so in both cases a hold
  bought the same visibility a notice does while stopping ordinary work. At
  `strict` a mission is held (it can be planned, not started) and a schedule is
  refused outright.

  To tighten or loosen this per crew:

  ```bash
  crewship policy set --crew <slug> --level strict  --reason "…"  # refuse crew/agent/schedule creation
  crewship policy set --crew <slug> --level trusted --reason "…"  # unchanged for crew/agent; missions + schedules go journal-only
  crewship policy set --crew <slug> --level full    --reason "…"  # nothing blocks; crew/agent still leave a notice
  ```

  `strict` refuses `crew_create`, `agent_create` and `routine_schedule_create`
  with a structured `403` naming the level, so the CLI can suggest the
  `policy set` that would unblock it. `full` blocks nothing but still leaves a
  non-blocking notice for a new crew or agent — full autonomy is still
  autonomous, but a new permanent principal is the change an operator wants to
  see having happened.

- **Agent-created missions are now bounded by two live instance settings
  (#1768).** Letting `guided` — the default level — start a mission without a
  hold rested on missions being bounded by the #1757 delegation caps. They are
  not: the mission engine dispatches its task list through a path that never
  passes the delegation insert, and both files say so. `POST /mission/create`
  now answers `403` past either of:

  | Setting | Default | Bounds |
  |---|---|---|
  | `mission.max_tasks` | `16` | Tasks one agent-created mission may carry. `0` allows task-less missions only. |
  | `mission.max_active_per_crew` | `6` | Agent-created missions one crew may have in a non-terminal state. `0` switches agent-driven mission creation off. |

  The refusal body names the `setting` an operator would change, and no mission
  or task row is written. Both are read live from `app_settings`, so
  `crewship instance settings set mission.max_tasks 24` applies to the next
  call, not the next restart, and neither number can be raised from the request
  — there is no such field on the route.

  The second number is the one that matters, because **mission creation
  recurses**: a mission created with no tasks makes the engine run its lead as
  a planning turn, that turn is the one dispatch shape that keeps the sidecar,
  and the planning brief we send it offers "create a new sub-mission" as an
  option. A per-mission task cap alone would have bounded nothing. The crew's
  live-mission budget does, because every mission an agent creates lands in the
  crew its token is bound to.

  Scope, stated rather than implied: this covers the **agent** door only.
  Missions created through the dashboard/JWT API are neither capped nor counted
  against the agents' budget — an operator planning work is making a decision —
  and issues (which share the `missions` table) never count.

### Fixed

- **Leaving a workspace kept every crew membership (#1976).** `RemoveMember`
  deleted the `workspace_members` row and nothing else, so each `crew_members`
  row the departing user held in that workspace outlived their departure —
  and those rows grant on their own. Crew membership alone opens crew-owned
  pages (`pages_authz.go`) and crew credentials (`credentials_loaders.go`),
  and `CrewRoleFromDB` folds `crew_members.role` into
  `effectiveRole(workspace, crew)`. So a user removed while holding a per-crew
  ADMIN override and later re-added as a plain MEMBER came back **as crew
  ADMIN**: `AddMember` inserts a workspace_members row and never looks at
  `crew_members`, so nothing on the way back in could notice the elevation
  nobody granted.

  The removal now deletes both, in one transaction — both or neither, because
  workspace-removed-but-crew-attached is exactly the state being fixed. The
  purge is scoped through `crews` (`crew_members` has no `workspace_id` of its
  own), so the same person's crews in other workspaces are untouched, and it
  runs *after* the page-owner transfer, whose "else the crew the departing
  user belonged to" fallback reads the very rows being purged.

  **Behaviour change:** re-adding someone to a workspace no longer restores
  their crews. A returning member must be added back to each crew by hand —
  including any per-crew role override they used to hold.

- **Cancelling a devcontainer build on macOS could leak the process tree
  forever (#2030).** `AppleContainerBuilder.Build` left `cmd.Cancel` at
  `os/exec`'s default, `Process.Kill()` — the direct `container` process and
  nothing under it — while its own watchdog killed the whole process group.
  Both woke on the same cancellation, and when exec's kill landed first the
  child could already be an exited, unreaped zombie by the time the group kill
  asked which group it was in. Darwin cannot answer that: XNU's `getpgid(2)`
  goes through `proc_find`, which excludes exited processes, so it returns
  `ESRCH` where Linux still reports the group. The kill then fell back to
  re-killing the corpse, the CLI's helpers kept the write end of stdout, the
  log scanner blocked on a pipe nobody would ever close, and `cmd.Wait()` was
  never reached. A cancelled provision leaked the goroutine, the pipe and the
  process tree indefinitely.

  The group id is now derived from what the command was started with — `Setpgid`
  makes the child its own group leader, so pgid == pid for the pid's whole life,
  including as a zombie — instead of being looked up at kill time, and `Cancel`
  is that same group kill, so exec no longer sends a second, racing signal. The
  watchdog also keeps signalling after a cancellation instead of stopping after
  one attempt; that closes a narrow gap, a group member that forks between the
  kernel walking the group and the signal landing, rather than being a general
  rescue — SIGKILL is uncatchable and the pgid no longer moves, so the first
  kill already reaches everything in the group. A holder that has left the group
  entirely (via `setsid`) is still unreachable and still wedges the build, as it
  does today; note also that once a build is cancelled the idle-timeout branch
  no longer runs. `internal/provider/apple`'s copy of the helper had the same
  lookup-at-kill-time shape on its timeout path and got the same fix. The
  regression tests reap the direct child before killing, which makes Linux's
  `getpgid` answer `ESRCH` too — so a macOS-only hang is now provable on the
  Linux runners that gate every PR.
- **"Waiting on you" counted things nobody was waiting on (#1876).**
  `scopeOf` — the classifier the Activity rail, feed and status segments all
  read — put every human-source journal row in the `waiting` bucket. But the
  journal is an EVENT LOG: an `approval.requested` row stays in it after the
  approval was granted, and `peer.escalation` is emitted for both the ask
  (`escalation_handler.go:255`) and its resolution (`:607`,
  `escalation_autoresolve.go:172`), separated only by `payload.state`. So on
  any instance that resolves what it asks — which is every working instance —
  the segment could read `Waiting 4` beside an Overview card reading `0`. Two
  answers to one question on one screen, and the wrong one was the reassuring
  direction to be wrong in.

  `scopeOf` now takes the same view the card takes: a human-source row is
  `waiting` only while its ask is still OPEN. A resolved escalation says so on
  its own face; an approval or keeper request is closed by a *different* entry
  type, so the join runs over the window (`answeredAsks` → `scopeCounts`,
  `entriesInScope`, `scopeByEntry`). The card's `openAsks` is now that same
  bucket rather than a second opinion about it, and a test pins
  `openAsks(feed).length === scopeCounts(feed).waiting`. An ask whose answer is
  outside the window, or that carries no id to join on, stays in `waiting` —
  over-reporting one row beats hiding something a person is blocking on.
- **The crew bottom panel's Docker tab could never show a container (#1697).**
  It fetched `GET /api/v1/system/runtime` — the HOST runtime inventory — and
  read `data.containers` off it, a field that endpoint has never sent. The
  guard was `Array.isArray(data?.containers) ? data.containers : []`, so the
  absent field became an empty list and the tab rendered "No containers
  running." on every crew, forever, with every container up: the line that
  would have surfaced the mismatch was the same line that swallowed it.

  Nothing served the data, so there is now something that does.
  **`GET /api/v1/crews/{crewId}/containers`** returns the crew's live
  containers — its agent runtime *and* its sidecars — with state, CPU, memory
  and the runtime row's agent count, read straight from the container runtime;
  `crewship crew containers <crew>` is its CLI counterpart. `/system/runtime`
  keeps answering the host question it was built for.

  The client no longer has a fallback to swallow anything: a response without a
  `containers` array is reported as a broken contract, not as an empty crew, so
  the next rename fails loudly instead of quietly. Absent numbers stay absent
  end to end — a stopped container and a runtime without stats support both
  report `null`, rendered "—", never a `0%` that would draw an idle container
  where nothing was measured.

- **The status chips on `/issues` could only ever select one status.** The
  chip row was handed the list `useFilteredIssues` had *already* narrowed by
  status, so picking "Backlog" dropped every other chip's count to 0 — and a
  chip whose count is 0 is not rendered at all, which put the second status
  permanently out of reach. The "All" pill had the mirror-image bug: it
  advertised the filtered count as the total. The hook now returns
  `{ visible, statusFacet }` — `visible` is what the board and list render,
  `statusFacet` is the same set with the status filter left out, and it is
  what the chips count. The code comment above the call site had described
  the correct behaviour ("counts derive from the pre-status-filter set")
  since it was written; only the code disagreed.

- **Bulk editing from the issues list view did nothing.** `IssuesListInline`
  — the wrapper `/issues` actually renders in list mode — never forwarded
  `workspaceId`, so `IssuesListView.handleBulkUpdate` returned at
  `if (!workspaceId) return`: select rows, pick a status, no request, no
  error, no feedback. That also made the refusal reporting added in #1563
  unreachable from the real UI. The wrapper now requires `workspaceId` (and
  forwards `onBulkAction`), and the regression is pinned at the wrapper
  level rather than only on the inner view, which the old tests had been
  handing the prop themselves.

- **Renaming a label was a 500 for everyone.** `PATCH /api/v1/labels/{labelId}`
  built its statement with `newUpdate()`, which always emits `updated_at = ?`
  first; the `labels` table has only `created_at`, so SQLite answered "no such
  column: updated_at" on every call since the endpoint shipped. The statement is
  now built from the columns the table actually has. Worth noting how it
  surfaced: a route that 500s cannot be tested for tenancy — the UPDATE never
  executed, so nothing could be said about its `WHERE` clause — and fixing the
  500 is what made the fence assertion on that route real.

- **A local-model endpoint now works whatever shape it was stored in.** One
  `ENDPOINT_URL` credential was consumed by three code paths that each expected a
  *different* shape of the same string: a bare root for `llm.Ollama` (which
  appended `/api/chat`), `.../v1` for the OpenCode provider block, and the full
  `.../v1/chat/completions` for `llm.OpenAI` (which used the value verbatim as the
  POST target). Our own documentation tells operators to store the `.../v1` form —
  point the Keeper governance model at that credential and the judge POSTed to
  `.../v1/api/chat`, got a 404, and, Keeper being fail-closed, **denied every
  credential request**. The credential's own Test button stayed green throughout,
  because the reachability probe strips `/v1` before falling back to `/api/tags`.
  A new `internal/llm/endpoint` package normalizes any pasted shape — bare
  `host:port`, trailing slash, `/v1`, `/v1/chat/completions`, `/api/chat` — to a
  mount root, and each provider appends the path for the wire it speaks, so the
  mismatch is now unreachable by construction. A reverse-proxy mount prefix
  (`https://gw/ollama`) and an Azure-style unversioned deployment are both
  preserved, as is an `?api-version=` query.

- **A reasoning model no longer silently denies everything as the Keeper judge.**
  Ollama returns a reasoning model's chain of thought in `message.thinking`,
  separately from `message.content`. A model that spends its token budget
  thinking (verified against Ollama 0.32.5 with `qwen3:4b`) answers with empty
  content, `done_reason: "length"`, and HTTP 200 — which the provider reported as
  a successful, empty, `end_turn` completion, so the fail-closed judge parsed
  nothing and denied, with no error to explain it. `Response` now carries
  `Thinking`, and a budget-truncated answer reports `max_tokens` instead of
  `end_turn`, so callers can tell "the model said nothing" from "the model
  reasoned and never reached an answer".

- **A transient database hiccup during hook dispatch was reported to users as
  "a hook blocked this run".** `hooks.Dispatch` looks up the hooks registered
  for an event before evaluating any of them; when that lookup itself failed
  (a closed connection, a busy SQLite file), the error came back wrapped in
  the same plain `error` that a genuine blocking hook's `*BlockedError`
  travels in, and every call site — `pre_agent_start` in the orchestrator
  chief among them — treated any non-nil `Dispatch` error as a block. An
  infrastructure blip cancelled the agent run and printed "pre_agent_start
  hook blocked", which was false: no hook ever ran. Registry and handler
  failures now return a typed `*hooks.DispatchError`; an explicit policy
  refusal remains `*hooks.BlockedError`. The `pre_agent_start` gate fails
  closed for either condition but reports "dispatch failed" for infrastructure
  instead of inventing a policy block. Lookup failures are also logged
  unconditionally and, when a journal emitter is wired, recorded as a new
  `hook.dispatch_error` entry so the outage stays observable.

- **A provisioning run held by admission control looked identical to a hung
  one (#2167).** The `provision.event` wire frame already carries a
  machine-readable `reason` (`host_memory`, `host_pressure`, `concurrency`,
  `pacing`) whenever a container start is held for host capacity, but the
  provisioning popover, the crew canvas banner and the chat provisioning
  card all built their step label as `p.feature ?? STEP_LABELS[step] ?? step`
  and never read it — so every held run read "Waiting for host capacity" with
  no way to tell why, or whether it would ever move. The reason now renders
  next to that label (e.g. "Waiting for host capacity — not enough free host
  memory"), mapped from the real `admission.Reason*` tokens and falling back
  to the raw token for one this build doesn't recognize yet.

- **`approvals_queue` was kept forever, had no GDPR erasure path, and its
  read endpoints answered any workspace member (#2233).** Every terminal
  approval decision (approve/deny, cancel, both timeout paths) only ever
  updated `status`/`decided_*` in place — nothing deleted a row, so the
  table grew without bound and every row rode into every backup bundle.
  Decided rows now age out on a per-workspace retention schedule
  (`workspaces.approvals_retention_days`, defaulting to 90 days, swept
  daily by `harbormaster.StartApprovalsRetentionSweeper`; set it with
  `crewship workspace update --approvals-retention-days`, where `0` means
  keep forever — the same as its `--credential-audit-retention-days` and
  `--audit-log-retention-days` neighbours on that command), a pending row is
  never touched regardless of age, a `kind=autonomy_gate` row is never swept
  regardless of age or status either — for a mission target that row is the
  hold itself (`autonomyGateApproved` treats "no row" as "proceed"), not
  history, so sweeping a denied or timed-out one would eventually let a
  mission that was never approved start running unattended — and the
  Article 17 cascade
  (`DELETE /api/v1/admin/users/{userId}/data`) now erases a subject's rows
  by `requested_by`/`decided_by` since the table has no `data_subject_id`
  column. Separately, and this is a behaviour change an integrator will
  notice: `GET /api/v1/approvals` and `GET /api/v1/approvals/{id}` used to
  require only workspace membership and returned the full request payload
  to any member; they now require `OWNER`/`ADMIN`, matching the decide/
  cancel routes next to them. The shipped Inbox (`/inbox-v2` and
  `/approvals`) fetched this endpoint for every member regardless of role,
  so both surfaces now gate the fetch on role client-side instead of
  showing a 403 error banner to a MEMBER/MANAGER viewer; when that gate
  flips off mid-session (role resolved away from admin tier), rows already
  fetched while the viewer was authorized are now cleared rather than left
  rendered. A companion migration
  (`20260901140000_approvals_retention_pin_existing_workspaces`) pins every
  workspace that predates this change to an explicit `0` (keep forever):
  without it the sweeper's immediate first sweep at boot would have
  resolved every existing workspace's unset override to the 90-day default
  and deleted decided approval history on the first restart after
  upgrading. `--approvals-retention-days` now also rejects a value above
  106751 days (~292 years) — past that point the day count overflows the
  `int64`-nanosecond duration the sweep computes its cutoff from and wraps
  negative, which would otherwise delete every terminal row regardless of
  age.
- **An escalation's raw text reached the permanent journal entry and the
  workspace-wide broadcast, even though the inbox copy was scrubbed
  (#2238).** `CreateEscalation` wrote the same agent-supplied
  `reason`/`context`/`metadata` into three places — the inbox row, the
  `peer.escalation` journal entry, and the `escalation_created` /
  `escalation.created` WebSocket broadcasts — but secret-redaction and a
  length bound were applied only to the inbox copy. An inbox row is exactly
  what a GDPR erasure request deletes, while the journal entry is explicitly
  excluded from that erasure and is never rewritten again, so the copy that
  survived forever was the unredacted, unbounded one: a credential-shaped
  value an agent pasted into an escalation sat there permanently, and
  nothing capped how large `context` could be. The journal payload and its
  summary line are now redacted and capped at 4096 characters, the same
  treatment the inbox copy already got — and so is the `reason` sent in
  `CreateEscalation`'s own workspace-wide broadcast, since that goes out
  live to every connected member the moment the escalation is raised, not
  just the person who ends up seeing the inbox row.

  The same gap existed at three other points on the escalation path, closed
  the same way: the expiry sweeper (`escalation_lifecycle.go`) re-reads
  `reason` out of the `escalations` table and writes a SECOND permanent
  `peer.escalation` entry when nobody answers in time — that summary line
  now gets the identical redact-then-bound treatment, not just the create
  path's. The auto-confidence escalation path
  (`confidence_handler.go`) broadcasts its own `escalation.created`
  workspace-wide with the agent-supplied `reason` — that call site now
  redacts too. And `ResolveEscalation`'s journal entry redacted
  `resolution` only when the escalation's type was `CREDENTIAL` and never
  bounded it for any type, so an operator's free-text resolution on a
  non-`CREDENTIAL` escalation could carry a secret an operator pasted in
  ("used token ... to unblock it") into the same permanent entry, verbatim
  and unbounded — `resolution` is now redacted and capped the same way for
  every non-`CREDENTIAL` type.

  Left out, deliberately: `CancelEscalation`'s journal entry and broadcasts
  also carry a raw `reason`, but that text is operator-supplied (the human
  cancelling, not the agent that raised the question), which is outside
  this issue's scope of scrubbing agent-supplied text — tracked as a
  follow-up rather than silently left unredacted.

- **`on_budget_exceeded` now fires once per breach, not once per LLM call
  while over budget (#2153).** `hooks/types.go` documents the policy/limit
  events — `on_approval_requested`, `on_guardrail_triggered`,
  `on_budget_exceeded` — as firing once per triggering condition, but
  `paymaster.Enforce` dispatched it from inside the per-status loop with
  nothing recording that a breach had already been announced: it fired on
  every call made while a budget stayed over, and twice on a single call
  that breached two budgets. A journal row absorbs repeats fine; a hook
  routed to pagerduty or Slack does not. `paymaster.announceBudgetBreach`
  now debounces per `(workspace_id, crew_id-if-the-budget-is-crew-scoped,
  budget_id, period, limit_usd)` — the first call to push a budget over in
  a given period dispatches, later calls in the same period do not, and it
  fires again once the period rolls (the same boundary `sumSpend` uses) or
  the limit is raised and breached again (folding the limit into the key
  gets re-fire-on-raise for free, without a separate invalidation path).
  Two budgets breached by the same call still dispatch once each — that is
  two distinct triggering conditions, not a repeat of one. The debounce
  state is in-memory only (mirrors `enforceLocks`' existing trade-off in
  the same file); a `crewshipd` restart can re-announce an already-seen
  breach once. Not built: tiered re-firing on a much larger breach (e.g.
  10% over vs. 400% over) — noted in the PR as a possible follow-up. The
  `budget.exceeded` journal entry itself is unchanged and still emits every
  call. The debounce state holds one entry per budget (overwritten in
  place as its period/limit change via a `CompareAndSwap` retry), not one
  per `(budget, period, limit)` ever seen — an earlier draft keyed the
  latter, which meant a regularly-breaching hourly budget grew the map
  forever over a long `crewshipd` uptime; found in review before merge.

- **`hooks.Dispatch` no longer queries `hooks_config` when nothing is
  registered (#2154).** `Dispatch` called `ListByEvent` unconditionally
  before its early return, so a workspace with zero hooks paid the same
  lookup as one with ten — on every LLM call (`pre_llm_call` +
  `post_llm_call`), every observed tool call, every delegation hop, every
  peer query, and every breached budget. A negative cache inside `Dispatch`,
  keyed `(workspace_id, crew_id, event)`, now remembers "nothing enabled
  here" and returns immediately without touching the database; only the
  negative case is cached, so a workspace that does have hooks still pays
  the query on every call, because the `Matcher` pass that follows is
  per-call and a cached row set can't safely stand in for it. `Register`,
  `Update`, `Delete` and `SetEnabled` in `internal/hooks/store.go` — the
  only writers to `hooks_config` — invalidate every cached entry for that
  workspace on a successful write, coarse (workspace-wide, not just the
  touched `(crew_id, event)` pair) but always correct, via an exported
  `hooks.InvalidateCache(workspaceID)` for any writer introduced outside
  the package. Invalidation is single-process: a second `crewshipd` writer
  would serve a stale negative until its own next write, called out as a
  follow-up rather than built now. A write-epoch counter closes a narrow
  TOCTOU found in review: a hook registered for the exact triple `Dispatch`
  is checking, landing between its `ListByEvent` read and its cache write,
  could otherwise be cached as a permanent false negative — `Dispatch` now
  re-checks the epoch before caching and skips caching (not an error, just
  a forgone optimization for that one call) if a write landed in between.

- **Repeated crew deletion or idle eviction could accumulate anonymous Docker volumes.** New noexec bind-volume records carry installation ownership and are reaped once unused, preserving host data, home/tools history and other installations; unlabelled historical volumes stay for operator investigation. Runtime recreation now reports container removal failures. (#2970)

- **Long routine runs no longer drop out of the overview and the Activity menu.** Running and waiting runs load from their own list instead of the 200 newest runs. When those 200 runs do not reach back seven days, the routine run summary reads "newest N runs · since …" instead of "7d"; partial and needs-a-person results count as finished, not as successes. The run detail shows the result and next step before provenance and evidence. (#3011)

- **Accepted deferred routine starts disappeared when execution capacity was busy or dispatch failed.** Capacity rejection now retries with bounded backoff until TTL, and errors/expiry remain inspectable through `routine pending get` and `pending list --status`. Retry preserves the accepted recipe and occurrence identity. ⚠️ **Behaviour change:** starts without TTL stop after ten capacity rejections; attempted debounce starts keep their payload while newer triggers open a separate window, and attempted one-time starts cannot be rewritten by another save. (#3010)

- **Content inspection allocates less on repeated matches (#4006).** Redaction emits spans once per rule and encoded-content scanning collects only the existing first 256 candidates, preserving finding order and results.

- **Routine script steps clean up completed control directories (#4003).** Cleanup checks invocation ownership and process-group state, and reports cleanup failures separately from the script result.
- Prepare closed manifest and receipt schema producers for artifact API tooling.

- Preserve project feedback during upgrades and backups, keep private-history bundles owner-only, and erase legacy and native version attribution within the selected workspace.

- Add default-off artifact project handlers with atomic versions, anchored feedback and immutable shared pins. Public routing follows separately.
- Read retained artifact snapshots and publish atomic manifests with explicit version conflicts and credential-scoped write availability.

- Add default-off artifact restore, shared-version selection and anchored feedback routes, plus a typed human CLI comment command.

- Bind artifact requests to explicit human chat intent and one signed run, preserving the original Page and version authority. Recheck live original authority and exact consent after the final chat or task write before committing admission.

- Add optional artifact project previews, versioned element comments, shared-version navigation and explicit chat creation intent behind backend availability.

- **Disclosure toggles and checkable menu rows meet the 44 px touch floor.** On touch screens a `<summary>` that opens a collapsed section and checkbox or radio items in menus are now at least 44 px tall, like buttons and plain menu items already were; mouse and trackpad layouts are unchanged.

- **GDPR export and erase failures show the server's reason.** The admin user-data toasts now show the API's error sentence (or "Export failed. Nothing was downloaded." / "Erase failed. No data was removed.") instead of a raw status code and response body.

- **`crewship routine schedules now` names an unknown schedule instead of a missing endpoint.** An id that is not a schedule in this workspace now prints the server's `API error (404): schedule not found` and exits 3 (not found); it used to print "force-fire endpoint unavailable on this server" and exit 1. The "endpoint unavailable" hint remains for a server that has no force-fire route. ⚠️ **Behaviour change:** scripts that matched the old message or exit code 1 for an unknown id need updating.


## [1.0.0-rc.1] — 2026-07-12

### Security

- **X-Internal-Token is now bound to a workspace (PR-F24) — closes the
  documented symmetric cross-tenant bypass.** Sidecars no longer
  receive the process-wide master internal token. At sidecar start the
  orchestrator derives a workspace-bound token
  (`wsv1.<workspace_id>.<HMAC-SHA256(master, workspace_id)>`,
  `internal/auth/internaltoken`) and injects it via the stdin
  `IPCConfig`. The `internalAuth` middleware validates the binding on
  every `/api/v1/internal/*` request: tampered tokens fail the
  constant-time MAC check, and the binding is enforced as a **mandatory
  request scope** rather than an optional `?workspace_id` check. For a
  bound token `requireInternal` rejects a `?workspace_id` that disagrees
  with the binding (403) and **injects** the bound workspace when the
  caller omits the query — so every handler that filters by
  `?workspace_id` (webhook secret, list credentials, agent/chat resolve,
  crew/agent create) is tenant-scoped automatically, with no
  legacy-unscoped fall-through. Path-param mutations that don't read the
  query (chat message-count / title, run finalize, credential status)
  constrain their `WHERE` clause by the bound workspace (foreign rows →
  404, never mutated). Handlers scoped by a body-carried `workspace_id`
  (`cost/record`, `journal/emit`, `pipelines/save`, plus the issue /
  mission / assignment / query / escalation create handlers and the
  confidence report) enforce the same binding in-handler via
  `assertInternalTokenWorkspace`. The unbound master token — which
  authorizes every workspace and so retains cross-tenant power if leaked
  from a container — is now **pinned to a loopback origin**: a master
  token presented from a Docker-bridge / LAN IP is refused (403), capping
  the blast radius of a leaked master to the host trust boundary
  (`CREWSHIP_INTERNAL_ALLOW_ANY=true` relaxes the pin for reverse-proxy
  setups). Pre-fix, an agent that captured the token inside its container
  could aim internal routes at ANY workspace by picking the
  `?workspace_id` it wanted (or simply omitting it on the routes that
  ran unscoped) — the "symmetric case" left open by the earlier Keeper
  Phase 2 asymmetric fix below. Derivation is stateless (no persistence;
  derived tokens roll with the master each boot) and the master token
  remains valid for host-side trusted callers (chat bridge, webhook
  secret resolver, LLM proxy) that reach the API over loopback and never
  enter a container. See the updated "Tenant isolation" section in
  `docs/security/threat-model.mdx` and the retired "known exception"
  block in `docs/api-reference/internal.mdx`.

- **Cross-tenant scoping on Keeper Phase 2 internal endpoints.** The four
  `/api/v1/internal/keeper/*` handlers (skill-review, behavior,
  memory-health, negative-learning) now (a) include `workspace_id` in
  the `self_learning_enabled` lookup WHERE clause and (b) reject any
  request where the body `workspace_id` disagrees with the request
  context `workspace_id` set by `internalWsCtx`. Pre-fix an internal-
  auth caller could pass an `agent_id` from workspace A while claiming
  workspace B in the body and read the gate flag — asymmetric cross-
  tenant bypass. The symmetric case (caller picks one workspace
  consistently across query + body) is closed by the workspace-bound
  `X-Internal-Token` entry above (PR-F24); the former "known
  exception" block in `docs/api-reference/internal.mdx` is retired
  accordingly.

- **Lessons memory tier hardened against agent-author writes.** The
  generic `memory.write(tier="lessons", …)` dispatcher path returned
  cap=0 and bypassed every governance layer the F4.4 evaluator path
  enforces (schema validation, idempotency by ID, atomic-rename,
  flock). Agent-author writes to the lessons tier are now rejected
  with an error that points at the F4.4 negative-learning endpoint as
  the supported entry point. Tombstone test
  `TestDispatch_Write_LessonsTier_Rejected` pins the contract.

- **Security hardening v1 wave.** Two-tier CLI tokens (standard +
  HMAC-keyed admin) with fine-grained PAT-style scopes, per-crew role
  overrides and per-agent ownership gates, structured 403s with a denial
  audit log, one-shot setup token on `/api/v1/bootstrap`, internal API
  refuses non-private client addresses, sidecar credential proxy strips
  plaintext token fields, `NET_RAW` dropped from default crew container
  capabilities, `/crew/init.sh` auto-exec now opt-in per crew, and
  bootstrap/pair tokens widened to 256-bit (#462).

- **May–June external-audit remediation waves.** Prod `docker.sock` is
  brokered through a filtering proxy (#478); memory writes are scanned
  *before* persist, including invisible-format (Cf) codepoint evasion
  (#502, #477); a TOCTOU symlink window in `writeCredentialFiles` closed
  (#464); path traversal, IDOR, cross-crew access, MCP SSRF,
  prompt-injection and info-leak findings fixed across four passes
  (#476–#508, #612, #619, #620, #651, #733, #752).

- **RBAC chokepoint: route-table declared authz.** Previously
  un-gated control-plane mutation endpoints now enforce role checks
  (#792); every route's permission gate is declared in the route table
  and pinned by an invariant test so new endpoints can't ship ungated
  (#824, closes #809/#811); admin console + system endpoints get a
  uniform ADMIN+ floor (#893); scoped CLI-token permissions are enforced
  at the same route-table chokepoint (#888).

- **Ingress trust fence.** Untrusted external content (webhook bodies,
  poll payloads) is neutralized before it can enter an agent prompt
  (#819, #808 M0), extended to the remaining mission/task and
  crew-context ingress sites (#918); `tool_result` events from **all**
  adapters now pass through one shared injection-scan chokepoint (#950).

- **Per-agent sidecar identity.** Each agent in a crew receives its own
  derived auth token, closing intra-crew identity spoofing against the
  sidecar control plane (#826, closes #812), and escalations are
  attributed to the bound agent rather than a caller-supplied `from`
  field (#796). Per-agent memory identity fixes landed in the dev2
  validation sweep (#779, CRE-137…146).

- **Credential revocation is now effective at runtime.** The sidecar's
  in-memory credstore reaps revoked credentials within ~60s (#795), and
  revoking a credential also removes its file-based `/secrets` materials
  from running containers (#903, closes #814).

- **Webhook trigger hardening.** Every pipeline webhook dispatch
  requires an HMAC signature (#501) with replay auto-dedupe (#506) and a
  rate-limit floor (#507); empty-secret HMAC configs are rejected and
  optional signed-timestamp replay defense added (#789), with per-agent
  `require_timestamp` to close the body-only replay window (#822,
  closes #815).

- **New crews default to restricted egress**, and egress-policy denials
  are loud instead of silent (#793); `http` pipeline steps enforce the
  crew egress policy and resolve credentials from the vault rather than
  inline secrets (#778).

- **Memory file-path hardening.** Centralized pathsafe fencing on memory
  paths plus capped search allocations close 13 CodeQL HIGH findings
  (#926); memory-read and writer-lock opens use `O_NOFOLLOW`, closing a
  symlink TOCTOU (#936, closes #934/#935).

- **Log-injection neutralized centrally.** One CR/LF + control-character
  neutralizer covers server and sidecar log sinks (#938); secret
  redaction is wired through slog (#488) and raw token values in logs
  replaced by fingerprints (#486).

- **deb/rpm packages are GPG-signed** and the public key published for
  apt/dnf verification (#942, closes #932).

- **Go toolchain bumped 1.26.0 → 1.26.5** across the release cycle for
  stdlib CVEs, including the crypto/tls GO-2026-5856 advisory
  (#570, #907).

### Added

- **Pipeline resume-from-step at boot.** The executor now persists
  `current_step_id` + the step-outputs map at every step boundary, and
  boot recovery re-enters previously in-flight runs from the next
  unfinished step instead of stamping them `interrupted`: completed
  steps are restored (not re-executed), the in-flight step re-runs
  with at-least-once semantics, DAG runs recover at wave granularity,
  and runs parked on a `wait` approval step re-attach to their
  original pending waitpoint token so the approval card stays
  answerable across restarts. `interrupted` remains the fallback when
  persisted state is insufficient (missing pipeline, definition drift,
  non-resumable mode), with the reason recorded in `error_message`.
  Operator escape hatch: `CREWSHIP_PIPELINE_RESUME=off` restores the
  old stamp-everything-interrupted behaviour. See
  `docs/guides/routines.mdx` § Durability and restart recovery.

  Hardening pass on the resume scan: (1) the boot scan now runs
  BEFORE the cron scheduler starts and is additionally fenced on
  process-boot time + the live run registry, so a scheduled run fired
  at boot can never be "resumed" into a second concurrent execution
  under the same run id — `RunRegistry.Acquire` also rejects
  duplicate run ids outright instead of silently overwriting the live
  entry; (2) a resumed run that loses the concurrency-slot race
  retries with capped exponential backoff instead of being
  permanently stamped interrupted; (3) migration v114 stamps the
  pipeline's definition content hash onto each run row at start, and
  resume refuses (→ `interrupted: definition changed`) when the
  definition was edited in place even if every step id survived;
  (4) a waitpoint that timed out during downtime now fails the
  resumed run with `timed out` instead of misreporting `denied`.

- **Domain metrics on `/metrics` (W10).** The Prometheus endpoint now
  exposes operator-facing series next to the existing process gauges:
  `crewshipd_assignments{status}`, `crewshipd_assignment_queue_depth`
  / `_queue_crews` / `_queue_depth_max` (aggregated — no per-crew
  labels by design), `crewshipd_pipeline_runs{status}`,
  `crewshipd_agent_run_events_total{event}`,
  `crewshipd_llm_calls_total{provider}` +
  `crewshipd_llm_cost_usd_total{provider}` from the paymaster ledger,
  `crewshipd_containers_tracked` / `_reporting`, and
  `crewshipd_db_migration_version`. Label sets are closed (unknown
  values fold into `other`), the DB-derived block is cached for 15s,
  and migration v113 adds the two status indexes the counts ride on.
  Documented in `docs/observability/metrics.md`.

- **PR-G / PR-F UI surface.** Three React panels expose previously
  backend-only governance toggles: `CrewPolicyControls`
  (`autonomy_level` × `behavior_mode` × `max_ephemeral_agents`),
  `AgentLearningToggle` (per-agent `self_learning_enabled` flag from
  migration v106), `AuxStatusSection` (read-only diagnostic of the
  five auxiliary model slots). Plus four keeper P2 review queue
  sub-tabs in the admin panel, a GDPR admin export/delete panel,
  inbox approve-hire button, and codemirror markdown editor for the
  agent memory tab.

- **Migration v106 — per-agent `self_learning_enabled` flag** with the
  standard audit triple. Consumed by the F4.4 negative-learning and
  F6 persona-suggest ALLOW paths: when the flag is OFF, the proposal
  queues a blocking inbox row with the full proposal payload instead
  of auto-applying.

- **Migration v107 — GDPR cascade primitives.** `data_subject_id`
  columns on `memory_versions` and `inbox_items`, plus the
  `gdpr_actions` audit table. New `DELETE /api/v1/admin/users/{id}/data`
  cascade endpoint + `GET` Art. 15 export bundle. Idempotent — each
  invocation lands a new `gdpr_actions` row.

- **`MemoryProvider` interface and `LocalDispatcher` reference impl**
  for future pluggable memory backends. Additive — existing production
  call sites still route through the built-in dispatcher; swap lands
  as PR-F17.

- **`AgentBrief` sub-agent briefing primitive.** Replaces the
  all-or-nothing `SkipConvHistory` boolean with a curated `Mission` +
  `SharedMemory` + `Constraints` slice written to the child's
  `BRIEF.md`; picked up by the orchestrator's prompt assembly.

- **Declarative deployment manifests (SPEC-2).** `crewship apply` covers
  14 manifest kinds end-to-end with validation (duplicate-slug detection
  at validate time), plus auto-managed sidecar credentials (SPEC-4)
  (#454, #456, #587).

- **Routines platform wave.** Governance review gate
  (proposed → approve, with OWNER/ADMIN `skip_governance_gate`),
  describe-first authoring from chat, `save_routine`/`list_routines` as
  native MCP tools, precondition gates and declared required
  integrations, CEL expressions, deferred dispatch, hooks and input
  streams (#743, #715, #739, #755). Follow-on: first-class token-zero
  `script` steps (#849) with portable export/import bundles (#913),
  per-step retry policy with backoff + CEL classifier (#882),
  auto-parallelized independent steps with bounded DAG waves (#872),
  single-step fixture runs (#854), `routine init` scaffold/clone (#860),
  run-result retrieval (#844), run→files listing (#891), client-facing
  shareable/redacted progress views (#877), offline `validate` parity
  with server-side checks (#901), and non-blocking `notify` steps with
  outbound email + signed-webhook channels and anti-spam caps
  (#843, #859, #910).

- **Managed integrations via Composio.** Catalog, OAuth connect flow,
  per-agent binding, tool exposure and triggers (#696), a flag-gated
  default connector for all agents (#699), portal-safe Add-app UX
  (#703), and agents are made aware of their connected integrations
  (#704).

- **Chat overhaul.** Faithful history with reload, grouped
  tool/reasoning UI, sub-agents and multi-user group chat (#702);
  resumable streams so a reply is never lost to a refresh (#757); smooth
  streaming reveal (#758); unread badges, activity ordering and
  agent-replied notifications (#760); mid-turn steering of an in-flight
  run, long-conversation compaction instead of truncation, cross-session
  conversation search (BM25), and LLM model discovery with live model
  switch (#630 wave).

- **Fleet operations UI.** The Journal Runs tab is reworked into a fleet
  ops overview (#750), a global Activity Bar + readable run-activity
  timeline (#701), context-aware bottom dock across Issues, Routines &
  Activity (#710), and a drillable agent-native run trace — tool-call
  sub-spans, waterfall, persisted per-step input/output with lazy fetch
  and syntax highlighting (#852, #853, #874), plus per-step
  container-ready timing (#930).

- **Inbox redesign.** Gmail-style triage with formatted detail,
  noise/secret hardening and CLI parity (#708), collapsible group tree
  with bulk select/resolve (#692), refined toolbar (#747), and
  agent-proposed credentials with one-click human approval (#706).

- **Ephemeral ("hired") agents surfaced in Crews & Agents** with full
  lifecycle controls (#693); hired agents automatically receive an
  Anthropic credential so they can actually run (#680).

- **Slash commands + per-user capabilities.** Server-driven slash
  palette with CLI/UI parity, gated by per-membership capability grants
  (#595).

- **Packaging: deb/rpm packages + systemd unit** for server installs
  (#927, #858 phase 4), and **Windows support via a CLI-only
  `crewship-cli` build** — zip archives, `O_NOFOLLOW` platform split,
  gated self-update (#949, closes #945).

- **`crewship self-update`** — one upgrade command per install channel
  (brew/deb/rpm/tarball) (#915), including systemd server-mode upgrade
  orchestration with health-checked restart (#929, #858 phase 5).

- **Downgrade/version safety.** A version-skew guard refuses to boot a
  binary over a newer DB schema (#912), and
  `crewship db restore-snapshot` provides the matching downgrade
  recovery path (#924); backups got a disaster-recovery rewrite —
  `--replace` mode, schema-driven FK discovery, user reconciliation
  (#594).

- **Local-model support.** Ollama-style local endpoints for the OpenCode
  adapter with BYOK egress (#951), and a first-class `ENDPOINT_URL`
  credential type so local model endpoints live in the vault like any
  other credential (#957, closes #955).

- **Devcontainer-based provisioning.** BuildKit feature-image
  provisioning (#675), proactive auto-provision so crews are runnable on
  first dispatch (#731), deduped feature catalog preferring canonical
  publishers (#732), and persisted BuildKit stderr tails so failed
  builds are debuggable (#884).

- **Agent-authored skills.** Agents can draft skills that route through
  inbox review into a GENERATED catalog (#734).

- **CLI: agent-ready contract.** Structured errors, stable exit codes,
  `--wait`, env-var auth and API parity for driving Crewship from
  agents (#782); native server profiles for multi-instance targeting
  (#737); unified `crewship nuke` subcommands with full workspace
  teardown (#748); confirmation prompts + `--yes` on six destructive
  commands (#579); `--max-turns` on run/ask + agent schedule flags
  (#753); `routine logs --show-outputs` for post-hoc step debugging
  (#828); `me preferences` + privacy commands (#754).

- **Cost controls.** Cache-stable prompt assembly, per-run turn caps
  with a loop guard, and cheap-model routing for aux/sub-agent calls
  (#751).

- **Operator observability.** Opt-in pprof + Pyroscope push profiling
  (#552), runtime log-level toggle and disk-health reporting (#784), and
  every run surfaces the model it actually resolved to.

- **Crew memory from mission outcomes (F4.5).** Mission results are
  distilled into crew memory with provenance (#546); an evolving
  per-operator user model personalizes agent behavior over time
  (#630 wave).

- **Settings & workspace management.** Real workspace switcher (list,
  select, persist, create) (#597), editable profile with password change
  and workspace member role management (#883), avatar upload (#900).

- **Release engineering.** The release smoke pipeline runs again on a
  real trigger plus a pre-merge package smoke (#941, closes #933), and
  nightlies publish per-run immutable pre-releases instead of a rolling
  tag (#895).

### Changed

- **Frontend RBAC mirrors backend.** `AgentLearningToggle` derives
  `canEdit` from `abilities.can("manage", "Agent")` (matching the
  backend PATCH permission gate); `CrewPolicyControls` mirrors via
  `abilities.can("update", "Crew")`. Update-only users see the
  toggle disabled instead of hitting 403 at save time.

- **`Promise.all` → `Promise.allSettled`** in `CrewPolicyControls.load`
  so a quota-fetch network error doesn't poison the required policy
  fetch.

- **One request-builder for every dispatch path.** Chat, missions,
  routines and peer delegation now build agent requests through a single
  shared factory, which also activated the previously dead HITL approval
  path and fixed mission/peer MCP + prompt divergence (#825, closes
  #810); pipeline executor wiring was likewise unified behind one
  factory (#773).

- **Telemetry defaults to opt-in on stable releases** with an explicit
  onboarding consent step (crash-reporting opt-out remains for
  pre-release channels) (#645).

- **First-run bootstrap UX.** The setup-token gate is replaced by an
  n8n-style first-run flow (#593), and the bootstrap window now stays
  open until the first admin exists, with the finite time window as an
  opt-in (#785).

- **UI chrome unified for 1.0** — consistent sub-bars, sidebars and
  toolbars across pages (#749); agent access consolidated under a single
  Skills & Tools surface (#698) with a curated built-in tool profile per
  adapter (dead harness tools removed) (#705).

- **Routine `test_run` is gone** — `dry_run` returns an honest execution
  plan plus the declared capability manifest instead of pretending to
  execute (#743 wave).

- **First-party MCP tools are eager-loaded**, removing the per-run
  ToolSearch discovery tax (#745).

- **Dispatch/runtime performance.** Deferred-run dispatch is async,
  removing the one-run-per-run-duration cliff (#857); warm crew hits
  skip the host-wide Docker `ContainerList` (#876); crew containers
  prewarm on claim, off the critical path (#902).

### Fixed

- **`crewship seed` now bootstraps against the selected `--profile`, not
  `CREWSHIP_SERVER`.** The seed flow's unauthenticated bootstrap POST (and
  the `--nuke` confirmation, smoke test, and backup warmup) resolved their
  target with `ResolveServer`, whose precedence is `--server` >
  `CREWSHIP_SERVER` > config. Every *authenticated* call in the same command
  uses `EffectiveServer`, under which an explicit `--profile` /
  `CREWSHIP_PROFILE` wins over `CREWSHIP_SERVER`. So in a shell that exports
  `CREWSHIP_SERVER` (the documented multi-clone convention), `crewship seed
  --profile prod` sent bootstrap to `CREWSHIP_SERVER` while everything else
  went to the profile server — silently splitting one seed across two
  instances and surfacing as a bogus `DB already initialized` when
  `CREWSHIP_SERVER` pointed at an already-bootstrapped instance. The seed
  flow now routes every call through one `seedTargetServer()` helper backed
  by `EffectiveServer`.

- **Episodic indexer now starts at server boot.** The journal-embedding
  sweeper (`episodic.NewIndexer`) was fully implemented and tested but
  never constructed in production, so `HybridRecall` always queried an
  empty vector index. The server now starts the sweeper at boot when an
  embedder is configured (`KEEPER_OLLAMA_URL`). Without one, episodic
  recall runs in **sparse-only mode** and says so: a WARN at boot, an
  `episodic: vector|sparse-only` field on `GET /healthz`, and a
  matching `crewship doctor` check with the enable hint.

- **Stuck-QUEUED assignment sweeper now runs in production.** The
  crash-recovery sweeper (`StartStuckQueueSweeper`) was implemented
  and tested but never started — QUEUED assignments stranded by a
  crash between "row set QUEUED" and the next completion-path pump
  stayed queued forever after a restart. Server boot now starts the
  sweeper alongside the other background loops (scan every 60s, rows
  count as stuck after 10min queued; goroutine exits cleanly on
  shutdown) and logs a `stuck-queue sweeper started` line at boot.

- **Inbox `fetch()` network-error handling.** Both `wrap("approved")`
  (approve-hire) and `wrap("retried")` (routine retry) in
  `inbox-list.tsx` now wrap `await fetch(…)` in `try`/`catch`. Pre-
  fix, an offline / DNS / CORS preflight failure cleared the busy
  state with no user toast (silent success).

- **Free-form `reason` text scrubbed from app logs.** The
  `agent_learning` PATCH handler logged the operator-entered reason
  verbatim; switched to `reason_len` so centralized logs no longer
  collect PII / business context that's already on the DB audit row.

- **Inbox enqueue failures surface as 500.** The `self_learning=OFF`
  gate path in both the F4.4 negative-learning handler and the F6
  persona-suggest handler was swallowing `inbox.Insert` errors,
  returning 200 with neither lesson nor inbox row.

- **CI build break from a leaked merge-conflict marker** in
  `internal/api/agent_config.go` (PR-D `agent.status` + PR-E
  `system_prompt_legacy` collision during parallel-agent push churn).

- **Credential escalation no longer fakes success.** When a credential
  proposal can't be staged, the agent gets an error instead of a
  silent false-success (#787).

- **Recurring issues actually fire.** The dispatcher was never wired
  into server boot (#791); follow-up adds creator attribution, durable
  fire idempotency and UTC consistency (#823), and issue creators are
  recorded and displayed everywhere (#774).

- **Schedulers are at-most-once.** Cron and deferred pipeline fires
  dedupe via idempotency keys (#788), the agent scheduler gets the same
  guarantee (#820), and scheduled fires honor `target_pipeline_version`
  (#777).

- **Container-start failures are classified** instead of collapsing into
  one masked generic error, so operators see the real cause (bad image,
  legacy volume, credential prep, …) (#790).

- **Crash recovery for assignments and chats.** RUNNING assignments
  orphaned by a crash are recovered at boot (#768), orchestration loops
  re-attach to IN_PROGRESS missions (#641), webhook-triggered runs
  dispatch asynchronously instead of blocking the receiver (#769), one
  active run per chat is enforced regardless of sender (#765), and a
  chat turn never ends in silence — zero-output and restart-interrupted
  replies are surfaced (#770).

- **Memory writes are durable and fail closed.** MCP memory-write
  failures no longer report success; memory tools are only advertised
  when the backing store is healthy; restart-agents matches the right
  container (#786).

- **dev2 validation sweep (CRE-137…146).** Memory identity, keeper
  workspace scoping, webhook HMAC, cost attribution and CLI
  parity/fidelity fixes from a full-instance validation pass (#779).

- **Keeper F4.1 skill-review sweep bills a real workspace** instead of
  attributing its LLM spend to a phantom one (#970, CRE-138).

- **Full archives ship a Linux ELF sidecar on every platform.**
  Darwin-built archives previously bundled a Mach-O sidecar that could
  never run inside Linux crew containers (#968, closes #953); archives
  now include `crewship-sidecar` + `entrypoint.sh` at all (#914), and
  sidecar remediation hints are install-channel-aware with the Homebrew
  libexec layout supported (#925).

- **HTTPS login worked around a CSRF cookie-name mismatch** — the CSRF
  cookie is re-sent under the server's real `__Host-` name (#875).

- **Crew shared files reach `/crew/shared`.** Bundled `files:` never
  arrived for agentless crews (#870); delivery is container-routed with
  overwrite semantics and works for standalone SPEC-2 Crews (#928);
  re-applying an unchanged file no-ops and succeeds on a stopped crew
  (#940).

- **OpenCode adapter production parity** — usage keys, model surfacing,
  JSONL schema and EOF resilience (#948).

- **Raw internal errors no longer leak to chat/comments**; hook warnings
  surface on the run instead (#771); journal poison entries are dropped
  rather than retried forever, and dev logs are capped (#783); chat WS
  sends are guarded against the server's 64 KiB frame cap (#764).

- **Scheduler resolves agent config via loopback** instead of the
  public Next.js URL, fixing scheduled routines behind proxies (#709);
  `crewship system keeper` injects the workspace so it stops 400ing
  after the admin-floor change (#909).

- **Pre-C1 legacy Docker resources are auto-migrated** on use and an
  ops command detects + prunes orphaned pre-C1 crew resources, fixing
  the "failed to start agent container" wall after old seeds
  (#736, #738).

## [0.1.0-beta.4] — 2026-05-19

**Routines 2026, declarative manifests, security hardening.** Substantial
beta covering observability (OTel spans, prompt-cache token plumbing),
ADLC phase-7 signal (typed feedback API + thumbs UI), continuous online
grading (sampler worker), per-routine guardrails, declarative workspace
manifests with sidecar services, and security CI cleanup. v0.1.0-beta.3
was skipped — this tag bundles everything from beta.2 → beta.4 on `main`.

### Operator upgrade notes

- **Backup `crewship.db` before upgrading.** Migration v97 recreates
  the `eval_runs` table via the standard SQLite RENAME → CREATE →
  `INSERT...SELECT` → DROP pattern to widen the `kind` CHECK constraint
  for the new `online` sampling kind. The migration runs in a
  transaction so a mid-migration crash atomically rolls back, but it
  has not been benchmarked on a production-sized eval suite — schedule
  the upgrade during a quiet window.
- **`CREWSHIP_ALLOWED_ORIGINS`** must be set in production env config
  for browser-driven POSTs (Next.js → daemon cross-port). `dev.sh` now
  emits it automatically alongside other managed keys; systemd-driven
  prod deploys must add it to their unit env file.
- **Online eval sampler runs on every server boot** with a 60-second
  tick. Routines without `eval.online.sample_rate > 0` are zero-cost
  deterministic skips. Operators introducing `sample_rate: 1.0` on
  high-throughput routines should size their grader budget; the sampler
  enqueues at the routine's rate but the grader cost is per-eval.
- **Shadow features available but require operator config:**
  - **Prompt caching:** ledger + telemetry plumb provider-reported
    `cached_input_tokens` once an `API_KEY`-typed Anthropic credential
    is provisioned (Claude Code CLI tokens don't go through this path).
  - **OTel routine spans:** `routine.run` / `routine.step` /
    `agent.invoke` / `llm.call` spans emit when `OTEL_EXPORTER_OTLP_ENDPOINT`
    is set; collector wire-up is operator's choice — any OTel-compatible
    backend consumes the GenAI semconv format natively.
  - **Per-routine input-guard action policy:** DSL
    `guardrails.input.prompt_injection.action: block | sanitize | log`
    only fires for routines that opt in.

### Added — Observability

- **OpenTelemetry GenAI spans** wired across the hot path:
  `routine.run`, `routine.step`, `agent.invoke`, `llm.call` with the
  prescribed `gen_ai.*` + `crewship.*` attributes. New
  `StartRoutineRunSpan` + `StartRoutineStepSpan` helpers
  (`internal/telemetry/spans_routine.go`). Trace tree mirrors DSL
  composition; `call_pipeline` nests as a child step. Panic recovery
  pattern preserves the original crash stack across nested defers
  via `telemetry.PanicWithStack` so post-mortem traces point at the
  real explode site, not at the re-panic line. (#447)
- **Prompt-cache token plumbing** through provider → ledger → OTel.
  Anthropic's `cache_read_input_tokens` + `cache_creation_input_tokens`
  and OpenAI's `prompt_tokens_details.cached_tokens` now surface on
  `llm.Response`, flow into `paymaster.CallResponse.CachedInputTokens`,
  land in `cost_ledger.cached_input_tokens` / `cache_creation_tokens`,
  and stamp `gen_ai.usage.cached_input_tokens` on every LLM span.
  Anthropic tools array gets a `cache_control: ephemeral` breakpoint
  by default — the single highest-leverage cache hit for agent
  workloads. (#447)

### Added — Feedback (ADLC phase-7)

- **Typed per-message feedback API** (`/api/v1/feedback`) with six
  signals (helpful, not_helpful, inaccurate, unsafe, edit, regenerate)
  bound to `trace_id` for eval-mining correlation. Migration v96
  introduces `message_feedback`. POST is UPSERT-idempotent; DELETE is
  idempotent (204 on missing row); GET is workspace + per-user scoped.
  Body capped at 16 KiB via `MaxBytesReader` before JSON parse;
  per-field caps at 4096 chars on `reason` and 256 chars on id fields. (#447)
- **Frontend optimistic-update store** (`stores/feedback-store.ts`)
  with per-(turn, signal) Promise-chained serialization so a fast
  thumb-toggle can't race between POST and DELETE. State is namespaced
  by `user.id`; switching accounts on the same browser clears the
  previous user's votes. (#447)
- **Trace_id WS propagation** — `internal/chatbridge/bridge.go` stamps
  the active OTel trace id onto the `done` event metadata;
  `hooks/use-chat.ts` lifts it onto `ChatTurn.metadata.trace_id`. The
  feedback POST flows it through so every signal lands indexed against
  the routine run that produced the message. (#450)

### Added — Online eval sampler

- **Continuous production grading** via `internal/quartermaster/online_sampler.go`.
  Worker scans completed `pipeline_runs` every 60s, picks rows at the
  routine's configured `eval.online.sample_rate`, and enqueues a
  `kind='online'` eval row. Schema-layer idempotency via partial
  `UNIQUE INDEX uq_eval_runs_online_pipeline_run`; (ended_at, id) tuple
  cursor handles sub-millisecond pipeline_run completions without
  orphaning siblings; doubling-skip backoff on entropy outages capped
  at 10 ticks. Wired into `cmd/crewship` server start. (#447, #449)

### Added — Guardrails

- **Per-routine input-guard action policy**
  (`guardrails.input.prompt_injection.action`) with `block` (default) /
  `sanitize` / `log` modes. Sanitize uses offset-based replacement via
  new `Finding.MatchEnd` field — earlier substring-based redaction
  silently let through long jailbreak matches and synthetic unicode
  findings like `"U+202E"`. (#447)
- **`on_guardrail_triggered` hook dispatch** via context-attached
  `GuardListener` callback. Lookout stays zero-dep on the hooks
  package; the pipeline runner bridges them. Listener receives the
  full findings slice. (#447)

### Added — Tooling

- **`crewship apply` / `crewship export`** for declarative workspace
  manifests with sidecar service declarations (Redis, Postgres, MySQL,
  MongoDB). Migration v95 adds `crews.services_json`. (#448)
- **Playwright E2E specs:** `e2e/feedback.spec.ts` (8 contract tests)
  and `e2e/feedback-ui.spec.ts` (browser-side fetch via real NextAuth
  cookie + CSRF defense pin via spoofed Origin → 403). (#450)

### Added — Installation

- **Auto-generate secrets on first run.** `crewship start` writes
  NEXTAUTH_SECRET + ENCRYPTION_KEY to
  `~/.local/share/crewship/secrets.env` when missing. End users no
  longer touch env files for the happy path. (#446)

### Fixed

- **Online sampler was dead code in PR #447** — `NewOnlineSampler`
  had test coverage but no production call site. Wired into bootstrap. (#449)
- **Sampler SQL queried non-existent `completed_at` column.** Real
  column is `ended_at`. The test fixture matched the bug so unit
  tests passed; real schema check on dev-VM smoke caught it. (#449)
- **Code-scanning alerts.** All open CodeQL + Grype findings closed. (#445)
- **Privacy leak in `GET /api/v1/feedback`** — earlier draft scoped
  only by workspace membership; now scoped by `user_id` AND workspace. (#447)
- **Sanitize bypass via mixed zero-width characters.** ScanInput
  emitted a Finding only for the FIRST zero-width rune; subsequent
  ZWNJ/ZWJ/BOM in the same payload survived sanitize. Now emits one
  Finding per occurrence. (#447)
- **OnlineSampler data race** on watermark cursor between concurrent
  Start callers — `go test -race` reproduced. Added `sync.Mutex`;
  `Start` now wrapped in `sync.Once`. (#447)
- **Sampler panic-naked.** A panic in `runOnce` would kill the
  daemon. Added deferred `recover()` in `tickWithBackoff` that logs
  + lets the loop continue. (#447)

## [0.1.0-beta.2] — 2026-05-18

**First public beta release.** APIs and data models may break across
minor bumps until v1.0. See `RELEASING.md` for upgrade and rollback
guidance.

> v0.1.0-beta.1 was burned by a series of release-pipeline iterations
> (cosign version pin, pnpm toolchain mismatch in the Dockerfile,
> Windows cross-compile, missing direct deps for Turbopack,
> port_exposures test flake). The "release immutability" toggle was
> enabled mid-iteration and permanently reserved that tag name even
> after deletion. The first public tag is therefore v0.1.0-beta.2.

### TL;DR for beta testers

- Install: `brew install crewship-ai/tap/crewship` (macOS) or
  `docker pull ghcr.io/crewship-ai/crewship:v0.1.0-beta.2` (Linux/Docker).
- One adapter is production-ready in beta: **Claude Code (Anthropic)**.
  Codex / Gemini / OpenCode / Cursor / Factory Droid have scaffolds
  but lack parity testing — see README "Beta status & limitations".
- Telemetry (Sentry crash reporting) is **enabled by default** during
  v0.1 beta to give the solo maintainer signal from real installs.
  Disable any time with `crewship telemetry off`. Reverts to opt-in
  for v1.0 GA. See `RELEASING.md` Telemetry section.
- Storage is SQLite-only in v0.1; PostgreSQL is on the v0.2 roadmap.

### Added — Release infrastructure

- **Auto-snapshot before migrations.** `database.SnapshotBeforeMigrate`
  takes a `VACUUM INTO` copy as `<db>.pre-migrate-vN-to-vM-<UTC>.bak`
  whenever a migration is pending. Keeps 10 newest snapshots; opt out
  with `CREWSHIP_SKIP_MIGRATION_BACKUP=1`.
- **Migration lint in CI.** `.github/workflows/migration-lint.yml` +
  `scripts/lint-migrations` enforce append-only ordering — versions
  strictly increase, no rename of a version already shipped to `main`.
  In-tree Go tests guard monotonicity and uniqueness on every PR.
- **GHCR multi-arch Docker images.** linux/amd64 + linux/arm64,
  cosign keyless signed via GitHub OIDC. Tags published per release:
  `:vX.Y.Z`, `:vX.Y`, and `:latest` (last one ONLY on clean semver tags
  — pre-release tags never bump `:latest`).
- **Nightly channel.** `.github/workflows/nightly.yml` rebuilds on every
  push to `main`: `:nightly` and `:main-<sha>` Docker tags, plus a
  rolling `nightly` GitHub pre-release with prebuilt binaries.
- **One-line installer.** `scripts/install.sh` detects OS+arch, verifies
  sha256 + cosign signatures, installs to `~/.local/bin` (no sudo) or
  `/usr/local/bin`. Until the project website is live, fetch direct from
  the repo: `curl -fsSL https://raw.githubusercontent.com/crewship-ai/crewship/main/scripts/install.sh | bash`.
  The short `crewship.ai/install` redirect will land alongside the
  website launch.
- **Update notification.** `internal/update` queries GitHub Releases API
  daily (cached in `~/.crewship/cache`). CLI prints upgrade banner at
  startup; web UI surfaces a dismissable banner via
  `GET /api/v1/system/version`. Optional `GITHUB_TOKEN` to lift the
  60/h unauthenticated rate limit to 5000/h.
- **Sentry crash reporting (opt-out by default in beta).** New
  `internal/crashreport` package wraps `getsentry/sentry-go` behind a
  consent gate stored in `app_settings`. DSN injected at link time via
  ldflag from `SENTRY_DSN` GitHub Actions secret. Strict client-side
  scrubbing of headers, query strings, request bodies, User field, and
  device/runtime/culture contexts; server-side regex rules in Sentry UI
  cover email/Bearer/`sk-*`/`ghp_`/`xox*-` patterns in error messages.
  `CREWSHIP_SENTRY_DSN` env var redirects to a self-hosted/own Sentry.
- **`crewship telemetry on/off/status`** sub-commands manage consent at
  runtime; `status` shows the resolved endpoint host plus DSN source
  (vendor default vs env override). First-run prompt removed — beta
  default is enabled.
- **Sentry alert-rule provisioner** (`scripts/sentry-setup-alerts.sh`):
  idempotent bash script that calls the Sentry REST API to create the
  "New issue (beta)" and "Spike — 50+ events/hour" alert rules.
- **PR + repo hygiene.** Stale-bot workflow (issues 90d, PRs 44d, generous
  opt-out labels), PR template Migration Safety checklist,
  `scripts/setup-branch-protection.sh` one-shot for required checks +
  linear history. Hotfix runbook in `RELEASING.md`.
- **CODE_OF_CONDUCT.md** (Contributor Covenant 2.1 by reference) +
  `ee/README.md` scaffold for future dual-licensed enterprise add-ons.

### Added — Connectors (catalog → install → MCP)

- **`ConnectorCatalog`** tile-grid UI for browsing the bundled manifest
  catalog under `manifests/` (`feat/connector-catalog-impl`).
- **`SchemaForm`** five-field-type renderer (text/secret/select/toggle/
  number) with per-field validation and defaults.
- **`ConnectorConnectSheet`** wires SchemaForm into the install flow —
  validates inputs, persists credentials via the sidecar, hands off
  OAuth where applicable.
- **Backend connector handlers** — `ParseManifest`, `Validate`,
  `Resolve`, `MaterializeMCP`, `LoadAll`; HTTP routes for List / Get /
  Verify / Install (incl. credential persistence + OAuth handoff).

### Added — Auth + onboarding overhaul (PR #314)

Pre-beta sweep: account recovery, device pairing, split-screen
onboarding wizard, session-rotation + lockout primitives.

### Added — CLI: AI-first 2026 (15 new commands and flags)

Major CLI surface expansion aligning Crewship with the 2026 agent-CLI playbook (long-running workflows, plan/act separation, headless scripting, real-time dashboards, model-tiering control). All additions live in `cmd/crewship` and `internal/cli`; one server endpoint added (`GET /api/v1/runs/{id}`).

**New top-level commands:**

- **`crewship -p "..."`** — headless one-shot prompt to the default agent. Sets quiet by default, exits non-zero on agent error. Pipe-friendly: `cat issue.md | crewship -p "summarise"`.
- **`crewship plan <prompt>`** + **`--plan`** flag on `run`/`ask` — plan/act separation. Read-only architect mode that outputs a step-by-step plan + files-to-touch + risks without executing tools. Prompt-engineered (no backend mode), so it composes with every adapter.
- **`crewship resume [chat-id|run-id|pr-url]`** — pick up the last session, an explicit one, or the session that produced a GitHub/GitLab/Bitbucket PR. No-arg form opens a `huh`-styled picker over the 10 most recent CLI sessions.
- **`crewship wait <run-id>`** — block until a run reaches a terminal status. Status-aware exit codes (0 done, 1 failed, 2 cancelled, 3 timeout). Use in scripts: `crewship wait $(crewship ask --no-stream -q "..." | jq -r .id) && echo done`.
- **`crewship tui`** — real-time Bubble Tea dashboard. Three panels: running runs, pending approvals, live journal stream (SSE-pumped). Keys: `q` quit, `r` refresh, `Tab` focus.
- **`crewship recap <chat-id>`** — LLM-generated summary of a chat session via the default agent. Output is a 4-section markdown brief (outcome / decisions / open threads / next prompt). Tunable bullet count via `--bullets`.
- **`crewship shell`** — interactive REPL. Slash commands: `/help`, `/agent <slug>`, `/workspace <slug>`, `/cd`, `/plan` (toggle), `/effort <level>`, `/think` (toggle), `/clear`, `/history`, `/quit`. `@file` fuzzy expansion inlines file content into prompts.
- **`crewship me`** — your missions + your pending approvals + your recent runs (3 parallel REST calls).
- **`crewship today`** — today's runs and spend.
- **`crewship now`** — live status: running runs, idle/busy agent counts, pending approvals.
- **`crewship cost forecast`** — projected cost before you spend tokens. Two modes: `--prompt @file` (token-count heuristic) or `--from-history <agent>` (average of last 20 runs). Renders rate table for Sonnet 4.6 / Opus 4.7 / Haiku 4.5 with output-ratio tuneable (`--output-ratio`, default 2.0×).
- **`crewship diff <run-a> <run-b>`** — side-by-side comparison of two existing runs (status, agent, output diff). Distinct from `eval compare` which re-runs an eval scenario.
- **`crewship notify`** — desktop notifications group. `enable` / `disable` / `status` / `test` / `send <title> <body>`. Auto-fires on long-running run completion (≥30 s) and pending approvals. Uses `osascript` on darwin, `notify-send` on linux, BurntToast on Windows (no-op when missing).
- **`crewship slash`** — manage user-defined slash commands. `slash list` enumerates loaded files; `slash init` scaffolds `~/.crewship/commands/review.md` as a starter.

**New flags on existing commands:**

- **`--format=ndjson`** (global) — line-delimited JSON output, pipe-friendly for `jq -c` / `fx` / stream-processing tools. Plumbed through `Auto` / `AutoDetail` so every list/detail command supports it uniformly.
- **`--plan`** on `run` / `ask` — plan-mode without a separate command.
- **`--effort=minimal|low|medium|high|xhigh`** on `run` / `ask` — reasoning effort passthrough, threaded into chat-creation metadata.
- **`--show-thinking`** on `run` / `ask` — surfaces full reasoning blocks on stdout (not the 100-char truncated stderr peek).

**User-defined slash commands** (`~/.crewship/commands/*.md`)

Markdown files with YAML frontmatter become first-class CLI subcommands at load time:

```markdown
---
name: review
description: Review a diff
agent: viktor
plan: true
vars:
  - target
---
Review this ${target} for $args.
```

`name`/`description`/`agent`/`effort`/`plan`/`vars` are honoured. `$VAR` / `${VAR}` substitution against positional args. Built-in commands always win on collision (the loader skips + warns).

**Server surface (one endpoint added):**

- **`GET /api/v1/runs/{id}`** — single-run lookup used by `wait`, `resume`, `diff`. Reuses the existing `journal.ListRuns` + enrichment path; 404 for unknown ids (cross-tenant masked).

**New internal helpers** (single-responsibility, all unit-tested):

- `internal/cli/runs.go` — `GetRun(ctx, id)`, `PollRun(ctx, id, interval, onTick)`, `ParsePRURL(s)`, `RunDetail`.
- `internal/cli/notify.go` — `OSNotify(title, body, level)`, `NotificationsEnabled(cfg)`, GOOS dispatch matrix.
- `internal/cli/slashcmd.go` — `LoadSlashCommands()`, `ParseSlashFile(path)`, `SlashCommand.Render(args)`, frontmatter loader.
- `internal/cli/repl.go` — `REPL` struct with slash-dispatch, `ExpandAtFiles(line)`, `ApplyPlanShellPrefix`.
- `internal/cli/tui/` (package) — Bubble Tea Model/Update/View, SSE journal pump with reconnect, lipgloss styling.
- Formatter: `NDJSON(v)`, `WriteNDJSONRow(v)`, `"ndjson"` routing in `Auto` / `AutoDetail`.

**Tests added (~30 new tests):**

- `runs_test.go` — `IsTerminal`, `ParsePRURL` (5 hosts), `GetRun` (200/404/empty-id), `PollRun` (3-poll convergence).
- `notify_test.go` — `NotificationsEnabled` (nil/false/true), `OSNotify` no-panic guard.
- `slashcmd_test.go` — frontmatter parse, no-frontmatter fallback, `$VAR` / `${VAR}` / `$args` substitution, name validation.
- `repl_test.go` — slash dispatch, unknown-slash warning, `@file` expansion (existing/missing/`@-`), plan shell prefix idempotency.
- `formatter_ndjson_test.go` — slice → multi-line, single object → one line, `WriteNDJSONRow`, `Auto` routing.
- `cmd_run_metadata_test.go` — `SetEffort` validation (5 levels + uppercase + whitespace + invalid), `ChatCreationBody` (default vs plan vs plan+effort), `ApplyPlanFlag` idempotency.

**Documentation:**

- README links to new commands inline (TODO: separate `docs/cli/` page in a follow-up).
- This CHANGELOG entry doubles as the design rationale for each addition.

### Added — Routines: Eval framework (PR follow-up to #281–#284)

Cross-tier consistency framework that makes routines a credible **agentic-program primitive**. Three new pieces and one resurrected runner:

- **13 eval scenarios** seeded under the `eval-` prefix (`cmd/crewship/seeddata/eval_scenarios.go`). Each is a normal routine with rigorous gates — no special test-mode code path. Categories covered: pure transformation × 2, classification, format compliance, reasoning chain, prompt-injection refusal, RAG faithfulness, cross-family LLM judge, cost guardrail, boundary handling, DAG trajectory, idempotency / concurrency, tier-escalation loop. Cross-family graders (Sonnet judges Haiku) mitigate self-preference bias on rubric-graded scenarios.
- **`crewship eval scenarios`** — batch runner: sweep eval-* routines × tier list × N runs, output pass-rate matrix in `table` / `json` / `yaml` / `markdown`. Use `--scenarios slug,slug` to scope, `--tiers fast,smart` to compare worker tiers, `--runs N` for variance, `--fail-fast` for early-exit on regression.
- **`crewship eval compare <slug>`** — head-to-head: run ONE scenario back-to-back on two tiers, report a verdict (`AGREE-PASS` / `AGREE-FAIL` / `DIVERGE-A-PASS` / `DIVERGE-B-PASS` / `AMBIGUOUS`) plus side-by-side outputs. Designed for *gate-pass agreement*, not text identity (two LLM runs are essentially never byte-identical).
- **`tier_override` field on `RunInput`** + JSON body `{"tier_override":"..."}` on the `/run` endpoint. Replaces every `agent_run` step's `complexity` for the duration of one run; step-level `model_override` still wins. Plumbed through CLI as `crewship routine run --tier-override fast|smart|...`.
- **JSON Schema gate enforcement** in `internal/pipeline/executor.go validateOutput`. Previously a no-op (`"documentation only"`); now uses `github.com/santhosh-tekuri/jsonschema/v5` (draft 2020-12). Distinct reason prefixes per failure class: `schema invalid:` (author bug), `output not valid JSON:` (worker didn't follow contract), `schema validation:` (output failed constraints).
- **LLMRunner restored** (`internal/pipeline/runner_llm.go`) as opt-in fallback. Removed in commit `8408f3e6` when OrchestratorRunner shipped; restored here so the eval suite is runnable on a workstation without a fully provisioned crew container stack. Selection at boot: `CREWSHIP_PIPELINE_RUNNER=llm_direct` (explicit override) → `--no-docker` (auto-fallback) → OrchestratorRunner (default; production unchanged).
- **`schemas/routine.v1.json`** picks up `outcomes`, `concurrency_key`, `max_concurrent` so IDE validation matches the server-accepted DSL surface.

Tests: 8 schema-gate cases, 9 tier-override sub-cases, 10 eval-CLI helper tests, 13 eval-scenario parse+validate tests — 40 new test cases total, all under `-race`.

### Added — Routines (PR #281 + #282)

Routines are AI-authored, workspace-scoped declarative workflow recipes — one declarative layer that any crew can invoke for what previously required a patchwork of infra-as-code scripts, scheduled jobs, cron entries, chat-bot triggers, and ad-hoc shell SOPs. Authored once (preferably by a smart model) and executed many times by the cheaper runtime tier.

User-facing label is **Routine**; backend identifiers (`pipelines` table, `internal/pipeline` package, `/api/v1/.../pipelines/...` HTTP routes) remain unchanged for backwards compat. Three-layer architecture: **Routine** (atomic) → **Recipe** (Marketplace template, future) → **Cyclic Issue** (recurring user issue, future).

#### Frontend

- **New `/routines` page** as a clone of `/orchestration`. 3-column layout: filter sidebar with saved-view facets (status / usage / authored-by / show ephemeral), 4 main tabs (Routines list / Graph / Timeline / Activity), right detail panel with 7 sub-tabs (Overview / Editor / Runs / Versions / Schedules / Webhooks / Waitpoints).
- **Sidebar entry** *Routines* under *Work* (icon `ScrollText`).
- **Orchestration tab** *Routines* — 5th tab in `/orchestration` for in-context discovery, reusing the existing detail sheet so users don't lose mission context.
- **DSL editor dialog** — paste/edit JSON with 3 starter templates. **Test & Save** runs `/test_run` first; on pass calls `/save`. Skip-test-gate checkbox surfaces only for OWNER/ADMIN roles.
- **Run / Test Run / Dry Run / Cancel** action toolbar.
- **Live waterfall** — Runs sub-tab subscribes to `pipeline.step.*` WebSocket events; auto-expands the most recent run on first visit.

#### Backend

Five database migrations: v78 (`pipelines` + `workspaces.execution_tiers_json`), v79 (`pipeline_versions` + `pipeline_waitpoints`), v80 (`pipeline_schedules`), v81 (`pipeline_run_idempotency`), v82 (`pipeline_webhooks`).

- **6 step types**: `agent_run`, `call_pipeline`, `http`, `code`, `wait`, `transform`.
- **DAG with `needs[]`** — independent steps execute in parallel; leaf-node final-output preference for multi-leaf graphs.
- **Conditional `if`** — any step can carry a template-rendered boolean; false → step skipped.
- **Two-tier execution** — workspace `execution_tiers_json` resolves `complexity` annotation to `(adapter, model)`; tier override flows through to the CLI adapter's `--model` flag.
- **Versioning + rollback** — every save creates a new immutable version; rollback creates a new HEAD pointing at the target's definition.
- **HITL waitpoints** — DB-backed approval primitive with timeout sweeper and boot-time recovery scan reporting stranded entries.
- **Cron schedules** + **HMAC-signed webhooks** + **idempotency keys** for safe redelivery.
- **Bundle export/import** for cross-workspace transfer.
- **Workspace-scoped `POST /api/v1/workspaces/{ws}/pipelines/save`** for UI authoring (MANAGER+ role); `skip_test_gate` flag honoured only for OWNER/ADMIN.
- **8 stability bug fixes** with regression tests under `-race`: DAG completion bookkeeping, multi-leaf output picker, waitpoint lost-wakeup, webhook rate-limiter race, idempotency stale-row leak, SSRF-via-redirect, cross-workspace agent execution, template validation breadth, exponential-backoff jitter.

#### CLI (17 routine subcommands)

| Group | Commands |
|-------|----------|
| Core | `list`, `get`, `save`, `run`, `dry-run`, `delete`, `runs` |
| Versions | `versions`, `rollback --to N` |
| Bundles | `export [--include-history]`, `import [file.json]` |
| Runs | `cancel`, `watch [--json] [--once]` |
| Authoring | `validate [file.json]` (offline DSL check, CI-friendly) |
| Schedules | `list`, `create`, `update`, `enable`, `disable`, `now`, `delete` |
| Webhooks | `list`, `create`, `url`, `delete` |
| Waitpoints | `list`, `show`, `approve`, `reject` |

The `pipeline` alias is preserved — every `crewship routine X` invocation also works as `crewship pipeline X`.

#### Documentation

- `docs/guides/routines.mdx` — user guide (concepts, three authoring paths, DSL anatomy, all step types, two-tier execution, triggers, HITL, validation gates, observability, RBAC, troubleshooting).
- `docs/cli/routine.mdx` — per-subcommand reference.

#### Seeded routines

`./dev.sh seed` now populates 5 starter routines on a fresh workspace: `summarize-text`, `fetch-and-summarize`, `pr-review-structured`, `daily-status-digest`, `incident-triage`. Each is independently runnable with default inputs.

### Added — Core platform

- Self-hosted runtime: single Go binary with embedded Next.js UI, embedded
  SQLite DB, and a sidecar proxy for credential injection.
- Crew Journal — append-only event stream as canonical source of truth
  for every observable action; FTS5 search; SSE streaming to the
  `/journal` UI.
- Paymaster — hierarchical LLM cost budgets (workspace → crew → mission →
  agent), per-call ledger written before the LLM request leaves the box.
- Lookout — guardrails: prompt-injection detection, JSON-schema tool-arg
  validation, output parsing, secrets redaction.
- Harbormaster — human-in-the-loop approval queue with sync and async
  modes, configurable timeouts, full decision history.
- Cartographer — checkpoint/fork/restore over journal cursor; non-
  destructive restore returns divergence warnings instead of mutating.
- Quartermaster — eval suite with trajectory replay, regression detection,
  and an LLM-as-judge that uses rubric-shuffle anti-bias.
- Hooks framework — 15 lifecycle event types with shell, HTTP, and
  subagent handlers; `allowedShell=true` required at register time.
- Backup — AGE-encrypted, portable `.tar.zst` bundles at workspace and
  crew scope; retention rotation; advisory locking; forward-compatible
  manifest.
- Keeper — credential gatekeeping with AES-256-GCM versioned encryption
  and an Ollama-backed LLM evaluating per-request access.
- Multi-runtime container support — auto-detection of Docker, Podman,
  Colima, OrbStack, Rancher, nerdctl. Apple Containers on macOS Tahoe+.
- CLI adapters — Claude Code, Codex CLI, Gemini CLI, OpenCode, Cursor
  CLI, Factory Droid, all wired into the orchestrator dispatch table.
- Crew templates — Engineering, Quality, DevOps, and Research crews seed
  ready out of the box; `crewship template apply <slug>` to deploy.
- Issue tracker — Linear-style with labels, projects, sub-issues, and
  bulk operations; `crewship issue …` CLI.
- Multi-workspace support; OWNER/ADMIN/MANAGER/MEMBER/VIEWER server-side
  RBAC enforcement (UI for tier assignment ships in v0.2).
- OpenTelemetry GenAI spans with W3C trace-context propagation; OTLP HTTP
  exporter; every journal entry carries `trace_id`/`span_id`.
- Devcontainer provisioning with mise-managed runtimes, shared cache
  images, and 24-hour registry-digest checks.
- Per-IP rate limiting (10 req/min on auth endpoints, 120 req/min on the
  general API), security headers, single-use OAuth state with 15 min
  expiry.
- Goreleaser pipeline: cross-compiled binaries (Mac amd64+arm64, Linux
  amd64+arm64, Windows amd64), keyless cosign signatures, SPDX +
  CycloneDX SBOMs, Homebrew tap auto-publish.

### Security — Pentest 2026-05-14 hardening pass

Internal pentest of `dev2` (`dev-server:8082`, build `a78e8ac`)
produced 11 findings across 7 surfaces. All fixes have PoCs that
confirm the bypass before and the block after (reports gitignored
under `.pentest-2026-05-14/`).

- **F-001 (HIGH):** SSRF in skills import via DNS-resolved hostname
  bypass — blocked.
- **F-002 (MEDIUM):** SSRF error messages leaked internal network
  state — generic error masking.
- **F-003 (MEDIUM):** `/metrics` exposed without auth — now gated.
- **F-004 (LOW):** Next.js SPA fallback masked 404 for sensitive paths.
- **F-005 (INFO):** Inconsistent path-traversal validation — unified.
- **F-006 (MEDIUM):** No backend Origin check on state-changing routes.
- **F-007 (HIGH):** Rate limiter bypassable via X-Forwarded-For
  rotation — IP resolution hardened.
- **F-009 (LOW):** Scrubber regex bypassable via zero-width characters.
- **F-011 (HIGH conditional):** Devcontainer features could request
  `Privileged` / dangerous `CapAdd` — denylist applied.
- **F-012 (MEDIUM):** `CREWSHIP_DISABLE_RATELIMIT=true` shipped in dev
  `.env.local`.
- **F-A1/A3/A4 (HIGH):** Workspace-IDOR on relations + parent_issue_id
  — workspace-scope enforcement.
- **F-B4 (LOW):** Capability-URL proxy leaked `Referer` to upstream.
- **G-002:** Memory injection guard hardening.

### Security — Pass-2 quickfixes

Four backlog items bundled (each <70 LOC, independently revertible):

- Sidecar credential reads now emit audit events.
- Emoji reactions XSS — payload validation tightened
  (`emoji_reaction_test.go` covers 24 cases including real XSS strings).
- `/admin/backups/metrics` redacted to drop cross-owner workspace IDs.
- WebSocket frames capped at 1 MiB; fan-out N-amplifier closed.

### Security — Supply chain

- All release artifacts signed with cosign keyless via GitHub Actions
  OIDC (SLSA-3-ish provenance chain). Verify with
  `cosign verify-blob --certificate-identity-regexp ...`.
- SBOMs in SPDX and CycloneDX shipped with every release.
- `migration-lint` CI gate prevents the rebase-collision class of
  schema-divergence bug that bricks customer DB on upgrade.
- Goreleaser builds are reproducible (`-trimpath`, fixed `GOFLAGS`).
- `gitleaks` + `govulncheck` + `grype` run on every PR via
  `.github/workflows/security.yml`.

### Changed

- **README** rewritten for honest beta status — every feature labeled
  ✅ stable / 🟡 early / 🚧 WIP. Adapter scaffolds for non-Anthropic
  CLIs explicitly marked WIP rather than equal-billing alongside the
  production-tested Claude Code adapter.
- **Distribution channels** documented in `RELEASING.md` — stable /
  beta / nightly with their respective Docker tag policies. `:latest`
  Docker tag only moves on clean semver tags; pre-releases NEVER
  overwrite `:latest`.
- **Hotfix workflow** documented in `RELEASING.md`: cherry-pick onto
  release branch, fix-forward (never untag), forward-port to `main`.

### Removed — Repo hygiene (PR #344, #348)

- `.claude/context/prd/*` and `.claude/context/wireframes/*` —
  ~52 000 lines of pre-implementation design docs untracked.
  Mintlify (`docs/`) is now the canonical user-facing docs source.
- `internal-docs/audit-archive/*`, `internal-docs/wireframes/*` —
  archived audit reports and HTML wireframes.
- `mockups/activity-rail-v{2,3}.html` — wireframes for the
  activity-rail feature shipped in #287.

### v0.2 roadmap

The following ship as packages but are not yet auto-wired into the
runtime in v0.1; they activate via manual API calls today and become
default behaviour in v0.2:

- Episodic memory — vector recall over the journal (selective embedding,
  SQLite BLOB cosine).
- Consolidate — daily Consolidator that extracts learned rules into
  crew memory + Compactor that rolls up low-signal old entries.

The following are planned for v0.2 but not in v0.1 at all:

- PostgreSQL primary database (SQLite is the only supported backend in
  v0.1).
- Kubernetes container provider.
- Skills marketplace (local skill imports work today).
- Workspace-scope memory tier (3-tier today: agent, crew, session).
- Stripe-backed billing tiers / edition gating (v0.1 ships fully
  Apache-2.0 with no edition gating).
- UI for assigning ADMIN/MANAGER/VIEWER workspace roles (server-side
  enforcement is already wired).
- Crew-to-crew handoff with critique exchange.

### Notes

- This is the first tagged release. Public APIs and data models may
  still change in `0.x` minor versions before `1.0`. Pin a commit SHA or
  a specific `v0.x.y` tag if you ship to production.
- The `release` branch tracks deployable state (a 5-minute systemd timer
  on the dogfood prod VM polls it). Push `main:release` to deploy.

[Unreleased]: https://github.com/crewship-ai/crewship/compare/v0.1.0-beta.2...HEAD
[0.1.0-beta.2]: https://github.com/crewship-ai/crewship/releases/tag/v0.1.0-beta.2