# Changelog

All notable changes to SuperBased Observer are documented here.

## [Unreleased]

### Changed

- **Org dashboard, Settings > Plane B mode tells the truth about what is in flight (T-777, D-617).**
  With no mode change requested the page now says "No mode change requested" and lists what a change
  to Gateway Mode would need, instead of seven "pending" checks for a change nobody asked for. The
  Request selector offers only the other mode. While a change to Gateway Mode is pending, the server
  checks `mode_capability` and `adapter_route_matrix` itself (marked "Checked by the server", with the
  evidence and the time), and the other five checks get a Record result button (pass or fail with a
  required note, showing who recorded it and when). Machines whose member was removed or deactivated,
  or that left the org, no longer count toward (or block) the capability check. API:
  `GET /api/org/plane-b/mode` gains `change_pending`, `pending_generation`, `gates_required` and
  `gate_catalog`, and returns gates only while a change to Gateway Mode is pending (generation 0 and an
  empty list otherwise); each gate gains `title`, `about`, `kind`, `why_manual`, `source` and
  `server_check`; capability gains `departed` and `departed_nodes`. `POST /api/org/plane-b/preflight`
  now refuses a generation other than the pending one (409) and a pass or fail without a note (400).

## [1.36.0] - 2026-10-10

Stable release on the `stable` channel (npm dist-tags `latest` and `stable`, PyPI, the VS Code
Marketplace and Open VSX). 1.36.0 is one combined release (D-400): it supersedes the held 1.35.0, which
never shipped as a stable release, so everything below is new since 1.34.0. Where a note says "1.35",
it means the 1.35.0 release candidates that went out on `edge` and every build after them, this one
included. On top of the 1.35 work it carries modular packaging (components, prebuilt editions, custom
builds, distro-aware updates), the enterprise vendor API connections (synthetic, awaiting live
validation), the post-1.35 correctness and security rounds, and the move to Go 1.26. It is
`v1.36.0-rc.5` plus the two dashboard fixes from the rc.5 roll (T-762, T-763); how the release
candidates got here is at the end of this section ("What changed during the release candidates").

Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

### Read this before upgrading (1.36.0)

The first nine items need a decision or an action from you; the rest describe behaviour that changed.

- **Leaving an organization no longer blocks your AI tools, and a managed node now fails open by
  default when its organization's budget cannot be verified.** After `observer unenroll` a managed
  node used to keep refusing every proxied request with `B-625` ("the organization requires a budget
  on this managed node and none has been verified") until a re-enrol or a daemon restart. Now B-625
  never fires without a live enrolment, the running daemon recomposes onto your own `[guard.budget]`
  numbers without a restart, and a managed node whose org budget is not verified yet (right after
  enrolling, the org unreachable since start, a document that did not verify) runs on its own numbers
  and logs it. An organization that wants the old blocking answer pins the new
  `guard.budget.fail_closed = true` through node governance. `observer unenroll` is now an ordered,
  structured leave (`observer unenroll --plan` previews it; the dashboard's Leave dialog lists the same
  steps) that tells the organization it left (a `node_left` audit row, best effort) and ends as a plain
  individual node with your local data and config kept. Re-enrolling from the dashboard with an
  enrolment link works again on estates whose front end answers `/healthz` itself, and every refusal on
  that page now says what the server actually answered.

- **The leave fail-safe never drops your budgets on a slow read, and still applies your own caps.**
  (REVIEW-4, D-521.) A managed node no longer treats a failed enrolment read (a busy database, a
  checkpoint, a 2 s timeout) as "not enrolled": the last composed budget, the organization's caps and
  yours, keeps applying until the node confirms it left. After a confirmed leave, or a re-enrol whose
  budget has not arrived yet, requests are checked against your own `[guard.budget]` caps instead of
  no caps at all. `observer <tool>` and the dashboard's New Terminal now agree with the proxy: a leave
  that stopped partway does not block launches, and an expired or unverifiable managed grant starts the
  tool with a warning unless the organization set `guard.budget.fail_closed`. That setting now follows
  the organization you belong to without a daemon restart. A leave whose credentials step fails can be
  run again, and your AI tools' proxy routes are only removed once the leave has completed. The
  dashboard's live budget stream accepts at most 16 viewers at a time (the banner falls back to
  polling).

- **Only the org's super admin can publish the node components policy (D-524).** Publishing, rolling
  out (create, approve, stage, promote), rolling back or waiving `node.components` now needs the super
  admin as well as `write:policy`, matching the rule for granting `components.govern`. Anyone else gets
  `403 super_admin_required` with the reason (audited), the assistant's proposals for it need the super
  admin to approve, and Organization > Node components keeps Publish disabled with the reason while Check
  still works. Halting a rollout and every other policy family are unchanged. A `node.components` version
  a plain policy admin published before this release stays published: review the family's history.

- **Republish any `node.governance` feature.lock (MODPKG-16).** Before this release a published
  feature.lock was dropped from the signed `node.governance` body, so it never reached a node: a lock you
  published looked in force on the org dashboard while every node ignored it. After upgrading the org
  server, publish each existing feature.lock again so nodes receive it. A lock that forces on a feature
  whose component the `node.components` policy blocks is now refused at publish (`409 cross_rail_error`).

- **Proxy route and Claude Code settings.** The daemon is the proxy on `:8820`: take the proxy route off
  before stopping the old daemon and put it back after the new one is up (`scripts/restart-daemon.sh` does
  this in one step), or a session pointed at the proxy gets `ConnectionRefused`. On its first start the new
  daemon's hook auto-registration (`[observer.hooks] auto_register`, default on) rewrites an Observer hook
  or MCP command written by an older binary once, to the command this release registers: the npm or pip
  launcher (`<prefix>/bin/observer`) when Observer was installed that way, so the next package upgrade no
  longer breaks it. `observer init` and the auto-registration now render that command and its
  `--config` argument the same way, so they no longer rewrite each other's entries (T-725); keep a copy
  of `settings.json` if you compare it byte for byte. Leaving an organization removes a proxy route
  (Claude Code `ANTHROPIC_BASE_URL`, Codex `base_url`) only when the enrolment wrote it, and only after
  the leave has completed.

- **New hook events, and Codex asks you to trust them.** This release registers two more Claude Code
  hook events (`TaskCreated`, `TaskCompleted`) and three more Codex events (`SessionEnd`,
  `SubagentStart`, `SubagentStop`). Codex holds a newly registered hook until you trust it: open Codex
  once and run `/hooks` to mark every Observer entry trusted (`observer init` prints the count). Until
  then Codex runs the hooks it already trusted and skips the new ones.

- **The first start migrates the database, and on a large one that takes a while.** The new daemon
  applies the schema changes on its first start, before the dashboard and the proxy answer. Measured on a
  2 vCPU machine it takes about 7 seconds per 500,000 token rows, mostly migration 151's index builds.
  Keep the proxy route off until the new daemon is up (the item above). While the old daemon still runs,
  `observer status`, `doctor` and other commands from the new binary read the database without migrating
  it and say the running daemon is older; restarting the daemon finishes the upgrade.

- **The minimal edition compiles the proxy out; the dashboard can be compiled out too.** The prebuilt
  `minimal` node edition (staged artifact, not published to npm, PyPI or the Marketplace) is built
  without `capture.proxy` (34 omit tags in all): it captures through hooks and the watcher, has no
  accurate proxy token tier and no conversation compression, and its launchers say the build has no proxy
  instead of routing to a dead port. It keeps the local dashboard. The dashboard (`ui.dashboard`) can now
  be compiled out as well, through a custom build (`sbo-components build --manifest`); such a build
  starts headless with one reason and every pointer at Settings > Components names the CLI instead. The
  `developer` and `managed` editions keep both; the published channels still ship the `full` product.
  `observer doctor <tool>` for an adapter an edition leaves out now says "not in this build" (T-726).

- **Go 1.26 to build from source.** Every binary is built with Go 1.26.9, `golang.org/x/crypto`
  v0.57.0 and `golang.org/x/net` v0.60.0; building from source needs Go 1.26 or later, and CI lints with golangci-lint v2 (see Security
  below).

- **Code intelligence is now opt-in.** The in-process code index (`[codeintel]`: symbols, imports,
  call graph) is heavy on CPU and disk, so it now runs only when you turn it on: one click under
  **Settings > Intelligence > Code intelligence**, or `[codeintel].enabled = true`. A config that never
  set `[codeintel].enabled` used to inherit "on" and is now off; if that install already has an index,
  `observer start` prints a one-line note, the index is kept and ages out through
  `[codeintel].retention_days`. A config that sets `enabled` either way is untouched; set it to `true`
  to keep the old behaviour. While it is off, the MCP symbol tools (`search_symbols`, `get_symbols`,
  `get_relations`) stay registered and answer `degraded` with a `codeintel_disabled` warning
  (`get_symbols` still returns its regex fallback), `observer index` declines, body-collapse
  compression does nothing, and `observer doctor` reports `codeintel: off by choice` as a pass. On an
  org-managed machine an org pin of `codeintel.enabled` still wins either way. Org Code intelligence
  panels stay empty for machines that have not opted in or been pinned on.
- **Roll order for orgs: developer machines first, then the org server (or together).** Nodes on
  1.34.0-rc.7 to rc.11 that newly enrol by token into a 1.35.0 org server show "Governance: ALTERED"
  (a known node-side signature bug, GRANT-INTEG-2, fixed in this release; a stored grant verifies again
  after the node upgrades, with no re-enrolment). Default managed enrolment tokens now carry a
  governance grant, so every new token enrolment of an old node hits it.
- **Older nodes and node.governance.** Released nodes from v1.31 to v1.34.0 (every release candidate
  included) reject a whole node.governance body that names a section, schema or key they do not know,
  and then keep their old body. The org server now projects each node's body to what that build
  compiles (section vocabulary, body schema and key generation, judged by full version precedence, so
  a release candidate counts as older than its release) and re-signs it at the same version. Residual
  limit: a v1.33 node that upgrades to v1.34 can lack the `projects` section until the org's next
  publish.
- **Org server rollbacks now have hazards; run the preflight first.** `observer-org upgrade preflight
  --rollback-to <version>` refuses a rollback while any of these is in use, and you should not roll
  back around it:
  - **Binding v2 signatures.** Policy and guard-bundle deliveries to new nodes are now signed bound to
    the org, the developer and the node's advertised target. Rolling the org server back below this
    build makes those nodes refuse every policy delivery (they keep their last body) until it rolls
    forward again.
  - **Developer-dashboard tab overrides.** Ship dashboard overrides and per-tab hiding in the same roll,
    and never roll the org server back to a build without per-tab vocabulary while overrides carry tabs.
  - **Budget rail versions.** Rolling back below this build makes nodes refuse the lower budget-rail
    versions until the counter catches up.
  - Also guard fallbacks, lock-override grants and AI tool settings policies in force (other live
    grants warn).
- **Compound model budgets are now enforced at the AI gateway.** `member_model` and `team_model`
  budgets were shown on the node and the Budgets page but never projected to the gateway; from this
  release the gateway enforces them.
- **About 14 launch verbs now honour an org-disallowed tool.** The org's disallowed-tool gate moved onto
  the shared launcher helpers, so seeded `observer <tool>` launchers that never refused an
  org-disallowed tool now do (a closed hole). A tool grant still launches it.
- **Distinct approvers are always required.** `require_distinct_approver` is fixed on: nobody approves
  their own request, direct grant or extension, except a solo super-admin who is the only holder of the
  key (audited as `self_approved`). A PUT of `false` is accepted with a warning so older admin pages keep
  working.
- **Budget ids and grant fields follow a capability, not a version (T-505, T-625).** The org server puts
  the named `budget_id` and the request-grant fields (the offline revert) on the signed budget rail only
  for a budget fetch that advertises `?policy_caps=budget_grants.v1`, which every 1.35 build sends,
  release candidates and demo builds included. So 1.35.0-rc.14 and later rc nodes DO receive budget ids
  and the banner and Requests links name the budget. A node that does not send the token (any build
  before 1.35) keeps the id-less body and still receives the granted amount in its cap. No version is
  compared, so a `dev` build of 1.35 is treated the same; release-runbook step 3d is retired.
- **Budget requests and the new request types need a 1.35 org server (T-538, D-342).** A budget
  increase request without a budget id, and the new request types `page_access` and `config_edit`, are
  accepted only by a 1.35 org server: a released server still requires `budget_id` and answers 400 to
  the new types. Roll the org server and the nodes together.
- **A node OTLP receiver opened beyond loopback now needs a token (T-538, D-343).** With
  `[ingest.otel].allow_non_loopback = true`, every exporter must send the `X-Observer-Edge-Token` header
  (gRPC `x-observer-edge-token`) holding the value in the `otlp-ingest-token` file beside the node
  database; a request without it gets 401, and if the token cannot be resolved the receiver does not
  start. Loopback-only receivers (the default) are unchanged. While the receiver requires the token,
  Observer refuses to wire a tool's own exporter at it (no token is ever written into a vendor file).
- **Enforce-mode org budgets now stop tools that do not route through the proxy (T-519, D-332).**
  The daemon publishes its own budget decision and each tool's pre-send hook denies at the cap (the next
  prompt where the tool has a prompt hook, else the next tool call). Tools that used to keep running past
  a hard cap (Cursor among them) are now stopped; tools with no pre-send seam are flagged after send.
  The per-tool answer is the "Budget hook stop" column in `docs/adapter-parity.md`.
- **Recover dropped prompts after upgrading.** Codex 0.148 and later (Codex Desktop, `codex exec`) wrote
  each user prompt in a record Observer did not read, so most prompts were missing; run
  `observer backfill --codex-rescan` once to recover them. Codex subagent rollouts already stored under a
  file-name id keep it until a rescan that is tracked on its own (T-583). Qwen Code counted reasoning tokens twice: run
  `observer backfill --qwen-code-rescan`.
- **Managed enrolment tokens.** A managed token now defaults to the full managed authority set (23
  authorities, narrowable). Managed tokens minted earlier with no authority stay ungoverned and must be
  re-minted.
- **Cost display.** The org admin dashboard always shows dollars. Settings > Display holds one choice,
  "Developer dashboards show: Dollar costs (default) / Token usage only". The previous admin-facing
  setting is retired and NOT carried over; an org that wants developers on token usage selects it once.
  A node that cannot verify the org's display policy shows tokens, not dollars.
- **Security: org enrichment of individual-tenancy members (INTEL-7).** In `observer-org` v1.33.0
  through v1.34.0 org enrichment could enrich an individual-tenancy member's sessions without opt-in
  (latent unless an admin enabled org enrichment, which is off by default). Until you run this build,
  do not enable org enrichment on an org with individual-tenancy members. After upgrading, purge the
  hidden results under Intelligence > Session enrichment or with
  `observer-org intel purge-individual --confirm`.
- **Cloud Intelligence plans (hosted service).** Plan v3 and the GPT-6 Luna route ship inactive until
  the service is deployed and attested. When it is rolled, `SBCI_PADDLE_PRICES` must move to
  `plus_beta:3` together with cloud migration 0041, or Plus sells fewer enrichments than Free.
- **Components and distros (modular packaging).** Nothing changes for an existing install: every
  channel still ships the full product, and a node with no `[components]` block runs everything it ran
  before. New: `observer components` and Settings > Components choose what runs (inactive components
  start nothing and their routes answer `component_not_installed`); an org can govern a managed node's
  components with a `node.components` policy, which needs the new `components.govern` authority
  (super-admin only to grant); a developer can ask the org for a missing component on the Requests page
  (new request type `component_enable`). On a managed enrolment the local `[components]` block cannot
  narrow the node (it is ignored with a warning); the OS-pinned local ceiling stays the one local limit.
  The Projects alignment judge tier is in the public source tree (`internal/judgeclient`). The
  minimal, developer and managed editions are published as GitHub release archives with an edition
  installer (`install.sh` / `install.ps1`, see Added); npm, PyPI and the VS Code extension still ship
  the full build.
- **Migrations.** Node 148 to 161 (158 component purge plans, 159 the enrolment grant's signed initial
  component set, 160 the local ceiling's last-known set, 161 the update state's distro columns; all
  node-local); org server 192 to 231; PostgreSQL 0058 to 0098 (0063 is a PostgreSQL-only type fix; 206 /
  0073 add the vendor export tables; 231 / 0098 the org signing key history); cloud 0041. On the org
  server run `observer-org upgrade preflight` and then `observer-org migrate` before starting the new
  image. Take an org database backup before upgrading; the PostgreSQL
  model-filter index build holds writes on the token tables for about 18 seconds, before the server
  serves traffic.

### Added

- **Edition installer (T-729).** `scripts/install.sh` (Linux and macOS, x64 and arm64) and
  `scripts/install.ps1` (Windows) install the minimal, developer, managed or full edition: `--edition`
  (a menu on a terminal; `developer` otherwise), `--version` (default the latest final release; a
  pre-release only when named), `--prefix` (default `/usr/local/bin` when root or writable, else
  `~/.local/bin`; `%LOCALAPPDATA%\SuperBased\Observer\bin` on Windows), `--from-dir` for air-gapped
  installs, `--dry-run`, `--uninstall` (runs `observer uninstall --all` first and keeps the binary if
  that fails) and, on Linux with systemd, an offer to turn on `integration.service` and run `observer
  service install --now`. The archive must match the release's `SHA256SUMS`, and its vendor
  signature (`<archive>.sig`, the raw Ed25519 signature the update system already verifies) must
  verify against the vendor key compiled into the installer; a mismatch or a bad signature is refused,
  an unsigned archive or a machine with no Ed25519 verifier is a warning unless
  `--require-signature`. Every `v*` tag now publishes the minimal, developer and managed edition
  archives for the five platforms (`observer-<tag>-<edition>-<os>-<arch>.tar.gz`, `.zip` on Windows;
  the full edition keeps today's names), their `.sig` files, the signed `release-index.json` and both
  installers as release assets, all in `SHA256SUMS`. No telemetry; curl or wget.
- **Distro-aware updates (manifest v2).** Publishing a release on the org server now also writes a
  distro-aware v2 document beside the unchanged v1 one, served at `/api/agent/update/manifest/v2`
  with the vendor-signed release index. Nodes built as `minimal`, `developer` or `managed` update
  within their distro, and move to another distro only when the org's signed component policy names
  it, the local ceiling allows it and the channel's distro epoch has advanced. An older node or an
  older org server keeps working exactly as before. Agent migration 161 adds the distro columns to
  `update_state`; org server migration 220 (PostgreSQL 0087) adds `distro` and `components_digest`
  to `org_update_artifacts` and the `org_update_release_indexes` and `org_update_publications`
  tables. See `docs/enterprise-updates.md` "Distro-aware updates".

- **Modular packaging, governance round 3 (MODPKG, lane MP-GOV3).** The org dashboard has a
  **Node components** page (Organization > Node components) to compose, check and publish the
  `node.components` policy: it shows the stranding estimate and the cross-rail findings and asks for
  the stranded-count acknowledgement before publishing. A `node.governance` feature.lock that forces on
  a feature whose component the `node.components` policy blocks is now an error and refuses the publish
  (`409 cross_rail_error`, either order). Fixed: a published feature.lock was dropped from the signed
  `node.governance` body and never reached a node (ledger MODPKG-16); republish an existing lock to
  deliver it. A teams-to-enterprise grant replacement now carries the managed initial component set
  under a second signature, so older nodes accept it unchanged and newer nodes verify the set (org
  server migration 227, PostgreSQL 0094). Settings > Components shows the separately installed artifacts
  (browser and VS Code extensions, plugin shims, helpers), also on `GET /api/components` as
  `artifact_states`.
- **Scheduled component purges in the org audit log (MODPKG, lane MP-GOV4).** A node now reports, on
  the component posture it already pushes, the state and due date of each purge a `node.components`
  policy scheduled on it (enum values only; no counts or plan ids), and the org server writes an audit
  row (`node_component_purges_changed`) each time a node's list changes: scheduled, eligible, ran,
  expired or cancelled. Updates > Fleet versions carries the list per node and counts the nodes with an
  open purge. Optional both ways: older nodes and older servers keep working. Org server migration 228
  (PostgreSQL 0095) adds one column to `org_node_component_posture`.
- **Custom builds from a component manifest, staged (modular packaging P7, lane MP-CUST).** A
  `sbo-distro.v1` manifest names a prebuilt base (minimal, developer, managed or full) and adds or
  omits components; `sbo-components build --manifest` resolves it to one compiled set, builds with the
  matching omit tags and stamps the binary as distro `custom` with its components digest and custom
  distro id, and `sbo-components proof` checks it like a prebuilt distro. A custom build updates only
  from its own manifest's build named in the vendor-signed release index; `vendorsign index` carries
  custom archives, and `go run ./web/compgen -manifest` leaves the pages of omitted components out of
  its web bundle. The vendor build job (`custom-build.yml`) is manual-dispatch only with an ephemeral
  key and publishes nothing; there is no hosted build service and no org-signed custom build yet. No
  migrations. See `docs/custom-builds.md`.

- **Prebuilt distros, staged (modular packaging P3).** `scripts/build-distro.sh <minimal|developer|managed|full>`
  (and `make distro-build`, `make distro-all`) builds one distro with tags read from the component
  catalog, plus its `go version -m` buildinfo, a CycloneDX SBOM and a proof record. The proof gate
  (`sbo-components proof`) reads the tags back out of the binary, checks with `go list -deps` that every
  excluded component claiming compile-out is absent, that the linked modules equal the closure, and that
  the binary reports its own distro. A distro binary started with no `[components]` block runs its
  distro's default set; a component the distro excludes whose code this release still carries is inert
  and not selectable and is listed as `distro_out`. CI builds, proves and smoke-tests the four distros
  on every pull request and vets and tests every omit-tag variant; `distro-staging.yml` builds all
  platforms on demand as workflow artifacts. Nothing is published, signed or tagged by any of it.
- **Download this build's SBOM.** `GET /api/components/sbom` returns the CycloneDX SBOM of the running
  binary (the same document the release pipeline renders per artifact).
- **Local component ceiling keeps its last valid set.** When the OS-pinned ceiling source fails a check
  after a valid read, the last valid set stays in force (node migration 160) instead of falling to core
  only.
- **Model filter.** The node dashboard top bar filters by model, with the list narrowed by the chosen
  tool, project and window (a selected model outside the selection stays selected and says "no data in
  this selection"). Spend pages narrow to that model's own turns; session and action pages keep whole
  sessions that used it. The org dashboard gains a global Tool / Project / Model filter row, kept in the
  URL only. New indexes make model filtering about 100x faster for rare models.
- **Join and manage an organization from the node dashboard.** Settings > Enrolment joins by code, link
  or IdP sign-in, shows the consent and the org's grant, the status, Push now, re-enrol and Leave.
  Leave removes a proxy route (Claude Code `ANTHROPIC_BASE_URL`, Codex `base_url`) only when the
  enrolment wrote it, and the confirm names exactly what goes and what stays. **Share history** sends
  activity captured before enrolment (the twin of `observer org backfill --all --confirm`) and warns when
  older sessions came from a previous enrolment. **Re-send changed rows** is the twin of
  `observer org resync`, and the page shows `observer org push-status`'s push cadence. The CLI and the
  page run one enrolment sequence. AI tool settings > Organization and the org dashboard's invite
  screens point at the page. (T-642)
- **AI tool settings.** A new node dashboard page and `observer agent-config` read and edit each AI
  tool's own settings and instruction files: By tool, Projects, All AI tools, Instructions, Coverage and
  History tabs plus a raw editor. Every save is checked and previewed first, then written atomically
  under a lock and read back; secrets show only as present or absent; Observer-owned entries are
  refused; settings stored inside editor apps are read-only with a note. A per-adapter catalogue of about
  4,700 settings and a 21-key common vocabulary sit underneath it, and `docs/adapter-settings-reference.md`
  is generated from them. `observer config set` gains the same checks (`--dry-run`, `--yes`), and saving
  `config.toml` from the dashboard runs the same sanity check.
- **Org AI tool settings policies.** Org admins author AI tool settings for the org, a team or a member,
  by tool and project, in web2 (Coding-agent policies > AI tool settings), with a pre-publish check and a
  team-conflict gate. Managed machines apply and lock them (form, raw editor and CLI refuse, naming the
  policy), re-assert drift twice and then back off within the hour, and report `config_drift` to Fleet
  State. An empty signed body withdraws the locks and keeps the written values. Individual machines are
  never touched. Re-enrolling into another org clears the previous org's policy first.
- **Access requests and grants.** A developer can request an exception, a budget increase, or tool,
  model or feature access from the node (form, CLI `observer request access`, or the "request access"
  link every org block now carries). Admins decide in the Requests page and the Approvals inbox; a
  grant has an expiry (perpetual grants are super-admin only and flagged for re-review after 90 days),
  reaches the machine over a signed rail, and is shown as Issued until a machine confirms it. Grants
  change real enforcement on the tool hook, the prompt gate, the proxy, the launchers and New Terminal,
  the org AI gateway, and the node-feature and pinned-setting gates. Requests made offline wait in an
  outbox. See `docs/access-grants.md`.
- **Hook parity across AI tools.** Claude Code's hook model now reaches the other tools:
  - **Tool-call gates** (deny, and ask where the host supports it) for Codex (shell, `apply_patch` per
    file and MCP), Cursor, Qoder, Antigravity, Grok Build, Goose, Cline CLI, Qwen Code, Factory Droid,
    Gemini CLI (BeforeTool, plus a BeforeAgent prompt gate), Copilot CLI (preToolUse) and Muse
    (PreToolUse, plus a UserPromptSubmit prompt gate), each live-verified and auto-registered by
    `observer start`. Gates for Poolside, zcode, Command Code, Windsurf / Devin Desktop, the Devin CLI
    (new writer for `~/.config/devin/config.json`), Mistral vibe, Cline, Junie, Crush and Open
    Interpreter are written by `observer init` only until each is verified on a real install.
  - **A plugin shim** gates OpenCode, Kilo CLI and pi tool calls (and Command Code mods), and shows a
    withheld or rewritten prompt to the developer in the tool's own UI. Hermes gains a blocking
    `pre_tool_call` gate.
  - **Deny-only hosts** turn an enforced ask into a deny whose reason says how to proceed.
  - **Failure modes.** Gate hooks fail closed on Observer's own timeout or crash only while enforcement
    is in force, with a plain reason; observe-only hooks stay fail-open; every failure is recorded.
  - **Lifecycle and tasks.** Session start and end, compaction (Claude Code and Cursor) and Claude Code
    task events are recorded; Cursor retries of one turn fold into one row.
  - **Health.** `observer adapters --hooks`, `observer doctor --hooks` and `--probe-hook`, and a coverage
    card on the Security page show every binding as registered, trusted, current or not. Codex hook
    trust is detected and explained (Observer never trusts its own hooks for you). A vendor switch that
    turns hooks off (for example Claude Code `disableAllHooks`) raises a doctor warning and a guard event.
- **Prompt guard coverage.** Tools with no pre-send seam (Freebuff, Kilo Code CLI, Mistral vibe, Kimi
  Code unrouted, Pi, Prime Agent) get a post-hoc flag and a desktop toast, and every coverage
  surface names the reason. OpenCode Zen is routed through the proxy.
- **Dashboard controls for former CLI-only flows.** Each runs the CLI's own code:
  - Settings > Connected tools: Set up and **Remove Observer's wiring** (hooks, MCP server, proxy route)
    for every adapter with a hook or MCP surface, with a preview and a refusal when the file changed
    since Observer wrote it; a per-adapter **Run checks** (the `observer doctor <tool>` report); and,
    with the daemon in WSL, a Windows-side home picker (`observer init --windows-*-home`).
  - Settings > Health: each doctor finding links to the control that fixes it, and `observer doctor
    --json` gains an optional `Remediations` field.
  - Settings > Profiles: per-tool and per-project profile assignment with a change preview.
  - A forced database integrity check (above `integrity_check_max_gb`) as a cancelable background job.
  - Security: test a command, re-judge history, check or write native permission rules, MCP scan and
    compliance summary.
  - Proxy-route undo, egress lint, score, patterns, calibration, summarize, pricing sync, MCP
    wrap / relay / doctor, adopt-defaults, update history, benchmark dry run, spend and delete, and the
    resolved profile view.
  - The MCP access card names the relay's Turn on control instead of a command.
- **Command wrapping for Windows shells with a WSL daemon.** `observer shell-wrap enable --target
  windows` (or the target switch on Settings > Terminal) installs `.cmd` shims in
  `%USERPROFILE%\.observer\shims` and a marked, removable PowerShell profile block. A tool with a
  Windows build runs on Windows with its routing taken from the WSL daemon (which also applies the org
  disallow gate and managed budget admission); a Unix-only tool runs `observer <verb>` in WSL; anything
  that cannot route runs unrouted with a notice. The Windows user PATH is never edited (cmd.exe users
  add the folder themselves). Copilot CLI, Gemini CLI, Grok and Codex launch without routing on this
  target and say so.
- **Cursor Cloud Agent capture.** Cloud Agent (`bc-`) chats viewed in the Cursor IDE are captured again,
  under the `[cursor]` placeholder project: session start and end, and the agent's reasoning as a
  harness row. Tokens stay honestly absent. For Cloud Agents that ran before this release, run
  `observer backfill --cursor-hook-usage`.
- **Budget warnings.** Org-governed warnings at 75%, 90% and 100% of a cap, for the admin and the
  developer, on by default, including per-tool and per-model caps. The banner's level is the current
  reading (a raised cap clears "exceeded"), its label names the state ("Budget exceeded: requests
  blocked", "(warning only)", "(report only)", "Approaching budget"), and every banner state offers
  **Ask for a budget increase**, prefilled with the budget that ran out.
- **Org changes reach active machines in seconds.** An active node holds a policy-version probe open
  (it asks for 20 s, the server caps it at 25 s and answers the moment a version moves), so an org
  policy, budget or grant change is picked up in about 1 to 3 seconds instead of 30; idle nodes keep
  the push cadence.
- **Org Cloud Intelligence parity.** Managed and individual machines get the same enrichment
  experience: consent for individual-tenancy members (which an org can make a condition of membership,
  never switched on silently), node-built evidence over a signed rail, per-session Preview and Enrich,
  the org's full control set per org, team and member, weekly project digests, and purges that stick and
  reach the node even while the feature is off.
- **Developer dashboards (managed machines).** Managed machines hide the org-level pages by default;
  admins choose Hidden, Read-only or Visible per page, Settings section and tab, org-wide or per team or
  member.
- **Guard bundles for individual members** and **Remove from audience**, with need-to-know headers.
- **Org guard fallbacks** for managed machines: block guarded calls while a developer's guard policy is
  invalid, and refuse a New Terminal launch of a proxied tool when no sandbox is available.
- **New Terminal** lists Junie, Poolside, Crush and Aider, and Zed has a GUI launch row (Homebrew, winget,
  install script).
- **Arena** has a model picker per harness; agent step limits and the assistant's per-turn budget are
  free numeric fields.
- **Uninstall** tools that were installed from the dashboard.
- **Node.js runtime check** before guided install and launch of npm-distributed CLIs, with a copyable
  install command; `observer doctor` reports the same.
- **Compound budget scopes** (developer, team or project by tool or model, and "every developer,
  separately") and service accounts.
- **Docs.** `docs/adapter-parity.md` (the one living adapter parity record) and the generated
  `docs/adapter-settings-reference.md`, both drift-checked in CI.
- **Ask for a budget increase without knowing a budget id.** The Requests page offers a picker of the
  budgets your machine knows (whose budget, period, cap and current use, defaulting to the one that ran
  out); the org server settles the request against your own budgets. The guard's budget deny line points
  at `/requests?new=budget`. New request types: access to a page the org hid (`page_access`), a time-limited
  config edit (`config_edit`, at most 30 days) and "Something else". Org admins pick members, budgets,
  pages and settings from lists in web2 instead of typing ids.
- **OpenTelemetry from every AI tool.** The node receiver ingests any vendor's own OTLP export (JSON or
  protobuf), not only Claude Code's, under the same capture and scrub rules; where a tool also routes
  through the proxy, the proxy owns its token counts. `observer init --otlp-export <tools>` and Connected
  tools > Set up > Telemetry export point Claude Code, Codex, Gemini CLI or Qwen Code's own exporter at
  the node (opt-in per tool, removable; a collector of your own is never touched).
- **Vendor team usage on the org server (unverified live).** Settings > Vendor exports receives Cursor
  Enterprise and Claude Cowork team-wide OTLP exports, or polls the Cursor Admin API, with one source per
  tool, a scoped machine credential, held unmatched identities and an audited read. Vendor rows are shown,
  not counted in spend. See `docs/teams-operations.md` section 15.
- **Machine identities in web2.** Settings > Machine identities creates service accounts and mints,
  rotates and revokes ingest credentials (secret shown once); deactivating an account revokes its
  credentials.
- **Member deactivation.** An org admin can deactivate a member (bearers and sessions revoked by default,
  reversible, never self, the super admin or the last admin) from web2 or `observer-org users deactivate`.
- **Server maintenance from web2.** Support bundle, scrub content, log requeue, import archive, purge
  subject, update sync, resolve projects, digest send and seven Agent Access verbs run from the org
  dashboard as audited background jobs (the CLI's own code); entity ids are picked from lists.
- **Weekly project digests on developer machines.** A developer sees the org's weekly digest, read-only,
  for projects they pushed sessions in before that week ended; cost, provider, model and tokens are left
  out.
- **Administrator-managed AI tool settings (MDM).** The org AI tool policy renders into each vendor's
  managed layer (a file, a `.mobileconfig` or an HKLM `.reg`) with an honest per-value hold, from web2
  (Device management) or `observer-org agent-config mdm`.
- **Closed date ranges.** Both dashboards take a custom from / to range, not only "last N days".
- **Node dashboard parity.** A model filter, a notification bell (budget, requests, guard, cache, update
  and org notices; read and dismiss per item), Projects filters, the request-class split in session
  detail and a top-bar Export.
- **Remote systems and launch policy from the dashboard.** Terminals > Settings edits SSH profiles and
  the launch policy (both previewed and saved through the config save pipeline) instead of telling you
  to edit `config.toml`; a remote machine's host name is shown.
- **MCP server reputation** has a control on the Security page (the same code as
  `observer guard mcp reputation`).
- **AI tool settings, round 2.** Instruction blocks, the org view of each managed machine's settings
  inventory (audited, needs `read:content`), secret-shaped values scrubbed instead of withheld, project
  common values, pickers instead of typed ids, and enforcement of tracked instruction files.

### Changed

- **Organization > Node components is picked, not typed (D-571).** Require, Allow, Deny and "Deny, a
  grant may override" are multi-select pickers over the node component catalog: single components by
  title under their class, and whole groups (a class, an id group such as `adapter.*`, a stability
  level) with how many components each matches. A choice already in another list, or a Require choice
  that matches a component a Deny choice also matches (or the reverse), is listed greyed out with the
  reason. The options come from `GET /api/org/policy-resource/node.components/vocab`, built from the
  same catalog the publish check uses. The stranding estimate, Check and Publish work as before.
- **The org dashboard offers lists instead of text boxes wherever the options are known (D-571).**
  Policy rollout target version, egress provider and effort, the model fields (egress, routing rules,
  pricing, reprice, intelligence providers, enrichment and overrides) with model suggestions, node
  feature tool lists, the governance action allowlist, update ring manifests, members and timezone,
  project rule groups, grant rules and targets (tools, models, features, components), invite emails,
  client labels, sign-in domains, scopes, claims and IdP groups, Agent Access environments, workspaces,
  groups, issuers and rule versions, control-write budgets, machine identity scopes, mirror versions,
  AI gateway upstreams, machine ids, observability filters and annotation keys. Fields whose list is
  only a suggestion keep free entry. `observer-org` maintenance actions now refuse a release channel
  other than stable, lts or edge, and an MCP rollback mode other than observe or enforce. The audit of
  every field is `docs/audits/pickers-audit-2026-10-10.md`.
- **`observer obs admission setup` picks the judge hosting and the local server from numbered menus.**
  An answer outside the menu asks again instead of silently leaving the judge unchanged.
- **Node dashboard: known values are picked, not typed (D-571).** Every field whose valid values the
  daemon already knows is a picker fed by the endpoint that owns the set: the Actions and Security
  session filters (recent sessions), the request rule, tool, model, component and feature, the rule
  editor's override rule and MCP server, the Policies routing criterion, cohort, content class, model,
  user and cohort map, the guardrail topics and judge model, the Terminals allowed project root, the
  Remote tailnet host, the experiment tool, the MCP package lookup, the SSH jump host, the Arena context
  files, AI tool setting string values, and in Settings the enabled adapters, compress types,
  per-action allowlist, project allow and deny lists, disabled rule ids, dialect targets, MCP retrieval
  tools, summary models, profile keys and the reprice model. A genuinely open field keeps a "use what I
  typed" row, and a value set by hand in config.toml stays visible.
- **Cloud portal: session correction tags are picked (D-571).** Taxonomy tags come from the curated
  vocabulary grouped Activity / Area / Outcome; suggested tags stay free-form with the session's own
  offered back.
- **CLI: interactive prompts pick from a list (D-571).** `observer obs admission setup` picks the local
  judge model from the server's `/v1/models`, searches the priced models for a hosted provider, and
  adopts starter templates from one checklist; `observer init` picks the browser extension id from the
  unpacked SuperBased extensions found in the browser profiles (paste stays an option), and its
  component chooser shows the feature groups as one checklist (numbers toggle, enter accepts, b steps
  back) instead of one question per group.
- **Cloud Intelligence allowances (Signed-in Free and Plus).** Signed-in Free rises to 100 enrichments a
  day and 3,000 a month; Plus to 500 a day and 15,000 a month (plan v3). Both plans enrich on GPT-6 Luna
  with a 1,024-token output ceiling (a truncated answer is retried, then refunded, never stored). Open
  assignments move to v3, and renewals can no longer schedule a v3 subscriber back onto an older
  version.
- **One indexing switch.** `[compression.indexing].enabled = false` now also stops the hook path from
  writing tool-output excerpts (before, only the watcher obeyed it).
- **Copilot CLI launches** unrouted on a GitHub-subscription sign-in with a plain one-line note; it is
  routed only when a BYOK key and a model are set (a key without a model is refused, and a non-OpenAI
  provider type launches unrouted). `observer gemini` routes only API-key sessions.
- **`observer pi`** always gives pi a model and never switches yours: a default on another provider
  launches unrouted with a notice.
- **Antigravity (agy) prompt hook is warn-only.** On agy 1.3.0 the PreInvocation hook fires before every
  model call and Observer reads the prompt from `transcript_full.jsonl`, so it is registered again beside
  PreToolUse; it can warn, not block, and a tool-less side request carrying the prompt is seen by no hook.
- **Guard: an unresolved directory before a recursive delete asks instead of blocking.** A delete that
  resolves to a root, home, root-depth wildcard or a path outside the project is still denied (R-101);
  a relative recursive delete after a directory change Observer cannot resolve now asks (new R-102 row),
  so ordinary cleanups such as `cd $PROJECT_DIR && rm -rf build` are no longer hard-blocked.
- **A malformed `guard-policy.toml`** keeps the built-in rules and the org bundle in force and is
  reported loudly (doctor, a guard event, a Security banner); the dashboard editor refuses to save one.
  Managed machines follow the org's fallback setting.
- **Guided installs** run from your home folder, show the exact package-manager command when a program
  the vendor script needs is missing, and never stop at an interactive prompt (Goose installs
  non-interactively). Observer never runs `sudo`, except the Tailscale guided setup, where you type the
  password yourself.
- **Platform tabs restructure.** Long pages in both dashboards are deep-linkable tabs; old URLs
  redirect. The node session drawer keeps its tab in `?dtab=`.
- **Terminals** keep their original colours in light and dark mode. The New Terminal picker no longer
  overflows. IntelliJ IDEA installs the unified product.
- **Org admin writes are audited atomically.** Every org admin write route records its audit row in the
  same transaction (or before the change on split stores); a failed audit answers `audit_failed` and
  changes nothing. Publishes take a two-step confirm, and a stale editor gets `409 version_conflict`
  (Policies, setup wizard, guard bundles, developer dashboards).
- **Enrolment push cadence.** Enrolment leaves `push_interval_seconds` unset; the documented default
  applies.
- **Every dashboard config write goes through one save pipeline.** Section forms, SSH profiles, launch
  policy, pricing, process capture, profile assignments, sandbox settings and experiments all preview
  (`?dry_run=1`), refuse a file changed since you loaded it (`409 config_changed`), validate, read back
  and audit. `observer config set` refuses to save when the org posture cannot be read.
- **Token usage mode reaches every surface.** An org that shows developers token usage only now gets it
  in exports, server prose, the CLI and the statusline too, not only the dashboard pages.
- **Spend keeps counting what developer machines report.** Whatever vendor source an org picks, node
  rows still count for spend, budgets and alerts (operator ruling D-359); vendor rows are shown, not
  counted, until a live comparison approves them.
- **Analytics pollers follow current vendor docs (unverified live).** Claude Code Enterprise Analytics
  for `api_kind = enterprise`, local and remote rows summed per user-day; Codex and OpenAI Platform usage
  paged at the documented limits and Platform usage shown as its own entry, never as Codex; Copilot
  metrics from the current report and billing from AI credits, one day at a time; the Cursor Admin API
  asks for all usage.
- **The capture pill says what it means.** "Active", "No Claude Code", "Not routed" or "Checking"
  instead of "Paused" whenever Claude Code was not routed. The sidebar watcher line follows the watcher,
  not the Claude Code route, and Cursor's chat `store.db` no longer counts as misrouted.
- **Daemon restarts are safe.** The daemon exits promptly on SIGTERM (a second SIGTERM is honoured, a 20 s
  watchdog dumps stacks), and `scripts/restart-daemon.sh` waits for every daemon holding the database,
  including one that already released its port, before relaunching.
- **Hook writers are byte-idempotent.** Re-registering an unchanged hook leaves the file's bytes and line
  endings alone.
- **Command wrapping carries its config.** A shim enabled under a non-default `--config` runs observer
  with that config; on an org-governed machine a broken `config.toml` refuses the launch instead of
  running it unrouted.

### Fixed

- **Hooks and MCP entries survive an npm or pip upgrade (D-590 U1).** They used to name the binary
  inside `node_modules/@superbased/observer-<platform>/` or `site-packages/observer/_bin/`, a path the
  next `npm install -g` or `pip install -U` moves or deletes, so every hook failed after an upgrade.
  `observer init`, `observer start`'s auto-registration and the hook probe now register the package
  manager's own launcher (`<prefix>/bin/observer` for npm, the console script for pip) when one on PATH,
  or in its usual place, runs this binary; otherwise the real path as before. On Windows npm keeps the
  real path, because a `.cmd` shim cannot be an MCP stdio command.
- **A stale Observer MCP entry is repaired without `--force` (D-590 U2).** An `observer serve` entry
  whose command no longer exists (the binary an upgrade removed), or that runs this same install, is now
  treated as Observer's own and rewritten by `observer init`; `observer start` repairs such an entry in
  place (it never adds one). `observer doctor` names the exact command to run, with `--force` only where
  init would really refuse.
- **Commands from a newly installed binary no longer migrate the database under the running daemon
  (D-590 U3).** After an npm or pip upgrade, `observer status`, `doctor`, `components status` and every
  other command except `start`/`watch`/`proxy`/`update` and the capture paths (hooks, `serve`,
  launchers) read the database without migrating it while another observer process holds it, and print
  "the running daemon is vX (schema N); restart it to finish the upgrade". The daemon's lockfile now
  records its version, and `observer doctor` gains a `daemon.version` check comparing it with the CLI.
- **install.sh and install.ps1 no longer install a second copy over an npm or pip install (D-590 U4).**
  They now look first: another `observer` on PATH (npm, pip or another copy) or a daemon running another
  binary is listed with its version, the installer says which copy a shell runs now and after the next
  login, and offers the package manager's own upgrade command. A second copy is installed only on an
  explicit menu answer or `--force` (`-Force`); `--yes` or a pipe without `--force` stops with the
  explanation. The edition defaults to the existing install's (npm and pip ship `full`), and with a
  daemon from another install running, Next steps never start a second one and no service is offered.
- **`observer init` and the auto-registration render one command (D-590 U5).** `--config` is written
  only when it names a config other than `~/.observer/config.toml`, in both, so neither rewrites the
  other's entries.
- **A busy database no longer logs a spend-verdict WARN (D-590 U6).** The spend-verdict refresh retries
  `SQLITE_BUSY` with a short backoff (250 ms to 2 s); a lock that outlasts the retries is logged at debug.
- **Upgrade hints name the command that applies (D-590 U7).** The npm postinstall prints the
  `observer service upgrade` line only for a daemon running under the systemd unit and the
  route-off, stop, `observer start` order otherwise. `observer service upgrade` with no unit explains that
  restart path, and `upgrade` is listed in `observer service --help`.
- **The Codex trust hint counts the hooks it registered (D-590 U8)** instead of a fixed number, in
  `observer init` and the enrolment's client wiring.
- **`observer doctor` flags a proxy route on another port (D-590 U9).** A Claude Code or Codex route to a
  loopback port other than `[proxy].port` is a `proxy.route_port` warning naming the `observer init`
  command that rewrites it.
- **`observer init` routes to the configured proxy port (D-591).** It wrote every Claude Code and Codex
  proxy route on 8820, the `--proxy-port` default, even when `[proxy].port` named another port, so those
  routes reached no proxy. The route port is now `--proxy-port` when given, else `[proxy].port`, else
  8820, the order `observer org enroll --wire-clients` already used.
- **The Cursor watcher reads only your own CLI log directory (D-590 U10).** It used to glob every
  `/tmp/cursor-agent-logs-*`, including other users' on a shared machine. It now reads only
  `cursor-agent-logs-<uid>` or `-<username>`, and only when that directory is owned by you.
- **`observer guard status` on a node that never enrolled says "not enrolled" (D-590 U11)** instead of
  reporting the organization's budget as unreachable.
- **`/api/components` reports how the binary was installed (D-590 U12):** a `binary_install` object
  (channel `npm` / `pip` / `other`, version, and whether hooks register the launcher; no path, because a
  remote viewer can read the route). `observer components status` prints the binary's path, version and
  channel.
- **The antigravity bridge is described honestly on Linux (D-590 U13).** Outside WSL its component state
  now says it ships for a daemon running under WSL and is not used here, instead of a generic "not
  applicable"; the Linux packages keep shipping it for WSL2.
- **An in-place upgrade no longer leaves the old daemon running behind a "started" message (T-753).**
  Re-running install.sh, or `npm install -g` over an older version, replaced the binary underneath the
  running daemon, offered the background service again, and `observer service install --now` then
  printed "Service enabled + started." because `systemctl start` on a running unit does nothing; the
  old process kept running the deleted binary. install.sh now says "Upgraded X -> Y", does not offer
  the service again, and hands a unit that runs this install to the new `observer service upgrade`:
  it rewrites the unit for the new binary (keeping its `--config` / `--recipe` / `--port`, refreshing
  its Description) and restarts the daemon with `systemctl try-restart` only when nothing can be
  routed through it (no proxy listener, or no proxy route present and no open proxy connection).
  Otherwise it leaves the daemon running and prints the safe order, because the daemon is the proxy.
  `observer service install --now` on a running unit applies the same rule, and plain `install` no
  longer calls a running unit "not started". install.ps1 renames a running `observer.exe` aside
  instead of failing, says "Upgraded X -> Y" and names the still-running pid with the safe order; the
  npm package's new print-only postinstall names a daemon still running the replaced binary. Neither
  installer nor npm restarts anything itself. The "integration.service is off in every edition" next
  step now says it is off by default and that the command turns it on.
- **The npm restart hint now fires on a real npm 10 global upgrade (T-756).** npm 10 renames the old
  package directory aside to `@superbased/.observer-<platform>-<random>/` and runs postinstall before it
  deletes that directory, so the running daemon's executable did not read "(deleted)" yet and the hint
  stayed silent (rc.4 roll, node 5). The postinstall now also counts a daemon whose `@superbased`
  observer binary lives under such a retired dot-directory, or is any binary other than the one this
  install put in place. It still only prints.
- **Every `observer` command group refuses an unknown subcommand (T-757).** `observer service instal`
  (and the same typo under any other group) printed help and exited 0. A group now fails with exit 1,
  names the unknown word, suggests the nearest subcommand when there is one and points at the group's
  `--help`; a bare group still prints its help. One helper covers the whole command tree, extending
  the T-746 fix for `observer org`; groups that take a positional value keep their own rule.
- **Security > Rules > "+ Add override" lets you pick the rule again (T-762).** The node dashboard's
  override editor locked its Rule picker whenever it was handed a starting row, and "+ Add override"
  always handed it a blank one, so it opened as "Edit override -" with an empty, disabled picker and no
  override could be added (rc.5 roll). Each opener now says how it opens the editor: "+ Add override"
  lets you pick the rule, "Override" on an effective rule opens a new override locked to that rule, and
  "Edit" on an existing override keeps its rule and saves in place.
- **"Grant an exception" no longer greets you with an error (T-763).** The org dashboard's proactive
  grant dialog sent the empty form to the server's preview at once and showed its reply, "user_id and
  type are required", in red before any input. The dialog now checks the member and the grant type
  itself, keeps Grant disabled until both are chosen, says what to choose in plain words ("Choose a
  member.") only after you have used the form, and asks the server for its decision once the form is
  complete.
- **The Agent Access doctors pass on the compose and Helm shape (T-751).** There the agentgateway
  sidecar runs the stock image, whose own binary is a different build from the upstream release asset
  the binary pin names, so `observer-mcpgw doctor` D12 could only skip (no binary in the companion's
  container) and, pointed at the image's binary, failed G7. The image digest is now the pin on that
  shape: `--agentgateway-image` (default `$OBSERVER_MCPGW_AGENTGATEWAY_IMAGE`, which the production
  compose and the Helm chart now set from the sidecar image) passes D12 on the release digest and
  fails another digest or a tag-only reference; with `--agentgateway-bin` the binary's `--version` must
  still be v1.6.0. `observer-org doctor agent-access` and `upgrade preflight` take the same flag.
- **The Fleet versions skew banner names the newest release candidate.** It read "to 1.36.0-rc.1"
  while three nodes ran 1.36.0-rc.3: the board compared versions by their X.Y.Z core only, so two
  release candidates of one release tied and map order picked one. The board's oldest and newest
  versions now use full SemVer precedence (rc.3 above rc.1, rc.10 above rc.9, a release above its
  candidates), with a stable tie-break for versions that differ only in build metadata.
- **A machine that left and re-enrolled with a new machine key is no longer refused (T-747).** After a
  structured leave and a reinstall that dropped `~/.observer`, the re-enrolled node's new machine key
  was a `409 machine_key_conflict` and its machine-scoped grants were withheld until an admin reset
  the key. A managed node's leave notice now carries its machine key's proof and the org server
  retires that key (audited `machine_key_retire`); when the leave could not do that (an older node,
  an unreachable server), the bearer of a fresh admin-minted enrolment of the same member replaces
  the key (`replaced`, audited with the enrolment token). A bearer alone, an older bearer, and a
  self-minted or IdP device-code enrolment still cannot move a key.
- **The installers name real commands, and `observer org <unknown>` fails (T-746).** install.sh and
  install.ps1 printed `observer org enroll <link>` and `observer org unenroll`, which did not exist,
  and `observer org` with an unknown word printed help and exited 0, so the enrolment silently did
  not happen. They now print `observer enroll --link <enrolment link>` and `observer unenroll`;
  `observer org <unknown>` exits 1 naming the real commands; `observer org enroll` and `observer org
  unenroll` run the top-level commands (hidden aliases); the enrolment's config.toml comment, the
  config editor and `observer mcp doctor` name `observer enroll`. A test checks every command the
  installers print against the command tree.
- **Uninstall from a root-owned prefix changes nothing; no-proxy wording; `init --all` with no tool
  (T-744).** `install.sh --uninstall` from a directory you cannot write (a root-owned
  `/usr/local/bin`) stopped the service and removed every hook before failing to delete the binary;
  it now checks first, changes nothing and prints the per-user commands plus the one `sudo rm -f`.
  The minimal edition's next steps no longer promise a proxy, the systemd unit's Description names
  what `observer start` runs on the node (`watcher + dashboard` without capture.proxy), and
  `observer init --all` on a machine with no AI tool says so after any component note instead of
  printing only `mcp skipped`.
- **Accepting the installer's service offer no longer skips the component chooser (T-745).** The offer
  writes `[components] add = ["integration.service"]` before the first `observer init`, and any
  `[components]` block skipped the chooser, so the documented install, yes, init flow never showed it
  and recorded no edition. An add-only block (no `distro`, no `remove`) now runs the chooser with
  those components shown as already on and records the edition base; a block naming a distro or a
  remove is still a recorded choice.
- **The component chooser asks about browser chat capture (D-561).** It never did, so capture.browser
  stayed on unless you ran `observer components remove capture.browser`. "Browser chat capture" is
  now a feature group carrying the five browser-chat adapters bundled with it, asked where the build
  includes it and shown unavailable where it does not; "capture only the detected tools" no longer
  turns those adapters off behind it.
- **`observer init` and `observer enroll` wire only the components you chose, and only tools you have
  (T-730, T-742).** Without `--config`, init and the enrolment's `--wire-clients` step treated every
  component as active, so they wired hooks, MCP entries and proxy routes for adapters you had removed
  (on a fresh full install, ~20 tools you never installed, including a new `~/.claude/settings.json`
  route) and skipped adapters you had added on a minimal or managed build. They now read the default
  config and its governance like the daemon does. A component teardown also no longer creates an empty
  config directory for every tool it checks (that is what made those tools look installed), and
  removing the deepseek or openclaw plugin shim on a machine that never had one is quiet instead of an
  error.
- **The first components choice on a fresh install writes a minimal config.toml (T-741).** With no
  `config.toml` yet, the first `[components]` write (the init chooser, `observer components select`,
  Settings > Components) re-serialized every default: a 665-line file with no comments that also
  pinned a disabled, empty `[org_client]` block, so a later enrolment left pushing off. A save to a
  missing file now writes only the keys it set.
- **An individual enrolment in an enterprise-posture org is offered an individual grant (T-740).** The
  enterprise auto-grant (every extract.* token, `settings.pin`, the enforce tokens and a managed consent
  class) was signed into every enrolment under the enterprise posture, individual ones included, so the
  node listed 22 managed-only authorities and then refused the grant. It now applies to managed
  enrolments only (one table, `enrolGrantShapes`); an individual token carries exactly what it was minted
  with, and the Invite form sends an individual token's selection as shown, so nothing ticked offers
  nothing.
- **The install-time component chooser starts from your build and adds only what you pick (T-731, T-733,
  T-737, T-734).** It always wrote `distro = "developer"`, even from a minimal binary (which then warned
  about ten components that build lacks); it now writes the binary's own distro. Accepting every default
  now writes exactly that distro's defaults: a "yes" to a group used to add every id in it (developer
  defaults turned on routing, remote access, the sandbox, the MCP relay and update management) and the
  `add` list repeated ids that were already on. On a minimal build a detected AI tool can be turned on in
  step 1, the summary counts every component the result leaves off, and unavailable groups print with
  step 2. On an org-managed node the chooser writes no distro and offers only what a local choice may
  add, saying so before it asks, instead of refusing your answers at the summary. Start at login (the
  system service) is now offered as its own group.
- **`observer service install` offers to turn the system service on instead of only refusing (T-734).**
  `integration.service` is off in every distro, so the documented `observer service install --now`
  refused on a fresh machine. On a terminal it now explains why and asks to turn it on (the same as
  `observer components add integration.service`), then installs; piped runs, org-managed nodes and
  builds without the service keep the one-line refusal.
- **`observer enroll` warns about a stopped proxy only for routes it left in place (T-736).** It told a
  node with no `~/.claude` that Claude Code now routes through the proxy via `~/.claude/settings.json`
  although nothing had been written. The warning now names the tools whose route points at the proxy
  and prints nothing when there are none.
- **The org Fleet marks nodes that left, and the posture page labels exclusions by their reason (T-738).**
  A node that ran `observer unenroll` (or whose member was deactivated) stayed an ordinary row that slid
  to "offline / no contact"; Fleet versions now marks it "left", from the node's structured leave at or
  after its last contact or from the directory, and says how many rows left. Collection & posture
  labelled every structural exclusion "excluded (service account)", including an ordinary developer
  whose grant was only wider than the live document; each row now names its reason (holds authority the
  fleet document cannot carry, excluded until the next re-issue, or excluded by an admin). Its Excluded
  tile counts the rows it lists and no longer counts up from 0: in a background tab the browser runs no
  animation frame, so the tile stayed at 0.
- **Component status, doctor and service wording say what is true (T-732, T-739).** With no
  `[components]` block, `observer components status` and `observer doctor` said every component was
  active on distro and managed builds too, then listed the inactive ones; they now say the build's
  defaults (or the organization's selection) are active, with the count. On a managed node doctor
  printed "(policy source unauthorized)"; it now says in words what decides. The leftovers check
  ignores components the build does not contain (capture.browser warned on a minimal build),
  `observer components --help` no longer calls the feature read-only, and `observer service install` no
  longer says the service is the proxy on a node where the proxy is not active.
- **A node that is not enrolled no longer warns about the org bearer keychain (T-735).** `observer proxy
  start` opened the org bearer store on every node and, on a machine without an OS keychain, warned
  about a fallback it would never use. It now opens it quietly when `[org_client]` is not enabled; the
  warning stays armed for the first enrolment. The one goose `FOREIGN KEY constraint failed` on a first
  scan after the upgrade (node 3, data complete afterwards) is recorded in `docs/goose-adapter.md`; its
  writer was not pinned.
- **`observer uninstall --all` and `observer init --all` on a machine with no AI tool say so (D-553).**
  They printed "no tools selected and none auto-detected - pass ... --all" even though `--all` was
  passed; they now say `--all` found no supported AI tool installed and there is nothing to do.
- **`observer start` no longer rewrites an equivalent Claude Code hook (T-725).** A daemon started from a
  different binary path (say `observer.135`) replaced every existing `.../bin/observer hook claude-code
  <event>` entry in `~/.claude/settings.json` with its own path plus `--config`, so each relaunch changed
  the user's file. Startup auto-registration now keeps an existing observer hook that is equivalent (same
  tool and event, same native or WSL-bridge shape, a binary that still runs, the same effective config
  file) and leaves the file byte-identical; it rewrites only a missing or broken hook and logs each
  rewrite with its reason. `observer init` still points every hook at the binary you run it from.
- **`observer update status` agrees with the daemon on auto-apply (T-727).** On a managed node whose
  enrolment grant puts it on the managed-fleet default, the CLI said "auto-apply off - the default for a
  BYO node" while the daemon log and the org Fleet row said on: the CLI read only `admin_managed` from
  the config. It now resolves the enrolment grant the way the daemon does and goes through the daemon's
  one auto-apply resolver.
- **Leaving an organization turns sharing off in config.toml; re-enrolling rewrites the address (T-728).**
  After Leave, `config.toml` still said `[org_client] enabled = true` with the address of the organization
  just left (on the operator's node, a retired server), and a re-enrol never rewrote an existing block.
  Leave now sets `enabled = false` once the leave has completed, as a one-line edit that keeps every comment
  and every other setting, and says so; a re-enrol sets it back to `true` and writes the new
  `org_server_url` the same way. The leave plan now also names the per-organization machine key as kept:
  it is the machine's identity, grants nothing without the org credentials Leave removes, and keeping it
  lets a return to the same organization reuse its registration instead of a 409 that needs an admin reset.
- **WebSocket upgrade passthrough off the deprecated `ReverseProxy.Director` (LINT-126-2).** The proxy's
  upgrade passthrough now uses `Rewrite` (Go 1.26) and sends the upstream the same headers as before:
  the client's `Forwarded` / `X-Forwarded-*` values are kept (Rewrite would strip them), the client address
  is appended to `X-Forwarded-For`, and no `X-Forwarded-Host` / `X-Forwarded-Proto` is added that was not
  sent. No change for clients or upstreams.
- **Builds without a component say so everywhere (T-726).** `observer doctor <tool>` for an adapter the
  build leaves out answers "not in this build" and names the builds that include it (it used to say
  "active - no adapter"); a teardown step whose undo verb the build lacks says to run it from a build
  that includes the component; the OpAMP routes of an org image without `org.opamp` answer
  `not_in_image` from every binary that links the org server package; and the session MCP-call panel of
  a build without the relay returns the session id and an empty `calls` list, the full build's shape.
- **The minimal edition passes its proof again.** A build with `sbo_omit_ui_export_xlsx` left the
  spreadsheet export out but did not report it, so the binary listed `ui.export-xlsx` as inert instead of
  compiled out and `sbo-components proof` refused the `minimal` edition. The binary now reports it.
- **`observer update apply` / `rollback` no longer run under a daemon that has no dashboard.** A build
  without the dashboard (or `observer start --no-dashboard`) answers no update endpoint, and the CLI used
  to apply, or restore a database snapshot, underneath the running daemon. It now reads the daemon's start
  lock and refuses with the reason and the fix: let the daemon's update loop apply it, or stop the daemon
  (proxy route off first) and run the verb again. `--dry-run` still runs.
- **Builds without the API proxy or the dashboard stop describing them.** `observer privacy` no longer lists
  a proxy listener such a build never binds, the bare `observer` greeting describes what `observer start`
  runs in this build and sees a headless daemon, OTLP exports keep their token rows when this node serves no
  proxy, and the Components pointers name the CLI verb when there is no Settings page.
- **Release tooling:** the omit-tag test files whose code a tag compiles out now carry that tag, and the
  public-tree obs sweep matches obs build lines with extra conjuncts.
- **`observer enroll` no longer moves a running daemon's hooks.** Its AI tool wiring step registered
  hooks and MCP against whichever binary ran the enrol, so an enrol from a second build pointed Claude
  Code's hooks away from the running daemon. It now uses the running daemon's binary and says so;
  `observer init` still points them at the binary you run it from. `observer org push-status` also
  stops printing a stale 900 s fallback interval. (T-642)

- **Ingestion stalls on large machines.** Several causes, all fixed:
  - Replacing a tool-output excerpt scanned the whole full-text table (about one second per tool result
    at 500,000 rows) on both the watcher and the hook path; it is now an index seek (0.67 ms).
  - The initial scan ran before the watcher started, so one slow tree starved every other tool; it now
    runs in the background, round-robin across adapters.
  - The guard's budget cache aged on transcript time, so a replayed backlog paid two slow budget queries
    per action even with no budget configured; the cache uses the guard's own clock, and no lookup runs
    when nothing reads a budget.
  - Files whose unread tail exceeded `max_file_size_mb` were skipped forever; they are now read in
    capped windows.
  - The cross-OS process sweep, root registration and the Codex poller no longer repeat full passes.
  - The managed (org budget) token read is bounded to the budget window (from about 3 to 4.6 seconds to
    under 1 second on a large database), so a large managed machine no longer times out its budget
    lookup.
- **Sessions that never reached the org.** After the startup orphan sweep, SQLite could reuse session
  row ids at or below the push cursor, so new sessions never shipped. The cursor is now clamped in the
  same transaction, `observer org status` shows a real "eligible" count, and leaving an org clears the
  push history.
- **Lost lifecycle events.** Compaction and session-end events that arrive before the watcher has
  ingested the session are held and retried instead of failing on a missing session.
- **Droid hooks never fired:** Observer wrote `hooks.json` under a wrapper Droid ignores. It now writes
  the root-level shape and repairs older files.
- **Per-project profile writer** wrote a zero-valued `[compression]` block that turned compression off
  for the project, followed a symlinked `.observer`, and accepted the home directory.
- **Quickstart dev sign-in** failed its CSRF check (403).
- Connected tools showed hooks "off" right after registration, and probed only Claude Code, Cursor and
  Codex; it now probes every registered hook.
- Governed machines logged 404 console errors for hidden sections; Fleet State showed `node.features` as
  local-only even when published.
- Managed machines now consent to `node.features`, including machines enrolled before this fix (added
  once at `observer start`), so org feature locks apply.
- Mistral vibe 2.25's unified session store is captured.
- A grant minted on the enrolment-token rail no longer reads as tampered; an org's first policy publish
  reaches nodes within seconds.
- A member on two or more teams can reserve at the AI gateway again.
- **Codex prompts dropped on Codex 0.148 and later** (see the upgrade notes); a forced rescan now reads a
  file over the size cap whole, window by window, instead of only its first window.
- **Codex subagent lineage.** A subagent rollout whose `session_meta.source` is an object lost its whole
  `session_meta` (real id, `thread_source`, `parent_thread_id`); it decodes now.
- **One prompt, counted once.** A Codex prompt both the hook and the rollout recorded is counted once in
  the Messages tab, the Projects prompt counts, the cost predictor and the Cloud Intelligence prompt
  sample.
- **Devin was stopped on every launch** under a managed hard USD cap, because the budget walk treated
  Devin's in-store `_versions/current` symlink as unreadable; links inside the store are walked now.
- **A policy stop inside a New Terminal** is explained at the terminal for wrapped launches too, instead
  of a bare `EXITED (255)`.
- **Qwen Code reasoning counted twice** and **Gemini CLI duplicate events** (see the upgrade notes for
  the Qwen rescan; Gemini needs none).
- **Split control / data org deployments.** About fifteen org dashboard handler families answered 404
  "no org", and the machine identity routes failed, when control and data lived in different databases.
- **`observer-healthcheck -print`** exists, so a roll can read the Agent Access hop state from inside the
  distroless image; an idle or zero-vserver hop counts as healthy.
- **Ingestion stalls, second round.** Five more full-text excerpt reads (the MCP `get_action_details`
  tool, retention, the reasoning backfill) seek by index instead of scanning the table
  (`get_action_details` for 25 ids: 14.3 s to 18 ms), and the initial scan serves whichever adapter lane
  is ready instead of waiting on a stuck one.

### Security

- **`golang.org/x/net` v0.60.0 (HTTP/2 advisories).** `golang.org/x/net` moves from v0.58.0 to v0.60.0
  and closes five advisories in its `http2` package that `govulncheck` found reachable from Observer code
  (the proxy, the org server, the AI gateway and `observer-mcpgw`): GO-2026-6612 (double flow-control
  refund on server streams), GO-2026-6603 (server memory exhaustion through Trailer headers),
  GO-2026-6610 (malformed framing headers forwarded by a reverse proxy), GO-2026-6611 (CPU exhaustion
  through repeated initial window changes) and GO-2026-6617 (server crash through an HPACK encoder race).
  The image CVE gate for `observer-mcpgw` would otherwise have blocked the release. Minimum version
  selection moves `golang.org/x/crypto` to v0.57.0, `x/sys` v0.48.0, `x/text` v0.42.0, `x/term` v0.46.0,
  `x/sync` v0.23.0, and the indirect `x/mod` v0.41.0 / `x/tools` v0.49.0. No code changed; the stdlib
  half of these advisories was already fixed by Go 1.26.9.

- **Agent Access sidecar: stock agentgateway v1.6.0 (glibc CVE-2026-19499).** The digest-pinned agentgateway
  sidecar moves from v1.5.0 to the stable v1.6.0 (the upstream `agentgateway/agentgateway` image,
  tag `v1.6.0`, digest `sha256:9d3e6044ddcdc0878b1787f77bd401252b95e22684203fb5e874c4c42d2ed90c`; the
  full image reference is in the Agent Access compose files and `docs/agent-access-cve-patch-runbook.md`),
  whose image carries Wolfi glibc 2.44-r7. That closes CVE-2026-19499 (High, glibc `strfmon` overflow), whose dated
  exception expired today and would have failed the Agent Access image CVE gate, and two High `hickory-resolver`
  advisories in v1.5.0's lockfile (ledger AA-45). v1.6.0's breaking changes concern LLM routes only; the MCP hop
  config is unchanged. If you mirror the sidecar yourself, mirror the new digest and set `AGENTGATEWAY_IMAGE`
  (compose / OpenTofu) or let the chart's new `agentAccess.sidecar.image` default take it (Helm);
  `observer-mcpgw doctor` now expects agentgateway 1.6.0.

- **Signed-rail and component governance fixes from the fourth adversarial review.** The org server's
  boot re-sign of routing policies, announcements and update manifests now verifies a stored document
  only against keys the server has itself served (a new org signing key history, server migration 231 /
  PostgreSQL 0098), never against the key the document's own row names, so a forged row can no longer be
  re-signed under the org key; rotating the key file keeps working (ledger SIGN-2). A managed node keeps
  an initial component set it inherited from an earlier grant together with the grant that signed it, so
  an edited set no longer re-verifies (MODPKG-17 (1)). A fleet grant replacement the super admin issues
  now carries `components.govern` and the managed initial component set; anyone else's names those
  members as excluded with the reason (MODPKG-17 (4)). A scheduled component purge waits instead of
  deleting while the node runs on a last-known-good `node.components` policy, and records its request
  before the delete (MODPKG-17 (3), (4)). The `distro-staging` workflow no longer expands its dispatch
  version into shell (CI-INPUT-1).

- **A member can no longer lock a colleague out of their machine-scoped grants (REVIEW-4, ledger
  GRANT-16 / GRANT-17 / GRANT-18).** Machine keys now bind the (member, machine) pair (org server
  migration 229 / PostgreSQL 0096, existing keys copied in), so registering someone else's machine id
  only ever affects your own grants. Key registration is audited in the same transaction as the write
  and a concurrent registration is a 409 instead of a silent replacement. The admin reset takes an
  optional member. A node now keeps one machine key per organization, so leaving an organization and
  coming back no longer ends in a permanent key conflict.
- **Audit and retention fixes on the org server (REVIEW-4, ledger AUDITSTORE-1, VCONN-14, VCONN-15).**
  The node scheduled-purge audit row is written to the org database before the change (it was lost on
  split control / data deployments); three vendor connection tables declared as aging out are now
  pruned; and unlinking a vendor identity restores all of the held call's identities (migration 230 /
  PostgreSQL 0097).

- **Go 1.26 toolchain and `golang.org/x/crypto` v0.56.0.** Every binary is now built with Go 1.26.9
  (`go 1.26.0`, `toolchain go1.26.9`), which lets `golang.org/x/crypto` move to v0.56.0 and closes
  GO-2026-6354 and GO-2026-6355 (`x/crypto/ssh` denial of service; never reachable from Observer code, but
  carried in every binary). The org server, MCP gateway, cloud and deploy images build on `golang:1.26`;
  the two dated image-scan exceptions for those advisories (ledger AA-47) are removed. Building from
  source now needs Go 1.26 or later. CI lints with golangci-lint v2.12.2 (the v1 linter cannot read a
  Go 1.26 module); `.golangci.yml` moved to the v2 schema with the same rule set.
- **Guard rule holes closed:** a leading shell keyword (`{`, `if ... then`, `do`, `!`) hid a command from
  every rule (for example `{ rm -rf /; }` was allowed under enforce); directory changes and links made in
  the same command (`cd`, `pushd`, `ln -s`, `mklink` and more) could steer a recursive delete around
  R-101; a HOME under `/tmp` exempted `rm -rf ~`; Cline CLI's `run_commands` batches were never judged.
  Interpreter one-liners (`python -c`, `node -e` and others) that read or delete a protected or secret
  path are now judged by the same rules as shell commands.
- **Signed rails bound to the org and the developer (binding v2),** sticky once a node has held a bound
  envelope; a 404 or an unsigned answer never clears a node's cached policy; a withdrawal is a signed
  tombstone. Re-enrolling clears every identity-bound signed cache, so one org's policy cannot survive
  into another.
- **Hook posture file** is signed by the daemon and expires after 3 minutes, so a forged or stale
  posture cannot open or wrongly close a gate.
- **No credential reaches the wrong provider:** a proxied request for an unknown `/up/<id>` lane is
  refused (502) and a malformed lane address answers 400 before any upstream request.
- **Credential-bearing vendor files** (zcode, Junie, Qwen, Hermes and every MCP config Observer writes)
  are edited only inside Observer's own entries, keep their file mode, and are never backed up or
  checksummed by Observer.
- **Self-approval of grants is refused** (see the upgrade notes), rule severity and lock status are
  resolved on the server, and a grant on a shared budget row is refused.
- **Need-to-know:** a composed guard bundle names only the developer's own teams, and a member or team
  bundle's free-text note no longer reaches every recipient. A hidden settings section reveals nothing,
  not even which secrets exist.
- **INTEL-7** (see the upgrade notes).
- **Third adversarial review (REVIEW-3) folded.** The machine inventory filter could skip the
  `read:content` gate (`state=observed%20`); a dashboard ops job ran as the host user, so its launcher
  could approve their own Agent Access rollback; a deactivated service account's credentials still
  authenticated; the vendor usage read was not audited; the OTLP token file was accepted with any mode or
  owner; a pushed project hash opened another project's digest history; purge-subject could sign out a
  member without `admin:members`. All fixed. See `docs/security.md` (REVIEW3-* rows).
- **Vendor export credentials are exclusive at every request,** not only when minted (EA-F10), and every
  org route reads the org from the control store.
- **Guard: sensitive paths follow `cd`, PowerShell script blocks are judged.** A protected path reached
  through an earlier directory change is judged like the full path, and a recursive delete inside a
  PowerShell script block is judged (a pipeline `$_` target and an uncalled function definition ask;
  everything else keeps its verdict).
- **Hook-path budget stops are fresh.** A stop older than 2 minutes is ignored, the file is removed on
  unenrol and rewritten when damaged, and a transient spend read failure stops tools only after three
  failed ticks (an operator ruling; structural failures still stop at once).
- **The notification state write** needs the dashboard's confirm token and is audited.

### What changed during the release candidates

None of the five 1.36.0 release candidates was tagged or published: each was built locally and rolled
to the demo org server and nodes, and the notes above stayed one list throughout. What each candidate
added:

rc.2 replaces rc.1, which was built and rolled to the demo but never tagged or published, so this
section carries rc.1's notes and what changed after it as one list. New since rc.1: the edition
installer (`scripts/install.sh`, `scripts/install.ps1`) and the edition archives as release assets
(T-729), the follow-ups found during the rc.1 roll (T-725, T-727, T-728, LINT-126-2) and the
install and enrolment fixes from the fresh-install check on the demo nodes (T-730 to T-742).

rc.3 replaces rc.2, which was rolled to the demo org server and nodes 1 to 5 but never tagged or
published; this section stays one list. New since rc.2: `golang.org/x/net` 0.60.0 for four `http2`
advisories (lane XNET), the agentgateway sidecar re-pinned to v1.6.0, closing AA-45 (lane AGW16),
the fixes from the rc.2 roll (T-744 to T-747 and the browser capture question, lane FIX-RC2), and
release clean-ups: the Antigravity HTTP/2 clients moved off the deprecated `x/net` `http2.Transport`
with no behaviour change, the installer scripts executable again, and the Agent Access task-grant
refusal re-grounded on agentgateway v1.6.0 (T-749).

rc.4 replaces rc.3, which was pushed to `origin` and rolled to the demo org server and nodes 1 to 5
but never tagged or published; this section stays one list. New since rc.3: the fixes from the rc.3
roll (lane FIX-RC3). An in-place upgrade no longer leaves the old daemon running behind a "started"
message: install.sh hands a running unit to the new `observer service upgrade`, which restarts the
daemon only when nothing can be routed through it and otherwise prints the safe restart order, and
install.ps1 and the npm package name a daemon still running the replaced binary without restarting
anything (T-753). The Agent Access doctors check the compose and Helm sidecar by its image digest
(T-751), and the Fleet versions skew banner orders release candidates by full SemVer precedence.

rc.5 replaces rc.4, which was pushed to `origin` and rolled to the demo org server and nodes 1 to 5
but never tagged or published; this section stays one list. New since rc.4: the fixes from the rc.4
roll (lane FIX-RC4): the npm restart hint now fires on an npm 10 global upgrade, which moves the old
package aside before the new postinstall runs (T-756), and every `observer` command group refuses an
unknown subcommand with exit 1 and a hint instead of printing its help and exiting 0 (T-757). And
the pickers rule (lanes PICKERS and PICKERS-2, D-571): wherever the valid values are a known set, the
org dashboard, the node dashboard, the cloud portal and the interactive CLI prompts offer a list to
pick from instead of a text box, starting with Organization > Node components, and a choice that
cannot be used is listed greyed out with the reason (the `### Changed` entries).

1.36.0 replaces rc.5, which was pushed to `origin` and rolled to the demo org server and nodes 1 to 5
but never tagged or published. New since rc.5: the two dashboard fixes from the rc.5 roll (lane
FIX-RC5): Security > Rules > "+ Add override" lets you pick the rule again (T-762), and the org
dashboard's "Grant an exception" dialog no longer shows a server error before any input (T-763).

## [1.34.0] — 2026-10-01

Stable release on the `stable` channel (npm dist-tags `latest` + `stable`, PyPI, VS Code Marketplace and
Open VSX). It promotes `v1.34.0-rc.11` unchanged except for one release-script fix, and collects
everything that shipped on `edge` across `1.34.0-rc.1` through `rc.11` (`rc.9` was tagged but never
published). The per-RC sections below carry the full notes. Headlines since 1.33.0:

- Agent Access: SuperBased-minted agent identity and a governed MCP gateway (`observer-mcpgw`), off by
  default and inert when off (see `docs/agent-access.md`).
- Pricing chain: the full Tokenomics rate set reaches org and node pricing, the compiled price table is
  regenerated from the signed feed v9, model context windows come from Tokenomics, the org pricing feed
  gains a grade gate, and OpenAI Ultrafast turns are priced.
- Org guardrail control wave, the org admin assistant reaching every admin route, the shared design kit
  across the node and org dashboards, opt-in retroactive re-pricing, sandboxed-terminal containment, and a
  node dashboard performance pass.
- Enterprise deployment: cosign-signed `observer-org`, `observer-postgres` and `harness-gateway` images
  in the private registry, plus the release-pipeline fixes found while cutting the first pre-release tags.
- The VS Code extension publishes for the first time since 1.33.0 (the Marketplace refuses pre-release
  versions, so no RC reached it).

Upgrading from 1.33.0: node binaries run their agent migrations on `observer start` (head 147). On the
org server run `observer-org upgrade preflight` and then `observer-org migrate` before starting the new
image (server head 191, PostgreSQL head 0057; PostgreSQL 0032 needs `btree_gist`, see the rc.10 notes).
On a node that was enrolled before rc.10, run `observer org resync` once (dry run by default, `--confirm`
to queue).

Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

- fix(release): the CHANGELOG price-snapshot check no longer misses a line that is present.

## [1.34.0-rc.11] — 2026-10-01

Pre-release on the `edge` channel; everything since rc.10 (2026-09-30): the pricing-chain arc (every
Tokenomics rate component reaches org and node pricing; context windows come from Tokenomics, not a
hard-coded table), the org pricing-feed grade gate, OpenAI Ultrafast pricing, the compiled price table
regenerated from the signed feed v9, and the tokcron approval flow. This is also the first release that
carries the rc.10 public-CI fixes (mcprelay signal tests `//go:build !windows`, the taxgen theme
selectors, `admission_verify_test.go` scrubbed from the public tree, `projectskills_identity_test.go`) to
the public repository. Migrations: server 190-191 / PostgreSQL 0056-0057 (additive); no new agent
migrations (head stays 147). On the org server run `observer-org upgrade preflight` and then
`observer-org migrate` before starting the new image.

Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

- feat(pricing): the full Tokenomics rate set reaches org and node pricing - the reasoning rate, the per-request fee, the other-TTL cache write, image and audio rates, the fast multiplier and the grade ride the feed rows, `org_model_prices` (server 190 / pg 0056, nine nullable columns) and the signed org pricing document, all additive with presence semantics. An enrolled node's fast-mode premium now comes from the org rail. The reasoning rate is applied to separately tracked reasoning tokens; the request / image / audio / other-TTL rates are carried and shown in `observer pricing status`. A quoted `long_context_threshold` of 0 means FLAT on the feed, snapshot and org paths alike; prices are rounded to 1e-10 at every decode boundary.
- feat(org-pricing): the feed's grade now gates auto-apply vs park: a row below the configured minimum grade parks in auto mode (unknown mode or grade parks), through the existing park / approve flow. Mode and minimum grade live in `org_pricing_feed_settings` (server 191 / pg 0057), seeded once from `[pricing_feed].mode` and then dashboard-owned: `GET/PUT /api/org/pricing/feed/settings` (`read:budgets` / `write:pricing`, audited), a Pricing-page card and an assistant tool.
- fix(org-pricing): `observer-org pricing status` no longer fails on PostgreSQL (it wrote on a read-only store); a new read-only org lookup serves it.
- feat(routing): model context windows come from the Tokenomics data (the org document's windows, then the feed, then the compiled snapshot), never a hard-coded prefix table. An unknown window never excludes a candidate and never assumes a default; a switch to such a model carries the new reason code `context_window_unknown` (labelled on the Routing page). The advisor's balloon detector sizes sessions against the same composition, keeping its model-tag guess only for models the data does not cover yet.
- feat(cost): an OpenAI Ultrafast turn (`service_tier: "ultrafast"`) is priced as the exact `<model>-ultrafast` price key from any rung; with no such key it bills the standard rate and records a pricing warning, never the Fast multiplier. A request-side `service_tier: "fast"` now counts as Fast. Proxy path only for now (non-proxied Codex and offline re-pricers do not store the tier yet).
- feat(pricing): the compiled price table is regenerated from the signed Tokenomics feed v9 (maker prices over resellers, Claude Sonnet 5.5 at $2 / $10, the GPT-6 and Grok long-context tiers, gpt-6-astra-ultrafast, gpt-5.6-cyber, gpt-6.1-sol, gpt-realtime-2.1) and now carries context windows for 86 models. Claude Sonnet 4.5 is FLAT (Anthropic states no long-context premium); xAI's inclusive ">= 200K tokens" tier is encoded as threshold 199999.
- feat(model-pricing): Tokenomics migrations 0032 (every rate component, a context-window fallback, `long_context_flat`, presence fill from the same maker's next-best card) and 0033 (the xAI inclusive threshold); the evidence gate reads real vendor pages (table structure, tier sections, multiples of the base rate) - a by-the-README OpenAI + xAI capture now passes 87/87 and 64/64 rows.
- feat(tokcron): a price proposal is approved by ONE file (`APPROVAL.md`, `APPROVE: yes`) and `approve.sh` then runs unattended; the clone-of-prod rehearsal and prod load only the approved overlay files with prod's own identity; the rehearsal base mirrors prod's catalog state (`snapshot-prod.sh`), and `refresh` refuses before review when the local "before" differs from prod's export; a same-value cache-write slot move is an acknowledgement, a changed value is still refused.
- fix(deploy): a working-tree `observer-org` build no longer embeds OpenTofu provider caches (1.08 GB -> 112 MB): `make tofu-validate` keeps its data under `~/.cache/observer-tofu`, a test fails if a `.terraform` directory is embedded, and `build-orgserver` enforces a 200 MB budget. Release images were never affected (they build from `git archive`).
- test: CI timing flakes fixed (pricing-policy deadline, config-grid wall clock); the cross-engine context-gauge fixtures run on a model id the compiled snapshot does not name, so the "no catalog" rows stay meaningful as the snapshot grows.

## [1.34.0-rc.10] — 2026-09-30

`v1.34.0-rc.9` was tagged but never published: its release build failed (the web apps did not declare `lucide-react`, which the shared design kit imports) and its public snapshot did not compile (`release.sh` committed the unpatched `no_obs` stubs). rc.10 carries the same changes plus those two fixes.

Pre-release on the `edge` channel; everything since rc.8 (2026-09-21): Agent Access (off by default), the
post-Agent-Access backlog and its two live-verification rounds, the finish round (the shared design kit,
maker-over-reseller prices and Claude Sonnet 5.5, code-vs-comment lines, commit ownership, org session
gauges, the org daily spend summary), opt-in retroactive re-pricing, sandboxed-terminal containment, a
node dashboard performance pass and chart time granularity, with the review folds of each round.
Migrations: agent 127-147 (node-local or additive; they run on `observer start`), server 160-189 /
PostgreSQL 0026-0055. On the org server run `observer-org upgrade preflight` and then
`observer-org migrate` before starting the new image (PostgreSQL 0032 needs `btree_gist`; on Azure
Flexible Server see the `btree_gist` entry below). Node binaries need updating too. On a node that was
enrolled before this release, run `observer org resync` once (dry run by default; `--confirm` to queue)
so rows that changed or were corrected on the node before the re-send lane existed reach the org.

- chore(config): the flat `[org_client.share]` `obs_summary` / `obs_traces` / `obs_content` / `obs_eval_summary` aliases are removed from the schema - the same leak as the code-graph blocks: the struct fields still existed, so every dashboard save / `observer config set` wrote them back and every observer process kept printing their deprecation lines. A config still carrying them keeps loading (the keys are ignored; `[org_client.share.obs]` is the only spelling read); `observer start` / `observer config migrate` rewrite them on disk (config-migrate step 5, `config_version = 5`): leftovers beside the nested keys are stripped with the nested values kept, a flat key with no nested counterpart is moved onto it, and a never-migrated file still has its values carried by step 2. What ships to an org is unchanged. A new invariant pins that no key the migrate registry retires can come back as a config field.
- chore(config,codeintel): the legacy `[compression.code_graph]` / `[intelligence.code_graph]` config blocks are removed from the schema. They outlived their one-release deprecation window because the config structs still existed, so every dashboard save / `observer config set` wrote them back and the deprecation warnings never stopped. A config still carrying them keeps loading (the keys are ignored); `observer start` / `observer config migrate` now strip them (config-migrate step 4; a never-migrated file still has its values carried onto `[codeintel]` first). The dead Settings -> Intelligence "Code graph" toggle is gone - `codeintel.enabled` is the switch.
- feat(agent-access): Agent Access - SuperBased-minted agent identity and a governed MCP gateway (optional, OFF by default: `[agent_access].enabled` on the org server, `[mcp_relay].enabled` on the node; both inert and byte-identical when off). A new companion binary `observer-mcpgw` (roles sts / pdp / xds / front / connect / egress) runs a Go MCP policy front in front of a stock, digest-pinned agentgateway v1.5.0 (ADR-0007, data plane A2). Every governed MCP call is authorised by one in-process policy decision point and recorded before it acts in a per-org hash-chained audit (async by default, fail-closed only when neither a leased sequence block nor the spool is writable). Tokens: RFC 8693 exchange for node relays, `client_credentials` (private_key_jwt incl. `jwks_uri`, mTLS, client secret, `sbo_mcp_` API keys), an OAuth 2.1 authorization server with DCR and CIMD for direct MCP clients, and end-user OBO. Bearer by default, DPoP / mTLS opt-in per virtual server. See `docs/agent-access.md`.
- feat(agent-access): MCP server registry, virtual servers, grants (incl. team and project subjects, fail-closed without trusted context), single-author policy publish with optional four-eyes, snapshot pinning with drift alerts, per-user OAuth connections (sealed per record; My Connections in the org dashboard; the connect callback lands on the dashboard origin), TOCTOU-safe parked approvals bound to the request digest and the live connection pin, MCP server / tool token budgets (`budgets.scope` gains `mcp_server` / `mcp_tool`), shadow-MCP discovery from node inventories, and an MCP-calls panel in the node session detail and the org session drawer. Org migrations 163-173 (PostgreSQL 0029-0039), node migrations 131-134.
- feat(agent-access): `observer-org agent-access` - the full admin CLI (`server`, `vserver`, `grant`, `policy`, `agent`, `credential`, `key`, `approval`, `connection`, `audit`, `reset-bootstrap`, `purge-subject <id>`, `reapply`). Routed verbs run the dashboard's own handler in-process and write the same audit row as `cli:<os-user>`; `purge-subject` is the DSAR / deprovision cascade (credentials, API keys, OAuth AS grants, crypto-erased vault connections and IdP artifacts, task bindings, dashboard sessions, member generation; audit tables never touched).
- feat(agent-access): `observer-org agent-access reapply --since <T> --from <source>` re-applies, forward only, the security actions a point-in-time restore silently undoes (purges, credential / API-key / OAuth-client revokes, connection and IdP-artifact erasures, agent / server retirements and quarantines, private-network locks, key rotations and retirements, the policy-generation floor, member session revokes) from the pre-restore database (read-only), the split data store, or a saved `/api/org/audit` page - never the MCP WORM export. Each step probes, applies only if missing and re-probes through the seam the original used; `--dry-run` writes nothing; a real run (`--confirm`) writes one `agent_access.reapply` audit row and then makes every restored refreshable connection due for refresh so reused tokens are re-detected. Run it before the restored server takes traffic.
- feat(agent-access): node `observer mcp {status|relay|wrap|unwrap|connect|doctor}` (the older `observer mcp-relay` spelling stays); the node dashboard Security page gains an "MCP access" section and `GET /api/mcp-access/status`; the VS Code extension gains an "MCP access" status item.
- feat(agent-access): `observer-org doctor agent-access` (probes AA1-AA10, each naming its failure mode), Agent Access rows in `observer-org upgrade preflight` (schema range, normalized listener conflicts, key-ring health, the observer-mcpgw same-tag lockstep and agentgateway pin), an `agent-access.json` support-bundle section, and an Agent Access alert rule set (pdp_down, pdp_degraded, audit_degraded, xds_nack, sts_down, replay_store_down, control_store_down, stale_replica, jwks_rotation_stall, mcp_budget_breach, vault_refresh_failures; mailed under `[dashboard].obs_alert_email`). `[agent_access].companion_health_urls` lists several companions for split and multi-replica deployments: `pdp_down` then pages only when every companion is down and `pdp_degraded` warns per down companion.
- feat(agent-access): backpressure on the MCP front: PDP decision deadline `pdp_decision_timeout` (default 1 s; ~250 ms stays the latency target), per-call upstream deadline `hop_call_timeout` (120 s; first byte for SSE), a per-upstream circuit breaker (`hop_breaker_failures` 5, `hop_breaker_cooldown` 10 s) and an overload shed (`front_max_in_flight` 1024). All answer a retryable 503 + `Retry-After`; nothing retries a call.
- feat(agent-access): Azure Key Vault signing keys rotate through the product: `observer-org agent-access key rotate` adds (or, with `--akv-key-version`, adopts) a Key Vault key version to the ring through the same ACK-gated activation, `--emergency` included; an identity that cannot create versions gets a 409 that prints the exact `az keyvault key create` + `key rotate --akv-key-version` step. The front's own key cache is bounded by `min(invalidation_max_staleness, jwks_cache_seconds)`, so `key retire` takes effect at every running front without a restart (a key-set outage answers 503 + `Retry-After`, never 401).
- feat(deploy,charts,release,supply-chain): Agent Access in every deployment shape, off by default everywhere, with one topology: `observer-mcpgw` and the agentgateway sidecar share the org's network namespace and sit behind the existing TLS terminator on ONE origin (the STS paths to :8850, `/mcp/*` and its protected-resource metadata to :8851, everything else to :8443; no new DNS name, certificate or public port). Org compose (production + dev) gains a `docker-compose.agent-access.yaml` override, an inert `[agent_access]` block, a Caddyfile with the path routes, `keygen.sh agent-access-env` and preflight checks (`OBSERVER_AGENT_ACCESS_COMPANION=external` keeps the separate-host companion supported); Helm chart 0.3.0 gains `agentAccess.*` (companion in the worker pod by default); `observer-org deploy plan --set agent_access=on` renders the whole switch (config, .env, the override, tfvars, RUNBOOK checklist and route table); every Azure and AWS OpenTofu root gains `agent_access` (session key minted in Key Vault / Secrets Manager, Caddy / HAProxy / Application Gateway / ALB path routes, first-boot cosign verification, and refusal of a bundle that disagrees). At zero virtual servers the companion writes an idle hop config, so the sidecar stays up and the companion reports ready.
- feat(supply-chain): doc3 §18 gate 7 as code - `.github/workflows/agent-access-images.yml` (runs on every `v*` tag, separately from the npm / PyPI / Marketplace release) builds `observer-mcpgw` from an archive of the tag, emits SPDX + CycloneDX SBOMs, gates on a grype CVE scan against the ruled patch SLA, pushes by digest, cosign-signs keylessly with SBOM attestations and SLSA provenance, and mirrors the agentgateway image only after verifying upstream's signature and provenance, then counter-signs it. `scripts/agent-access-supply-chain-check.sh` is the one policy owner (pins / identity / upstream / verify / gate); dated, ledgered exceptions live in `deploy/observer-mcpgw/cve-exceptions.json`; `roll-a2.sh` verifies before every pull. The air-gap kit carries both images once that run has published them. Publishing needs registry credentials; without them the jobs build, scan and skip publish.
- feat(org-assistant): the admin assistant reaches every admin route: its closed tool table grows 58 -> 212 rows (every admin route is mirrored by a row or carries a reasoned exclusion, pinned by `TestEveryAdminRouteIsReachableOrExcluded`), then 212 -> 247 with the Agent Access admin routes (4 read views, 31 route rows - 30 writes plus a simulate read - under the domains `agent_access` and `mcp`; minted secrets go once to the approver, never into the transcript; the approve / reject decision routes stay human-only). `admin:agent_principals`, `admin:agent_keys`, `write:mcp_registry` and `write:mcp_policy` become privileged keys: granting or widening them (dashboard or assistant) needs the super admin.
- fix(agent-access): the PDP no longer serves its last-known-good policy forever (`invalidation_max_staleness` is enforced at decision time; `/healthz` goes not-ready past it); an agentgateway dying mid-response is answered with a retryable error and audited `hop_unavailable` instead of `ok`; the front's hop client pools connections; the front refetches the key ring within 1 s of an unknown kid (was 30 s: a 401 storm after every rotation); a node relay no longer reports a refused policy version as running.
- fix(agent-access): honest readiness and retryable outages: a NEW policy publication that fails to compile is refused and the replica keeps last-known-good (then fails closed at `invalidation_max_staleness`); the rendered `hop.yaml` is checked with the pinned agentgateway's `--validate-only` before it replaces the live file; `/healthz` gains `audit_store_error` and `dpop_replay`, `audit_degraded` pages on a data-store outage and now clears on recovery (it was sticky until restart), and a new `control_store_down` alert rule; an ineffective node relay point reports `accepted_inert`, never `effective`; the relay keeps a still-valid cached token while the STS is down and fails closed only within 5 s of expiry; transient store outages at the token endpoint answer 503 `temporarily_unavailable` + `Retry-After: 2`; a `refresh_token` rotation is undone when the mint fails, so a retry is no longer mistaken for reuse.
- fix(agent-access): security fixes from the session-3 adversarial reviews (ledger `docs/security.md` AA-13..AA-23, AA-GEN-1): an ambient HTTP proxy no longer bypasses the egress SSRF guard (explicit `[agent_access].egress_proxy_url` instead); approval redemption is fenced on the live connection; duplicate JSON members are refused before any decoding; approval previews require `read:content`; SCIM and team-admin roster changes commit atomically with the member-generation fence; every revocation strictly advances the member floor; a zero-estimate MCP call's quota reservation persists the unit it was checked against; discovery retention prunes the control store on split deployments.
- fix(agent-access): `deploy/observer-mcpgw/docker-compose.a2.yaml` sets `stop_grace_period: 45s` (Docker's 10 s default cut the companion's drain short); the `istio.io/istio` dependency moves past GO-2026-5363 / GO-2026-5289 (govulncheck: 0 reachable in all three binaries).
- fix(deploy,observer-org): PostgreSQL migration 0032 creates `btree_gist`, which Azure Database for PostgreSQL Flexible Server refuses unless it is in `azure.extensions`: the Azure OpenTofu module now allow-lists `BTREE_GIST` (a drift test fails when the lineage creates an extension the module does not allow), and `observer-org upgrade preflight` gains a `<plane> extensions` row per PostgreSQL store that refuses before migrate when a pending migration needs an extension the server will not allow, printing the exact fix. A server not managed by the module (for example an existing demo estate) needs the printed `az postgres flexible-server parameter set` step before the roll that carries 0032.
- fix(support-bundle): doctor.txt ran with the support-bundle command's own arguments (cobra reads os.Args when args are nil) and never held the doctor's output; config.redacted.toml no longer carries URL userinfo (a proxy password in `[agent_access].egress_proxy_url` / `serving_replicas`).
- feat(sessions): Tok/s has one owner. The Messages table's throughput used to divide output tokens by the gap to the next row (idle time read as generation time); it now divides by a measured per-call duration - the proxy's request time, the tool's own recorded per-call time (devin, hermes, poolside, muse, legacy copilot, cowork) or spans reconstructed from the Claude Code / Codex transcript - and shows "not measured" otherwise; the gap is shown only as "Elapsed". The node Messages tab, the cockpit and the org session drawer render the same value (`token_usage.gen_ms` / `gen_basis` ship on the org wire as metadata). Agent migration 136, server 174 / pg 0040. See `docs/message-throughput.md`.
- feat(pricing): frontier model price refresh (2026-09-23: Anthropic, OpenAI, xAI, Cognition) folded onto the seed with presence semantics (a dimension the snapshot omits keeps the seed value; a stated one wins, a quoted zero included); a feed replay / downgrade floor; cache reads a vendor does not price surface as unpriced instead of $0. `org_model_prices.long_context_threshold` becomes nullable (server 175 / pg 0041): NULL keeps the node's seed long-context tier, a quoted 0 means negotiated flat; `orgcontract.PricingPolicyRow.LongContextThreshold` is `*int64` on the signed rail (compatible both ways).
- feat(model-pricing): tokcron, an approval-gated refresh job for the Tokenomics data behind the public pricing feed: it re-fetches vendor endpoints, gates hand-captured prices against vendor pages it fetched itself, rehearses on a local database and writes a proposal only when the feed would change; only the operator's interactive approve step (re-proved on a throwaway clone of production) reaches production. See `model-pricing/deploy/tokcron/README.md`.
- feat(org): bulk developer import - `POST /api/org/members/import` (dry run, up to 200 rows, preflighted refusals before any mint, itemized per-row status and honest delivery `notifier_invoked` / `no_notifier_configured`, audited) and an Import developers dialog on the Provisioning page (paste or CSV).
- feat(guard): control coverage per tool - one row per tool joining the tool-call enforcement channel, the prompt-submit posture, budget admission and route proof, on `observer adapters`, `observer doctor <tool>`, `GET /api/org/guard/coverage` and the org Security page.
- fix(org): every session-scoped org read and every org correlation that joined on a bare session id is now bound to the session's owner (sessions are keyed by id AND user; a same-id session pushed by another developer can no longer be read through, merged into, or counted against a colleague's), including Live, the monthly report, LOC aggregates, the route matrix and coding-job evidence (an ambiguous owner is refused rather than guessed); task prose, the raw action target and the raw `project_root` are served only to callers holding `read:content` (ledger ORG-SCOPE-1 / ORG-CONTENT-1 / ORG-SCOPE-3).
- fix(org): project display names never show a hash-seeded placeholder when a repository name is known (one resolver for the Projects list, project detail, sessions, budgets and team views); the org Tools page gains a per-tool version histogram (`GET /api/org/tools/versions`).
- fix(alignment): the Projects-page local LLM judge (tier J) refuses to send org-owned or unknown-authority evidence to a non-loopback endpoint unless it is org-pinned; loopback detection is an exact host match (ledger JUDGE-1).
- fix(cursor): Cursor IDE sessions no longer lose their token rows - the hook writes tokens first under their own deadline, Cursor's own hooks log is replayed as a backstop (deduplicated against the live hook), root-less events resolve to the session's real project root, and stale hook entries left by a lost build are healed on registration (`observer doctor` check `cursor.hooks`; `observer backfill --cursor-hook-usage` recovers history).
- fix(deploy): the Azure env-sync re-applies a secret rotated in Key Vault to an already-rendered `.env` value and tracks what it applied per key (pending / committed / operator_override), so a crash on either side of the write is recoverable and an operator's own value is never overwritten (D-DEMO-16).
- fix(configschema): the committed `[mcp_relay]` annotation rows that the embedded config schema was generated from (`make verify-config-schema` is green again).
- docs(agent-access): operator reference `docs/agent-access.md` (incl. a per-profile enable checklist); runbooks for key rotation, restart while routed, audit degraded, vault refresh and CVE patching; `docs/agent-access-production-gates.md` (doc3 §18: gates 1-3 and 5 pass locally; the gate-4 reapply tool is built but the drill has not run; gate 7 is built as code with enablement pending registry credentials; live client interop not run); the vendor pen-test scope `docs/agent-access-pentest-scope.md`. Not yet done: push and deploy, the estate soak, the external penetration test, the six-agent security sweep, the live Azure Key Vault and client-interop checks.

- feat(projects): a new **Skills** tab on the node Projects detail panel (and `observer project <id|root> --skills`) shows every skill a project can load (`.claude/skills/<name>/SKILL.md` and `~/.claude/skills`), how each changed across the project's commits (versions identified by git blob id; added/modified/deleted, reintroduced, exact-content moves), and per session three separate facts: the version the Claude Code hook OBSERVED on disk at session start (SessionStart incl. resume/compact), the version committed at the commit the git REFLOG says HEAD was on, and the version each Skill-tool invocation used (PostToolUse, joined by tool_use_id). Sessions before capture read "not captured", never a guessed version; "uncommitted"/"untracked"/"ignored" come only from the status porcelain. Capture: hook snapshots (fail-open, 250 ms budget) + a read-only git step riding the commit scanner tick (reflog, `ls-tree`, status) through the one `gitview` envelope, with `GIT_NO_LAZY_FETCH=1` added for this step only (a partial clone never fetches). Reflog entries sharing one second are ordered by the reflog itself, and a session whose chosen second holds several commits reads "HEAD moved several times in one second" rather than a guess; same-second commits are ordered by ancestry. Agent migration 135 adds seven NODE-LOCAL tables (privacy sentinel + seeded test); `[projects].skill_history` (default on) and `skill_history_skew_seconds` (default 120). Existing endpoints are byte-identical. See `docs/projects-page.md` "Skills: versions across commits and sessions".
- fix(teams): the org session drawer's message rows are derived by the SAME pure code as the node's Messages tab (new `internal/sessionmsg`): orphaned actions, proxy/JSONL twins, codex multi-call turns (new wire column `token_usage.turn_id`, server migration 160 / pg 0026), user-prompt keying and Copilot shadow rows now fold identically on both sides; web2 labels a body that exists but joins no row "captured, not aligned" instead of "not shared" and joins tool bodies by id.
- perf(projects): one union activity query, one windowed LOC loader and agent migration 130's three covering indexes replace four correlated EXISTS probes and a whole-ledger LOC scan per Projects read; every project window is half-open `[since, until)`.
- fix(projects): the Projects page's spend figures (detail panel, the `/projects` list, and every `usd` ROI proxy) now go through the process cost engine's own per-turn dedup+pricing pipeline instead of a second, drifted implementation - closes several undercounting bugs (session-cumulative adapters like droid/goose/crush double-counted against their own proxy rows; a proxy turn's project was silently dropped whenever `api_turns.project_id` was NULL, which is every grounded install; a codex-shaped turn's reasoning-token split could double-bill). The commit count shown on the detail panel, the `/projects` list and the ROI proxies is now the same reachable-only predicate everywhere.
- fix: the Projects-page Commits/Prompts/Spend tabs now surface a "row caps hit" notice (matching the existing Overview banner) whenever a request-time linkage cap actually truncated their data, and flag a prompt's committed/uncommitted status as uncertain when it was computed over a capped input; the underlying prompt-linkage query and the task-report rollup are both faster (a new covering index and batched, no-longer-N+1 task queries).
- fix(predict): codex rate-limit snapshots were silently dropped when a client reported `plan_type: null` with a populated window; codex's 5h/weekly window label is now derived from the window's own duration instead of its `primary`/`secondary` position (a single-window plan was rendering its weekly cap under the "5-hour" label). The next-message predictor's limit gauge gained an honest "not visible" state (CLI, dashboard, `/api/session/<id>/predict`) for tools where no local usage-limit signal can exist (cursor, grokbot), replacing the misleading "route through the proxy" hint. Run `observer backfill --codex-rescan` if your codex rate-limit history has a gap.
- fix(tools): the Connected Tools page now flags compiled-in default adapters that are missing from a hand-written `enabled_adapters` list (a warn banner + a "not enabled (new default)" pill, one owner: the `adopt-defaults` diff), and `observer config adopt-defaults --write` states honestly that the daemon must be restarted before the new adapters capture anything.
- Node dashboard: a new Projects page detail panel (`web/src/components/ProjectDetailPanel.tsx`,
  `web/src/components/projectdetail/`) with six tabs — Overview, Spend, Commits, Prompts, Tasks,
  Guidance — answering "is the money I put into API tokens turning into shipped work?" per project.
  The list view (`web/src/pages/Projects.tsx`) grows additive spend/AI-lines/commit/capture columns;
  an empty corpus keeps a byte-identical legacy `/api/projects` payload. See `docs/projects-page.md`.
- Commit capture: a new read-only, HEAD-only `git log` scanner (`internal/commitscan`, `internal/commitlog`,
  daemon-lifetime, never a git hook install, `[projects].commit_scan` default on, 120s ticker) populates
  three new node-local tables (`project_commits`, `project_commit_files`, `project_commit_scan`, migration
  127) with reachability revalidation every tick so a rebased/reset commit is flagged, never deleted.
  `observer backfill --commits` runs a full-history pass; `observer doctor` gains a `commit-capture` line.
- Prompt-to-commit attribution + ROI: a pure `internal/projectroi` package links each AI edit to its
  owning prompt, applies a per-file supersede rule, then matches against commits within a configurable
  link window (`[projects].commit_link_window_days`, default 14 days) to produce a `committed` /
  `partial` / `uncommitted` / `superseded` / `no_edits` status per prompt. Eight ROI proxies (spend per
  AI line reached, AI-files-reached share, spend with no linked commit, spend per commit/per completed
  task, prompts/turns per commit, cache-read share) each ship their formula and an honesty caveat;
  nothing is called "dead" or "line survival" — file-level reach is stated as exactly that.
- Projects page spend is priced at READ time through the process cost engine (recorded cost wins when
  > 0; otherwise the turn's full token bundle is priced at its own timestamp), de-duplicated per turn
  across the proxy and transcript captures with the cost engine's own identity rule, and reports
  `spend.unpriced_turns` (turns with no recorded cost and no pricing entry) on the API, the Overview
  tile, the `/projects` list (`spend_unpriced_turns_30d`) and the CLI - a corpus that stores $0 in its
  cost columns no longer renders $0.00 (found on this repo's own corpus during the 2026-09-22 review).
- `observer project <id|root> [--days N] [--json]` prints the same per-project summary the dashboard's
  detail panel shows, through the one shared composition (`dashboard.ComposeProjectDetail`).
- Commit capture reports a fourth state, `error` (the last scan failed and none has succeeded since),
  instead of hiding a failing scanner behind `ok`; full-history scans are paged (500 commits per
  bounded git call, 60 s each) so `observer backfill --commits` completes on a large repository; a
  project rooted in a subdirectory of a repository is scanned with its subtree as the pathspec (file
  paths re-based onto the project root) instead of being credited with the whole repository's history.
- Alignment grading (delivered vs. missed): a three-tier design — always-on local heuristics (tier L),
  an opt-in local/configured LLM judge (tier J), and Cloud Intelligence grading under the existing
  `extended_evidence_deep_review` purpose (tier C, `observer cloud grade-commit`). Tier C ships its node
  contract and request path in this release; the hosted executor is honestly `not_available: hosted kind
  not deployed` until it exists, never a fabricated grade.

- Guard, proxy lane: goose's built-in `developer__shell` tool is now in the response-side tool
  table (`responseToolShape`), so a shell command goose intends to run is evaluated and flagged
  like Bash/run_command; before, goose shell calls were invisible to the proxy's response scan.
  Grounded on the demo estate 2026-09-21 (session 7). Response-side scanning stays flag-only.
- Org dashboard, Guard tab: the bundle editor's rows are called RULES ("+ Add rule", "Rules (n)",
  "Remove rule"); before, "+ Add override" shared a card with "Developer may override" (the
  developer exception), one word with two meanings, which made a multi-rule bundle read as a
  one-rule form. The `[[override]]` TOML key is unchanged.
- Org fleet findings: the evaluator's GRANTED set now includes the authority of the fleet grant-replacement
  generation a member acked under the enterprise posture (through the posture-owned
  `AckedAuthorityByMember` seam), not only the member's enrolment token. Before, every node that accepted
  the org's own fleet document was raised as `authority_divergence` ("accepted authority that was never
  granted") the moment it reported - D-DEMO-14, found on the demo estate on the first policy-acks after
  rc.8. A member that accepted tokens beyond its acked document is still flagged; an orphaned ack row
  never resurrects a deprovisioned member; on a split control store without the posture tables the fold
  is empty by construction and every other error is surfaced.
- Org CLI: `observer-org policy publish --team <id>` (repeatable) publishes a TEAM-scoped guard bundle
  through the same path the dashboard's Guard tab uses (composed strictest-wins on the org-wide floor
  for members of those teams); without `--team` the command is unchanged (org-wide). The wave contract
  named the CLI and only the API/dashboard had it.
- Node, org governance: the effective-policy-state reporter is now constructed on every org-client node
  and stays dormant until its channel is enabled, so an org raise of the `policy_state` share (enterprise
  default body, `extract.policy_state` authority) reaches a managed node whose local
  `[org_client.share].policy_state` was left off. Before, that raise had no reporter to act on: the node
  never posted a policy-ack and the org's fleet findings read every governed developer as
  `governance_lapsed` ("never reported a governance state") - D-DEMO-13, found on the demo estate the
  moment the rc.8 sweeper started. Individual nodes are unchanged (the org cannot raise the share there).

- feat(ui): dashboards UI pass 1 (web, web2, cloud portal): one shared CSS motion layer (route enter, stagger, count-up, reduced-motion safe, transform / opacity only, no animation library); one query cache per app (concurrent requests deduplicated, stale-while-revalidate across mounts, visible staleness instead of old data shown as current); terminals follow the app theme by default and can be pinned light or dark in the terminal header; the shared Tailwind preset's opacity fix revives ~880 classes that rendered nothing, and `fg-3` text meets WCAG AA; web2 and the portal are route-split (first-paint JS: web -18%, web2 -79%, portal -55%); quiet sessions poll every 60 s instead of 8 s. Report `docs/audits/dashboards-ui-review-2026-09-27.md`.
- feat(ui): UI pass 2: the Cost chart overlays its series; the "Actions over time" legend no longer overlaps the top y-axis label; a query-key bug that requested `/null` is fixed; one shared slide-over with a focus trap; the open drawer and its tab live in the URL; filters are route-aware; the cloud portal's buttons, cards and switches come from the shared primitives.
- feat(ui): the shared design kit across all three apps (plan `docs/plans/dashboard-visual-upgrade-tracker-2026-09-28.md`, WS1-WS10): real vendor logos for every tool key with capture-surface pips and a monogram for an unknown tool (attributions in `shared/lib/THIRD_PARTY_ICONS.md`); model-family, host and IdP marks and one shared model-id renderer; an SVG brand mark, branded loader and boot screens; one icon system; one tone vocabulary so the same status reads the same colour and pill everywhere; illustrated empty states, loading and error states, and a permission-denied state (a 403 is a denial, not an error); live signals (live dot, meters, progress rings) and number tweens; one Modal / Toggle / ConfirmButton / CopyOnClick / Tooltip; table hover and zebra rows; chart legends; branded sign-in shells for the org dashboard and the portal; radial gauges in the session detail.
- feat(ui): finish-round UI pass 3: a density toggle (comfortable / compact) in all three apps; the node's hand-rolled tables move onto one DataTable (sorting, numeric alignment, a loading state), now a single shared component with web2's row expansion; filters in the URL (node: window, range, tool, project, search; org: `?days=` on every route); sidebar collapse on the node and org dashboards; the web2 Spend figure counts up; the Security pages and org Settings fit a 390 px screen; a 403 on any chart or panel renders the shared permission-denied state. Behaviour changes: a cache row flagged by the engine is amber (warn) everywhere; destructive deletes need a two-step confirm (org: team, budget, dated rate, alert rule, project-identity rule, deployment connector, intelligence provider, virtual-key revoke, announcement retract, dataset item; node: Remote "Revoke all", arena candidate discard, "Run retention now", the terminal's "Stop & close"). Source maps are built `hidden` and never shipped in the embedded bundles.
- feat(ui): the custom time range is a picker, not typed datetime fields (node and org): one-click presets (Today, Yesterday, This week, Last week, This month, Last month), a Monday-first month calendar (start day, then end day; future days disabled) and hour / minute selects; the end defaults to Now. The org dashboard's rollups are trailing windows, so its picker chooses a start and runs to now.
- feat(dashboards): charts bucket by the window - 5 min / hour / day / week in the viewer's time zone, zero-filled, with a per-chart Auto / 5 min / Hour / Day / Week control (only the buckets the window allows, at most 2,000 points; an over-cap request is a `400 granularity`, never a silently coarser chart; the choice travels in the URL as `gran=`). Auto picks 5 min up to 3 hours, hour up to 7 days, day up to 180 days, else week. Node: every time-series endpoint now honours the selected window (analysis trend, cache-savings trend, cost-by-hour, cost-by-day-of-week-hour and cache timeseries used to serve 30 days on 1h / 12h / custom), and the Analysis headline, movers, top sessions and routing suggestions and the Cache overview and events follow it too; the raw proxy-only hour query (which dropped transcript rows) is gone. Org: the window ladder gains 1h / 12h / custom (additive `hours` / `since` / `until` / `gran` / `tz` params; a days-only request keeps the daily response); sub-day spend is read from raw rows within the cap and Auto picks Day above 2 days; charts fed by daily pushed summaries offer Day / Week with a "daily data only" note. Cloud portal: day labels and a daily-data note. Review fold: the zone database is compiled in, so a Windows node buckets in the viewer's zone instead of silently in UTC (a fallback says "UTC buckets (zone unavailable)"); every series on a page agrees across DST changes; malformed timestamps no longer 500 on PostgreSQL; zero-filled org series show their empty state again; window-scoped analytics answers of a day or less are at most 30 s fresh. Plan `docs/plans/chart-time-granularity-plan-2026-09-29.md`.

- perf(dashboard): node dashboard performance audit on a real 27 GB database, and fixes (`docs/audits/node-dashboard-performance-audit-2026-09-29.md`): a stale-while-revalidate response cache for 30 heavy GET endpoints (inside every guard, invalidated by dashboard writes); polls re-arm only after the previous one settles; the Sessions list polls every 30 s and pauses while the drawer is open; memoized table rows and charts, lazy tooltips, cached date formatters, finite illustration animations; the session Messages tab loads only the returned page; agent migration 147 adds covering indexes (sessions activity, excerpt lookup, latest limit snapshot, repeated-command discovery); the process-to-action correlator searches a sorted time window instead of every action. Measured on a copy of that database: drawer tabs 38-240 s -> 1.2-10 s to data-complete, Overview 157 s -> 54 s cold / 17 s warm, Analysis 111 s -> 33 s / 0.6 s, Discovery 60 s -> 12 s / 0.5 s, Cost 76 s -> 16 s / 6 s, Report 22 s -> 0.5 s; blocking time on drawer tabs 2-23 s -> 0.1-0.7 s; the correlator 6.2 s -> 71 ms on 20k x 15k. The org dashboard and the portal inherit the shared client fixes. On the live daemon (cold, first visits after a restart): Overview >240 s -> 93 s, Analysis 116 s -> 61 s, Discovery >240 s -> 27 s, Report 58 s -> 0.4 s, session Messages tab 207 s -> 5.4 s; idle main-thread use 5-35 % -> 1-2 % on every page.
- perf(dashboard): the Sessions list uses its index again - the default sort repeated `started_at`, which kept SQLite off `idx_sessions_started` and scanned every session before the page limit (`/api/sessions` first call 4.2 s -> 0.14 s, byte-identical responses, plan pinned by a test); the Overview stale-reads tile asks `/api/discover?sections=stale` instead of computing the whole discovery report (5.7 s -> 0.23 s warm; it was the last panel on a cold Overview); chart first mounts take turns instead of mounting about ten charts in one task (Analysis blocking time roughly halved); bar charts with more than 400 bars (a 7-day hourly trend is about 1,200) draw without the entry animation.
- perf: optimization review (`docs/audits/optimization-review-2026-09-27.md`): node Overview 40-47 s -> 11-21 s, Analysis 14-16 s -> 9-12 s, Cost 7-8 s -> 4.5-5.5 s, Sessions 8.5-9 s -> 6.8-7.4 s on a real 21.5 GB database copy (agent migration 138 covering index, a dashboard-only raw-row cache in the cost engine, serve-stale-then-refresh for `/api/status` and watcher health); org session drawer spend queries ~716 ms -> ~10 ms on a 900k-row PostgreSQL store (server 176 / pg 0042, indexes only); the org rollup cache shares concurrent cold loads and an invalidation beats an in-flight load.
- perf(org): a daily deduplicated spend summary (`spend_daily`, server 184 / pg 0050) written at ingest by one writer from the same per-row projection and duplicate-count verdicts as the live spend query; every ingest path, re-send, moved row, tombstone, scrub, purge, eviction and prune refreshes the affected units in the same transaction. Overview, Projects, People, Teams, Tools, Models, Movers, reports and budget totals read it (a window is split into live head, summary middle and live tail; until the boot rebuild has stamped the summary every reader stays on the live tables). Measured on a 462k-token-row fixture: Overview 15.9 s -> 1.2 s (PostgreSQL), Projects 10.2 s -> 0.45 s, budget total 834 ms -> 60 ms. The session drawer, Live, workspaces and the People model ladder stay on the live tables.

- feat(pricing): prices come from the Tokenomics database with their history: the public feed carries a per-row `history` of dated periods, the org importer keeps every period, and the cost engine prices each turn at the period in force at its timestamp (a period the source does not state is an honest miss, never a guess); the compiled seed snapshot is generated from the signed feed and the hand-maintained dated timelines are retired. New or corrected rows include claude-opus-5-5-fast (was billed at half its fast price), mimo-v2.6-flash / -pro, Moonshot's dotted kimi-k2.6 / k2.7-code ids, gemini-3.5-flash-lite (was billed as 3.5 Flash), gemini-3.1-flash-lite (was billed as 3.1 Pro) and the composer-2.5-fast cache read; Copilot CLI Auto sessions record the model Auto chose instead of `auto`.
- fix(pricing): the model maker's price wins over a reseller's. The feed export ranked offerings without preferring the maker, so reseller cards (Venice, Azure AI Foundry, Novita, OpenModel.ai) won for 16 models on the public feed from 2026-09-16 (for example Claude Opus 4.5-4.8 at $6/$30 instead of $5/$25 per million, gpt-5.4 input at $5 instead of $2.50); feed version 5 pins each maker's page, and the export's maker preference plus a guard listing reseller-won ids whose maker publishes a card follow in the next Tokenomics publish (open-weight ids such as gpt-oss-120b stay reseller-priced on purpose). Costs already stored at the reseller rates are not changed automatically: use the new re-price (below). On an org server, feed-owned price rows now mirror the latest applied feed (a first poll that answers 304 still catches up), so a stale imported reseller row can no longer stay in force in the org's price book, the gateway rate card or the enrolled nodes' signed pricing documents.
- feat(models): Claude Sonnet 5.5 (`claude-sonnet-5-5`): a 512-token minimum cacheable prompt in cache tracking and a 1M-token routing context window; the price ($2 in / $10 out / $0.20 cache read / $2.50 5m and $4 1h cache writes per million, no long-context tier) arrives through the pricing feed, not from a hand row in the binary.
- feat(pricing): opt-in retroactive re-pricing of stored costs, node and org (closes `PRICE-REPRICE-1`). Capture still stamps the cost; a re-price is an explicit act at the price in force at each row's own timestamp, never today's. Node: `observer reprice` is a dry run unless `--apply` (`--revert <run>`, `--list`, `--since` / `--until` / `--model`, `--json`), plus a Settings -> Pricing card; it re-prices `api_turns` and `summary_calls` costs Observer computed itself, never a vendor- or tool-reported cost (`integration.TokenTier.ReportsCost`, 13 tools), never writes $0 for an unpriced row, keeps the captured figure and a per-run change log (agent migration 145), and re-priced rows reach the org through the re-send queue. Org: `/api/org/pricing/reprice*` (`write:pricing`, history `read:budgets`, audited before any row changes, fail-closed) and a panel on the Pricing page re-price org-held rows from the org's own dated price book (server 187 / pg 0053) and refresh the spend summary. Review fold: a single dated org row prices only from its date; reverts run newest first (an out-of-order revert is refused and names the later run) and one run holds the claim at a time on the node and the org; the CLI honours an org pricing pin like the dashboard. Nothing re-prices automatically after a new price version, and a re-price never re-runs budget alerts or rewrites gateway reservations. See `docs/pricing.md` "Re-pricing stored costs".
- feat(org,pricing): context windows reach enrolled nodes (an unsigned sibling of the signed pricing policy, `context_windows`, covered by the ETag and outside the signed bytes so older verifiers still accept the document), so a node and its org show the same context-gauge ratio. A re-parse can now correct a token row's reliability: a Crush session that grows past one step corrects itself without `--crush-rescan`.

- fix(org): one duplicate-count rule on every spend surface, node and org. The org drawer header, model split and cost series derive from the same `sessionmsg.Derive` pass as the node (it had counted every proxied OpenCode turn twice); duplicate verdicts are stored at ingest and applied by every org list, page and drawer (server 179 / pg 0045; org Overview 30 d on PostgreSQL 71.7 s -> 3.5 s), and on the node by the cost engine, Analysis, reports, budget, live, statusline, predictor, guard token and priced-spend checks, cloud evidence and the task and sub-agent drill-downs (stored node verdicts, agent migration 143; server 182 / pg 0048). OpenCode twins whose output was clamped to 0 because reasoning exceeded the completion now fold (a session had shown 49,554 tokens for ~24.8K on node and org). The org names its push boundary ("as of <last received>"); a `claude -p` session reads `sdk · cli` on the org instead of `other`. Remaining: legacy session-less proxy rows always count.
- feat(org): rows a node changes after pushing them reach the org (agent migration 140, server 178 / pg 0044): triggers queue a changed row only when enrolled and a shipped column changed, every row carries a node revision, and the org applies a re-sent row only when its revision is newer (a moved turn is relocated, never doubled). Corrections a node makes by deleting rows (dedup sweeps, merges, identity changes) ship an identity-only tombstone (agent migration 141); ageing deletes (retention) never propagate. Migration 142 fixes the queue triggers, which failed a whole ingest batch on enrolled nodes when a row was already queued. `observer org resync` (dry run by default, `--confirm`, `--deletions` default on) heals divergence from before the upgrade and backfills session end times. A share-posture change between two sends no longer lands a second org row (server 180 / pg 0046), and `observer-org scrub-content` / the enterprise purge collapse such twins instead of failing on the primary key.
- feat(sessions): sessions get an end time: `sessions.ended_at` was never written by any path (NULL for every session of every tool); a table-driven rule (a session end closes, a later prompt or session start reopens) now sets it inside ingest, so the dashboards stop showing finished sessions as "in progress". Historical sessions pick it up on their next lifecycle event or via `observer org resync`.
- feat(scoring): the session quality score is computed: only the manual `observer score` CLI ever called the scorer, so almost no session was scored. A daemon auto-scorer (`[intelligence.scoring]`, default on, capped passes, a session counts as ended after 30 min idle) stores all four components (agent migration 137) and a Session quality card shows the breakdown and a stale-score note on the node session detail and the org drawer (server 177 / pg 0043; the org's newer-action count is derived like the node's). The scorer is about 80x faster on the largest session.
- feat(org): context-window and rate-limit gauges on the org session drawer from one shared derivation (context used = newest non-zero cache read over the session's reported prompt budget or the model's context window; over-window and unknown stay unknown, never 100% or 0%). Rate-limit windows reach the org as a new metadata-only wire family `session_limit_snapshots` (5 h / 7 d utilization and resets; no headers or counters), gated by `[org_client.share].limit_gauge` or full-content sharing (server 183 / pg 0049); agent migration 146 starts an already-enrolled node's cursor at head so its older limit history is not shipped. The node session detail gains the same context gauge.
- fix(codex,cowork): Codex (and Cowork) sessions no longer show a "Rate limit" row between every message. A rate-limit reading is recorded only when the limit really changes (status, plan, window, used percent by half a point or more, or a reset moved by more than 10 minutes), plus a 15-minute heartbeat that keeps the usage gauge fresh - on the author's own history that is about 9,100 readings instead of 53,500. In the session Messages tab, readings fold into the message they follow and a small badge (for example "7d 74%") marks only the turns where usage changed; node and org drawer derive this from the same shared code. Already-captured readings fold at display time; nothing is deleted.
- feat(org): the Claude Code request class (`x-claude-code-request-class`: main, subagent, workflow, compaction, auxiliary; anything else stays empty, never guessed) is recorded per proxied turn (agent migration 144), ships to the org as a content-free enum (server 188 / pg 0054); both session-detail APIs return the per-class split and the org drawer shows it.
- feat(org): `sessions.parent_thread_id` ships as metadata (server 162 / pg 0028) so the org drawer resolves a Cursor sub-agent session's tool account through its parent, as the node does; the per-session AI tool version reaches the org (server 161 / pg 0027).

- feat(loc,projects): AI code vs comment lines on every lines-of-code surface, node and org, from one derivation (code = added + modified code lines, comments = added comment lines, a share only when either is non-zero): session card, Sessions list, the Cost lines-per-dollar tile (code lines only), Projects list, overview, commits, spend and prompts, `observer loc show`, `observer project`, and the org People, person / project LOC cards, "Code lines over time", developer footprint and session drawer (server 185 / pg 0051; an older agent's rows show no split rather than 0%). Honesty fixes: Projects "AI code lines", by-session and commit lines, the reached-line proxy and prompt edit counts no longer include docs and config files.
- feat(projects): the session that owns each git commit, node and org. A table-driven rule: merge, unreachable, foreign-author (a teammate's commit you pulled) and no-AI-edit commits have no owner, never a guess; otherwise most AI code lines, then most files, then earliest prompt, then session id (comment lines do not count; sub-agent edits fold into the parent). Node: an Owner column on the Projects Commits tab, a Commits card on the session detail, `GET /api/session/{id}/commits`. Org: an additive commit-ownership wire family (no author identity, no paths; `commit_sha_hash` always, the raw SHA and subject only under full-content sharing; server 186 + 189 / pg 0052 + 0055), audited org session and project commit views, subject and raw SHA only with `read:content`. The local git author is stored as a hash only (agent migration 146). See `docs/projects-page.md` "Commit ownership" and ledger COMMIT-3.

- fix(claude-code): tokens-per-second sanity: a response-side attachment introduced in Claude Code builds from 2026-09-26 sat in the timing start slot and collapsed generation spans (rates up to 127,667 tok/s). A table of response-side attachment types plus a strict-before rule fix the span (live 7-day max 229, no row at or above 500). Rows stored with the old rule are corrected when their transcript is re-parsed.
- feat(proxy): the Claude Code prompt id (`x-claude-code-prompt-id`) is recorded per proxied turn (agent migration 139, node-local) and the next-message predictor groups by it; `observer claude` enables Claude Code's gateway hint headers only when routed to Observer's proxy and never over your own value. Codex: a Responses websocket upgrade is answered 426 so Codex falls back to captured HTTP; `/v1/realtime` routes to OpenAI instead of Anthropic; `observer doctor codex` gains `codex.proxy_route` and reports a managed `requirements.toml` provider. The org AI gateway forwards `anthropic-*` headers.
- fix(cursor): an unfinished Cursor turn (quit mid-answer, or every retry failed) records evidence and a precise reason on the node page, the org drawer and `observer doctor cursor` (`cursor.usage`) instead of a number: no local artefact holds its billed usage. Auto-mode turns record the model Auto routed to per request; placeholder models (`default`, `auto`) never overwrite a concrete session model; hook input nets both cache buckets (cache writes were billed twice). cursor-agent 2026.09 also runs Claude Code's user hooks with Cursor payloads; the Claude Code receiver now ignores those (no duplicate prompt guard, no rows mis-tagged as claude-code).
- fix(adapters): Hermes schema 30 auxiliary-call spend is captured on both the hook and database paths. Crush's token counters are the last step's context size, so only one-step sessions keep token counts; every other Crush session keeps a token row with its model and Crush's own cost at 0/0 tokens (reliability unknown), and `observer backfill --crush-rescan` corrects rows stored before. New tool-name mappings seen live or in vendor source (for example OpenCode `question` -> ask_user, Cline `list_code_definition_names`, Zed `grep` / `fetch` / `spawn_agent`, Kimi plan mode and task tools).
- feat(mcp): MCP calls made through the node relay are tied to their session for every client, not only Claude Code: a third, unanchored correlation tier (always labelled `inferred`, read-side only, retroactive, ambiguity shown rather than guessed). Protocol traffic (`tools/list`, notifications) never claims a tool action and attaches at session level; the method reaches the org so the drawer shows the same fields as the node (server 181 / pg 0047).
- feat(ide): `observer ide <id> [project-dir]` launches an IDE or desktop app through the same path as the dashboard's GUI launch and prints an honest per-agent routing outcome (vendor-hosted inference such as Cursor's own models, Antigravity, Kiro, Qoder, Devin / Windsurf or Grok Bot cannot be routed and is reported so). Live traffic proof is still owed for VS Code, JetBrains, OpenCode Desktop and Goose Desktop (steps in `docs/proxy-wrappers.md`).
- feat(shell-wrap): command wrapping, default off: `observer shell-wrap status|preview|enable|disable` and a Settings -> Terminal "Command wrapping" card put PATH shims first so typing `claude` runs `observer claude` (per-tool opt-in; `all` means installed CLI tools only). One marked block in bash / zsh rc files, a fish conf.d drop-in or the PowerShell profile (never auto-created), an exact preview, byte-for-byte undo, recursion guards so no launcher resolves a shim. On `observer start` a shim whose observer binary was moved or deleted is re-pointed at the running binary (a still-runnable different binary is kept); the PowerShell profile resolves the real Documents folder. Ledger SHELLWRAP-1.
- fix: small live-verification defects: the org session quality card's newer-action count is derived like the node's (it was always 0); the goose watcher no longer logs "caught up dropped writes" every 2 s for a database scanned by row watermark; `observer doctor <tool>` defers the whole-database quick_check (`--integrity` forces it); the Cursor "no finish hook" note no longer tells you to run `observer init` when the hooks are already registered.
- chore(build): `web/dist` and `web2/dist` are no longer tracked (the three `go:embed` bundles stay committed, so `go install` and the Docker builds are unchanged), every dist tree is marked `-diff`, and source maps stay out of the embeds; a rebuild no longer produces a multi-megabyte diff that agents such as OpenCode copy into their session stores. Stored `raw_tool_output` is capped at 1 MiB at every writer.

- fix(security): a review of what earlier reviews had not covered (`docs/audits/security-review-2026-09-27.md`; 3 High + 9 Medium found, all High and 7 Medium fixed with regression tests): the proxy refuses browser-shaped requests (a web page can no longer drive it cross-origin; CLI, SDK and editor clients are unaffected); the guard evaluates Monitor, PowerShell and Grep tool calls; a truncated PreToolUse payload asks instead of allowing in enforce mode; `key_pool` rotates only credentials in the pool; Gemini API keys are redacted; the org gRPC receiver authenticates before decoding; tree-sitter parsing runs under deadlines; a repository symlink into your home directory no longer leaks the target through `get_project_guidance`; node database files are restricted to 0600 when opened. The rest is ledgered as SR27-*.
- feat(sandbox): sandboxed terminals are contained (SR27-SBX-1): each sandboxed launch gets its own network namespace with the tier from `[terminal.sandbox].egress` (`internet` default, `proxy_only`, `none`, or `host` which restores the old shared namespace). A host helper serves the observer proxy and an egress gateway over sockets bound into the sandbox, so launcher URLs are unchanged and the dashboard on `:8081` is unreachable from inside; the gateway refuses loopback, link-local (incl. 169.254.169.254), multicast, the host's own addresses and private ranges (RFC 1918, CGNAT, IPv6 ULA and site-local) unless listed in `[terminal.sandbox].egress_allow_cidrs`. Every tier runs in a private PID namespace; host sockets under `/run`, WSL interop and agent environment variables are masked; Observer's secrets and the attach socket are hidden; daemon config, guard policies, shims, each tool's hook and MCP config and the workspace `.git/config` and hooks are read-only (a missing protected path gets a read-only placeholder) unless `allow_tool_config_writes = true`. A host that cannot create a network namespace refuses the launch (`netns_denied`), never a silent fallback. Linux and WSL2 only, opt-in as before; residual risk in ledger SR27-SBX-2, see `docs/sandboxed-terminals.md`.
- fix(harness-gateway): the codex adapter runs codex with its built-in tools disabled (exec, shell, view_image and apply_patch calls return unsupported, web search off, the default-off features explicitly disabled), an allow-listed environment and a per-session private home; `@openai/codex-sdk` and `@openai/codex` are pinned to exactly 0.147.0 (the disabled list is re-grounded on every bump), and turns are serialized per session with the codex home disposed only after a running turn ends (SR27-C2).
- fix(dashboard): the node dashboard's Origin check compares scheme, TLS, host and port with the request's own Host (loopback aliases equal) instead of the host alone (DASH-ORIGIN-1).
- ci: third-party GitHub Actions in secret-holding jobs are pinned to commit SHAs (tag kept as a comment; Dependabot keeps them current) (SR27-SC1).

- Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1) — the dated
  three-cloud price snapshot every `observer-org deploy plan` estimate in this release is
  computed from (plan v2.1 6.9; `scripts/verify-price-snapshot.sh --line` prints this line and
  `scripts/release.sh` requires it in a final tag's section).

## [1.34.0-rc.8] — 2026-09-21

Pre-release on the `edge` channel; rc.7 plus the two demo-estate fixes rc.7 could not carry, the
2026-09-21 Windows-side handoff merged onto the rc.7 tree, and one adversarial review of that merge
folded. Server migration 159 (`org_model_prices.peak_json`; run `observer-org migrate` before starting
the new image) and agent migrations 125 + 126 (node-local, additive). Node binaries need updating too.

- Org server: the fleet-findings sweeper is now carried onto the served server (D-DEMO-12) - the built-in
  `no_contact` alert rule seeds and `authority_divergence` / `integrity_risk` / `no_contact` /
  `governance_lapsed` findings open; a runtime test pins every background worker across the assembly copy.
- Deploy bundle: `observer-env-sync.sh` re-asserts the D12 `secrets/config.toml` mountpoint placeholder in
  place (D-DEMO-11) so `docker exec observer-org <cli>` keeps reading the real config.
- Org server, pricing feed: the public signed pricing feed importer now defaults to ENABLED with mode
  `auto` (operator decision 2026-09-20): a connected org pulls `https://superbased.app/api/pricing/v1/observer-pricing`
  and auto-applies list-price versions as `source = imported` rows; opt out with `[pricing_feed] enabled = false`,
  or keep pulls but park them for approval with `mode = "park"`. An air-gapped org (bundle_path set) egresses nothing.
- Pricing, peak/off-peak (Phases 0-3): `org_model_prices.peak_json` backs `pricing.Row.Peak` (a peak RateSet
  + UTC schedule); both signed rails carry it; the node cost engine prices a turn at the peak variant inside
  the window; the org Pricing page shows a read-only vendor-line badge; the Tokenomics feed export carries
  `peak_json`. Inert until an org authors (or the feed publishes) a peak variant. Both pricing rails now
  verify over the raw received bytes and persist them, so a field a newer server adds degrades instead of
  freezing the cache. DeepSeek flash-family off-peak base correction.
- Guard: manage guard rules from the node dashboard (Settings, per project) through a daemon-local
  trusted per-project policy layer under `~/.observer` (weaken/disable scoped to one project, never below
  the org floor; R-160/R-161 integrity rules cannot be disabled or relaxed below the org); the global rule
  picker can loosen built-ins; the org dashboard's guard form picks rules from a described dropdown; the
  guard-rule vocabulary is one shared module for both dashboards. Hook-lane policy blocks are interleaved
  into the session Messages tab at the exact message anchor.
- Guard, merge-review fold: a signed org bundle carrying a top-level `disable` list is accepted with the key
  ignored and noted (the forward-compatibility rc.7 introduced now covers decoded keys too - rejecting it
  would have stranded every node on its stale bundle); the trusted per-project layer loads even when the
  in-repo `project_policy` layer is disabled; `/api/session/<id>/guard` carries `overridable` / `org_locked`
  like the global timeline.
- Capture: user file/image attachments on a prompt are captured and shown in the Messages tab (agent 126);
  the AI tool / CLI version is captured per session (agent 125) and shown on the session card; lines of
  code by sub-agents fold under the parent session card; process-APM metrics correlate to the message /
  turn that caused them across every adapter; clinecli pidbridge rail proven live.
- Org client: benign policy-rail states (`channel_off`, `disabled`, `not_supported`, `no_budget`,
  `no_pricing`) log at Debug instead of a WARN per rail per cycle.
- Marketing site: `www` 301s to the apex host; `/listed-on` directory page with a quiet footer link;
  tool counts say 40 supported tools and 27 CLI launchers; guide links from the home page and footer.
- Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

## [1.34.0-rc.7] — 2026-09-21

Pre-release on the `edge` channel; rc.6 plus the org guardrail control wave (plan of record
`docs/plans/org-guardrail-control-wave-2026-09-21.md`, one adversarial review folded) and three
adapter/posture fixes found on the demo estate. Server migrations 157 + 158 (run `observer-org migrate`
before starting the new image). Node-side changes need the node binaries updated too:

- Org policy: team-scoped guard bundles and node-governance targeting (`teams` resolved server-side from
  the bearer, one composed bundle per developer, strictest-wins across teams, served version = bundle
  sequence + roster epoch so joining or leaving a team converges); per-rule `overridable` on the org
  bundle (the developer may consent on ask-capable channels or grant a scoped, reported approval;
  otherwise the rule is hard and local approvals are inert on a managed node); publish-time warnings.
- Node guard: human-first deny text naming the rule, what was blocked and the exact override step;
  node dashboard "Organization guardrails" card; desktop toast on every enforced overridable deny;
  proxy-lane approvals resolve the project root through the session.
- Tamper detection: the stored enrolment grant is re-verified on every identity refresh; proxy-route
  drift is inspected per registry route kind and an absent route is drift on a managed node when the
  tool's config is present; nodes report effective pinned values; org-side fleet findings
  (`authority_divergence`, `integrity_risk`, `no_contact`, `governance_lapsed`) with four new alert rule
  kinds and a Control Center panel; `GET /api/org/fleet-findings`.
- Posture: the teams -> enterprise flip widens authority and never drops it (D-DEMO-10; gateway-class
  authorities are withheld from the fleet-wide replacement and those members are named).
- Posture, second pass (pre-tag review): `POST /api/org/posture/reissue` signs a new fleet replacement
  generation on an already-enterprise org (no activation needed) and `GET /api/org/posture` says when one
  is due; withheld (service-account) members are excluded from the fleet document by construction, at
  issue time and at enrolment-token redemption, so re-enrolling one with its own token now sticks; a member
  enrolled later with a developer-class grant wider than the live generation is parked until the next
  reissue lifts it, and a developer-class re-enrolment lifts a structural exclusion; activate
  on an already-active org is a no-op; flip and reissue share one issue path. Node: the org guard layer
  ignores bundle keys a newer server adds instead of running without the org layer (`observer guard
  status` names them); nodes older than rc.7 still drop the org layer on such a bundle - update them first.
- pi adapter: git identity (remote, branch, owner) resolved from the session cwd (D-DEMO-9).
- Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)
- Deploy bundle (Azure + AWS cloud-init `observer-env-sync.sh`, and the four Azure templates that embed it):
  the D12 `secrets/config.toml` mountpoint placeholder is re-asserted IN PLACE on every timer run
  instead of being re-`install`ed. Recreating its inode detached the running org container's bind mount
  of `config.production.toml` for every later path lookup, so `docker exec observer-org <cli>` read an
  EMPTY config from the next 6-hourly run on (the server itself never re-reads its file and was
  unaffected; `docker compose run --rm --no-deps org <cli>` always worked). Found live on the demo
  estate (D-DEMO-11); the harness now pins the inode across runs. NOT in the rc.7 tag - lands in the
  next bundle export.
- Org server: the Track C fleet-findings sweeper was assembled but never carried onto the served
  server, so it never started - no built-in `no_contact` alert rule was seeded and no fleet finding was
  ever opened (D-DEMO-12, found live on the demo org after the rc.7 roll). Carried, and a runtime test
  now pins every background worker across the assembly copy. NOT in the rc.7 tag.

## [1.34.0-rc.6] — 2026-09-21

Pre-release on the `edge` channel; rc.5 plus two org-dashboard fixes found on the demo estate
(the OIDC login gate and the SCIM-hidden team create form). Cut so the org-feature validation
arc runs on a signed image carrying them:

- Org dashboard: the Teams page no longer hides its team CREATE form on a SCIM
  deployment (D-DEMO-7). It gated the form on `scim_configured`, which only
  means `[scim].auth_token_path` is set - and the appliance bundle always
  provisions a SCIM token secret, so on every bundle-deployed org the admin
  could not create a team at all (and a team budget had nothing to attach to),
  even with zero SCIM-provisioned rows. `GET /api/org/team-management` now also
  carries `scim_active`, resolved from the data (a non-empty `external_id` on
  any `org_teams` or `org_members` row), and the page always offers the form
  and uses the two flags to choose a notice instead - the D-DEMO-6 "offered,
  not hidden" rule. An individual SCIM-provisioned team is still read-only by
  provenance, unchanged.
- Org sign-in: a configured rail is offered before its first probe (D-DEMO-6).
  The login page hid the link for any rail whose health was not exactly `ok`,
  but an OIDC rail's discovery document is fetched lazily and following that
  link was the only thing that fetched it - so on a fresh boot the first
  sign-in could never be started. Health is now a tri-state that decides what
  is said beside a rail, never whether it exists, and the server warms the
  probe at boot.
- Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

## [1.34.0-rc.5] — 2026-09-20

Pre-release on the `edge` channel; rc.4 plus the demo-estate rebuild waves and two org-dashboard
fixes found on the first fresh org that booted from rc.4. Cut so the demo estate can run a
cosign-signed image carrying them (first boot pins the release workflow's signing identity):

- Org dashboard: Settings no longer crashes on a fresh org (`GET /api/org/plane-b/mode` served
  `"pending": null` for a fleet with no capability acks and the page read `.length` on it; the
  activate endpoint's Node-Mode downgrade result seeded the same way), and the People
  leaderboard's TOP TOOL / TOP MODEL are derived by count from every substrate (actions ->
  sessions -> token rows for the tool; the deduped proxied-turn ∪ token-row union -> sessions for
  the model) instead of the cost-ranked proxied-turns-joined-to-sessions query that left every
  developer on a free-tier model, or without a joinable proxy session, at "-".
- Azure appliance modules: `lb_nodes = 1` (single HAProxy, stated full-outage replace window,
  DR-63) and `nats_placement = dedicated` (the nats-single broker on its own VM); the org POLICY
  signing key is now minted beside the bearer key (`policy-signing-key`, both clouds), landed by
  env-sync and rendered as `[policy]` in every production config - without it every managed
  node's `GET /api/agent/budget` answered 409 and `observer <tool>` refused to launch;
  `restore-drill.sh --pgbackrest-conf` for the separate-PostgreSQL topology; the app NSG
  metrics rule admits the VNet; env-sync's PFX converter fails loudly and keeps SAS values out
  of comment lines.
- `budgetsigningcheck` warns on managed tokens / managed nodes without a policy key and
  `new-enrolment-token --managed` warns at mint time; node posture (budget + pricing) is fetched
  before every push and `observer org push-now` carries it.
- Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

## [1.34.0-rc.4] — 2026-09-18

Pre-release on the `edge` channel; rc.3 plus the enterprise-deployment Phase 1 and Phase 2
work. Cut so that the Phase 2 attended acceptance has CI-built, cosign-signed images to boot
from (first boot pins the release workflow's signing identity; the `observer-postgres` image
had never been published):

- `observer-org deploy plan` (Phase 1): the deployment catalog (axes, constraint table,
  developer-count size map, eleven reference architectures), the bill of materials, the dated
  three-cloud price snapshot with confidence letters and the 90-day stale gate (DR-17), the
  alternatives block, honest ceilings (D2), and the rendered bundle (`config.production.toml`,
  `.env`, compose override, `nats.conf`, RUNBOOK/ESTIMATE); `deploy export` ships the catalog.
- Azure OpenTofu modules (Phase 2): six thin roots (`compact`/`appliance` x
  `bootstrap`/`data`/`app`) over shared child modules under `deploy/modules/`, embedded and
  exported as the bundle's `modules/` row; tfvars rendered from the answer set's sizing and the
  catalog's provision SKU names; cloud-init + on-box units (Key Vault secrets flow, private
  bundle container, pgBackRest timers, restore drill); the `observer-postgres` image
  (postgres 16 + pgBackRest, DR-51) built, signed and pushed beside `observer-org` under the
  same tag.
- `[metrics]` listener + `/metrics` (DR-12) and `observer-org support-bundle` (DR-20);
  `doctor` gains the object-store probe and the SAS-expiry warning.
- The air-gap kit ships the Sigstore trusted root and `VERIFY.md` verifies with
  `--trusted-root`; `release.sh` pre-flight asserts the chart and harness-gateway versions.
- Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

## [1.34.0-rc.3] — 2026-09-18

Pre-release on the `edge` channel; rc.2 plus three release-pipeline fixes found by running
rc.2 (the second pre-release tag; every fix is pinned by an executed test):

- cosign is installed by the pipeline's own retried, sha256-pinned script at all three signing
  sites (`COSIGN_VERSION` / `COSIGN_SHA256`); on rc.2 one un-retried download inside the
  installer action failed after the observer-org image had been pushed, leaving the tag
  unsigned and the private release skipped.
- The release-archive filename rule has one owner, `internal/update.ParseArtifactName`, used by
  both the org server's `update import` and the pipeline's manifest producer; rc.1's fix had
  patched the importer's copy while the pipeline ran its own, so rc.2's public release failed
  with the same "no agent archives".
- The private GitHub release is created and its assets attached with `gh release create` /
  `gh release upload --clobber`, the mechanism the public release has always used; the
  third-party release action aborted its parallel upload batch on both rc attempts.

## [1.34.0-rc.2] — 2026-09-18

Pre-release on the `edge` channel; rc.1 plus four release-pipeline fixes found by
running rc.1 (the first pre-release tag the pipeline has ever cut):

- The two image jobs no longer upload the buildx build record, whose artifact broke every
  "download all artifacts" step (npm, PyPI, provenance) on rc.1.
- Update-artifact names with a pre-release version (`observer-v1.34.0-rc.1-linux-x64.tar.gz`)
  parse correctly, so the public release and the `edge` update manifest are produced for
  pre-release tags.
- The VS Code Marketplace publish is skipped on pre-release tags (the Marketplace rejects
  pre-release semver); the VSIXes are still packaged.
- The air-gap kit carries one compressed OCI layout per image (with its signature) instead of
  every image twice; rc.1's 1.8 GB kit aborted the private release's asset upload.

## [1.34.0-rc.1] — 2026-09-17

Pre-release on the `edge` channel. Its purpose is the first real publish to the private
enterprise container registry; nothing here changes a running node's behaviour beyond the
retention horizons and the fix below.

### Added

- **Enterprise private distribution (Phase 0).** The `observer-org` image and, new, the
  `harness-gateway` image are published to SuperBased's private registry with a per-customer
  pull token instead of a public GHCR package; both are cosign keyless-signed by digest, and
  a final release now FAILS when the registry credential is absent instead of silently
  skipping the image. The public GitHub release no longer carries any `observer-org` asset
  (archives, SBOM, pull recipe); they attach to the private release together with a signed
  deployment bundle and an air-gap kit.
- **`observer-org deploy export --to <dir>` / `deploy list`.** The org-server image carries
  its own deployment bundle: the hardened compose template, the Helm chart, the developer-node
  supervisor templates and the enterprise runbooks, stamped with the exact image tag and
  registry, with `MANIFEST.json`, `SHA256SUMS` and a README holding the pull-and-verify recipe.
- **`observer cloud job <cloud-job-id>`** reads a hosted job's state, terminal reason and
  result summary.
- **feat(retention): horizons for `compaction_events` and
  `compression_events`, the two node-local event tables that had none.**
  `[observer.retention].compaction_events_days` (default 30) and
  `compression_events_days` (default 90) age out per-session compaction
  snapshots and per-decision compression detail through the ordinary
  retention pass - startup, the `interval_hours` tick and `observer prune` -
  in bounded batches, with the counts printed in the `prune complete` line
  and the retention log. On the node that prompted this the two tables held
  1.4 GiB in 1,333 rows and 915 MB in 3.59M rows respectively. Both horizons
  are ON by default, including for existing installs, so the first pass after
  upgrading deletes accordingly; set either key to 0 to keep forever. One
  behaviour change: post-compaction context injection reads a session's most
  recent `compaction_events` row, so a session idle for longer than the
  compaction horizon no longer receives it.

### Fixed

- **fix(store): the guard limit-window poll no longer full-scans
  `limit_snapshots`.** `store.LatestLimitWindows` filters on the window
  columns and orders by `observed_at`, but migration 049 shipped the table
  with only a `(scope_hash, provider, observed_at)` index whose leading
  column that query never constrains, so every poll scanned the whole table
  and sorted it through a temp b-tree. At 178k rows that ran past the poll's
  3 s deadline every time. Agent migration 123 adds a partial index on
  `(observed_at DESC, id DESC)` covering exactly the windowed rows.

- **fix(orgserver): ORGSEC-CSRF-2** - one cross-site seam for every cookie-authenticated
  mutation (415 on a non-JSON body, 403 cross-site).
- **fix(aigateway): GW-AUDIT-1 / GW-SETTLE-1** - the gateway audit row and the reservation
  settle are one journaled write; a crash between them no longer strands a reservation.
- **fix(orgserver): ORG-NATS-REATTACH-1** - a durable consumer whose identity drifted is
  re-attached (bounded, with the drift cause surfaced) instead of backing off forever; a
  vanished stream is handled the same way.
- **fix(projectresolver):** the row-5 enterprise-owner fallback is a deferred suggestion,
  never an automatic fold, and a suggestion that names a project the hash already belongs to
  is suppressed.
- **fix(cloudserver):** the worker role can complete the weekly project digest (migration
  0040 grants); the portal CSP admits Paddle.js v2's own runtime footprint.
- **ci:** the `-race` suite is sharded ten ways with per-process migrated SQLite templates.

## [1.33.0] — 2026-09-15

### Added

- **feat(update): Enterprise Update Management - fleet self-update served by
  your own org server.** A node never contacts GitHub, npm or a CDN for an
  update; it fetches only from the org server it is enrolled with. That
  server's mirror is filled by `observer-org update import` (air-gapped
  sites) or `observer-org update sync` (connected ones), which is what makes
  air-gap the default path rather than a special case. Three channels
  (`stable` / `lts` / `edge`) are a property of the MANIFEST, never of the
  binary, and the node side is `observer update status|check|apply|history`.
  Operator reference: `docs/enterprise-updates.md`.
- **feat(update): two-signature update manifests and a compiled-in vendor
  key.** Every manifest carries the org's Ed25519 TOFU-pinned distribution
  signature AND a per-artifact vendor signature over the archive bytes,
  verified against a key compiled into the agent, so a compromised org server
  alone cannot substitute a binary we did not build. An artifact with no
  vendor signature is refused - fail closed. The release pipeline now signs
  every artifact and publishes a signed release manifest plus an air-gap
  bundle; cosign-bundle and minisign were deleted from the signature
  vocabulary because neither ever had a verifier.
- **feat(update): drain-gated apply with a fork-exec-and-watch handshake.**
  Applying an update is never an execve replace. The old daemon drains
  in-flight proxied requests (`503` plus `Retry-After` through the new
  `internal/quiesce`, never a connection refusal), swaps the binary
  atomically, spawns the new one as a child, and - if the child fails its
  self-check, exits non-zero, or hangs - the still-alive parent kills it and
  restores the previous binary, along with a pre-apply `VACUUM INTO` snapshot
  when the target advanced the schema. Supervisor templates for systemd,
  launchd and Windows ship under `deploy/supervisor/` for the residual window
  after the old parent exits.
- **feat(org,update): staged rollout rings, a fleet version board and a skew
  gate.** Manifests roll out through a pure ring engine (`rolloutcore`,
  extracted from the policy-rollout cohort code) keyed on each node's own
  subject. `[server].min_agent_version` and `min_agent_version_action` (warn
  by default, a typed `426 agent_too_old` when set to refuse) plus
  `max_skew_minors` feed `GET /api/org/fleet/versions` with a version
  histogram, a skew banner and a stranding-by-install-method panel. The new
  `observer-org upgrade preflight` turns the server's own pre-upgrade
  checklist (backup, migration dry run, disk headroom, skew report, config
  validation) into one gate-able exit code, and the VS Code extension will
  never launch its bundled binary over a strictly newer installed one.
- **feat(org,pricing): enterprise per-model pricing.** `org_model_prices`
  (server migration 132, effective-dated, USD only) becomes the ONE authored
  price table, and the two places that already priced a turn become
  projections of it: the AI gateway's rate card, projected through one seam
  (the old rate-card PUT answers `409 moved_to_pricing`), and a signed
  fleet-wide `GET /api/agent/pricing` rail that each node persists locally
  (agent migration 106) and feeds into a single process-wide cost engine, so
  captured turns are stamped at the org's negotiated rate. Reads need
  `read:budgets`; writes use the new 18th RBAC key `write:pricing`. Since
  migration 135 every rate column is nullable: NULL means not quoted and
  falls through, a set 0 means the org negotiated that rate free. Operator
  reference: `docs/pricing.md`.
- **feat(org,assistant): an org admin assistant that can author the
  organization's administration under approval.** A closed table of 57 tools
  generates the tool specs, the labels, the system contract and the gate, and
  three enforcement points make a proposal safe: the chatting member is
  authorized before dispatch (a miss writes no proposal row at all), the
  parked proposal is inert with a server-computed preview, and approval
  re-checks the APPROVER against the same table, re-previews (a changed plan
  goes stale, an uncomputable one invalid) and executes the resolved plan
  under the approver. Bulk operations are ordinary table rows capped at 200
  items, with invites itemized because mail cannot be un-sent. Ships with an
  Approvals inbox, a sidebar badge, nine status pills and an opt-in
  `[dashboard].approval_email` notification. Operator reference:
  `docs/assistant.md`.
- **feat(org,budgets): team and developer spend budgets with real
  enforcement.** One authored `budgets` table (server migration 125) carries
  `cap_tokens` beside `monthly_usd_cap`, an `enforcement` column
  (report / soft / hard) and calendar periods with a timezone. Two real
  chokepoints act on it: the existing alert evaluator, and the AI gateway's
  reservation ledger, which now PROJECTS its cap from `budgets` instead of
  being separately authored. A third, opt-in node-side chokepoint composes
  the org's cap onto the node's existing guard engine through a signed
  per-caller `GET /api/agent/budget` pull - lowering-only on an individual
  node, org-authoritative on a managed node holding the `enforce.budget`
  authority. Dashboard team CRUD makes a "team budget" addressable without an
  IdP. An org that would rather not show dollars can render every figure on
  the org dashboard as tokens, or as a percentage of the relevant cap,
  through one formatter seam - never per-surface division - and token counts
  now ride beside cost on every payload that carried cost alone. Operator
  reference: `docs/budgets.md`.
- **feat(org,budgets): an honest per-developer coverage column.** A budget
  nothing can enforce must never render as "under budget". Nodes now
  self-report an enum-only budget posture that ingest lands in
  `org_node_budget_posture` (server migration 130) and the rollup turns into
  table-driven coverage reasons on the Budgets page, so an unenforceable
  scope or a developer who does not route through the gateway is visibly
  uncovered rather than silently green. The gateway also buckets each cap's
  window in the cap's own timezone (migration 131), retiring the
  gateway-buckets-in-UTC warning.
- **feat(org): three sign-in rails behind one seam - local, SAML and OIDC.**
  The new OIDC rail does authorization-code plus PKCE with JWKS rotation and
  presets for Entra, Okta, Google and a generic provider; SAML now boots
  non-fatally against an unreachable IdP instead of aborting startup; and the
  local email-and-password rail (argon2id) is unconditionally mounted as the
  break-glass path when an IdP is down. Identity is configured from the
  dashboard (Settings, Identity) and the setup wizard, seeded once from TOML
  and dashboard-owned thereafter, with `observer-org auth show` /
  `auth reset-bootstrap` as the CLI escape.
- **feat(org): IdP group to role mapping, gated JIT provisioning and member
  approval.** Group-to-role mapping is an admin-editable ordered rule set
  applied at every sign-in, with a last-admin guard and an explicit
  dashboard-versus-IdP precedence. More importantly, an unknown email on an
  SSO rail no longer becomes an active member by default: it auto-activates
  only via an email-domain allow-list (empty by default) or a matching group
  rule, and otherwise lands `pending` awaiting an explicit approval. Sessions
  are generation- and epoch-aware for every rail, so a single member or the
  whole org can be signed out
  (`POST /api/org/members/{id}/revoke-sessions` and
  `POST /api/org/auth/revoke-all-sessions`); every sign-in, failure, lockout,
  revocation and settings change is audited BEFORE the session issues; and
  `admin:identity` is the 16th RBAC permission key, held only by the builtin
  admin role.
- **feat(org,loc): lines-of-code tracking.** Per-session and per-developer
  AI-versus-human-versus-system CODE line counts, with comments, blanks and
  whitespace split out, produced by a pure classifier over already-scrubbed
  tool input (agent migration 103, node-local). Human capture is VS Code-only
  in v1 and `human_capture="none"` means unmeasured, never zero - no surface
  renders an AI share on it. `observer backfill --loc` re-counts history; the
  org wire ships aggregate counts by default and gates only the per-language
  mix behind the raw-content posture. Operator reference:
  `docs/loc-tracking.md`.
- **feat(org): Project Identity Resolver v2.** N differently-named local
  folders across N developers now fold onto one project with zero developer
  action: the node resolves a set of identity hashes at capture (agent
  migration 102), they ride on the session wire (server migration 121), and a
  pure table-driven rule engine (server migration 122) materializes projects
  through a single writer at ingest. Ships with `observer-org resolve-projects`,
  admin surfaces on Projects and Project Detail, and a Settings, Identity
  panel for the rule table.
- **feat(telemetrylog): a shared durable log in front of both org ingest
  paths.** Node push and OTLP gateway requests each publish one record to a
  durable log and are acked only after the log's PubAck - a log fault answers
  `503` plus `Retry-After`, never a lying `200`. The log contract is pure
  (`internal/telemetrylog`) with a NATS/JetStream adapter that can run
  embedded in-process or against an external cluster, a `[log]` config block
  with redaction, an `observer-org doctor` probe, and a conformance suite.
  Three durable consumers drain it, and records that cannot be applied land
  in a quarantine table with one writer and its own alerting.
- **feat(orgserver): typed Parquet on object storage as the durable system of
  record, with offline replay.** Accepted telemetry is written as typed
  Parquet to local, S3-compatible or Azure Blob storage, which is also the
  update mirror; legacy JSONL replay remains supported. Recovery inventories
  and validates the whole archive first, then applies one generation's
  sequence order in bounded pages, and transactional receipts (SQLite
  migration 137 / PostgreSQL 0003) stop a stale occurrence committing its
  derived rows twice. Object-store credentials resolve by identity (S3
  default chain, Azure SAS) rather than long-lived keys. Alongside this,
  `observer-org serve --role all|collector|worker|api|aigateway` (or
  `[server].roles`) splits the server into independently scalable tiers
  behind a load balancer, with advisory-lock singletons for the jobs that
  must run once and `/healthz` reporting the roles and the log probe.
- **feat(aigateway): AI Gateway v1.** An optional org-side gateway with
  virtual keys, atomic budget reservation and settlement, streaming support
  and metadata-only audit, plus Bedrock and Vertex providers, a standalone
  gateway binary, a capacity envelope and a live disallow gate.
- **feat(node): direct-vendor budget enforcement on managed nodes.** A
  managed node whose developer talks straight to a vendor - no gateway, no
  proxy - is now inside the budget too: the node watches its own captured
  spend against the org's cap and, past the cap, stops the offending agent
  processes and refuses new launches, with a policy-bound process cutoff and
  a three-class accounting readiness model so an unpriced model is FLAGGED,
  never silently denied.
- **feat(cloud): Cloud Intelligence - a signed-in personal plane (BETA).**
  An entirely opt-in, manual-first lane in which a developer can send one
  session's evidence to a hosted service and get an AI-written summary back.
  **Signed-in Free** allows up to 20 session enrichments per day and 100 per
  month on GPT-5.6 Luna (xhigh reasoning). **Plus is beta and experimental**,
  USD 15 per month with a 7-day trial: enrichments run on the substantially
  stronger GPT-5.6 Sol (xhigh reasoning), capped at 120 per month (25 per
  day), and add weekly project digests. Results now read as narrative
  sections - what was done, plans implemented, issues found, failures, and
  what to do next - and never expose internal evidence ids. The node half is
  zero-egress by construction: the `observer cloud` CLI is the only outbound
  trigger, preview bytes are the upload bytes, and nothing leaves a machine
  that a consent screen did not already name. Operator reference:
  `docs/cloud-intelligence.md`.
- **feat(cloud): consent, results and background enrichment where developers
  already look.** One plain consent card in Settings replaces the purpose
  vocabulary (which moves to an Advanced fold), a "What we sent" ledger shows
  every upload content-free, and session cards gained Enrich now, Sync now
  and a preview-first flow. With the policy on, a daemon-side sweep enriches
  finished sessions in the background on a 15-minute default. AI-written
  session titles and descriptions surface on the Sessions list, the session
  header and the VS Code tree, with inline editing and a user-over-AI
  precedence.
- **feat(orgserver): org-served Cloud Intelligence.** An enrolled node can get
  the same AI session enrichment from its OWN org server instead of the
  hosted personal plane, over a disjoint authority plane with its own org
  settings, job and result tables, a signed result-pull rail, per-org
  retention and an admission bound. Surfaces land on the node dashboard, the
  org session drawer and a Settings card.
- **feat(adapter): four new tool adapters.** `poolside` (Poolside's agentic
  coding model, reached as a JetBrains ACP agent; event-sourced NDJSON
  trajectories, per-call tokens), `zed` (Zed's own native agent; per-OS
  `threads.db` whose rows are rewritten whole per turn as zstd-compressed
  JSON), `kiro-crew` (AWS Kiro Crew, the multi-agent desktop app that drives
  kiro-cli - it emits rows ONLY for a Crew chat with no kiro-cli twin, so
  nothing is double-counted) and `grokbot` (the Grok Bot desktop app, whose
  inference runs in a remote sandbox, so tokens, model, cost and cwd are
  honestly absent rather than guessed). Freebuff also gained its desktop
  store, and Qoder, Open Interpreter, Factory and OpenClaw gained additional
  grounded surfaces. Supported-tool copy is reconciled to 40 across every
  surface.
- **feat(surfaceenrich): a hosted-surface enricher for JetBrains AI
  Assistant.** An orchestration host that owns no conversation but points at
  the agent session it drove now stamps that session's capture surface: a
  daemon-lifetime loop maps JetBrains agent-session pointers onto the owning
  adapter's session id, and the host record wins over the agent's own
  self-report (an empty host never clears it). Agents that do not round-trip
  by exact id stay honestly unmapped, and no JetBrains capture adapter was
  added, because one would double-count every agent's conversation.
- **feat(org): node session-detail trickles up to the org dashboard.** The
  org session drawer now carries what the node has always shown, additively:
  the capture surface, sub-agent token and cost attribution, real message
  columns with per-message role, effort, tools and stop reason, per-model
  cost buckets, a per-event cache timeline, the process tree with metrics,
  a Tasks tab and per-message tool-account attribution - the last two behind
  two new opt-in share tiers, with the rest as default metadata.
- **feat(design-system): one shared design system for every application
  surface.** `shared/` is now an npm-workspace package owning the tokens, the
  Tailwind preset, the primitives and the charts that the node dashboard, the
  org dashboard and the cloud portal all consume, ending web2's hand-copied
  tokens and webcloud's look-alike tiles. Components promoted into it stay
  pure, with a one-line re-export shim left at the old path so existing
  importers are untouched.
- **feat(config,dashboard): config management from the dashboard.** A
  generated config schema (with a CI drift gate) backs
  `GET /api/config/schema` and `PUT /api/config/keys`, a surgical file patcher
  that preserves comments and formatting, credential redaction, and a
  schema-driven Settings renderer that is honest about which keys need a
  restart.
- **feat(pricing): a signed public pricing feed.** List prices can now be
  refreshed without a package release: a signed feed published from the
  Tokenomics database and shaped like the node rate vocabulary, an
  in-process poller that re-prices the live cost engine, explicit precedence
  (enrolment first), an air-gap bundle, park and auto modes, and an org-side
  importer with a dashboard panel.
- **feat(ssh,terminal): SSH remote-profile terminals and an instance
  switcher.** Dashboard terminals can open on another machine through an
  allow-listed SSH profile (the request carries a profile NAME only),
  `observer ssh` reaches CLI parity with a "Test connection" verb and an
  opt-in reverse proxy forward, and the dashboard can switch to a remote
  install's dashboard over a local port forward.
- **feat(archive): corpus archival and reclaim.** An opt-in cold store
  (`archive.db`, its own lineage and its own owner) moves aged corpus rows
  out of the hot database copy-verify-delete, never delete-first, verifying
  by reading back from the cold file; `observer archive status|rehydrate|reclaim`
  drives it, and reclaim is operator-invoked only and never deletes. Disabled
  by default, so an untouched install is byte-identical to before.
- **feat(orgpush): a uniform envelope budget across all 41 wire families.**
  Every family is now bounded end to end with a loud push breaker, closing
  the class behind the 2026-08-26 host-crash amplifier, and cursor wires
  leave explicit slack so a push cannot pause 693 bytes over the limit.
- **feat(govern): enterprise share algebra and node governance.** A managed
  node's reporting tiers are composed through one share algebra with grant
  replacement and posture-conditional invariants, enterprise authority tokens
  reach the node through the enrolment-delivered grant, and every authority
  string on the dashboard says honestly what it does and does not allow.
- **docs: a private-datacenter deployment playbook and a sizing
  calculator.** `docs/private-datacenter-deployment.md` is the full operator
  playbook for standing `observer-org` up inside a private or air-gapped data
  center - hardware sizing, a non-cloud object store, HA PostgreSQL and NATS,
  a Kubernetes path, the air-gapped update mirror and the private-DC pricing
  feed - with a companion per-component sizing calculator rebuilt for the
  PostgreSQL, Parquet and NATS architecture.

### Changed

- **feat(orgserver): SQLite is no longer the org server's runtime engine.**
  The deployed org server runs its control plane and its Plane-B hot and
  query data on PostgreSQL (`OBSERVER_CONTROL_STORE_DSN` /
  `OBSERVER_DATA_STORE_DSN`; `--role all` may point both at one database),
  with typed Parquet as the durable system of record and a NATS/JetStream
  durable log. SQLite remains the org server's test engine and is completely
  unchanged as the node's local store. Migration is documented in
  `docs/stateless-collectors-postgres-migration-runbook.md`; note that the
  reference deployment's NATS sidecar uses ephemeral storage at R=1 and so
  does not by itself support an HA or container-group-loss claim.
- **feat(org,pricing): the gateway rate card and the gateway budget cap are
  projections, not authored objects.** `POST /api/org/ai-gateway/budgets` and
  `PUT /api/org/ai-gateway/rate-card` are retired to `409`; caps come from
  `budgets` and rates from `org_model_prices`. The projection is lossy by
  design (the card carries 4 of 13 price fields), and the one shape that
  cannot project is surfaced as `gateway_skipped` on the Pricing page rather
  than being dropped silently.
- **fix(orgserver): `scrub-content` now erases the durable system of
  record too.** Targeted erasure previously scrubbed only the hot data store,
  leaving the Parquet/object SoR readable and able to resurrect scrubbed
  content on a rebuild; it now runs through the same governance and retention
  seam with verify-read-back before tombstoning, fails loud, and refuses
  legacy JSONL. Replay defaults to a dry run with a target assertion and a
  sequence-gap policy.
- **feat(orgserver): retention covers the raw-detail tiers and the gateway
  lane.** The server-side retention allow-list was widened so the
  content-bearing tables added by recent arcs age out with everything else,
  and the ingest quarantine follows `data_retention_days` with requeued rows
  pruned after 7 days.
- **feat(web2): primary content shows directly.** The click-to-disclose
  gates on the org dashboard are gone; audited message bodies reveal on click
  instead of collapsing to a spacer row, and a content cell says honestly
  whether it holds a preview, an audited chip, or nothing because the node
  did not share it. The dashboard itself was reorganised into three areas
  with Observe and Configure split, Trajectories became a master-detail
  drill-down, every entity mention is a link through one shared primitive,
  and the brand mark and favicons now match the node dashboard.
- **fix(web,web2): em-dashes replaced with hyphens in user-facing
  copy.** A sweep across the node dashboard, the org dashboard, the shared
  components and the cloud portal, leaving code comments untouched.
- **fix(handoff): Full+cache is disabled where the source cannot provide
  it.** Thirty adapters have no full-body reader, so the Full+cache carry
  mode was inherently identical to Full for them; the option is now disabled
  with honest copy rather than offering a distinction that does not exist.
- **perf(orgpush): the org push tick no longer recomputes every snapshot wire
  on every tick** (steady-state CPU remediation, Track R2). Before this, all
  ~23 snapshot/aggregate wire families — the teams-tier aggregates plus the
  enterprise per-session and per-developer wires — re-ran their full 7-day
  window or whole-table read on every push regardless of whether anything had
  changed, which was the systemic cause behind the three query-shape findings
  fixed in 1.32.0. Each family is now guarded by an O(1) change probe over its
  own source tables (a single index-endpoint seek in most cases), so an idle
  node's whole snapshot family costs a handful of seeks instead of a full
  recompute. The cursor wires (sessions, actions, api_turns, token_usage,
  guard_events, otel_content) are untouched and still ship every tick.
  Fail-open by construction: a probe error, an unknown family, a failed push,
  or a budget-truncated wire all recompute, and every family is force-refreshed
  at least hourly so its server-side freshness never ages out of a dashboard
  window. No wire shape, server behaviour, or migration changed.
- **feat(config): new `[org_client] snapshot_interval_seconds`** bounds how
  often the snapshot wire families recompute even when their source data DID
  change, for nodes busy enough that the change probe never gets to skip.
  Unset means 4× the effective `push_interval_seconds` (8 minutes at the
  shipped defaults, and it tracks a retuned push interval rather than freezing
  an absolute); a negative value restores the previous every-tick cadence. The
  staleness it buys is explicit — see `docs/teams-operations.md`.

### Fixed

- **fix(budget): a fallback-priced model is no longer reported as an
  unpriced one (BUDGET-COV-3).** Org budget coverage lumped "this model was
  priced from the built-in table because the org has no negotiated rate for
  it" together with "this model has no price anywhere", so an estate with a
  perfectly enforceable budget read as partially blind. The two are now
  distinct posture classes (server migration 152) with their own coverage
  notes.
- **fix(node): a transient capture state never stops a running process.**
  The managed-node budget intervention treated a momentarily unresolvable
  per-tool capture state as an enforcement signal and could kill a healthy
  agent process. Transient states are now inert: only a settled, measured
  crossing acts.
- **fix(node): managed budget accounting uses the full pricing ladder.** A
  prior correction narrowed managed accounting to exact and org-quoted
  prices only, so every model without an org rate read "unpriced" and got
  blocked at effectively zero spend. Accounting now walks the whole engine
  ladder, and an unpriced model is FLAGGED, never denied; org spend is
  additionally sourced by capability rather than by tool name.
- **fix(org,budgets): the Budgets page sources spend by capability.** Spend
  attributed on the Budgets page could disagree with the enforcing
  chokepoint; both now read through the same capability-scoped source, and
  coverage ignores the individual-tenancy predecessor of a node that has
  since become managed.
- **fix(org): one org distribution identity (SIGN-1).** Several signed rails
  minted or pinned their own key material, so a node could hold more than
  one trusted org identity. Every signed rail now uses the single
  enrolment-delivered key, and pre-existing TOFU pins heal on a hash match
  instead of failing the node.
- **fix(org,budgets): budgets fail CLOSED on a managed node (BUDGET-FC-1).**
  A managed node that could not resolve its cap previously behaved as if no
  cap existed. It now fails closed, an explicitly-no-budget answer is signed
  rather than inferred from silence, and per-window hardness is shared so the
  node and the gateway cannot disagree about whether a window is hard.
- **fix(org): team-management routes worked only on fresh installs
  (TEAM-KEY-1).** `write:teams` was granted by the migration that created it,
  so an already-bootstrapped admin never received it and every team route
  answered `403`. Server migration 129 back-grants it, and a matching
  control-store retrofit covers `admin:identity`.
- **fix(harness-gateway): cancellation and timeouts are plumbed end to end.**
  Closing the org bridge now cancels the in-flight provider inference and
  disposes uncached failed sessions instead of leaking them, the provider
  request is bounded independently and below the org deadline, the saved
  provider timeout is forwarded rather than defaulted, and a silent exit or
  an empty completion produces an actionable diagnostic.
- **fix(orgserver): the org hot window evicts correctly.** A hot-window
  eviction defect that could leave stale rows resident was fixed and shipped
  with the v54 estate roll.
- **fix(org,policy): a committed mutation whose audit row fails is not a
  client error.** Under a split PostgreSQL control plane, policy-rollout and
  policy-resource mutations wrote their audit row inside the control
  transaction against a table that is not mirrored there, failing the whole
  mutation. The audit now rides inside the transaction only when the pools
  are the same, and a post-commit audit failure maps to a typed
  `500 audit_failed_after_commit` that says the change took effect and must
  not be retried.
- **fix(orgclient): the push cursor advances by compare-and-swap.** A blind
  save could rewind or skip the cursor under concurrency; the cycle now
  advances it with a CAS, and the task, tool-account and cache-event wires
  are mapped into the envelope with a reflective sentinel so a new wire
  cannot be silently forgotten.
- **fix(orgpush): zero-cost token rows are priced at push time.** Rows that
  reached the org with no cost are now priced with the node's own cost
  engine before shipping, and the org prices previously-unpriced model ids,
  falls back honestly for an unknown session model, and shows an explicit
  Unattributed spend bucket instead of quietly dropping it.
- **fix(terminal): dashboard terminals link to their captured sessions.**
  Late-starting sessions are now correlated (the first scan no longer gives
  up before first activity), simultaneous terminals of the same tool no
  longer share one candidate set, default-cwd launches auto-link, and the
  behaviour extends across every adapter with a launcher rather than a
  handful.
- **fix(launcher,predict,hook): three node-daemon defects.** Hooks under
  `observer claude` crashed on an inherited `OBSERVER_OOB_FD=3` that was
  adopted without first checking it was still a pipe or socket (it is now
  verified, and `OBSERVER_OOB_*` is scrubbed from tool-child environments);
  predictor facts were coupled to pricing availability, so proxy-only
  sessions got no cost band; and hook events collapsed several distinct
  events into one row.
- **fix(scripts): `restart-daemon.sh` refuses to run inside a
  daemon-launched session.** Restarting the daemon kills that session
  outright, because the daemon owns the pty, and it never resumes; the script
  now refuses by default and tells you to restart from an outside shell.
- **fix(scrub): Anthropic API keys with hyphens now redact.** The API-key
  body regexes did not admit hyphens, so `sk-ant-api03` keys survived
  scrubbing.
- **fix(codeintel,watcher,orgserver): three smaller regressions.** Project
  roots discovered under temporary directories were re-indexed on every
  daemon start, burning minutes per boot; a legitimate large watermark
  SQLite store was rejected by the oversize DoS gate; and `/ai-gateway`
  crashed on an empty estate because its list endpoints returned `null`
  rather than `[]`.
- **fix(cloud): two hosted-lane defects.** The results-pull cursor is now
  keyed by cloud host, so a node that had synced against staging no longer
  replays staging's cursor against production and never pulls a production
  result; and a zero-total trial-start transaction no longer flips a trialing
  subscription to active (found against a live sandbox checkout, with the
  Paddle goldens replaced by real sandbox deliveries).
- **fix(org,pricing): a colliding price row answers `409`, and an undated
  price takes effect when it is approved.** A duplicate model plus
  effective-date pair produced a raw constraint `500`, and an undated row
  approved from the assistant landed behind an earlier dated import instead
  of superseding it.

### Security

- **Nine dated reviews since 1.32.0, all recorded in `docs/security.md`.**
  Every arc in this release went through at least one fresh-context
  adversarial pass before shipping: the Plane-B gateway and RBAC arc
  (2026-08-30), Cloud Intelligence across seven separate rounds
  (2026-09-02 through 2026-09-16), the sign-in arc and its hardening wave
  (2026-09-07), lines-of-code tracking and the identity resolver
  (2026-09-07), enterprise pricing and the admin assistant (2026-09-08), the
  stateless-collectors architecture (2026-09-08 and a whole-arc review on
  2026-09-10), and org budgets (2026-09-07). The ledger in `docs/security.md`
  remains the canonical record.
- **SOR-2: targeted erasure reached the durable store.** `observer-org
  scrub-content` scrubbed only the hot data store, so a rebuild from the
  Parquet system of record could resurrect scrubbed content. Closed - see
  the Changed entry above.
- **XFF-1: dashboard audit rows record the real transport peer.** Audit rows
  recorded a forwarded address even when no trusted-proxy resolver was
  injected; the transport peer is now recorded unless one explicitly is.
- **Sign-in hardening.** `__Host-` cookie prefix behind a dual-read rename
  transition (so no admin is force-logged-out across the upgrade), `Secure`
  as an enforced policy with one explicit override, a double-submit CSRF
  token on the one server-rendered form POST, logout as a CSRF-bearing POST,
  MFA signal passthrough, IdP-initiated logout, an SSRF-hardened identity
  probe, and a held identity that can no longer admit itself simply by
  signing in again.
- **Cloud Intelligence privacy invariants are pinned, not promised.** Zero
  egress from the daemon (the CLI is the only outbound trigger, pinned by an
  invariant test), preview bytes equal upload bytes, an authority gate that
  refuses org-owned or unknown-authority evidence, credential absence checked
  before any provider call, a content-free local ledger of everything sent,
  and a per-table deletion matrix. The provider's data-retention posture is
  now stated as an explicit, operator-attested disclosure rather than an
  unqualified claim, and the marketing copy was flipped from absolute to
  conditional truth with a CI gate holding it there.

## [1.32.0] — 2026-08-26

### Fixed

- **fix(retention): the daemon no longer runs unbounded full-database
  `VACUUM`s** — the retention size-cap's automatic, looping bare `VACUUM`
  (which could write tens of GiB of SQLite temp files on large databases and
  fill the host disk) is removed from every automatic path. Size-cap
  reclamation is now a single bounded pass (aged-actions shed + WAL
  checkpoint + incremental vacuum where enabled); full compaction is
  operator-triggered via `observer prune --vacuum`, which now also requires
  the daemon to be down and ~2× free disk headroom.
- **fix(db): connection-scoped pragmas apply to every pooled connection** —
  `synchronous`, `temp_store`, and a new `hard_heap_limit` memory backstop
  moved into the SQLite DSN (previously they were applied post-open to one
  arbitrary pooled connection, letting other connections spill temp files to
  disk with default settings). The pool is now bounded
  (`SetMaxOpenConns`/`SetConnMaxIdleTime`), and a regression test pins the
  pragma set on N concurrent connections. Applied to the node DB, the org
  server DB, and the edge WAL store.
- **fix(db): startup integrity check is size-gated** — `PRAGMA quick_check`
  (which reads every page and could run for over an hour on multi-GiB
  databases) is skipped above a configurable size threshold
  (`integrity_check_max_gb`, default 8) with a 10-minute deadline;
  `observer doctor db` remains the explicit, authoritative integrity path.
- **fix(observer): cross-process maintenance lease** — retention,
  maintenance, and codeintel-on-start acquire a flock-based lease so
  concurrent observer processes cannot duplicate expensive maintenance work;
  codeintel index-on-start gained an aggregate deadline.
- **perf(store): org-push snapshot queries no longer sort or scan far more
  than they ship** — three per-tick reads fixed, each verified with
  `EXPLAIN QUERY PLAN` and selection-equivalence tests: session network
  events (per-session cap pushed into SQL via `ROW_NUMBER()` so the body
  join fires only on surviving rows, migration 089), session process rows
  (same cap pushdown, plus the per-run event count now seeks a new
  `process_run_id` index instead of aggregating the whole `process_events`
  table per tick, migration 090), and the codeintel dev + teams-tier
  aggregates (Cartesian-product joins rewritten to pre-aggregate per
  file). On the profiled node these were ~55% of steady-state daemon CPU.
- **fix(arena): Windows build** — unix-only process-group syscalls in
  `internal/arena` are build-tagged, restoring `GOOS=windows` builds (and
  the win32 npm/VSIX artifacts).

### Added

- **feat(observer): env-gated pprof endpoint** — `OBSERVER_PPROF_ADDR`
  (loopback-only, default off, fail-soft) serves `net/http/pprof` for the
  daemon's lifetime, so steady-state CPU consumers can be named empirically.
- **feat(observer): temp-file watchdog + startup guidance** — a background
  check WARNs when deleted-but-open SQLite temp files exceed a threshold
  (the failure mode that silently consumed ~80 GiB inside WSL), a
  stale-binary check WARNs when the running executable no longer matches
  the on-disk build, and daemon startup states that full integrity checks
  and compaction are operator-triggered.

### Docs

- Root-cause audit + remediation plan for the disk/compute exhaustion
  incident, and a steady-state CPU audit (pprof-named findings, a full
  background-loop cadence inventory, and prevention guidance) with its
  remediation plan — see `docs/audits/` and `docs/plans/`
  (`*2026-08-26*`).

## [1.31.0] — 2026-08-17

### Added

- **feat(adapter): JetBrains Junie adapter** — event-sourced `events.jsonl`
  capture for JetBrains' Junie coding agent, bringing the supported-tool
  count to 33.
- **feat(judge): opt-in Baseten judge provider** — a Qwen 2.5 3B Instruct
  judge behind a budget on/off switch, for admission and eval scoring.
- **docs: adapter count reconciled to 33** — READMEs, package manifests, and
  in-product copy aligned to the 33 tools folded from the integration
  registry.

- **feat(plane-a): P1-4 remote-config and cert rotation v1** — server migration
  040 `org_fleet_remote_config` / `org_fleet_cert_events`; GET/PUT
  `/api/org/fleet/collectors/{id}/config`; POST
  `/api/org/fleet/collectors/{id}/certs/rotate` (placeholder not_before/
  not_after); fleet board gains `remote_config_present` / `last_cert_event`.

- **refactor(plane-a): telemetry bundle helper for deployment paths** —
  `telemetry.AssembleBundle` is the single seam for capabilities/Doctor/
  connector Test connection; handlers no longer construct CH/Parquet/SQLite
  adapters inline. Full Control Store rewrite (Postgres dialect across
  orgserver handlers) remains residual (tracker P1-7).

- **feat(plane-a): P1-1 FTS filter on ClickHouse query store** — additive
  `model.QueryRequest.TextQuery`; ClickHouse `fts_text` column (DedupKey+
  ServiceName) + `positionCaseInsensitive` filter. Trajectory
  (`obs_traces`) explorer remains without FTS — TelemetryQueryStore only.

- **feat(plane-a): P1-9 Doctor + demo IaC emit** — `POST /api/org/deployment/doctor`
  returns `{ok, probes, ingest_ok, query_matched, detail}` (hot/ingest/query/
  durable Probe + synthetic `doctor-<uuid>` batch when hot configured);
  `GET /api/org/deployment/iac` emits static Terraform/Bicep demo templates
  (CH URL / Blob / ACI open-webui vars, no secrets); `/deployment` Doctor +
  IaC card.

- **feat(plane-a): P1-7 ClickHouse HTTP adapter + JSONL durable SoR** —
  `clickhouse.Store` (EnsureSchema / IngestBatch / Query / Probe via HTTP
  JSONEachRow; `OBSERVER_CLICKHOUSE_URL` or `CLICKHOUSE_URL`); `parquet.Store`
  filesystem JSONL under `OBSERVER_PARQUET_ROOT` (engine `parquet_object`,
  interim until Arrow); stubs when unset; `assembleTelemetryBundle` prefers
  env stores; `POST /api/org/deployment/doctor` synthetic ingest+query.

- **feat(plane-a): P1-4 fleet inventory + health board v1** — org-scoped
  collector board (`fleetinventory`) with healthy/stale/never_seen;
  `GET /api/org/fleet/collectors`; hosted on `/deployment`. Residual:
  remote config / cert rotation.

- **feat(plane-a): P1-2 entity correlation graph v1** — server migration
  039 `org_entities`/`org_entity_edges`; Upsert/List/Link/Neighbors; admin
  APIs + `/deployment` entity card. Provenance taxonomy unchanged.

- **feat(plane-a): P1-9 Phase 2 — connector catalog + capability probes** —
  server migration 038 `org_deployment_connectors`; catalog CRUD + Test
  connection via P1-7 capability Probe; `/deployment` shows resolved
  capabilities + connectors.

- **feat(plane-a): P0-10 Phase B — targeting, simulate, rollout UX** —
  workspace/environment/service selectors on policy-resource publish
  (signing-bound); agent GET query attrs; `POST …/simulate` fleet
  preview; `/policy` rollout panel wired to P1-3 APIs.

- **feat(plane-a): P1-7 Phase A — engine ratification + capability seams** —
  designate ClickHouse T1 / Postgres control / SQLite starter / Parquet SoR
  (harness = validation). Pure `telemetry/model` + five capability contracts +
  topology resolver; SQLite adapter; ClickHouse/Parquet NotConfigured stubs;
  `GET /api/org/deployment/capabilities`. Plan:
  `docs/plans/plane-a-storage-ha-plan.md`.

- **feat(plane-a): P1-9 Deployment Control Center Phase 1** — server
  migration 037 `org_deployment_wizard`; `GET/PUT` topology APIs; web2
  `/deployment` wizard (SQLite / ClickHouse-recommended / existing /
  custom). Connectors, Doctor, IaC residual (P1-7 blocked). Plan:
  `docs/plans/plane-a-deployment-control-center-plan.md`.

- **feat(plane-a): P0-10 Organization Control Center Phase A** — admin
  HTTP list/show/lint for `admission.input` + `egress.routing_guardrail`;
  web2 `/policy` gains family tabs (Guard TOML + Plane-A JSON
  lint→publish) with links to `/fleet-state`. Targeting/simulate/rollout
  UX residual. Plan: `docs/plans/plane-a-p0-10-org-control-center-v1-plan.md`.

- **feat(plane-a): P1-3 policy rollout + exceptions v1 (API+CLI)** —
  server migration 036 (`org_policy_rollouts` / `org_policy_exceptions`);
  canary delivery via `policyrollout.ResolveDelivered` on
  `GET /api/agent/policy/{family}` (named + hash% cohort; waivers force
  baseline); admin stage/approve/promote/halt/rollback + exception
  routes; auto-halt from `policy_state` cohort rates; rollback republishes
  baseline as MAX+1; CLI `observer-org policy-rollout`. UI deferred to
  P0-10. Plan: `docs/plans/plane-a-p1-3-policy-rollout-exceptions-plan.md`.

- **feat(plane-a): P1-1 trajectory explorer v1 (pagination + filters)** —
  `GET /api/org/obs/trajectories` gains Sessions-style `limit`/`offset`/
  `total` plus status/source/session_id/model/provider filters over the
  pushed `obs_traces` substrate. Web2 `/trajectories` gains a filter row
  + pager. FTS / saved views / live-tail / gateway browse / million-trace
  remain deferred (P1-7). Plan:
  `docs/plans/plane-a-p1-1-searchable-trajectory-explorer-plan.md`.

- **feat(plane-a): P1-10 production self-obs retrofit (Phases A–D)** —
  opt-in `[selfobs]` (default OFF) builds a credentialed OTLP emit sink
  in `buildProxy` (Shutdown on cleanup). Routing Decide emits sampled
  DecisionRuns (`routing_sample_n`, default 32). Admission Admit, online
  eval (`OnlineSampler.OnScored`) + CLI `obsEvalRun`, and `observer
  advise` emit under `system_agent`. Conformance registry Wired:true for
  routing/advisor/admission/eval (insight-agent remains P2-7). Plan:
  `docs/plans/plane-a-p1-10-production-retrofit-plan.md`.

- **feat(plane-a): P0-5 unified policy resource v1** — org distribution for
  `admission.input` + `egress.routing_guardrail` (agent mig 081 / server mig
  035). Signed fetch + CAS-fenced accept, enrolment-generation fence,
  LKG-before-listener (incl. standalone `observer proxy start`), steady-state
  poller, layered Org ownership on the shared AdmissionService, and P0-6
  reporter widening (`accepted_inert` / `delivered_unaccepted`). Pure
  compilers live in `internal/policyfam/{admission,egress}`; wire in
  `internal/orgclient` + `cmd/observer/policyresource_wire.go` +
  `internal/orgserver/policyresource`. Codex BLOCK B1–B11 + SHOULD-FIX
  SF1–SF8 folded (304 revalidate, LKG pin-required, cache-tree clear on
  identity change, Cleared outcome slots, accepted_inert↔observe,
  publish BEGIN IMMEDIATE + in-txn audit, 4KiB description cap).

- **feat(dashboard): New Terminal dialog gains a model picker.** Per-tool,
  capability-gated: a grounded `Model ModelSpec` row on the adapter's
  `internal/integration` capability declares HOW a tool takes a model
  (top-level flag, subcommand-scoped flag, or env var) so no consumer
  branches on tool name. The picker is seeded from the tool's own local
  session history (180-day window, recency-ordered) plus the row's
  grounded known models; an invalid or unsupported value is silently
  dropped so the tool's own default applies. goose is delivered via
  `GOOSE_MODEL` (env-only, no flag exists); kiro-cli's `--model` lives
  under its `chat` subcommand. openclaw and droid get no picker at all —
  neither has a grounded seed-time model mechanism (droid's `--model`
  exists only on its headless `droid exec`, not the interactive launch).

- **feat(terminal): New Terminal launches can run inside a bubblewrap
  filesystem sandbox (Linux + WSL2, opt-in, default off).** New
  `internal/sandbox` (bwrap argv composition + a readiness probe) and
  `internal/workspace` (three host-side workspace sources) packages,
  both pure per CLAUDE.md #1 — no SQL/HTTP/os-exec, the actual `bwrap`
  and `git` exec calls live in the one seam,
  `cmd/observer/terminal_sandbox.go`. The private root is bwrap-only in
  v1 (no Docker backend); it shares the host's network namespace, so
  **this does not block or monitor egress** — a sandboxed agent can
  still reach the network exactly like an unsandboxed one, same
  provider creds and all. `~/.observer` is bound read-write inside the
  sandbox on purpose, so the proxy route, hooks, and token capture are
  unaffected. Workspaces come from one of three host-side git
  operations before the sandbox starts — `live` (bind the real project
  dir), `clone-local` (`git clone --no-hardlinks`, so the clone can
  never hardlink objects back into the real repo), or `clone-remote`
  (host-side `git clone <url>` using your ambient auth, gated by
  `allow_remote_clone`, off by default) — plus a fourth, `worktree`,
  that ships **off by default** because it needs the main repo's `.git`
  bound read-write and a known pre-existing worktree-attribution bug
  (`findGitRoot`) has to be fixed first. Only `claude-code` has a
  grounded per-tool `SandboxSpec` (its real state directories) in v1;
  every other adapter is honestly reported as not sandbox-launchable
  rather than guessed at. A sandboxed launch request that can't
  actually be satisfied (disabled, backend missing/too old, userns
  denied, tool unmapped, workspace prep failed) **fails the launch
  outright** — there is no silent unsandboxed fallback. New
  `observer workspaces ls|rm <id>` CLI to inspect/clean up the managed
  workspace tree (no automatic retention sweep yet in v1). See
  `docs/sandboxed-terminals.md`.

### Fixed

- **fix(watcher): New Terminal install→launch capture for Muse/Prime (and peers).**
  The watcher used to freeze its fsnotify root set at daemon start via
  one-shot `Detected()`, and entered permanent idle mode when no session
  directories existed yet. Installing Muse/Prime (or any transcript-only
  adapter) from the New Terminal dialog and launching immediately left
  that session invisible until a daemon restart. `Watcher.RefreshRoots`
  now hot-adds newly-existing roots into the live watch set and Scans;
  the dashboard kicks it (with a short retry schedule) after guided
  install and after a successful launch; the poller's full-scan pass
  also re-applies roots so CLI installs recover without a dashboard
  kick. Empty `enabled_adapters = []` still detects nothing.

- **fix(launchers): every `observer <tool>` launcher now faithfully
  passes arbitrary flags through to the wrapped CLI.** `observer
  claude --model sonnet` previously died on a silently-swallowed
  unknown-flag rejection (exit 1, no output); passthrough only worked
  when a positional preceded the flag or after `--`. All 24 launcher
  verbs now parse their own wrapper-reserved flags manually
  (`DisableFlagParsing` + a shared parser) and forward every other
  token verbatim, in order. Wrapper-owned flags (`--resume`,
  `--continue-from`/`--carry` and the handoff family,
  `--attach`/`--no-attach`/`--no-proxy`, `--verify`, `--config`,
  `--proxy`, `--<tool>-path`, codex's process-control flags,
  copilot-cli's `--model`) keep their existing meaning and are never
  forwarded; malformed wrapper-flag usage now errors loudly instead
  of silently. Positional-first and `--` invocations behave
  byte-identically to before. Known trade-off: shell completion no
  longer suggests wrapper flag names on these subcommands (a cobra
  `DisableFlagParsing` limitation).

## [1.30.0] — 2026-08-08

### Fixed

- **fix(cursor): Cursor-on-Windows capture restored end to end.** The
  hook bridge had been dead since 2026-07-05 behind stale tee-shim
  entries; auto-register now self-heals that file shape (loud WARN +
  remediation on failure, `last_result`/`last_error` persisted to
  `hook_checksums.json`), the watcher resolves project roots from
  `.workspace-trusted` with stat-gated candidate expansion, and hook
  payloads carrying the IDE's `Uri.fsPath` spelling (`/c:/…`) now
  land on the same canonical `/mnt/c/…` root as the watcher's rows —
  one project identity instead of up to six spellings of one
  directory.
- **fix(pathnorm): the `/c:/` URI-fsPath drive spelling folds into the
  Windows-drive layer.** Anchored lexical detection (never
  `filepath.IsAbs`, which is host-dependent); non-drive lookalikes
  (`/cache/…`, `/cc:/…`, bare `/c:`) are pinned untouched. Hook ==
  watcher convergence is enforced by test.

### Changed

- **Tool count synced to 31 everywhere, from one generated manifest.**
  `tools/toolcountgen` derives the editorial adapter count from the
  integration registry (fold rules explicit and tested); the website
  hero badge, docs, READMEs, npm and VS Code Marketplace descriptions,
  and the extension walkthrough all read 31 now, and the accuracy
  checker fails on bare "N tools"/"N integrations" drift, on
  registry↔prose disagreement, and on the distribution surfaces that
  previously sat outside its scan root.
- **Version-scoped the stale "Cursor 3.4+ stopped writing transcripts"
  claims.** True on 3.4.20–3.9.16 where it was measured; on 3.14.27
  the transcript walker is live again and currently the sole
  Windows-IDE capture path.

## [1.29.0] — 2026-08-07

### Added

- **feat(adapter): Meta Muse Code CLI — the 30th adapter.** Event-sourced
  `session.jsonl` parsing (envelope → payload_type → event.kind) with
  microsecond `recorded_at` timestamps. `model_completed.usage` needs
  DUAL netting — input including `cache_read`, output including
  reasoning — the OpenAI-Responses convention rather than Anthropic's;
  a subagent run under `subagent/<child-uuid>/` rolls up into its
  parent session. `auth.json`, `trust.json`, and `tui-history.jsonl`
  are never read.
- **feat(adapter): Prime Agent — the 31st adapter.** Prime Intellect's
  Prime Agent CLI is a hard fork of pi-mono with its own parser, not a
  retag of the existing `pi` adapter. Flat JSONL sessions under
  `~/.prime/agent/sessions/<uuid>.jsonl` form a tree via `parentId`
  (8-hex ids); the envelope timestamp is ISO-8601 while the inner
  message timestamp is Unix milliseconds. Usage input arrives already
  NET (`totalTokens == input+output+cacheRead+cacheWrite` exactly) —
  the opposite of most adapters' gross-then-netted convention, so this
  one is a genuine exception, not a bug. `ipython` is the sole
  built-in tool: reads, edits, and shell commands all run through one
  persistent Python kernel. A child agent run's usage folds into the
  parent's token row via the same source-event id (ON CONFLICT
  MAX-upgrade, never double-counted). `auth.json`,
  `daemon-workers/*.json`, and the pickled `kernel-state.dill` sidecar
  are never read.
- **feat(cli): `observer muse` and `observer prime-agent` — launcher
  verbs 22 → 24.** Muse launches non-proxied for now; an open
  `--base-url` question blocks proxy routing until it's answered.
  Prime Agent launches proxied, through its own
  `~/.prime/agent/models.json` provider entry. Both ship with the same
  grammar/resume-row/provider-merge conformance tests every other
  launcher verb carries.
- **feat(dashboard): plain-shell "New terminal" launch, opt-in.** The
  New Terminal dialog can now spawn a bare shell — the child's own
  `$SHELL`, or `/bin/bash`/`/bin/sh` as a fallback — instead of only a
  known AI-tool launcher. Off by default and deliberately independent
  of the existing fresh-agent toggle: `[terminal.launch].allow_shell`
  is its own opt-in, because a plain shell can run any command, a
  strictly larger authority grant than a capability-registry-bounded
  AI-tool launch. The dialog only offers the option when the daemon
  reports it enabled, rather than showing it and failing at launch
  time.
- **feat(dashboard,obs): Policies module — admission and egress policy
  authoring on the node dashboard.** What used to be config-file-only
  setup is now a guided editor at `/policies`: six tabs (Overview,
  Templates, Guardrails, Routing, Test, Activity) covering an
  11-entry template catalog across five groups (Scope, Safety, Cost,
  Data locality, Bundles) for one-click guardrail criteria and egress
  rules, plus live validate-and-apply and an activity feed. The UI
  states its own honesty limit rather than hiding it: the dashboard
  and the proxy each hold a SEPARATE `AdmissionService` instance, so
  "Apply live" only takes effect on the dashboard's own SDK front door
  immediately — egress edits and proxy-side enforcement need Save plus
  a daemon restart. Paired with a new `examples/copilot-harness` demo
  walking the whole Plane-A governance loop (admit → proxy → optional
  OTLP trace) end to end.
- **feat(store,dashboard,cli): overall session rating (1–10).** A
  fourth session-classification primitive alongside tags, favorite,
  and note (migration 080): one reviewer score per session, landing
  as a column on the existing `session_annotations` row rather than a
  new table. 0 is the "unrated" zero value everywhere, and an
  annotation row is garbage-collected once favorite, note, and rating
  are all back to their zero states — "no row" and "reviewed and
  found unremarkable" stay indistinguishable, as intended. Node-local
  like the rest of session classification: no wire surface, no
  org-push column.
- **feat(cost,dashboard): dated pricing — recorded → dated → undated.**
  A new per-model rate timeline lets a price change take effect
  without silently repricing history: usage before a cut keeps the
  old rate, usage after keeps the new one. First landed against a
  real change — the OpenAI GPT-5.6 Terra/Luna price cut effective
  2026-07-30 — then rolled out across the dashboard surfaces that had
  been pricing every row at today's flat rate regardless of when it
  ran: report, budget, statusline, live, and experiments, plus two
  more found beyond the originally named list. Each now prefers a
  turn's own recorded `cost_usd` first, falls back to the rate that
  was actually in force on that turn's own timestamp, and only falls
  back further to the current flat rate when neither exists.
- **feat(website): `/pricing`.** The site had no pricing link anywhere,
  and a missing price label reads as a hidden price rather than a free
  product. The page states what is true: the node **and** the
  self-hosted org server are both Apache-2.0 with no licence gate, so
  Teams can be self-hosted free today; commercial support and a managed
  option are in design and do not exist yet. No figures, because none
  are shipped. Pricing takes the Arcade slot in the primary nav; Arcade
  stays reachable from both footers.
- **feat(website): homepage rebuilt around the install command.** Four
  competing hero subheadlines collapse to one, and
  `npx @superbased/observer` becomes the primary copyable call to action
  — the site's own analytics already counted installing as the
  conversion while the gold button pointed at the docs. "No account · No
  signup · No telemetry" is promoted out of fine print. A new
  measurement-honesty section surfaces the public retraction, which had
  no link from any marketing page, alongside two entry points to the
  eight comparison pages, previously unreachable from the marketing
  site.
- **feat(website): FAQPage schema on the comparison pages.** The docs
  renderer was already generic; emission was gated behind an allow-list
  containing only the track section. Auditing Compare and flipping one
  map entry adds 31 questions across 9 pages, taking site coverage from
  30 pages / 151 questions to 39 / 182, with honesty parity holding by
  construction.
- **feat(website): RFC 9116 `security.txt`.** The disclosure route
  existed only as prose; researchers and enterprise scanners look for
  `/.well-known/security.txt` first, and its absence reads as no
  process.
- **test(website): licensing and release-date tripwires** in the
  accuracy gate (9 → 11 check groups). The licensing check binds to
  structural column identity — locate the header column named
  SuperBased, inspect only its cells — rather than proximity to the
  word, because comparison prose routinely names SuperBased and a
  competitor in one sentence.

### Fixed

- **fix(integration,adapters): adapter-count surfaces move together,
  30 → 31.** Landing Prime Agent meant every pinned adapter-count
  surface had to move in the same pass — `observer adapters`, doc
  counts, and the generated website pages that state "N coding tools"
  — six drift gates re-verified in sync so the number can't drift out
  from under the roster the way a stale "26 coding tools" once did
  (see v1.28.0's tool-count drift fix).
- **fix(vscode): `observer.daemon.mode` now defaults to `auto`.** It
  shipped as `detect`, which never spawns the daemon, so a fresh install
  showed an empty sidebar and a warning status bar until the user found
  and changed a setting the README itself called "recommended for most
  users" — the documentation and the default disagreed, and the default
  won. `auto` attaches to a daemon you already started and only spawns
  when none is running, and only ever stops a daemon it spawned itself.
- **fix(website): three shipped claims that contradicted the site's own
  honesty standard.** Literal `[REDACTED]` placeholders in the live
  `/enterprise` SSO and enrolment copy; SuperBased's own Apache-2.0
  licence described as "Source-available" across nine comparison pages,
  next to competitors correctly labelled MIT; and npm/PyPI **downloads**
  presented as "total installs" beside a 35-star repo.
- **fix(website): the nav "Install free" button was unreadable.** It
  rendered `--ink-dim` cream on gold at 1.52:1, in both rest and hover,
  on every home-layout page: the CTA sits inside `.nav__links`, so that
  rule's higher specificity beat `.nav__cta` and the intended dark text
  never applied. Now 9.14:1.
- **fix(website): WCAG AA contrast across both themes.** Eight measured
  failures, worst 2.70:1, corrected by lightness and alpha only so hue
  and brand identity are unchanged; verified live at 77 elements per
  theme with zero failures.
- **fix(website): meta descriptions across 61 docs pages.** All were
  past the point where search results truncate, and 16 generated ones
  carried a literal ellipsis mid-sentence. Composition is now
  budget-aware, spending what is left after the per-tool lead on the
  longest call-to-action rung that fits, so the marketing tail degrades
  and the differentiating fact survives. Median length 209 → 154, zero
  ellipses, all unique.
- **fix(website): exactly one `<h1>` per docs page.** 62 of 95 emitted
  two — one from the front-matter title, one from the markdown body.
  Fixed in the renderer rather than the sources, because the changelog
  page is itself generated and would have been overwritten.
- **fix(website): sitemap freshness.** `lastmod` was a hardcoded
  constant reused for every URL and never updated, leaving `/docs` a
  month stale; it now derives per file from git history. `changefreq`
  was "weekly" on 94 of 104 URLs, contradicting its own stale
  timestamps.
- **fix(website): missing `<main>` landmark and focus ring** on the
  home-layout pages, which had neither while every support page had
  both.

## [1.28.0] — 2026-08-01

### Added

- **feat(cli): `observer statusline` — one-line, fail-open, wordmarked
  cost status.** Prints a single line — the `▞ superbased` wordmark plus
  (when available) the current session's cost, today's total observed
  spend, and the active model name — for Claude Code's `statusLine`
  contract or any host tool that execs a command and reads stdout.
  Input precedence is piped stdin JSON, then `--session-cost`/`--model`/
  `--cwd` flags, then `OBSERVER_STATUSLINE_SESSION_COST`/
  `OBSERVER_STATUSLINE_MODEL` env vars, then nothing — segments are
  omitted, never rendered as a fabricated `$0.00`. The "today" segment
  comes from a new, lean `GET /api/statusline` daemon endpoint over a
  bounded, loopback-only HTTP call (`--timeout`, default `80ms`); when
  no daemon is running, or it doesn't answer in time, that segment (and
  only that segment) is silently omitted and the command still exits 0.
  `--no-daemon` skips the daemon attempt entirely; `--explain` reports
  which data path was used to stderr; `--json` emits a machine-readable
  line. All dollar figures are
  estimated list-price totals, not invoiced amounts, stated once at
  `--help` and at registration time, never per-render. Registration is
  opt-in via `observer init --statusline` (writes Claude Code
  `settings.json`'s top-level `"statusLine"` key) — never implied by
  `--all`, never auto-registered by `observer start`; `--uninstall`
  removes the key entirely. A Claude Code install detected only on the
  Windows side of a cross-OS WSL setup gets an honest WARN, not a
  cross-OS bridge. The VS Code status bar's live-state text also picks
  up the same `▞ superbased` wordmark prefix
  (`observer.statusBar.wordmark`, default `true`, to turn it off). The
  daemon side adds migration 074 (`idx_token_usage_timestamp`) so the
  endpoint's "today" aggregate is an index scan, not a table scan. See
  [`docs/observer-statusline.md`](docs/observer-statusline.md).
- **feat(cli): `observer usage` — zero-install one-shot cost report (the
  `npx @superbased/observer` activation path).** Scans every detected AI
  coding tool's own local session files into a throwaway temp database,
  prints one tool × model cost table, and deletes the database again.
  Zero configuration, zero network calls: pricing is embedded in the
  binary and the default path never reads `~/.observer/config.toml` or
  any `OBSERVER_*` environment variable, never writes any AI tool's
  config, and never binds a port. Flags: `--since` (default `30d`,
  accepts `7d|30d|90d|all|RFC3339`), `--days`, `--group-by`
  (`tool-model|tool|model|day`), `--tool`, `--budget` (default `30s`,
  `0` = unlimited, prints an honest `partial:` footer on expiry),
  `--json`, `--keep-db`, `--config` (opt back into a real config and its
  pricing overrides), `--no-progress`. Bare `observer` now runs this same
  report on a machine with no local SuperBased state at all (no
  `~/.observer/observer.db`, no `config.toml`, no daemon listening) — a
  state branch, never an invocation-channel branch — and prints the
  usual welcome screen otherwise; `OBSERVER_ONESHOT=off` always forces
  the welcome screen. New pure package `internal/oneshot`. See
  [`docs/one-shot-usage-report.md`](docs/one-shot-usage-report.md).
- **docs: repo-landing hygiene fixes.** README gets a "Try it in one
  command" block (the `npx`/`observer usage` activation path, immediately
  above Install) and a plain, no-count "⭐ Star this repo" badge + CTA
  line near the top. `scripts/release.sh`'s public-mirror re-staging now
  also carves out `docs/deployment-models.md`, `docs/remote-access.md`,
  `docs/session-handoff.md`, `docs/cache-tracking.md`, and the
  `docs/guard-{rules,policy-authoring,compliance}.md` trio, fixing four
  confirmed-live 404s on the public repo's README links (all three
  re-staging sites — the force-add list, the `.gitignore` negation
  block, and the `docs_leaks` sanity-check regex — kept in sync). Both
  README hero infographics regenerated from new **versioned HTML
  sources** (`docs/assets/infographics/gen/` + `render.mjs` — the old
  images were one-offs with no source in the repo): current single-word
  lockup, correct counts (29 adapters / 25 MCP tools), and the
  proxy-accuracy / cache-attribution / routing differentiators now in
  the pixels. The stale `13-trajectories.png` screenshot recaptured from
  the web2 admin dashboard's Trajectory Explorer (the node dashboard no
  longer hosts that page).
- **feat(mcp): droid + Command Code MCP registration.** `observer init`
  can now register the SuperBased MCP server into Factory Droid and
  Command Code — one locate row + Installed probe + registry `MCPTarget`
  each, following the grounded droid pattern. Registry rows only; no
  new switches (integration-registry discipline).
- **feat(store,dashboard,web,cli): session tags/favorites/notes.** New
  migration 075 backs a `sessiontags` store seam behind Execute-class
  routes (mutations gated the same way as every other write path), plus
  an `observer tag`/`observer tags` CLI with exact-first-then-index-range
  prefix resolution. The dashboard gains `TagPill`/`TagEditor`,
  star-favorite toggles, a note field, server-side tag+favorite filters,
  and a tags rollup panel; the rollup query is chunked past SQLite's
  32766 bind-variable ceiling (`cost.SessionRowsByID`, capped at 900
  session IDs per scope — the pre-fix symptom was cost columns silently
  zeroing out, not an error). Remote devices are honestly read-only for
  tag mutation: the only `Execute`-class mint is terminal-scoped and
  loopback, so a phone or tablet viewing the dashboard sees the
  classification controls disabled with a stated reason rather than a
  control that quietly fails. Mutations are validate-before-write atomic
  and single-flight; a conflicting note edit surfaces a hint instead of
  silently overwriting. Privacy pins cover the new columns end to end
  (a canary tag proven never pushed under `admin_managed`). See
  [`docs/dashboard-walkthrough.md`](docs/dashboard-walkthrough.md)
  ("Classifying sessions: tags, favorites, notes").
- **feat(announce,web,orgserver,orgclient,web2): dashboard
  announcements, three rails.** New pure package `internal/announce`
  backs **R1**, a `GET /api/announcements` embedded rail with a
  dismissible `AnnouncementBanner` (ack tracked in `sb_announce_ack`,
  never re-shown once dismissed). **R2** is a click-only npm-metadata
  piggyback — the `superbased.announcement` field an operator authors
  into `npm/observer/package.json` at publish time and the dashboard
  reads passively; an always-on background poll was considered and
  rejected for the zero-network posture `observer privacy` states, and
  the choice is written down on the measurement-honesty page. **R3** is
  a signed org-distribution rail on the routing-policy pattern: agent
  migration 076 (a node-side cache) + server migration 022, a
  `[dashboard].org_announcements` gate (partial-merge default tested),
  and a web2 composer as the first UI consumer of the sign-and-distribute
  mechanism. See Fixed below for the security round that hardened R3
  before it shipped, and
  [`docs/teams-operations.md`](docs/teams-operations.md) §7 for the
  publish/retract/trust-model/opt-out operator reference.
- **feat(tooltax,web): canonical cross-adapter tool taxonomy.** New pure
  package `internal/tooltax` (WP-T1) is a 1,074-row table across all 30
  tool identities, with `MCPIdentity` as the one owner of MCP-tool
  naming — a corpus-measured slash-form convention was dropped on
  zero corpus evidence rather than guessed at, closing a taint
  false-positive class; `models.IsMCPToolName` now delegates to it, and
  the routing package's independent zero-imports pin correctly refuses
  the same delegation, with equivalence proven from the tooltax side
  instead. WP-T2 generates a TypeScript mirror (`actiontax.gen.json` →
  `actions.ts` as a reader) so the dashboard's category/colour data
  can't drift from the Go table, aligns the MCP-parser divergence to Go,
  and adds a `taxonomy-build-drift` CI job. A codex gate round then
  closed the real hole the first pass left open: the Go-side test suite
  stayed green while a hand-written TS reader could still silently
  diverge, so the fix is a REAL-TS parity gate that esbuild-compiles the
  actual `actions.ts` against 28 Go-oracle vectors, a generated literal
  category union that makes a missing `CATEGORY_COLOR` a compile error
  instead of a silent runtime fallback, and `C:/`-drive plus
  POSIX-colon path guards.
- **feat(mcp,cli,docs): published stable MCP local contract.**
  [`docs/mcp-contract.md`](docs/mcp-contract.md) documents the full
  25-tool tier table (18 stable, 4 conditional, 3 experimental) and
  `observer contract --json` emits it as machine-readable data, backed
  by conformance tests that pin it against the real server; the README
  gains an Integrations section pointing at it. A codex round then made
  the published invariants actually true: a `days`-parameter clamp
  closes a gap between the documented and enforced range, every one of
  the 25 tools' required parameters and all 18 stable tools' result keys
  are wire-checked, and the markdown drift-gate test now parses BOTH the
  doc and the generated mirror instead of one — the prior version could
  pass while blind to a real divergence between them.
- **feat(plugins): adapter distribution as installable plugins, Phase 1
  in-repo — not yet published.** `plugins/plugingen` satisfies the
  one-owner registration rule by execution rather than duplication: it
  runs the real `observer init` registrars (`mcp.Registrar`,
  `hook.Registry`) against a sandbox `$HOME` and transposes their exact
  output into `plugins/claude-code/` (a marketplace root plus a plugin
  directory — `plugin.json`, `.mcp.json`, `hooks.json` with all 22
  events) and `plugins/cursor/deeplink.txt` (a static, exact-config
  base64 deeplink, with its inherent one-click-install caveat stated
  rather than hidden). A byte-for-byte `verify-plugins-build` plus a
  `plugins-build-drift` CI job keep the generated trees honest, and
  `sync-npm-version.sh` now stamps both plugin manifests with the full
  semver (an opaque version pin, not MV3's numeric-core trap). Nothing
  is published: the `superbasedapp/observer-plugins` repo, the Claude
  Code marketplace listing, and the Cursor deeplink distribution all
  stay operator-gated pending a decision on a known caveat — installing
  the plugin alongside `observer init --claude-code` double-registers
  hooks, so both would fire on every event until that's deduped.
- **feat(orgserver,orgclient,web2): Teams member-invite loop,
  default-off.** `[server].member_invites` (default `false`) lets an
  active admin mint a capped, audited, time-boxed invite link — server
  migration 023 backs the monthly cap and the `invite_minted` audit
  trail — with a web2 invite composer page and a node-dashboard nudge on
  the `Execute`-class surface. Conversion is reconstructed by joining
  `minted_by` against `used_at`; nothing new goes on the agent wire. See
  Fixed below for the security round that closed eight findings (seven
  fixed, one documented) before this shipped.
- **feat(plugins): one-command install for 20 AI coding tools, published
  as the public `superbasedapp/plugins` repo.** Each supported tool can
  now wire SuperBased up through its own native plugin or extension
  mechanism instead of a hand-edited config file. The repo is *assembled*
  from this one, never hand-maintained: `scripts/assemble-plugins-repo.sh`
  runs the REAL `observer init` registrars (`mcp.Registrar` +
  `hook.Registry`) against a sandbox `HOME` and transposes their exact
  output, so a plugin manifest can never drift from what `init` actually
  writes. Coverage grew across three waves to a **52-file** assembled
  tree: six native manifests (kimi-code, qoder, devin, droid, openclaw,
  antigravity — validated with each vendor's own validator where one
  exists), six generated config listings (crush, kiro-cli, copilot-cli,
  kilo-code, roo-code, open-interpreter), a Gemini CLI extension, a Goose
  listing, a Codex plugin + marketplace, and a Copilot
  `vscode:mcp/install` deep link. `@superbased/opencode-plugin` is
  published to npm. Cowork's `.mcpb` bundle is built but deliberately
  **not** claimed as supported until a live install verifies it.
- **feat(tooltax): a canonical tool-name taxonomy shared by every
  adapter.** A single 1,074-row table (30 tools) is now the one owner of
  what each tool call *is* — its canonical name, category, and surface —
  replacing per-adapter string matching. Adapters read `tooltax.For`;
  migration 077 backfills historical rows whose `action_type` was
  `unknown`; the dashboard gains a `/api/tools/breakdown` endpoint with
  real category and surface dimensions; and `observer adapters` gains a
  `VOCAB` column reporting, per adapter, whether its vocabulary is
  grounded or honestly unknown.
- **feat(db): test runs can no longer touch your real database.** `db.Open`
  now refuses any path inside the operator's actual `~/.observer` when
  running under `go test`, returning `ErrRealDBInTest` before `sql.Open`.
  This closes a real incident in which a working-tree test resolved
  `config.Default()`'s live path and ran a migration against the 16 GB
  production store. The gate resolves symlinks across the full path and
  checks hard links via `os.SameFile`, guards both migration entry points
  (including `internal/orgserver/db`), and fails loudly rather than
  skipping when the home directory can't be resolved.

- **feat(orgserver,web2): GitHub Copilot seat subscriptions are finally
  priced.** The seats API returns COUNTS ONLY, so `/api/org/telemetry`
  reported "50 seats" and the metered overage while the subscription
  those seats cost — normally the larger of Copilot's two cost feeds —
  appeared nowhere. `[copilot_analytics].per_seat_price_usd` existed and
  defaulted to $19, but **nothing read it**: an admin could set it and
  change nothing. `SeatStats` now carries `per_seat_price_usd` and
  `monthly_usd` (`total × price`), threaded from config through the
  dashboard options, and the org dashboard renders a "Seat subscription"
  tile plus a summary stat. Both are omitted entirely when the price is
  unconfigured — absent means "price not supplied", never "seats are
  free". **The unit trap is preserved at every level:** `monthly_usd` is
  a point-in-time monthly fee and is never summed into `cost_usd`
  (additive per-day metered spend) — asserted in Go, on the wire, and in
  every UI aggregate. A non-finite or negative price is now refused at
  config validation: TOML accepts the literals `nan` and `inf` without
  error, and `inf` would otherwise reach `encoding/json`, which refuses
  it *after* the 200 status is already sent.

- **feat(cockpit): burn rate on the session cost strip.** A running
  total never answers "should I stop this?" — a rate does. The terminal
  cockpit's cost strip gains $/h plus a +1h projection. The rate is
  measured over the turns the cockpit already polls so it reflects
  current spend rather than being diluted by earlier idle time; the
  oldest fetched turn is the window boundary, so it sets the denominator
  but is excluded from the numerator. Falls back to the session average
  over the same elapsed the header shows, and returns nothing — never a
  confident $0.00/h — when neither basis exists.

### Fixed

- **fix(codex): patch rows no longer land with an empty input.** Modern
  Codex invokes `apply_patch` from inside an `exec` custom_tool_call and
  the executor stamps `patch_apply_end` with its own `exec-<uuid>` id,
  while the response_item carries `call_<hash>`. Different namespaces, so
  the join could never match on current builds and every patch row took
  the standalone path with no `raw_tool_input`. Measured over a
  393-rollout corpus: 2,059 exec-uuid vs 416 call_hash. There is no join
  to repair, so the standalone path now reconstructs the input from the
  producer's own `changes` object, with the rendering owned in one place
  so a live-captured row and a `backfill --codex-tool-input` recovery are
  byte-identical. On one live update-heavy session this took empty inputs
  from 95 to 0.

  Authored-byte accounting was deliberately left alone after measurement
  proved the obvious "fix" wrong: an `update` change carries only
  `unified_diff` and scores zero here, which *looks* like a bug, but every
  patch also emits an invocation row that already counts the same bytes
  from its own patch text (107 invocation rows / 142,823 B alongside 95
  executor rows). Counting the diff as well double-counts every update.
  The reasoning is now written into the code so the zero is not "fixed"
  again.

- **fix(dashboard): Compression tiles show an em dash, not a confident
  zero.** `deriveTotals()` returned an all-zero object whenever the
  timeseries query had no data, so five tiles rendered "$0.00 saved
  across 0 compression events" from the moment the page mounted — and
  because the loading flag also clears on error, a failed query settled
  that zero in as a confident, wrong answer. The no-data branch now
  yields undefined, which the existing null-safe formatters render as an
  em dash: loading keeps the pulse, an error settles to a static dash.

- **test(terminal): one flaked assertion can no longer kill an entire
  package.** A cache-cleared `-race` sweep reported `FAIL cmd/observer
  2400s` — the full 40-minute timeout. The cause was not slowness:
  `TestTerminalPidSeederEndToEnd` failed an assertion and then deadlocked
  in cleanup, because the PTY stub's `Kill`/`Close` were no-ops that never
  unblocked the parked reader, so `Manager.Shutdown`'s unbounded
  `wg.Wait()` never returned. Being a serial test, it left ~340 parallel
  tests in the same package waiting and never run — the package reported
  FAIL having executed almost none of itself. The prior "green" sweep
  could not have caught this: `cmd/observer` was one of the 193/195
  cached packages. With the stub honouring `Close`, the same failure now
  takes 6.9s instead of 40 minutes.

- **fix(dashboard): cache-savings counterfactual no longer zeroed for
  proxy-recorded turns.** Rows with a recorded cache read > 0
  contributed $0 to the "saved by caching" counterfactual, understating
  cache savings roughly 3× on real corpora. Found by the Show HN corpus
  mining pass; the memo's savings claims are gated on this fix.
- **fix(store): outcome-update seam hardened.** Cross-tick
  `tool_results` outcome flips now persist action outcomes through ONE
  store-owned seam instead of per-adapter writes, closed across two
  adversarial review rounds (evidence-gated 1→0 self-heal included).
- **fix(hook,init): settings.json writer classes hardened (9 call
  sites).** Two pre-existing defect classes shared by the hooks/cursor/
  statusline registrars: the `any`-decode re-indent path could mangle
  big integers (float64), reformat numbers, HTML-escape strings, panic
  on JSON null, and silently collapse duplicate keys — now re-indents
  RAW bytes; and the read-modify-write used a fixed temp name with no
  lock — now unique temps + a cross-process advisory lock +
  re-read-after-lock. Plus: loose ownership matching tightened, symlink
  clobbering refused, a 5 MiB size cap, PID-reuse liveness via
  `/proc` cmdline, and oversize-stdin handling on the statusline path.
- **fix(hook): registrar write-path hardening, second pass.** The
  deferred WP9 ledger: `hook_checksums.json` writes now take the
  cross-process advisory lock and rename a unique temp file (was an
  unlocked plain write); the codex `hooks.json`/`config.toml` writers
  drop their fixed `.tmp` names for unique-temp atomic writes under
  per-path locks with re-read-after-lock; and the unregister path
  refuses to delete a symlinked config file instead of silently
  unlinking the link while the target keeps stale hooks. Each pinned
  by a concurrent-writer or symlink regression test.
- **fix(adapter): foreign-mount SQLite mirror staging unified under
  `internal/adapter/mirrorbase`.** Seven adapters staged cross-mount DB
  mirrors into persistent `~/.cache` during parsing through copied
  helper code; the new single-owner seam scopes them, and
  `observer usage` redirects mirrors into its throwaway scratch
  directory (live-verified: a one-shot run adds zero cache entries).
- **fix(integration): npm Binary-row honesty.** Dropped impossible
  `.exe` spellings from 10 npm-distributed CLI tools' Windows binary
  rows — npm shims install `.cmd`/`.ps1` wrappers, never raw `.exe`.
- **feat(web): share surfaces + camera-ready wordmark + once-only star
  prompt.** CommunityCard can share a real personal stat the user opts
  into ("$X tracked across N tools this month — superbased.app"), with
  the exact text previewed before sharing and a static-link fallback
  (never "$0.00 tracked"). MilestonesCard brag moments gain share/copy
  actions. The four hero stat surfaces (Cost, Suggestions, Milestones,
  Report) carry a muted in-frame `▞ superbased` wordmark so a native
  screenshot travels with attribution — no export pipeline. A
  lazygit-pattern once-only GitHub star prompt appears after a week of
  real usage (never in demo mode, never twice). A new open-ended
  Feedback issue form joins the GitHub templates.
- **feat(cli): `observer privacy` — verifiable zero-network posture.**
  Prints an honest, config-derived egress report: every listening
  socket (loopback-only except the opt-in tailnet remote-access
  listener) and every outbound path the binary can take, each with its
  gate and this config's actual on/off state; `--json` for scripting.
  Paired with two changes that make the claim exact: the dashboard's
  npm-registry update check is now **user-initiated only** (a "Check
  for updates" card in Settings → Health; no fetch on tab load, no
  background timer), and a new website page,
  `/docs/reference/measurement-honesty`, states the
  compression-savings retraction plainly and documents the provable
  accuracy claims that replace it.
- **feat(website): three new competitor comparison pages** (CodeBurn,
  Claude Code Usage Monitor, TokenTracker), authored from a dated
  2026-07-30 re-verification of every competitor claim, with steelman
  sections and the competitors' newest features stated fairly. New
  `make track-build` / `verify-track-build` + a CI drift gate; fixed a
  track-gen idempotency bug (marker blocks re-appended at EOF instead
  of spliced in place, which could permanently redden a byte-for-byte
  drift gate).
- **fix(website): tool-count drift sweep.** Live compare pages said "26
  coding tools" against 29 shipped adapters; the four compare pages are
  corrected and `track-gen` now derives counts from `len(roster)` so the
  class can't recur (new accuracy-check Check B2 guards it).
- **fix(orgserver,orgclient,store): org-announcements rail hardened
  before release (adversarial review, six findings, all fixed).** The
  rail was built by cloning the routing-policy distribution rail, and
  cloning a mechanism cloned its weaknesses into a context that couldn't
  tolerate them. Three HIGHs, all fixable because the rail was still
  unreleased: the signature covered the body only — no version, no rail
  identity — so a captured signed document replayed at a bumped version
  froze a node's cache via its own monotonic short-circuit, an old
  retraction replayed cleared every banner, and because the org server
  has one shared signing identity, a genuinely-signed routing-policy
  document verified as a valid announcement. Fixed with
  `orgcontract.AnnouncementSigningMessage` (a domain tag, the version,
  and the body, hashed together) — the routing rail keeps its released
  wire shape as-is, and the residual is now tracked as ledger row
  **ROUTING-SIG-1** (`docs/security.md`) instead of silently inherited.
  Announcement TOFU also consulted only its own rail's pin, so a node
  enrolled for months would accept any key on its first announcement
  fetch — closed in `internal/orgclient/orgpin.go`, one org identity now
  enforced across both rails. And unenrolment left a departed org's
  cached banner (and its pinned key) live, risking poisoning
  re-enrolment into a different org — `store.DeleteEnrolment` now clears
  both distribution caches. Three smaller fixes: the per-cycle poll is
  now stated in `observer privacy` instead of left implicit; both
  endpoints' 1 MiB caps applied to the read only and ignored trailing
  bytes, now `orgcontract.DecodeCapped`; and `"[]"`/`"null"` were a third
  and fourth silent spelling of a retraction, now one representation.
  Every fix carries a regression test proven to fail pre-fix by inline
  mutation against a document the org genuinely signed.
- **fix(orgserver): member-invite loop hardened before release
  (adversarial review, eight findings, seven fixed, one documented).**
  Two HIGHs: the monthly mint cap was read-then-insert across two
  connections with tens of milliseconds of argon2id hashing between
  them, so concurrent mints could all read the same pre-mint count and
  all land past the cap — now one `BEGIN IMMEDIATE` transaction,
  mutation-proved by an 8-goroutine hammer test; and a SCIM-deactivated
  admin with a still-live SAML cookie kept minting uncapped because the
  admin branch returned before any liveness check — fixed both at the
  invite gate and, more broadly, at `adminCheckerFor` (`AND active = 1`),
  restoring deactivation as an authority revocation across every
  `RequireAdminSAML` route. Three MEDs: `ttl_days` was unbounded (a
  273-year token was mintable) and is now clamped 1–90 with explicit-zero
  rejected rather than treated as "omitted"; the invite-lookup
  404-vs-201 response was a membership oracle, now rate-limited to 20
  failed lookups/hour per inviter (server migration 024, storing only
  the inviter id and timestamp — never the probed address); and the
  enrol link is now copy-only text rather than a clickable URL (the SPA
  has no `/enrol/:token` route, so navigability bought nothing and only
  cost exposure to link-unfurlers and mail scanners). One MED + one LOW:
  inviter attribution now survives SCIM deletion via a `minted_by`
  fallback, and the invite audit's `source_ip` no longer trusts
  `X-Forwarded-For` (new ledger row **XFF-1** for two pre-existing,
  deliberately-deferred XFF-trusting audit sites elsewhere in the org
  server). One LOW documented rather than fixed: target-deletion CASCADE
  frees a cap slot early, recorded in `docs/teams-operations.md` §8.2 as
  needing member-lifecycle authority that already outranks the cap.
- **fix(adapters): model reasoning no longer files itself as a completed
  task.** Fifteen adapters minted a separate action row — typed
  `task_complete` — every time the model produced a reasoning block,
  inventing 15,734 phantom "task completions" in a live corpus for work
  the model never did. Reasoning is not an action; it is something the
  model did on the way to one. Every adapter now carries it as
  `preceding_reasoning` on the *successor* event and mints no row at all.
  Threading is consumed-once, last-wins, discarded at a turn boundary,
  and never crosses a session id. Opaque or encrypted reasoning
  placeholders are never threaded anywhere. Affected: crush, hermes,
  cline-cli, antigravity, cursor, opencode, kilo-code-cli, codex,
  open-interpreter, openclaw, cline, cowork, pi, copilot, copilot-cli,
  gemini.
- **fix(dashboard): `/api/status` no longer saturates the daemon.**
  `diag.Snapshot` costs several seconds of `COUNT(*)`s on a large
  database, and two always-mounted chrome components polled it every 5
  seconds — so a scan was permanently in flight and starved every other
  query (measured first-load latencies reached 36 s). The snapshot is now
  computed behind a 15-second TTL + singleflight cache. Crucially the
  scan runs **detached** from the caller's request context: the previous
  fix was incomplete because the client aborts its prior fetch each tick,
  cancelling whichever poller held the gate and serialising the scans
  anyway. Degraded snapshots now carry a `QueryErrors` count and are
  returned but never cached.
- **fix(cursor): the reasoning stash is now safe across hook processes.**
  Cursor is a hook adapter — one process per event — so its pending
  reasoning needs an on-disk carrier. The first implementation raced:
  under contention, 190 of 200 iterations double-threaded a thought and 8
  of 200 reads saw a truncated file. It is now an atomic rename-claim
  protocol — writes land at a unique temporary name and rename over the
  target, and consumers claim by renaming the target to a nonce first, so
  exactly one participant can win a name. Proven under `-race` with
  multiple concurrent participants.
- **fix(gemini): a failed call no longer records itself as a success.** A
  legacy-shaped failed call persisted `success=1` forever. The verdict is
  now taken from the response body — but only for *meaningful* errors
  (non-blank strings, non-empty objects or arrays). `{"error": false}`,
  `0`, `[]`, `{}`, and bare booleans or numbers never invent a failure.
- **fix(plugins): two wrong-plugin-resolution hazards caught before
  publication.** Both were reproduced live, not theorised. Factory's
  `droid` resolved `./superbased` at the repo root to the *Claude Code*
  plugin directory — hooks and all — so the plugin was relocated to
  `factory/superbased`. `qodercli plugins marketplace add` likewise
  installed the Claude plugin via its binary's literal search order;
  closed with a root `.qoder-plugin/marketplace.json` whose schema was
  extracted from the shipped binary, then verified end to end.

### Changed

- **Migration 079 deletes ~15,050 content-free reasoning rows on first
  run, and your action counts will drop.** This is the historical half of
  the reasoning fix above: the `(reasoning)` and `(encrypted reasoning, N
  bytes)` placeholder rows written by the retired emit sites, plus their
  FTS search excerpts, are removed, and 7 stale cursor rows are rewritten.
  Those rows have no content, never had content, and were never threaded
  anywhere — deleting them removes rows, not information. **Aggregate
  action counts on the dashboard will fall accordingly; this is the
  intended correction, not data loss.** Everything content-bearing is
  kept, including the 329 codex reasoning rows carrying real summary text
  and all 15 gemini reasoning rows (deleting those was measured to be
  lossy). An id high-water marker is recorded in `schema_meta` before the
  deletes so the result can be re-verified afterwards. Schema golden
  moves 78 → 79.
- `scripts/sync-npm-version.sh` now stamps **11** plugin-side manifests
  in addition to the npm and VS Code packages, with a set-equality test
  in both directions so a new manifest cannot be silently missed.

## [1.27.0] — 2026-07-29

### Added

- **feat(adapter): three new adapters — Factory `droid`, Open Interpreter
  and Command Code (26 → 29).** All three were Phase-0 grounded against
  live installs on WSL *and* Windows before any parser was written, then
  put through one adversarial review over the combined diff (four
  confirmed findings, each fixed with a revert-proof regression test —
  see Fixed below). All three are **Tier-2 log capture**: none has a
  verified proxy lane and none exposes a hook mechanism, so every token
  figure they produce is the tool's own reported number read out of its
  local transcript, never a proxy-exact one.
  - **`droid`** (`internal/adapter/droid/`, `models.ToolDroid`) is
    Factory AI's terminal agent — the company is Factory AI, the product
    is droid, and Observer names adapters after the product. Two flat
    files per session and no SQLite anywhere: the JSONL transcript at
    `~/.factory/sessions/<dashed-cwd>/<uuid>.jsonl` plus a
    `<uuid>.settings.json` sidecar. There is **no per-message usage
    envelope anywhere in the corpus** (`"usage"` occurs zero times across
    the nine captured sessions), so tokens are SESSION-level cumulative
    only — the goose precedent. Only the self-only `tokenUsage` block is
    emitted, under the stable id `tokens:<session-id>`, so a later parse
    of a grown sidecar rewrites the same `(source_file, source_event_id)`
    row and the store's `ON CONFLICT … MAX(…)` upgrade keeps the counts
    monotonically non-decreasing; `inclusiveTokenUsage` and
    `lastCallTokenUsage` are deliberately NOT emitted (both would
    double-count — mission child sessions get their own transcript and
    sidecar), and `factoryCredits` has no `TokenBundle` counterpart at
    all. Tier `source='jsonl'`, `reliability='approximate'`. Project root
    comes from the inline `session_start.cwd`; `compaction_state` maps to
    `ActionContextCompacted` with its git-output snapshots dropped. The
    adapter never reads the `~/.factory` root — `auth.v2.*` and the
    top-level `settings.json` carry plaintext BYOK keys — and sidecar
    reads refuse symlinks (a new house idiom).
  - **Open Interpreter** is deliberately **not a new package.** The
    `interpreter` binary is the OpenAI Codex CLI Rust codebase recompiled
    under another product name, and the evidence is not circumstantial:
    every subcommand's `--help` is titled "Codex", the Rust module
    namespace is `codex_*`, the session file's `base_instructions` say
    "You are Codex", `CODEX_HOME` is renamed to `INTERPRETER_HOME`, and
    every `token_count` event's `rate_limits.limit_id` is still the
    literal string `"codex"`. So `codex.NewOpenInterpreter()` retags the
    existing codex parser at the §2.1 boundary seam (CLAUDE.md rule 3 —
    branch on capability, not source identity) with watch root
    `~/.openinterpreter/sessions`; because the on-disk shape is
    *identical* to codex's, root-based watcher dispatch is the only thing
    keeping the two apart. Tier 2 JSONL `token_count`, with gross input
    netted against `cached_input_tokens` exactly as codex's own path does.
    Its four SQLite stores are index/debug only and are not read.
  - **Command Code** (`internal/adapter/commandcode/`,
    `models.ToolCommandCode`) is the closed-source `command-code` npm CLI
    (v1.4.5 at capture) — one binary behind four bin aliases (`cmd`,
    `cmdc`, `command-code`, `commandcode`), not a two-product split.
    Claude-Code-shaped JSONL under `~/.commandcode/projects/`, with
    per-assistant-message usage inline. **`inputTokens` is GROSS** — it
    includes `cacheReadTokens` — so the adapter emits the netted figure,
    clamped at zero (mutation-proved), and carries the cached count
    separately. The provider's own `costUsd` is carried through as an
    estimated cost (the opencode / pi precedent) because Command Code
    resells ~48 mostly open-weight models through its own gateway, for
    which Observer has no pricing rows. `.checkpoints.jsonl`, meta,
    config and history files are excluded by `IsSessionFile`, and
    `auth.json` is never read.
  - **Registration.** `enabled_adapters` goes 26 → 29, with one
    `internal/integration` capability row each (droid and open-interpreter
    `probe_required`; command-code `after_bridge` — its API-URL knob
    points at its own closed gateway, not an Anthropic/OpenAI-shaped
    endpoint), guard conformance rows, cross-OS process-attribution
    basenames (the `cmd` / `cmdc` aliases are deliberately excluded — they
    collide with `cmd.exe`), `defaults.Adapters()`, and dashboard tool
    label + colour rows (CIE76-checked). `RegistryVersion` stays at 1 by
    the browserchat precedent: a bump revokes aggregate consent receipts,
    and adding tools is not a consent-shape change. As with every new
    adapter, a daemon built before this release has no compiled-in support
    — rebuild and restart before expecting rows.
- **feat(launch): full terminal parity for the wave — 19 → 22 launchers.**
  `observer droid`, `observer open-interpreter` (alias `interpreter`) and
  `observer command-code` (alias `commandcode`) each open a real PTY from
  the dashboard or a shell. Every seed and resume contract was read out of
  the tool's own `--help` on 2026-07-29 rather than inferred: droid takes
  the distilled handover as a **trailing positional** and resumes with a
  JOINED `--resume=<uuid>` (its flag declares an optional value, so a
  space-separated form would swallow the next argument); Open Interpreter
  resumes through the `resume <uuid>` **subcommand**, codex's shape, which
  landed as a new positional `resumeTranslation` shape expressed as DATA
  rather than a new code path; Command Code resumes with `--session <id>`,
  chosen over its optional-value, name-resolving `-r`. All three launch
  **non-proxied** on purpose — no proxy lane has been probed for any of
  them, and `observer open-interpreter` deliberately does not copy
  `observer codex`'s `openai_base_url` injection. Attach, attach-by-default,
  Jump-in and the Session Cockpit come for free, because those dispatch on
  the launcher capability rather than the tool name (new-adapter checklist
  §3.6a). Totals after the pass, read out of the registry: **22 launcher
  verbs** (20 seeded + 2 doc-assisted), **22 attachable**, **21 of 22 with
  native resume** — openclaw is the sole holdout, picker-only — **22
  `Binary` rows**, and **21 with at least one grounded install hint**
  (`kimi-code` is the sole gap, no official channel grounded). Factory's
  Windows `irm` one-liner is deliberately NOT offered as an install hint:
  it is undocumented upstream.
- **docs: the adapter-coverage parity matrix is re-derived from code.**
  `docs/plans/adapter-coverage-parity-plan-2026-06-26.md` §15 is now a
  34-row matrix — every cell read out of the `internal/integration`
  registry and the launcher wiring on 2026-07-29 and cross-checked against
  `observer adapters`, with `—` meaning the registry's honest zero ("no
  grounded capability"), never "probably". It also writes down the four
  adapter numbers that are routinely confused and are not a discrepancy:
  **29** CLI/IDE/desktop adapters, **34** registry rows (the 29 plus the
  five browser-rail `*-web` tool identities, which are one package),
  **35** `enabled_adapters` entries (the 34 plus `roo-code`, which has no
  package and no row), and `integration.Tools()` — not `EnabledAdapters` —
  as the canonical closed tool vocabulary. `docs/new-adapter-checklist.md`
  gains §3.6a, "what a new launcher gets for FREE".

### Fixed

- **fix(adapter): a tool result that lands in the NEXT parse tick is no
  longer dropped.** Found by adversarial review over the wave's combined
  diff, not by a test: when a poll ends between a `tool_use` record and
  its `tool_result`, the outcome arrives in a later parse and the action
  had already been written without it. Both new JSONL parsers now defer —
  an unanswered trailing `tool_use` rewinds `NewOffset` back to that
  record's start (never below `fromOffset`), bounded by a 1 MiB tail and a
  90-minute mtime grace so a genuinely abandoned session cannot pin the
  cursor forever. **Honest scope: this fixes the two new parsers only.**
  claudecode, qwencode, qoder, kimicode and grok carry the same latent
  defect, and the right fix there is one store seam (an `ON CONFLICT`
  outcome upgrade, or a `ParseResult` outcome-update channel) rather than
  five more copies of the deferral — that arc is deferred and recorded
  rather than quietly bundled here.
- **fix(codex): duplicate token and system-prompt rows when identical
  snapshots straddle a poll boundary.** Surfaced while reviewing the
  Open Interpreter retag, but it is a **codex bug and the fix benefits
  codex itself**: `prefetchSessionContext` did not seed its dedup state
  from the already-parsed prefix, so a `token_count` snapshot whose totals
  were unchanged across a poll — and, separately, a re-seen system prompt
  — produced a second row. It now seeds both `seenModernTotal` and
  `seenSystemPrompts` by a state-only prefix replay: rescan-idempotent,
  with no change to the `SourceEventID` scheme, and it closes a
  pre-existing codex system-prompt duplicate class along the way.
- **fix(dashboard): the messages-table sort survives a reload and follows
  you across sessions.** v1.26.0 made every header sortable but the choice
  was per-mount state, so any reload or session switch silently reverted to
  chronological. The selection now persists in `localStorage`, is validated
  on read (an unknown column or direction falls back to today's exact
  chronological default rather than erroring), and is *removed* rather than
  written when the sort IS the default — so a stored value never
  out-lives the preference that created it.
- **fix(adapter): two smaller findings from the same review.** Command
  Code's meta-model fallback was reachable only at offset 0, so a session
  first parsed mid-file never recovered its model; it is now lazy and
  fires at any offset. And a racy `WithName` mutator was removed outright —
  the adapter name is construction-only, so a setter that could run
  concurrently with a parse had no reason to exist.

### Changed

- **test(terminal): the repaint-nudge geometry read is now pinned.**
  v1.26.0's reconnect repaint nudge shipped with the gap written into its
  own commit message: the geometry snapshot must be taken BEFORE the
  forwarded resize (after it, the manager's snapshot has already converged
  and every resize misreads as identical), but nothing pinned that order,
  because the package's fake `Snapshot()` never converged — so a refactor
  moving the read below the resize would have passed the whole suite while
  nudging on every resize. A converging fake closes it; mutation-proved.

## [1.26.0] — 2026-07-28

### Added

- **feat(processobs/etw): Windows per-process network accounting over ETW
  (W1–W4).** Closes the cross-OS gap where only Linux (eBPF) could measure
  per-process network bytes. W1 is a pure-Go, CGO-free, dependency-free
  decode-only consumer of `Microsoft-Windows-Kernel-Network` — the manifest
  provider chosen over the legacy NT Kernel Logger for no singleton-session
  contention, fixed-width payloads (`connid` is `win:UInt32`, where the
  legacy MOF declares it Pointer-qualified so the width tracks pointer size)
  and keyword filtering. Bytes are attributed to the PAYLOAD pid, never
  `EVENT_HEADER.ProcessId`, which for kernel network events is routinely 4
  (System) or 0 (Idle) because completion runs in a DPC or worker thread.
  TCP only, enforced structurally: TCP and UDP decode into unrelated types
  with no shared parent, so a UDP count cannot reach a TCP total by
  accident. The ABI is pinned by 26 two-sided compile-time assertions rather
  than tests — CI has no Windows runner and `GOOS=windows go build` does not
  compile `_test.go` files, so a size test would never execute anywhere.
  W2 adds the per-pid cumulative accumulator that reconciles ETW's
  PER-EVENT byte reports with the cumulative contract every consumer
  differentiates (16384 live entries with LRU eviction, mirroring the Linux
  `netMapMaxEntries`, plus a 1024-entry retired cache so an exit event still
  carries final totals), and settles the W1 open question: Linux's
  `tcp_cleanup_rbuf(copied)` maps to ETW event 11 alone, not 11+18 — summing
  both would double-count already-pended data.
- **feat(processobs,cmd,config): the elevated Windows capturer dials the
  daemon (ETW W3/W4).** The transport direction from the 2026-06-17 spike
  was inverted by measurement: on a NAT-mode host, WSL→Windows 127.0.0.1 is
  REFUSED (it is WSL's own loopback) and WSL→gateway times out (Defender
  drops inbound on the WSL vNIC), while Windows→WSL loopback works via
  `localhostForwarding`. So the capturer dials a loopback listener the WSL
  daemon owns — no firewall rule, no host-IP discovery, no
  NAT-vs-mirrored probe. Auth is mandatory with no bypass: 256 bits of
  `crypto/rand` persisted 0600 beside the DB, constant-time compared, never
  logged, read from `--token-file` or `OBSERVER_PROCESS_BRIDGE_TOKEN` —
  there is deliberately NO `--token` flag, because argv is world-readable
  and this tool captures argv. New `[observer.process.etw]` config block.
  Backend selection is additive: `etw` selects the same baseline `auto`
  would and ADDS the listener, so an elevated feed that never arrives can
  never trade away working zero-privilege capture. Two real bugs were found
  building it — an infinite hot loop (a read error and `bufio.ErrTooLong`
  are permanent and `bufio.Scanner` returns them forever, latent on a pipe
  where EOF ends a stream, immediately fatal on a socket where a reset does)
  and a 30s reconnect stall, now ~1s via a hangup watcher. W4 adds
  capturer-link health (a `TransportStatsSource` + `TransportUnavailableSource`
  capability PAIR resolved into `none`/`unavailable`/`configured`, with the
  `(TransportStats, bool)` signature load-bearing so a Composite carrying no
  transport child cannot be forced to claim "a transport exists, with zero
  connections"), a detect-and-emit setup surface (`observer init` DETECTS an
  existing task via `/Query`, which works unprivileged, and emits a
  fully-resolved command for the operator's own elevated run — it never
  prints "registered", because from WSL's medium-integrity interop token
  `/Create` is refused for `/RL HIGHEST` and for `/SC ONLOGON` while a plain
  `/SC ONCE` succeeds, so it is elevation that is blocked, not task
  creation), and `--token-file` re-read per reconnect attempt so a
  logon-triggered task firing before WSL is up no longer dies permanently.
  `AuthFailures` counts every handshake refusal and so can never name a
  cause — proven live, a wire-version mismatch and port-scanner garbage both
  rendered as "shared-token mismatch" — so the daemon's verbatim reason now
  travels separately, clamped to 240 bytes, with the metric label carrying a
  bounded CLASS rather than the remote string.
- **feat(processobs,dashboard): dashboard-driven ETW capturer setup (E1–E7).**
  The W4 arc had concluded `observer init` can only DETECT and emit a
  command; the measurement behind that still stands (`schtasks /Create` IS
  Access-denied from WSL's medium-integrity token) but the inference —
  "elevation cannot be self-granted" — was too strong. Elevation cannot be
  taken silently; it can be brokered through UAC consent. Measured on this
  host: `Start-Process -Verb RunAs` from WSL reaches High Mandatory Level,
  `/Create /SC ONLOGON /RL HIGHEST` succeeds, and the single-quoted `/TR`
  form stores correctly — the first end-to-end confirmation of the quoting
  rule W4 derived (the backslash-escaped form parses in cmd.exe but FAILS in
  PowerShell; the unquoted form stores unquoted and would launch
  `C:\Program`). New `GET /api/process/etw/status` (capability V, first-class
  states rather than errors), `POST /api/process/etw/register` (capability L
  + confirm token, with the argv built ENTIRELY server-side — there is no
  request struct at all), and an ETW capturer card under Settings → Process
  capture. Independent review of E1–E6 raised eight findings, each reproduced
  with a failing test before any fix; two were real and sharp — an apostrophe
  in a Windows path (`C:\Users\O'Brien\…`) closed the `/TR` quote early so
  schtasks stored a program that was a PREFIX of the real path, and
  `normalize()` floored a negative counter to zero, turning "this report is
  nonsense" into "the decoder ran and refused nothing".
- **feat(processobs,diag,metrics): decode-classification counters, so
  "nothing captured" can no longer read as "healthy".** `Classify()` routes
  every unknown event id to `ClassIgnored`, so a renumbered provider would
  report `dropped:0 / unsupported:0` and zero bytes — passing validation
  while measuring nothing. New `NetworkIgnored` + `NetworkDecoded` counters
  and `NothingClassified()`; `Ignored` is deliberately NOT in `Any()`,
  because a healthy busy capture has a huge Ignored and folding it in would
  fire a fault on every working host. Separately, `Health.NetworkAccountingMode`
  / `Reason` were computed and read by nothing, so an operator whose probes
  failed to attach got silence and could not tell "measured, no traffic"
  from "never measured". The daemon now publishes a small node-local JSON
  record beside the DB (per-PID + liveness-filtered, the pattern
  `diag.LockInfo` already uses; a record whose writer pid is gone is dropped
  rather than called stale), refreshed every 30s because the backend only
  decides the accounting outcome inside `Start`. Both `observer doctor` and
  the `/metrics` exporter read it and report it AS A REPORT ("pid N said X,
  T ago"), never as live truth; with no daemon reporting, the
  `observer_process_*` families are ABSENT rather than zeroed, since a
  fabricated `backend_up 0` is indistinguishable from a genuinely down
  backend, and the network mode is an enum series per mode so a mode flip
  cannot leave a stale series at 1.
  - Honesty caveat, restated on every surface: nothing under
    `internal/processobs/etw/` has ever executed. There is no Windows CI
    runner and WSL cannot elevate, so the Windows runtime path is compiled,
    vetted and lint-clean under both GOOS — not run. The six-step elevated
    validation is now enumerated (it had been cited in three documents and
    written down in none) in `docs/process-observability.md` §5.5 and is
    still owed. An idle host also produces the same counter shape as a
    renumbered provider; no threshold was invented in either direction, so
    the signal is worded as a suspicion.
- **feat(processobs): eBPF per-process network bytes + a high-frequency
  metric ring.** The Linux backend attached only
  `sched_process_exec`/`exit` and hard-coded `NetworkBytesIn/Out` to zero;
  it now attaches `fexit/tcp_sendmsg` (return value = bytes actually
  queued, so partial sends are honest) and `fentry/tcp_cleanup_rbuf`.
  `tcp_recvmsg` was rejected deliberately — its arity changed between 5.x
  and 6.x and an fexit program must know the argument count to locate the
  return slot. Same pure-Go `cilium/ebpf` loader and hand-written asm as the
  existing lifecycle programs: no clang, no bpf2go, no CO-RE, no CGO.
  Alongside it, sampling and persistence are split into separate cadences —
  `sample_interval_ms` (2000) into memory, `persist_interval_ms` (15000)
  with a ring capped at `persist_max_samples` (60) — which is 7.5× finer
  sampling AND 7.5× fewer row rewrites, with the stored column the same size
  as before and independent of the sample rate. `MetricSample` gains
  `net_rx`/`net_tx`/`net_measured` as additive JSON on the existing ring, so
  no migration; old rings decode with the fields absent, which reads as
  unmeasured. TCP payload bytes only — no UDP, so QUIC/HTTP-3 is invisible —
  stated in the field docs, the config and the operator docs. NOT VERIFIED:
  the eBPF happy path; the authoring host runs
  `kernel.unprivileged_bpf_disabled=2`, so the programs have never been
  through the kernel verifier. The degradation path is verified.
- **feat(dashboard): live CPU/RSS/disk charts on the Session Cockpit.** The
  cockpit's System section rendered three 48×14px sparklines with no axes,
  units, tooltip or time base, and three defects underneath: only ONE
  process was charted (measured on a real session — 458 processes, 455 with
  samples, 33 with the ≥2 samples a rate needs, exactly one drawn);
  `cpu_ms`, `rb` and `wb` are cumulative monotonic counters plotted RAW, and
  no differentiation code existed anywhere in the repo. New
  `GET /api/session/<id>/metrics?bucket=` aggregates the process subtree onto
  an epoch-anchored common grid, differentiates each consecutive pair with
  overlap weighting, and sums per-process rates (RSS is instantaneous and is
  summed, never differentiated). Each trap is pinned by a test: mid-window
  entry is a baseline not a delta against an implicit zero, mid-window exit
  contributes nothing after its last sample, a counter reset drops that pair
  for that metric only, a pair spanning >8 buckets is a sampling gap rather
  than a fake plateau, and a counter reading zero in every sample of every
  process is reported UNMEASURED. Every rate is nullable — null is a real
  gap, 0 is covered-and-idle — and `cpu_scale` is `per_core_sum` with
  `cpu_cores`, unclamped (real data hit 963%). The bucket is the observed
  median sample interval; nothing hardcodes a cadence. Rendered pixels are
  NOT verified: reaching the cockpit needs a live agent terminal.
- **feat(attach): native auto-resume on 18 of 19 launchers.** v1.25.0 held
  auto-resume-on-daemon-restart to claude and codex. Two live PTY
  verification waves (bare binaries, bounded, no input typed, read-only
  store inspection) confirmed 15 more tools reopen the SAME transcript by
  the observer-captured id — opencode, kilo, cline-cli, goose, gemini,
  copilot-cli, pi, qwen, grok, kimi, devin, hermes, kiro, qoder,
  antigravity — and a follow-up authenticated run added cursor, whose
  `chatId` is our `SessionID` verbatim (Cursor names its on-disk chat
  directories with the same uuid the adapter already stores). Cursor's id is
  passed JOINED as `--resume=<id>` because the flag declares an OPTIONAL
  value; `resumeTranslation` grew a `joined` field for it. Implemented as 15
  `Resume: ResumeSpec` registry rows + 5 new id mechanisms
  (`flag:--session` / `--session-id` / `--id` / `--conversation` /
  `--resume-id`) driving one shared table-driven
  `cmd/observer/resume_launcher.go`; claude/codex stay bespoke for their
  session-id/fork interplay. Grounded nuances captured in the table: gemini
  resumes by full UUID, goose strips the `@hash8` scope suffix while
  announcing the stored scoped id for correlation, kimi wants the
  `session_`-prefixed id, kiro's flag rides the `chat` subcommand. openclaw
  is now the sole `ResumeNone` launcher (picker-only, runtime-blocked from
  probing). Recorded honestly: cursor's resume is flaky over some networks
  ("RetriableError: WritableIterable is closed"), affecting non-resume calls
  alike, so it is transport rather than a broken mechanism.
- **feat(attach,integration): the launching shell's credentials now reach an
  attached child.** Retires the v1.25.0 accepted caveat that an attached
  child inherits the DAEMON's environment, so a shell-exported-only API key
  that worked bare vanished under attach-by-default. New
  `Capability.AuthEnv []string` carries the env-var NAMES (never values) a
  tool reads credentials from, with seven grounded rows — claude-code,
  codex, hermes, pi, copilot-cli (BYOK key plus the documented GitHub-token
  precedence chain), gemini-cli (upstream-verified 6-var set across
  AI-Studio and Vertex auth modes) and grok; every other row stays
  zero-valued with candidate/exclusion comments, and kiro-cli's AWS
  credential chain is a deliberate exclusion. `forwardAuthEnv` is
  presence-aware (an explicit empty `KEY=` forwards verbatim and overrides
  the daemon value at the child, last-wins) and wired ONCE in
  `launcherAttach` by capability dispatch — no per-launcher edits, bare
  launch untouched. New `[terminal.attach].forward_auth_env`, default TRUE.
  Values transit the owner-only attach socket once per launch, are never
  logged (count-only audit, test-pinned) and are never persisted.
- **feat(predict): billed tokens beside the next-message cost band.** The
  predictor showed a dollar band and a fan-out pill with no token figure.
  Every dimension was already on the wire, so this is a pure read-side
  change — no API, no Go model, no migration. The figure is
  `turns × (prefix + fresh_input + output)`, the term-for-term counterpart
  of the priced `P·cache_read + S·input + O·output`, so the tokens and the
  dollars count the same things; showing only "new" tokens was the tempting
  alternative and is wrong by roughly three orders of magnitude against the
  price. It is called BILLED, never "total tokens" or "context" — cache-read
  tokens genuinely are billed, and the cockpit already uses the same
  `prefix_tokens` field as a context-fill gauge. The composition is shown
  rather than hidden ("420.7K tok billed · 702 new"); a percentage was tried
  and rejected because 420,702 against 420,000 rounds to "100% cached".
  Arithmetic verified end-to-end through the real CLI against the pinned
  fixture: `2.0 × (210,000 + 1 + 350) = 420,702`, new `2 × 351 = 702`. Same
  figure added to the CLI band table; the docs disclose that cache-WRITE is
  neither read nor priced, so both the dollars and the tokens are a lower
  bound on a message that seeds new cache.
- **feat(dashboard): sortable columns on the session messages table.** The
  table was chronologically ascending with server-side pagination, so new
  messages landed on the LAST page while page 1 stayed pinned to the oldest
  rows — following a live session meant paging manually to the end. Every
  header now toggles asc/desc with the `DataTable` arrow convention, and the
  sort is SERVER-side (a client-only sort would have reordered just the 25
  rows of the current page). New allow-listed `sort_by` + `sort_dir` mirror
  `parseSessionsSortParams`; an absent OR unrecognised key reproduces
  today's exact chronological order rather than erroring. Three details
  carry the correctness: `elapsed_ms` and `tps_ms`/`tps_basis` are derived
  from neighbouring rows over the whole timeline, so the reorder runs
  strictly after those derivations and immediately before the offset/limit
  slice; the `#` column is now a server-assigned whole-timeline ordinal
  (`seq`) instead of a page-relative array index; and every comparator falls
  through to `seq` ascending, without which equal-valued rows would visibly
  reshuffle between 4s polls. `tail=N` still selects the last N
  chronologically and then sorts those for display, and `locate` computes
  its page in the post-sort order. Suggested-by: @smoochy.
- **feat(website): IA + aesthetics rework — generated marketing pages,
  `/features` and `/faq`.** The homepage was 22.4 mobile screens and the
  product screenshots were hand-crops cut mid-column; the root cause the
  operator named is that the site had two mandatory pre-ship gates and both
  are CORRECTNESS gates — neither asks whether the page is any good. So
  `docs/website-design-guide.md` gains a third mandatory gate (editorial &
  aesthetic review, 13 items each tracing to a real observed defect) plus a
  quarterly cadence. The top-level marketing pages are now GENERATED from
  `website/pages-src/*.html` through one shared shell
  (`docs-tools/pagegen`) via `make website-build`, gated by
  `make verify-website-build` — which kills a materialised drift class,
  since the chrome had already forked into 4 `#topnav` and 3 footer variants
  with mismatched analytics attributes and stale build markers. The gate
  runs in `website-deploy.yml` BEFORE the strip step, not only in `ci.yml`,
  because `ci.yml` is a separate workflow and cannot block a deploy. The
  homepage goes 19054px / 22.4 screens / 1787 words → 11294px / 13.3 / 897
  with ZERO points deleted: the removed prose moved to new `/features` and
  `/faq` pages, with the FAQPage JSON-LD moved WITH it (parity is checked by
  same-file verbatim presence). 20 pixel icons redrawn at 16×16; the nav and
  footer drop the "S" glyph for a wordmark — six chrome sources needed
  updating, not the three expected, because `/docs`, `/arcade` and
  `legal/eula` each carried their own lockup. Density and a11y: the privacy
  prose-run 4418→437px, enterprise 14 tiny fonts / 11 sub-44px targets →
  0/0, all five support pages at 0/0. The public site and READMEs also gained
  a terminal-capability content wave (dashboard launch, Jump-in,
  native→local→remote lease movement, Session Cockpit, per-terminal
  Files/Git), a new `website/docs-src/guides/terminals.md`, and matching
  README sections regenerated through `docs/distribution/README-body.md`.
  `security.html` / `privacy.html` corrected: raw content ships under
  `full_content` OR `admin_managed`, not `full_content` alone.

### Fixed

- **fix(web,dashboard): the mobile terminal is usable.** Reported from a
  phone: tapping a running-terminal pill rendered the panel clipped on BOTH
  sides, scrolling did nothing in either presentation, and the soft keyboard
  offers no Ctrl/Alt/Esc/Tab/arrows. Panel geometry —
  `min-w-[480px]` beats `max-w-[96vw]` (CSS 10.4: min wins over max), so the
  box resolved to 480px on a 393px viewport and the `justify-center`
  backdrop split the overflow evenly, making the LEFT half unreachable
  (before: panel 480×511 @ left −43, 3 text overflows; after: 393×852 @
  left 0, 0 overflows). The breakpoint is a CAPABILITY query —
  `(pointer: coarse) and (max-width: 1023px)` — so a desktop user who merely
  narrows their window keeps a fine pointer and is untouched; desktop
  geometry is bit-identical. Touch scroll was never a CSS problem: xterm
  gates its ONLY touch-scroll path behind
  `!coreMouseService.areMouseEventsActive`, so scrolling dies the moment a
  TUI enables mouse reporting — an identical 150px drag moved −30px with
  mouse mode off and 0px with it on. Own handlers now drive
  `term.scrollLines()` for vertical-dominant gestures on a scrollable normal
  buffer, so a tap still reaches the TUI as an SGR mouse report. On the
  ALTERNATE buffer (captured live from `claude` 2.1.220, which sets `?1049h`
  with `?1000h ?1002h ?1003h ?1006h`) there is no scrollback at all and the
  app scrolls on WHEEL events — which a finger does not have, and which is
  exactly why this never reproduced on desktop; a vertical drag there now
  dispatches a `WheelEvent` and lets XTERM encode it, so the writer-lease
  gate applies with no second input path. The on-screen key bar writes
  through `term.input(seq, true)`, inheriting both the `disableStdin` and
  `canWrite` gates, with exact bytes asserted per button including SS3 under
  DECCKM. Keys are now labelled by ACTION (Interrupt / End input) with caret
  notation demoted to a sub-label — the operator read `^C`/`^D` as
  "Alt+C / Alt+D" — and Mac labelling (⌃ Control, ⌥ Option) is driven by the
  DAEMON's OS via a new `host_os` on `/api/status`, not the browser's
  user-agent, since the browser is usually a phone that is not the machine
  being typed into. There is deliberately no ⌘ button: a PTY receives bytes,
  Ctrl+C is 0x03 on every OS, and ⌘ never reaches a terminal at all. Also:
  a visible "▾ Minimize" with a filled background so the SAFE exit catches
  the eye (all three of minimize's previous doors are shut on a phone — no
  hardware Escape, no backdrop under a full-viewport panel, and an icon-only
  ▾ carrying its meaning only in an aria-label, which left the operator
  believing the destructive ✕ was the only exit); horizontal swipes are now
  swallowed rather than declined, so the OS edge-swipe no longer unloads the
  whole dashboard; tap targets 19px → 44px; a Copy action, because xterm's
  mouse-drag selection leaves no way to get an error off a phone; and focus
  mode renders honestly disabled naming its missing dependency instead of
  vanishing.
- **fix(web): the on-screen keyboard costs the terminal zero rows.** The
  first fix here rested on a wrong premise — per the CSSWG a virtual
  keyboard does not affect ANY CSS viewport unit, `dvh` included — and the
  second (`interactive-widget=resizes-content`) broke Chrome/Android touch
  scrolling with the keyboard DISMISSED and could not be tested at all, since
  the Playwright suites run desktop Chromium where the key is inert. Both are
  gone. Shrinking the panel turned out to be the defect itself: measured live
  from the operator's own session, the keyboard took the PTY from rows=29 to
  rows=8, and a live `claude` 2.1.220 driven in a PTY at fixed sizes caps its
  composer at 2 lines and shows only the tail at 8 rows — so a third typed
  line looked like it overwrote the second. Nothing was wrong with the
  emulation; the app was being handed an 8-row terminal. The panel now keeps
  its UNOCCLUDED height and TRANSLATES up instead, putting the composer and
  key bar at the bottom of the visible area while the row count never
  changes, with the header sliding off the top as the deliberate trade. The
  unoccluded height is the running maximum of `visualViewport.height` at the
  current width — a keyboard only ever reduces that height and never changes
  the width, so the maximum IS the no-keyboard height, obtained without
  asking any engine-specific "is a keyboard present" question. Width changes
  reset it, which is rotation. The two keyboard specs are inverted to pin the
  new contract, and the test fake's viewport snapshot (taken in an init
  script that runs BEFORE Playwright applies the emulated viewport, so every
  consumer inherited a baseline no test asked for) is now live getters.
- **fix(terminal): a reattached terminal renders at its own width, and
  repaints.** Operator-reported from a phone after a page reload: every line
  missing its first character, that character appearing at the end of the
  line above — the signature of content wrapped at one width being rendered
  at another. `Manager.Subscribe` started every new subscriber at the replay
  ring's OLDEST byte, and the ring stores raw PTY bytes with no geometry
  tagging, so a session that lived at 152 columns on a desktop and later at
  47 on a phone replayed both eras into whichever width the reconnecting
  client happened to be. The ring's absolute offset is now recorded at each
  real geometry change (planted in `recordResize` and nowhere else, so
  geometry keeps its single owner) and every subscriber starts at
  `max(currentBase(), that offset)`. The stated trade: a genuine resize
  shortens the replay available to the NEXT attach — those bytes were
  unrenderable at the new width anyway, and already-attached subscribers are
  untouched. It never self-healed because the client's post-replay resize is
  a no-op: Linux `tty_do_resize()` skips SIGWINCH when the winsize is
  unchanged, measured directly as three `TIOCSWINSZ` calls and only two
  SIGWINCH delivered — and a full-screen TUI on the alternate buffer owns
  every cell and only rewrites what it believes changed, so a stale frame
  persists indefinitely. A one-shot repaint nudge (resize by one row and
  immediately back, `rows-1` so the PTY never exceeds the client's real
  viewport) now fires once per reattach on the writer path only, skipped when
  geometry is unknown or when the client's resize already differs from the
  live size.
- **fix(terminal): mobile backgrounding no longer kills terminals or forces a
  fresh capability code.** Leaving the browser to copy a code out of email
  tore down the view of every running terminal. The PTYs never died —
  unsubscribe detaches a viewer without killing the process and idle reaping
  is off by default — but `ws.onclose` latched status "exited", a terminal
  state, and the socket-setup effect depended only on `[token, isRemote]`, so
  nothing ever reopened it; only a full page reload recovered. There is now a
  distinct "reconnecting" status that counts as live, retry with exponential
  backoff and jitter, and a `visibilitychange`/`pageshow` handler that
  reconnects immediately on return, with the standing-secret auto-present in
  `onopen` so control is regained with no user action. Server side, three
  expiries each forced a new code and each moved with a config key whose
  default is the new value: capability TTL 2m → 10m (two minutes is shorter
  than the round trip to a mail app; still single-use, still bound to
  session+action+handle), device-session idle 1h → 24h with the absolute cap
  12h → 48h (an absolute cap below the idle target makes the target
  unreachable), and standing-provenance writer leases exempted from the 5m
  idle reap while the 30m hard cap stays. WS liveness now needs 5 consecutive
  missed pongs (~3.3min) rather than one, so a briefly-frozen tab is not
  mistaken for a dead peer; an aged-out lease DEMOTES rather than closing the
  socket, while a trust-withdrawing revoke still closes it outright. A
  revoked standing secret is classified `auth_revoked` (permanent, so the
  device clears it) while temporarily-disabled and rate-limited stay
  transient — previously any auth-ish denial deleted the saved secret with no
  retry. Negative `session_ttl_minutes` values previously validated clean and
  silently yielded the maximum; they are now rejected at load.
- **fix(remote): a paired phone no longer loses authorization within the
  hour.** Returning to the dashboard from a phone gave
  `401 unauthorized: authentication required` on every API call while the UI
  itself still served — a working shell with no data. `handlePair` set the
  cookie with HttpOnly, Secure, SameSite=Strict, Path `/` — and NO Max-Age
  and NO Expires, making it a BROWSER-SESSION cookie that mobile
  Safari/Chrome discard when they end a browsing session or evict a
  backgrounded tab, while the server session stayed live and simply
  unreachable. Root-caused by elimination against the live install, with the
  session table as the fingerprint: 17 rows from 24 pairings since Jul 14,
  ELEVEN with zero seconds between `created_at` and `last_seen`. MaxAge now
  derives from the store's own post-defaults lifetime via a new
  `SessionStore.TTL()` accessor, tracking `[remote].session_ttl_minutes` with
  no second constant, clamped to ≥1 (a 0 omits the attribute and silently
  restores the bug); nothing was loosened and no TTL was extended. This is
  also the true root cause of the symptom the 2026-07-25 TTL widening treated
  — no server-side lifetime can rescue a credential the browser has already
  thrown away, which is why the defect survived that work by two days. Two
  adjacent defects fixed with it: `restore()` loaded every non-expired row
  with no Max check while `Create` hard-fails `ErrTooManySessions`, so the
  store could start above `max_sessions` and pairing then failed with a bare
  503 (restore now keeps the Max most-recently-seen and durably prunes the
  surplus; the refusal is a 409 naming the revoke path); and `api.ts` gated
  401 recovery on `unsafeMethod()`, which is FALSE for GET, so EVERY read had
  no recovery and no UX — recovery is now gated on `isRemoteView()` with a
  single-flight whoami probe and a one-shot latch, rendering a full-screen
  re-pair prompt on a confirmed loss and latching nothing on a probe failure.
- **fix(remote): the pairing audit was never wired, so mobile auth was
  unfalsifiable.** `buildRemoteController` built `dashboard.RemoteOptions` and
  never set `Audit`, and `remoteController.auditSession` returns early on a
  nil func — so every session-lifecycle event was silently discarded:
  `session_paired`, `session_revoked`,
  `terminal_control_standing_acquire`, and the six reasons `handlePair`
  distinguishes. Only the DIFFERENT `Options.RemoteAudit` seam was ever set,
  which is why `http_request` rows existed in abundance and hid the gap.
  Measured on this install: the audit window 2026-07-13..2026-07-27 covers
  all 17 rows in `remote_sessions` and contains zero `session_paired` rows to
  explain any of them, so the "maybe it's the max_sessions limit" hypothesis
  had been untestable the whole time. Second half: a deny row could not tell
  a missing credential from a rejected one — `Principal` collapses no cookie,
  unknown session, expired session and failed CSRF into `CapabilityPublic`,
  and those have opposite fixes. The deny row now carries `no_cookie` or
  `cookie_rejected`, appended to the row that is already written so it adds
  no audit volume on a hot auth path. Both changes are metadata-only and
  neither alters an authorization decision.
- **fix(dashboard): `/api/health/doctor` withholds local paths and user names
  from remote callers.** The route is capability V, so a paired REMOTE device
  could read the checks' free text verbatim — and that text carries absolute
  paths and user names pervasively, because most checks are built as
  `"read X: " + err.Error()` and a Go path error stringifies the whole path.
  Measured on a live host before designing anything, and the finding that
  mattered is that the disclosure is in the HEALTHY report, not just on
  errors: the `windows proxy routes` check emits the Windows USER NAME on a
  passing run. The sibling ETW route already withheld exactly this class, so
  the two were inconsistent in the ordinary case. One choke point now mirrors
  the ETW route: for a remote-exposed caller a `pathRedactor` performs
  EXACT-SUBSTRING substitution of roots the server already holds —
  deliberately NOT a "looks like a path" regex, on the precedent that
  heuristic predicates in this tree have shipped critical bypasses four times
  — longest-root-first with dedupe, both cleaned and as-given spellings
  registered, roots under 4 chars discarded, and cross-OS homes from
  `crossmount.AllHomes()` given INDEXED placeholders because several homes can
  carry the config. `local_detail_withheld` is set UNCONDITIONALLY so the
  client knows which projection it is rendering, and the UI notice says the
  redaction is partial rather than implying it is complete. Named residuals:
  a path under no known root, OS-convention system paths left readable on
  purpose, and non-path identity — the org enrolment check reports the
  enrolled user's EMAIL, which substitution structurally cannot touch.
- **fix(cost,cachetrack,routing): Claude Opus 5 was unregistered and priced
  live traffic at $0.00.** `LookupWithSource` MISSed `claude-opus-5` because
  the family ladder had no bare `claude-opus` key and `"claude-opus-4"` is
  not a prefix of `"claude-opus-5"`. Measured on a live node: 78 Opus-5 turns
  over ~3 days (16.76M cache-read + 1.26M cache-write) reported $0.00 and
  re-cost to $18.04 — an under-count that grew with every turn. Three
  registries were wrong, not one: `cost/pricing.go` gains an exact row at
  $5/$25 per MTok (cache read 0.50, 5m write 6.25, 1h write 10, web search
  0.01) with `FastMultiplier` 2, plus a bare `claude-opus` family net so a
  future SKU inherits current rates instead of MISSing to $0;
  `cachetrack/tier.go` gains the 512-token min-cacheable tier (Opus 5 halved
  Opus 4.8's 1024, and Fable 5 and Mythos 5 shared the same bug, so
  512–1023-token prefixes were labelled `below_min_cacheable` though they
  cached); `routing/tiers.go` gains an explicit `TierOpusClass` pin plus the
  `seedRepresentatives` opus-class swap. Adversarial review caught four
  pre-existing errors in the same tables, each re-verified against the vendor
  card: `opus-4-7` was 4096 where 2048 is published (it survived because a
  test asserted the 4095/4096 boundary — a passing test defending the bug);
  `claude-mythos-preview` had no row and fell through to 1024 instead of
  2048, erring in the dangerous direction where the engine predicts a cache
  write that never happens and then grades a mispredict; there were no bare
  `claude-sonnet` / `claude-haiku` rows, the identical MISS-to-$0 hole, added
  at the STANDARD $3/$15 rather than Sonnet 5's introductory rate which
  expires 2026-08-31; and legacy alias `claude-opus-4-0` resolved through the
  current-gen family row at $5/$25 instead of $15/$75, a 3× under-bill.
  Non-shadowing was proven empirically by resolving a 277-id corpus against
  both the old and new tables — 259 rows byte-identical, every delta
  intended.
- **fix(policy,guard): R-155 launcher-wrapper bypass.** R-155 (persistence
  installs) is SeverityCritical/DecisionDeny, but `matchPersistenceCommand`
  switched on `Command.Base`, so any launcher wrapper put the real program in
  a positional slot and the rule never saw it — measured ALLOW in
  `ModeEnforce`, in all three dialects, for `Start-Process` (positional,
  `-FilePath`, `saps`/`start` aliases, `-Verb RunAs`), `wsl.exe -d <d> --`
  and cmd's `start`, and for the crontab / `systemctl enable` / Run-key arms
  too. Fixed at the PARSE layer rather than inside R-155:
  `internal/policy/launcher.go` resolves a launcher into the launched argv so
  EVERY rule inherits the coverage (verified through R-101 `rm -rf /`, R-110
  force-push and R-153 secret-read). Three further rounds each found the same
  class again, each after clean mutation proofs: a `bound` flag computed over
  the whole argv SUPPRESSED the cmd-`START` reading (the tell was that ADDING
  an argument made a denied command allowed) and is deleted, with ambiguity
  now emitted as a full cross-product; four fail-OPEN exits became
  fail-CLOSED via `Command.Unanalyzed`, a new rule R-157 and a
  `maxParseUnits` budget; `pwsh -CommandWithArgs`/`-cwa` was absent from the
  host vocabulary, substitutions were never stripped under the cmd dialect at
  any depth, and `parseDepth` stopped stripping at the cap without marking —
  all fixed vocabulary-wide with a ~30-row `psHostParams` table. Found
  unprompted while fixing: a PANIC (seven matchers sliced `Argv[1:]`
  unguarded, so a line lexing to no words crashed the whole evaluation on
  attacker-influenced input), and that .NET ignores whitespace in base64
  while Go rejects it, so `powershell -e "<b64 with spaces>"` was silently
  undecodable. Because mutation proofs verify the change you made and never
  the class, the defence is now GENERATED:
  `TestLauncher_WrappingNeverRelaxes` walks 2,385 command lines / 7,155
  verdicts asserting that wrapping never turns a deny into an allow, and it
  found four further holes in the fix's own drafts. Recorded rather than
  papered over: `ssh`, `docker run`, `psexec`, `conhost`, `wt.exe` and
  `Invoke-Command`/`Start-Job -ScriptBlock` are still unresolved and still
  allow. The ETW setup carve-out was deliberately not widened — it now fails
  closed on any launcher-wrapped unit, and its predicate is a tokenizer plus
  closed allow-lists (subcommand must be the FIRST argument, `/TN` must
  match, the schtasks flag set is closed, the program extension must be
  `.exe` or absent, `--connect` must name a loopback address) after two
  adversarial passes each found a critical bypass in permissive parsing.
- **fix(processobs,termsession,store): process attribution reaches
  non-claude-code tools.** Resource charts and process trees were blank for
  almost every AI tool — measured against a real DB, 101 direct-attribution
  rows out of ~2.67M, with `session_pid_bridge` holding only claude-code and
  hermes. Three independent causes. (1) The terminal knew the pid and threw
  it away: `termsession` spawns the PTY child and held `proc.Pid` only to set
  the process group, so a terminal launched from the dashboard — exactly
  where the operator clicks "Session" — was never directly attributed. It is
  now published through an injected `OnProcess` seam (nil = clean no-op) on
  both unix and Windows ConPTY, each pinned by a compile-time assertion, and
  seeded ON CORRELATION rather than on run identity, because putting a
  run_id in the session_id column would fabricate a session that the PROXY
  then stamps onto `api_turns`, corrupting cost attribution. (2) Attribution
  resolved once at exec and never again, so a correlation-time seed was a
  race against the poll: measured over 103 real runs, out-of-band correlation
  lands in 0.2–1.9s and usually wins, while `discovered` correlation takes
  30–266s and ALWAYS lost — i.e. precisely the non-claude tools. A deferred
  pass now re-resolves a tracked-but-unattributed run when a seed appears and
  re-inherits down its subtree, upgrade-only
  (`none<low<medium<high`), bounded to the live in-memory tree with a 15-min
  age cut and 512 lookups/pass; steady state is zero lookups. (3) The store
  was erasing attribution it had already resolved:
  `upsertProcessRunSQL` wrote `session_id` / `attribution_source` /
  `attribution_confidence` unconditionally from `excluded`, so the exit
  persist wiped whatever `CorrelateCrossOS` had since set — and
  `cross_os_correlation` is the ONLY attribution path for every non-claude
  tool. Now a SQL MAX-upgrade guard mirroring the `token_usage` ON CONFLICT
  discipline, five columns gated on one shared predicate so they move as a
  unit. The guard stops future erasure but does not repair already-blanked
  rows.
- **fix(dashboard,web): the per-process network series reaches the chart.**
  The network chart was invisible on Linux with the eBPF probes live and
  measuring, and the cause was on both sides of the wire:
  `sampleNetworkRx`/`Tx` were hardcoded `return 0, false` stubs whose comment
  ("MetricSample carries no network counters today") had been stale since the
  fields landed, forcing `MetricSeriesAvailability.Network` false forever;
  and `ResourceCharts.tsx` had no network chart at all — `ChartSpec.dataKey`
  was typed `"cpu" | "rss" | "disk"` — so the server would have emitted the
  fields and the browser discarded them. Both sides now land, gated on
  `series.network` exactly the way the other charts gate on their
  availability flags, so an unmeasured host gets no chart rather than a flat
  zero line that would read as "no traffic" when the truth is "not measured".
  `ok` is gated on `NetMeasured` alone and never inferred from the byte
  value; mixed rings produce an honest gap. Also fixes `anySeries`, which
  ORed only cpu/rss/disk, so a host measuring network but none of those
  rendered "No resource samples in the retained window." over a non-empty
  points array. The series is TCP-only and the chart says so.
- **fix(dashboard): the `etw` process backend is runnable, and the whole
  vocabulary is pinned.** `processBackendRunnable` mirrors
  `selectProcessBackend`'s construction vocabulary and had silently drifted:
  `"etw"` was correctly false while the selector returned "not yet
  implemented" and STAYED false after the selector began constructing a real
  Backend. Nothing went red, because the only coverage was a handler test
  asserting the OLD answer — the test defended the staleness rather than
  catching it. The consequence was not cosmetic: the enable verb switches a
  non-runnable backend to `auto`, so an operator who had configured
  `backend = "etw"` and granted elevation would have had it quietly
  rewritten, discarding the ETW feed they set up, with the response reporting
  success. A table-driven test now covers the ENTIRE vocabulary, each row
  stating the selector behaviour it claims.
- **fix(termsvc): a correlate-before-registration race dropped the
  out-of-band session link.** `drainOOB` starts INSIDE `Spawn` but
  `s.byRun[runID]` is only assigned after `Spawn` returns, so a trusted OOB
  session frame could reach `Correlate` before the run was registered.
  `Correlate`'s liveness guard exists to stop an ENDED run being resurrected,
  but `byRun` is equally empty for a NOT-YET-REGISTERED one, so a legitimate
  early correlation was silently discarded — and the frame is one-shot, so
  the link was lost for the life of the run and "Jump in" stayed blank. Not
  theoretical: the full `-race` suite failed on
  `TestAttachCorrelationAssembledThroughHTTP`. Fixed with a `launching`
  reservation taken under `s.mu` BEFORE `Spawn` and released in the SAME
  critical section that installs `byHandle`/`byRun`; `releaseLaunching` drops
  the reservation AND any `bySession` entry on the Spawn-error path plus a
  deferred catch-all, because an entry written while the run was only
  reserved would otherwise be unreachable by `EndRunByHandle` (keyed by
  handle) — i.e. fixing the bug naively would have reintroduced the
  resurrection leak the guard exists to prevent.
- **fix(hermes): `observer hermes` supplies a model whenever it injects
  `--provider`.** The launcher prepended `--provider observer` and nothing
  else; hermes rejects that combination outright
  (`--provider requires --model (or HERMES_INFERENCE_MODEL)`) and exits
  before issuing a single API call, so every wrapped run died at argument
  validation while the same agent was healthy run natively. The bug survived
  live verification because the documented invocation always carried an
  explicit `--model` — the one form anybody tested was the one form that
  worked. The launcher now resolves a model the way hermes would, via an
  ordered rule table: a foreign `--provider X` leaves argv untouched with a
  not-proxy-routed warning; an already-supplied model injects the provider
  only; otherwise hermes' own `model.default` is injected alongside; and
  failing that, nothing is injected and the run launches unrouted with a loud
  notice (deliberately fail-open — injecting `--provider` without a model is
  guaranteed to fail, and refusing to launch would break a command that works
  natively). Also fixed while hardening the arg scanner: `hermesConfigPath`
  ignored `HERMES_HOME` and `--profile`, so with a profile active the
  provider entry was written to the wrong file AND the injected model came
  from the wrong home; the `chat` subcommand re-declares
  `--model`/`--provider`, so top-level flags were silently discarded and are
  now placed after `chat`; `--oneshot` and `chat -q` did not trip the
  attach-incompatible gate, so scripted headless runs were handed to a
  daemon-owned PTY; argparse abbreviations (`--prov openrouter`) bypassed the
  foreign-provider guard; and an option-looking token is no longer accepted
  as a flag value. `stripUpstreamPrefix` now warns once per unknown upstream
  id — it fails open by design but did so silently, returning an opaque 404
  with nothing to debug from. Reported-by: @Pranjal-Godhat.
- **fix(obs): the `budget-band-cheaper` egress starter template routed to a
  retired model.** It suggested `claude-3-5-haiku-20241022`, retired
  2026-02-19, so an operator applying the template as-is would route
  budget-pressured end-users to a model that now 404s upstream. Swapped to
  `claude-haiku-4-5`, the documented drop-in replacement. Test fixtures and
  the historical pricing-registry row keep the old id by design — they price
  observed data, not suggestions.
- **fix(website): mobile visual density and three tap/overflow defects.** The
  complaint was "the mobile site is very text-heavy"; measurement said the
  intuition was right but the cause was not text volume — word count is
  IDENTICAL desktop vs mobile and words/screen is actually LOWER on a phone.
  What collapses is the visual supply: text:visual 0.59 at 1280px vs 1.69 at
  393px, with 6 of 13 sections carrying zero visual coverage — 6.2 phone
  screens without an image, diagram, chart or code block. Two mechanisms: a
  16:9 embed loses height exactly as fast as prose gains it (648px at 1280
  becomes 201px at 393, −69%, while the same copy grows 751 → 1963px), and
  the 860px collapse stacks visuals BELOW copy instead of beside it. So the
  fix adds visual supply rather than cutting text — nothing deleted, hidden,
  collapsed or reordered, which keeps the deliberately text-first indexable
  homepage intact: text:visual @393 1.69 → 0.879, longest visual-free run
  2936 → 1023px, longest prose run 1916 → 318px, sections at 0% visual
  6 → 0. The cheapest step was surfacing what already shipped — `pixel-icons.js`
  defines 20 pixel-art glyphs, loads on every page except index and arcade,
  and its 13 domain icons rendered nowhere. The two dashboard screenshots
  were 1920×1080 rendered into 355 CSS px, a 5.4× reduction putting the UI's
  own 13px labels at ~2.4px, and are now 3:2 detail crops whose numbers are
  readable. Defects: the arcade rotate-banner dismiss button was 100%
  unreachable at every phone width and tapping it navigated the visitor OFF
  the arcade (the real cause was a full-screen z-index:200 scrim on first
  paint, not the top bar that appeared to steal the tap); all six support
  pages scrolled horizontally below 344px (+21px at 320 — iPhone SE, Galaxy
  Fold cover), and the earlier 7px-font hack attempting this is deleted; two
  homepage images had no intrinsic size, reserving 0px before load for ~400px
  of cumulative shift; the install command — the page's primary CTA — was
  visually truncated and now wraps; footer legal links were 17px tall. Site
  download and stars figures refreshed from authoritative sources (the npm
  registry range API, pepy.tech for the all-time PyPI figure since pypistats
  only exposes a 180-day window, and the Marketplace extensionquery).

### Changed

- **perf(db): the `quick_check` integrity probe is opt-IN, not opt-out.**
  `observer remote status` took 3m59.971s on a 14.7GB install — not because
  the data was too large to read, but because `db.Open` ran
  `PRAGMA quick_check`, which reads and checksums every page, so a read-only
  status command paid a full-database verification to print a table. Measured
  after: 0.189s, same output. The polarity was the defect: under the opt-out
  spelling (`SkipIntegrityCheck`) the same class had already been patched
  three times at individual call sites — the MCP server, the daemon, and
  `observer run` (re-measured 0.16s vs >120s) — and each patch left the trap
  armed for the next caller. The real blast radius was never 11 files:
  `cmd/observer`'s `loadConfigAndDB` reached 85 call sites across 40 files,
  every read-only reporting command among them. An opt-out flag must be
  remembered at each new site and is silent when forgotten; an opt-in flag
  fails safe. `Options.SkipIntegrityCheck` becomes `Options.IntegrityCheck`,
  and the `loadConfigAndDB` / `loadConfigAndDBFast` twins collapse into one
  function — two names for identical behaviour is how callers picked wrong in
  the first place. Nothing loses the probe: it runs once per daemon via
  `RunStartupMaintenance` (off the readiness path) and as `observer doctor`'s
  `db.integrity` check, which ran its OWN `quick_check` all along, so doctor
  had been paying for it twice. The one caller that opts in is
  `observer db import`, which validates an untrusted foreign database before
  merging it. The schema-034 path-hash backfill also moves to a single owner
  (`RunStartupMaintenance`) rather than whichever `Open` happened to come
  first.
- **ci: the Windows cross-compile is gated.** `go test ./...` never compiles
  a `//go:build windows` file and the build step's only Windows target was
  `cmd/antigravity-bridge`, so a Windows-only break in `internal/processobs`
  shipped undetected — a gap that widens with the almost entirely
  windows-tagged ETW backend. Compile-only; the tree was verified clean
  before adding, so this pins a property that already held. `make test-race`
  also gains a `-timeout` (`cmd/observer` measures 593–698s against Go's 600s
  default, so the release checklist's full race suite could have failed RED
  for no reason).

## [1.25.0] — 2026-07-24

### Added

- **feat(terminal): dashboard-launched terminals joinable by default.**
  `/api/attach/sessions` widened to every live daemon-owned run kind
  (fresh/handoff/attach/resume) — a terminal launched from the dashboard is
  now itself a Jump-in candidate, not just an `--attach` session. A handoff
  terminal's row keys by the FORKED session (not the source it continued
  from), so it's joined from the fork's session detail once correlation links
  it. `JumpInButton`'s copy and newest-row selection (picking the most
  recently created live row when more than one matches a session) were
  updated to match the wider row set.
- **feat(attach): attach-by-default for all 19 CLI launchers.** Every
  `observer <verb>` launcher (claude, codex, opencode, cursor, copilot-cli,
  kilo, cline-cli, hermes, gemini, openclaw, pi, antigravity-cli, qwen, kiro,
  grok, kimi, devin, qoder, goose) now attaches by default the same way
  claude/codex have — a shared launcher gate plus 19 new integration-registry
  Attach rows (tool key → launcher verb). Auto-resume-on-daemon-restart stays
  gated to the two tools with a verified native resume (claude, codex) — every
  other launcher gets an honest degraded-mortality notice instead (a daemon
  restart ends the session outright; `observer <verb> --continue-from
  <session-id>` is the manual fork fallback). Proxy env forwarding and
  `[terminal.attach].route_proxy` / `--no-proxy` remain claude/codex-scoped —
  every other tool's daemon-spawned inner launcher handles its own
  base-URL routing itself. Note the attached child inherits the DAEMON's
  environment, not the launching shell's — a credential exported only in the
  launching shell won't reach it (config-file/OAuth auth unaffected; export
  it where `observer start` runs, or use `--no-attach`). `JumpInButton`'s verb map extended to cover
  all 19 tools.

## [1.24.1] — 2026-07-24

### Added

- **feat(terminal): generic terminal→session correlation sweep.** Closes the
  Session Cockpit gap where only claude-code (out-of-band, 0.95 confidence)
  and codex (rollout discovery, 0.75) could link a dashboard-launched
  terminal to its observer session — every other launcher stayed
  uncorrelated. A 10s daemon-side, tool-agnostic discovery pass
  (`termsvc.Correlate`) now links any LIVE uncorrelated run to a UNIQUE
  candidate session (matched on tool + project root + a launch-time window
  of [−5s, +30m]) at `SourceDiscovered` 0.75 confidence — unique-or-abstain
  with a 2-tick dwell before committing a link, and tick-wide abstention on
  any unsound tick (hit caps, transient failures) rather than a partial or
  best-guess link. Both sides are revalidated immediately before a link
  commits; store queries use julianday-precise window arithmetic;
  dashboard-handoff runs are resolved via the source session's own project
  root; a new integration reverse map (launcher-verb → tool) normalizes the
  match. Open Session Cockpit panels self-heal through the existing 15s
  link poll — no frontend change needed.
- **feat(dashboard): themed tooltips.** Finished the migration to the
  existing floating-ui `Tooltip` primitive across the sidebar collapsed
  rail, terminal toolbars (⊙ Session/Files/Git, focus/grid/minimize/close,
  size-mode, standing-secret), the Launch Dock, and the New Terminal
  dialog — aria-labels preserved or added throughout, and the Playwright
  specs flipped from `title` to `aria-label` assertions in lockstep. Native
  `<option>` titles are deliberately kept as-is, and the terminal-resize
  modal hint deliberately stays a native `title` (a persistent tooltip
  hovering a live terminal is worse than a native one).
- **feat(dashboard): Tailscale setup flow.** The Configuration card's "Pair
  a device" action now gates on tailnet reachability: disabled with the
  exact missing step plus a "Go to Tailscale setup" scroll-link when the
  tailnet is known-unreachable, and enabled-with-caution when serve status
  can't be detected on older Tailscale CLIs. Device-side guidance was added
  to the serve-active step and the QR reveal ("install Tailscale on your
  phone/device and sign into the same tailnet", with iOS/Android/download
  links). The HTTPS-consent (`enable_url`) path now states plainly that
  approval alone does not start serving, and offers a Retry serve action.
  `docs/remote-access.md` updated to match.

### Notes

- Adversarial review: two codex GPT-5.6 passes (all findings fixed) plus an
  independent Claude Opus pass (verdict SHIP; its remaining findings —
  bounding the forward correlation window at 30 minutes, reconciling the
  remote-language e2e case, reverting the resize-hint tooltip, and a
  watcher-lag accessibility fix — were all applied). codex usage stayed
  capped through this work (resets 2026-07-28); the Opus substitution was
  operator-approved.

## [1.24.0] — 2026-07-24

### Added

- **Session Cockpit: a live per-terminal floating panel.** Every embedded
  dashboard terminal running an AI tool gains a "⊙ Session" button that
  opens a compact, draggable cockpit next to the terminal — the glanceable
  companion to the session-detail page, not a clone of it. It shows, live:
  a now strip (last activity, tokens/sec with an honest measured/estimated
  basis badge, live process count), total cost with the AI/tool split and
  the next-message cost band, context fill against the model budget, token
  buckets, the 5h/7d rate-limit gauge (proxy-routed sessions), prompt-cache
  expiry countdown chips, system telemetry (CPU/memory/disk sparklines and
  the spawned-process tree from process observation, plus proxied API
  traffic with byte totals when body capture measures them), and the last
  five turns deep-linking into the session-detail page.
- **Terminal→session live linkage.** New `GET /api/terminal/session/<token>`
  resolves a running terminal to its correlated observer session (id +
  correlation confidence, refusal-ordered so remote callers can never probe
  token existence); the cockpit keeps polling so a later authoritative
  correlation re-points the panel, and links below the out-of-band tier
  carry an explicit "≈ linked" badge.
- **One-click process-capture enable.** When process observation is off, the
  cockpit's System section explains what's missing and offers an atomic
  server-side enable (`POST /api/process/enable-capture`): non-runnable
  backend selections switch to automatic with the previous value named in
  the notice, hosts with no runnable capture backend get an honest
  "unavailable on this machine" instead of a false success, and capture
  honestly starts only after the daemon restarts.
- **`?tail=N` on the session messages API** — returns the true last N rows
  of the full timeline for fast pollers (explicitly rejected when combined
  with pagination parameters).
- **`?summary=1` on the session network API** — a server-side aggregate
  separating proxied API calls (with request/response byte sums from body
  metadata) from OS-observed process connections.

- **Tool-binary resolution with classified verdicts.** Every embedded-
  terminal launcher now resolves its tool binary through a shared ladder —
  process PATH, then a memoized login-shell PATH capture, then native
  install-location probing, then (WSL only) a foreign-Windows-home check —
  and classifies the result as `ok`, `ok_off_path`, `shadowed`,
  `foreign_only`, or `not_found`. Fixes the class of bug where a
  Windows-installed npm shim shadowed (or stood in for) a native binary on
  WSL, and the launcher's stale process PATH meant a fresh native install
  wasn't picked up without restarting the daemon.
- **Guided one-click install.** When a tool isn't natively resolvable, the
  New Terminal dialog shows the verified official install command and an
  "Install in terminal" button that runs it in a visible PTY. Gated by the
  new `[terminal.launch].allow_install` config key (default on).
- **`observer doctor` and `observer adapters` surface binary-resolution
  health**, including a `foreign_only` bucket (tool installed on Windows
  only, not launchable from a WSL daemon) and a best-effort Windows
  proxy-route reachability check.
- **`observer init` writes Windows-side proxy routes.** When the daemon
  runs in WSL, `init` can now also point a Windows-installed claude-code or
  codex at the daemon's proxy (`localhost:8820`, relying on WSL2's
  `localhostForwarding`), so accurate token capture works even when the AI
  tool itself is installed on the Windows side.
- **`[launch.tools.<tool>].path`** config override to pin a specific binary
  path per tool, bypassing the resolution ladder.
- Custom terminal project paths typed in Windows form (`C:\Users\…`) are
  now translated to their WSL mount equivalent before validation.

### Fixed

- **Concurrent dashboard config saves can no longer lose updates.** All
  in-process config read-modify-write paths — section saves, pricing,
  backup restore, remote-manage toggles, terminal limits/policy,
  experiments, and the admission-policy persister — now serialize on one
  shared lock in the config package (cross-process CLI writes remain
  outside a mutex's reach and are documented as such).
- The attach-replay bound test no longer flakes on slow runners (the
  precondition now waits for the pump to drain the full produced stream).

## [1.23.0] — 2026-07-23

### Added

- **`superbased` CLI alias.** The binary now also runs as `superbased`,
  selected from `argv[0]` — `observer` is unchanged and stays canonical
  (no deprecation yet). npm and PyPI ship `superbased` alongside `observer`
  as console entry points, and release tarballs/zips include a `superbased`
  alias next to the `observer` binary.
- **First-run guided dashboard tour.** A spotlight-and-coach-mark
  walkthrough (Overview → Live → Sessions → Cost → Cache → Terminals →
  Security → Settings → global filter/help) auto-starts once on new
  installs and is replayable any time from the Help drawer or the command
  palette.
- **Per-terminal Files/Git project explorer.** Every dashboard terminal
  (floating window or grid tile) gets Files/Git panel buttons: a read-only
  file tree + viewer and a git view (branch, ahead/behind, changes,
  100-commit history). Panels are floating, draggable, multi-panel windows
  — one per terminal, open simultaneously — with a right-click context
  menu to copy the selected path (relative or absolute) and, on a live
  write-capable terminal, paste it straight into that terminal.
- **Authenticated remote terminal takeover.** A fully-authorized remote
  dashboard can now take over control of a terminal from a local/native
  writer or from another remote seat, completing the native → local →
  remote handoff. Default-on; see the config change below.
- **Playwright e2e regression suites** covering the guided tour, terminal
  key/paste handling, and the new project panels.
- **VS Code extension lint gate.** `npm run lint` (eslint) is now runnable
  in the extension's dev workflow; dev-only, not part of the packaged
  extension.
- **Pricing: the 2026 model-release wave.** ~35 new cost-engine rows for
  Claude Mythos 5 (Fable-5-equivalent pricing); the Qwen 3.5 family
  (plus/flash/omni-plus/omni-flash) plus 3.7-Plus and a 3.8-Max-Preview
  placeholder row (no published rate yet — anchored to 3.7-Max's exact
  price pending an official card); GLM-5.2; MiniMax M3; Tencent Hy3;
  StepFun Step-3.5-Flash; ERNIE 5.1; ByteDance Seed 2.0 (provisional,
  Volcengine has no official card yet); Meta Muse Spark 1.1; Cohere North
  Mini Code (genuinely free); Sakana Fugu Ultra; Thinking Machines
  Inkling; Jamba Mini 2; Gemini Omni Flash; and Sarvam (free). A
  researched-but-not-priced ledger is kept in code comments for models
  with no public rate card (Cohere Command A+, the original pre-1.1 Muse
  Spark, Phi-4-reasoning-vision-15B, Falcon H1R 7B) so they aren't
  re-researched needlessly.
- **Website repositioned around the AI-agent control-plane story.**
  superbased.app now leads with seeing agents' actions and provider-
  reported token usage across 26 tools, then controlling the supported
  sessions (dashboard terminals, paired-device session attach/takeover,
  model routing, egress guardrails); four decorative Canvas animations
  from the marketing library embed on the homepage
  (`prefers-reduced-motion`-aware, pause when hidden/offscreen).
  "Observer Quest" renamed "SuperBased Quest". 12 README + 3 website
  dashboard screenshots refreshed against the current UI.

### Changed

- **`[remote].allow_terminal_view` now defaults to `true`.** A paired,
  authenticated remote device can view (read-only) attach/resume terminal
  output by default; set it to `false` to restore the prior deny-by-default
  posture.
- **New `[remote].allow_remote_terminal_takeover`, defaults to `true`.**
  Pairs with the takeover feature above; set it to `false` to keep refusing
  a remote takeover of an existing writer.
- **`[terminal].idle_timeout` now defaults to `"0"`.** Idle embedded
  terminals are no longer reaped after 30 minutes of no PTY I/O (a quiet
  agent sitting at its prompt was being killed mid-session); set it back to
  `"30m"` to restore the old cleanup behavior.
- **Product renamed "SuperBased Observer" → "SuperBased"** in prose and UI
  only. Every technical identifier — the `observer` CLI, package names, the
  `[observer]` config section, `~/.observer`, the `observer.db` filename —
  is unchanged. VS Code extension display strings (command titles, activity
  bar, output channel, notifications) were renamed the same way; the
  Marketplace listing name updates at the next publish.

### Fixed

- `observer run` no longer mangles multi-line commands or shell builtins
  (`cd`, `export`, …) when wrapping them for hooks, and the wrapped command
  now skips the daemon's integrity check on that path — about 750× faster
  to start (measured 0.16s vs. over 120s against a large database).
- STT/dictation paste into the embedded terminal: xterm.js was silently
  canceling plain Ctrl+V, so dictation tools' fallback paste landed a stale
  clipboard instead of the transcription; plain Ctrl+V now reaches the
  browser's native paste handling.
- Terminal-dock drag gestures: an interrupted drag (pointer cancel or lost
  pointer capture) can no longer leave the gesture armed for a later stray
  pointer move to resume from a stale origin.

## [1.22.0] — 2026-07-21

### Added

- **Take control back at your native terminal.** The missing leg of the
  session-control triangle: after a dashboard Jump-in, just start typing in
  the terminal that launched the session (`observer claude`/`codex`) — the
  daemon returns the writer lease, delivers that keystroke, prints a
  one-line notice, and re-pushes your terminal's geometry so a TUI the
  dashboard left at foreign dimensions heals in the same gesture. Machine
  bytes never reclaim (terminal emulators auto-answer TUI queries on stdin);
  arrow keys or a bare ESC alone won't either, by design. Config:
  `[terminal.attach].reclaim_on_input` (default on). The dashboard seat goes
  honestly read-only — "control returned to the native terminal — click to
  take back".
- **Original-size restore for broken TUIs.** The daemon now tracks each
  session's launch-time and current PTY dimensions; every dashboard terminal
  gets a fit / original-size toggle that pins the launch geometry (auto-refit
  suppressed) to recover a TUI corrupted by resizes, and a seat re-asserts
  its own geometry whenever it regains control.
- **Keyboard shortcuts reach the dashboard terminal.** Ctrl+A/E/K/. and
  friends now go to the TUI instead of the page while the terminal is
  focused; Ctrl+Alt push-to-talk chords pass through untouched;
  copy-with-selection stays native. Browser-reserved keys (Ctrl+W/T/N)
  honestly can't be intercepted in a normal tab — the new fullscreen
  **focus mode** (Keyboard Lock, Chromium) is where they reach the TUI.
- **Watch a bare session read-only.** Sessions started outside observer
  (plain `claude`, `codex`, …) that are actively producing events now show a
  "live · watch" badge: a read-only, auto-following view of the conversation
  (4s refresh, stick-to-bottom) in the session panel. "Jump in" stays
  honestly disabled — a bare launch's terminal belongs to the shell that
  started it — with "Watch instead (read-only)" offered in its place.
- **Collapsible sidebar.** The dashboard's left nav collapses to a compact
  icon rail on desktop (persisted, tooltips); the mobile drawer is unchanged.

### Fixed

- Post-v1.21.0 CI red: six golangci-lint findings in the release's new code
  (behavior-preserving refactors) and the missed website version sweep.

## [1.21.0] — 2026-07-21

### Added

- **Browser-chat capture (opt-in MV3 extension).** Full-detail capture of
  ChatGPT, Claude.ai, Perplexity, Gemini, and consumer Copilot web sessions
  from Chrome (WSL + Windows) via a native-messaging bridge into the new
  `browserchat` adapter — prompts, responses, models, and estimated tokens,
  with best-effort redaction and health telemetry (`observer browser health`).
  Load-unpacked only for now. See [`docs/browser-extension.md`](docs/browser-extension.md).
- **Session attach: join and drive live sessions from the dashboard.**
  Observer-launched `claude`/`codex` sessions are daemon-owned PTYs the
  dashboard can now *join* ("live · joinable" badge → Jump in), while your
  native terminal stays fully interactive. Closed sessions gain one-click
  native **Resume** (`observer claude --resume <id>` composed server-side)
  from the session panel. Remote (paired-device) viewing of attach/resume
  terminals stays deny-by-default behind the new `[remote].allow_terminal_view`
  read opt-in.
- **Resilient default-on attach.** Interactive `observer claude`/`observer codex`
  launches attach by default when the daemon is reachable
  (`[terminal.attach].default_on`, Settings-togglable; `--no-attach` opts out
  per launch). Graceful daemon restarts stamp a durable `end_reason`
  (migration 072) and the attach client offers prompt-with-timeout
  auto-resume onto the same transcript; every skipped default-attach prints
  an honest one-line reason.
- **Terminal Workspace dock grid.** The Terminals page is now a workspace:
  an auto-compacting responsive grid of live terminals — drag tiles by their
  header, resize from edges, add running sessions from the tray, "⊞ Add to
  grid" directly on any floating terminal window, "⬈ Open as window" to
  undock a tile back into a **user-resizable, size-persisted floating
  window**. Layouts persist server-side (node-local `workspace_layouts`,
  migration 073) and render read-only on paired remote devices. Honest close
  semantics: "Remove from grid" keeps the session running; "Stop & close"
  actually ends the process. `[terminal].max_concurrent` default raised to 9.
  Existing policy/status/history content lives under a Settings tab.
- **Standing-access hardening toggle.** Opt-in
  `[remote].revoke_standing_on_takeover`: a desktop takeover of a remote
  writer that held control through the standing secret also revokes the
  standing secret itself (identical teardown to the explicit revoke). Default
  stays seamless — takeover revokes only the live lease.

### Fixed

- **Daemon-down no longer breaks claude launches.** `observer init` bakes the
  proxy route into claude's own `settings.json`, which outranks the process
  environment — so a "bare" fallback launch used to route API calls into a
  dead proxy. The launchers now resolve the *effective* route across every
  settings scope claude honors (managed/CLI/local/project/user, including
  inline-JSON `--settings` and `--continue-from` working directories) and
  neutralize observer routes with a one-shot CLI-scope `--settings` override
  (signal-safe temp file); un-overridable cases (managed scope, your own
  `--settings`, codex's config-file route) refuse with copy naming the exact
  fix. Third-party gateway routes are always honored, never clobbered.
- **"Stop & close" now actually stops the process.** Since detach-replay, a
  websocket close only detached the embedded terminal; every stop control now
  issues the explicit server-side reap.
- **Mobile layout no longer breaks on long project paths.** One shared
  tail-preserving truncation primitive (ellipsis at the head, leaf visible,
  full path on hover) across all pages, plus explicit horizontal-scroll
  containment on the Overview table.
- Terminal runs killed by a daemon shutdown no longer show as running forever
  in the run history; floating-terminal resize no longer minimizes the window
  on release.

## [1.20.0] — 2026-07-17

### Added

- **Remote dashboard + terminal control (Phase 4, explicit opt-in).** Drive a
  node from another device over your tailnet: multi-device pairing, a draggable
  launch dock, in-dashboard terminals, and a mobile-friendly dashboard layout.
  Remote **execute** (launching AI tools / running terminal commands from the
  dashboard) is gated behind an explicit standing grant
  (`[remote].allow_standing_terminal_control`, default off) with per-session
  terminal leases, fanout bounds, revoked-lease handling, an execute-tier CSP,
  and a full audit lifecycle. Tailnet-only; nothing is exposed to the public
  internet. See [`docs/remote-access.md`](docs/remote-access.md).
- **Process-network body capture + attribution wave.** For observed processes
  routed through the proxy, capture proxied/plaintext request/response bodies
  into the new `process_network_bodies` store (agent migration 067) — never a
  claim of TLS visibility. Broader process observation and attribution: five
  adapters seed the pid bridge directly, a background attribution sweep and
  per-wave basenames tighten which session a process belongs to, and the
  dashboard gains process + raw-events surfaces. See
  [`docs/process-observability.md`](docs/process-observability.md).
- **GPT-5.6 / OpenAI cache-write token capture.** The proxy now parses
  `input_tokens_details.cache_write_tokens` from OpenAI/Responses usage (both
  the provider and streaming paths), nets cache-write against gross input
  correctly, and feeds the cachetrack engine so implicit-write events are
  observed instead of silently dropped. Wire field + expiry semantics
  documented in `docs/general_info/openai_cache_expiry.md` and
  `docs/cache-tracking.md`.
- **Dashboard time-window dropdown.** A new date-range control adds **1h / 12h /
  1d** windows plus explicit custom ranges alongside the existing options,
  resolving `since`/`until` with hours taking precedence over days. The range
  params thread through every dashboard page.
- **Benchmark integrity: retry-as-attempt + ephemeral runs.** Each retry is now
  recorded as its own attempt (agent migration 068) so benchmark integrity
  reflects real attempt counts instead of collapsing retries. New ephemeral
  runs execute without persisting into the main corpus.
- **Compression: no-drop capability + honest lossy-eviction display.** A new
  `disable_drops` capability lets the `codex-safe` recipe compress without lossy
  content eviction. All lossy eviction now routes through one classifier owner,
  and evicted bytes are **subtracted** from reported compression savings so
  "saved" reflects genuine, retrievable compression only — evicted content is
  surfaced additively (still recoverable via `search_past_outputs` markers,
  never counted as a saving).
- **M365 Copilot org analytics + browser-extension capture fixes.** New
  `observer-org m365` command and M365 Copilot analytics surface (Graph auth +
  `surface_graph`) on the org server — server-side only, never on the agent
  wire. Browser-extension capture (native-messaging host + service worker + the
  loopback ingest receiver) is fixed, with per-browser/per-OS host manifest
  writers including Windows registry hostfiles.
- **`[dashboard].addr` config knob (#8).** The dashboard bind address is now
  configurable via `[dashboard].addr` (and the `OBSERVER_DASHBOARD_ADDR`
  environment override).
- **Kimi K3 model pricing** added to the cost engine and the settings surface.

### Changed

- **Codex fork/subagent token de-duplication + session lineage.** Replayed
  fork/subagent turns are now skipped so a forked Codex session no longer
  double-counts tokens already attributed to its parent. New parent/child
  session-lineage tracking (agent migration 069, surfaced in the session-detail
  panel) makes the relationship explicit, and the new `--codex-fork-dedup`
  backfill pass reconciles historical fork double-counting.

### Fixed

- **VS Code extension activation stall (#5).** Fixed extension activation and
  observer-binary resolution; a new `preferPathBinary` setting lets the
  extension use a `PATH`-resolved observer instead of its bundled copy.
- **Codex 16 MiB record limit (#7).** The Codex JSONL scanner's 16 MiB record
  cap is replaced with a shared `readRecord` (64 MiB bound + per-record skip) so
  an oversized record no longer aborts a whole session parse.
- **Prune now reclaims disk space.** `observer prune` actually reclaims disk
  instead of only shedding rows, and startup latency previously spent in
  on-open integrity work is cut.

### Upgrade notes

- Agent DB migrates to schema 69 (migrations 061–069); the org server stays at
  schema 21 — both automatic.
- Restart the daemon via the safe order (route off → stop → relaunch → route
  on; `scripts/restart-daemon.sh`) so the new binary and migrations load.
- Remote execute + standing terminal control stay fully inert until you set
  `[remote].allow_standing_terminal_control = true`; pairing and remote viewing
  are tailnet-only.
- Run `observer backfill --codex-fork-dedup` (or `observer backfill --all`) to
  reconcile historical Codex fork double-counting.

## [1.19.0] — 2026-07-11

### Added

- **Email notifications.** New `[email]` config block (stdlib SMTP:
  STARTTLS/implicit-TLS, AUTH PLAIN/LOGIN; default **off**, fail-soft —
  a delivery failure never affects evaluation). Rides the existing alert
  evaluators: org budget alerts, org obs-alert rules, and node-side
  `[observability.alerts]`. See `docs/email-notifications.md`.
- **Scheduled cost digests.** Weekly/monthly digest emails on both the node
  (`[digest]`) and the org server: period spend, per-model/per-project (org:
  per-developer) breakdowns, movers vs prior period. Restart-safe send-once
  de-dup via the new `digest_state` table (agent migration 060, server
  migration 021). Test on demand with `observer digest send --dry-run` /
  `observer-org digest send --dry-run`.
- **Shareable cost card.** `observer report share [--period week|month]
  [--markdown]` renders a 1200×630 SVG social card + markdown summary of your
  observed spend (period total, cache-read share, model/tool leaderboards).
  Aggregates only — project names/paths never appear (pinned by test). No
  network.
- **Admin dashboard (web2) onboarding & navigation.** First-run checklist for
  a fresh org server, command-palette **data search** (teams / projects /
  people / recent sessions), teaching empty states across pages, breadcrumbs
  on detail routes, and sidebar count badges.
- **Plane-A general-observability upgrades.** web2 **Admission center**
  (`/trajectories/admission`, read-only policy viewer) + **T6 admission
  org-wire tier** (`[org_client.share.obs].admission`, default off; server
  migration 019) with audited deep reads; **T7 per-item eval tier**
  (`.eval_items`, server migration 020) with per-item EvalRun detail and
  run-vs-run compare; **per-end-user spend page**; node-side **alert
  evaluation for share-off deployments** (`[observability.alerts]`, default
  off); LLM-judge robustness (map-reduce chunking, per-criterion prompts,
  hardened client) + `observer obs admission verify`; SDKs attach
  prompt/response content by default (`OBSERVER_CAPTURE_CONTENT=0` to
  disable) and target the correct node port `:8081`; `POST /policy?persist=1`
  write-through.
- **M365 Copilot org-tier connector** (server-side native-console poller,
  server migration 018; never on the agent wire).
- **Browser-chatbot capture extension (preview).** Opt-in MV3 extension
  capturing ChatGPT / Claude.ai / Perplexity / Gemini / consumer-Copilot web
  chats via a native-messaging bridge (`observer browser hook`). Load-unpacked
  only for now — **not yet published to the Chrome Web Store**; all token
  counts are estimates.
- **Website.** Text-first, fully indexable homepage (the Observer Quest
  arcade lives on at `/arcade`); product deck at `/deck` with a downloadable
  PDF; 28 per-tool "track <tool> costs" pages generated from the adapter
  registry; 6 comparison pages; 21-term glossary; a public two-planes
  explainer; `llms.txt` + JSON-LD + an explicit GEO robots posture
  (retrieval crawlers allowed, training crawlers opted out).

### Changed

- **READMEs and store listings overhauled** around the durable story:
  proxy-accurate billed-token attribution, local-first privacy, free node →
  team layer. One true adapter count (26) everywhere; npm/PyPI/VS Code
  listing descriptions rewritten; MCP tool census corrected to 25 (21
  always-on + 4 conditional) and `docs/mcp-tools.md` fully rewritten.
- **Org-server retention is now enforced.** `server.data_retention_days`
  (default 730) actively prunes: **upgraded org servers begin deleting
  rows older than the configured window** (identity/config/audit/guard-chain
  tables are never pruned). Set the knob before upgrading if you need longer
  retention.
- Guard alerting (desktop toasts, Slack/Discord/PagerDuty webhooks) and
  process observability are now documented on the main surfaces.

### Fixed

- VS Code walkthrough listed a nonexistent "Continue" adapter; stale
  "seventeen tools" counts across README/website/listings; dead help entries
  in the node dashboard; org migrate-test schema assertion; a date-dependent
  test (`TestAggregateForOrg`) that failed once its hardcoded day aged out.

### Upgrade notes

- Agent DB migrates to schema 60; org server to 21 — both automatic.
- Restart the daemon via the safe order (route off → stop → relaunch →
  route on; `scripts/restart-daemon.sh`) so the new binary and migrations
  load.
- Email/digests stay inert until you set `[email].enabled = true` plus the
  per-consumer opt-ins.

## [1.18.0] — 2026-07-10

### Added

- **`observer devin --continue-from` launcher.** Devin CLI joins the
  session-handoff launchers: `observer devin --continue-from <session-id>`
  distills a handover and seeds it as Devin's first prompt. Devin takes its
  prompt as a clap last-only positional after the `--` separator
  (`devin -- "<prompt>"`, operator-verified on a real TTY), so the launcher
  uses a new `injectTrailingPositionalAfterDashDash` inject kind. The launch is
  seed-only and **non-proxied** (Cognition backend, `native_exempt`, no
  base-URL knob); `child.Dir` is threaded from the continue-from cwd per the
  cross-OS handoff contract. The launchable set grows to **19 launchers**
  (**17 Seeded** + 2 DocAssisted); the Devin registry row gains `InjectPrompt`
  + `Launch` and drops its unverified-seed caveat.

### Changed

- **`qwen-code` promoted to a live, observer-driven proxy route.** qwen-code
  resolves its active model by the `(id, baseUrl)` pair, so rewriting
  `model.baseUrl` alone was ignored when it matched no `modelProviders` entry —
  the grounded 2026-07-09 probe failure (qwen fell back to `api.openai.com` and
  bypassed the proxy). `RegisterQwenCode` now **also retargets every OpenAI-lane
  `modelProviders` entry on the known default host** to the proxy URL, keeping
  each entry's `id` + `envKey` untouched, tolerating both live schema shapes
  (array + object form), and synthesizing an entry only when none matched (same
  guard matrix: refuse-foreign-URL, idempotent, `.bak`, temp+rename,
  ConfigMissing skip; API keys never touched). Live-verified 2026-07-09: a
  `qwen -p` turn through `:8820` landed `api_turns` 23728–23730 (gpt-4o,
  `provider=openai`). The registry row is promoted to `routable_now` with an
  observer-driven **Proxy** route; `ProxyProbe` is KEPT — it remains the
  persistent config-lane writer `observer init` dispatches on.
- **GPT-5.6 cache/effort grounding closed against live traffic.** A live
  gpt-5.6 session (`019f4801`) confirms the launch pricing: the model ids
  `gpt-5.6-{sol,terra}` hit their pricing rows exactly and a live terra turn
  recomputes to the stored cost to the digit; no effort levels beyond
  low/medium/high manifested. **NO cache-write usage field exists on the Codex
  wire** — only `cached_input_tokens` (read discount). OpenAI docs confirm the
  write tier we priced (1.25× uncached input, 90% read discount, 30-min minimum
  TTL, explicit-breakpoint mode), but Codex's ChatGPT-plan credit formula has no
  write term, which is why the field never appears on our wire. The shipped
  write-tier pricing therefore stays **present-but-dormant and harmless**, and
  parsing a `cache_write_tokens` field is deliberately DEFERRED until the
  netting semantics can be arithmetic-grounded on live traffic — additive
  billing without grounding would repeat the reasoning-double-bill trap.
  `docs/cache-tracking.md` gained a GPT-5.6 cache-expiry subsection.

### Fixed

- **Codex reasoning tokens were double-billed.** The OpenAI/Codex wire reports
  **GROSS** `output_tokens` with reasoning as a **subset** (`input + output ==
  total` on every live `token_count` event — arithmetic-verified on gpt-5.6
  traffic). The codex adapter emitted that gross value alongside
  `ReasoningTokens`, and the cost engine's additive reasoning-at-output-rate
  rule then billed every codex reasoning token twice. The adapter now nets
  reasoning out at both emit sites (clamped ≥ 0, mirroring the `netInput`
  pattern), and `TokenBundle.Reasoning` gained a hard documented precondition:
  netting is a **per-wire property** — OpenAI/Codex fold reasoning into output
  (subset), whereas gemini/antigravity report it disjoint (the additive rule is
  correct only for disjoint wires). **Migration 058 corrects the stored history
  one-shot** (1,991 gross codex rows / 436k double-billed reasoning tokens on
  the reference node): historical rows are corrected automatically at the first
  startup of the upgraded binary, because a rescan cannot lower counts past the
  `ON CONFLICT` MAX-upgrade and the run-once ordering makes the subtraction
  idempotent by construction. Scoped to `tool='codex'` only —
  gemini/antigravity are disjoint-correct.
- **grok ACP update content was dropped when polymorphic.** `tool_call_update`
  content arrives as an **array** of text/diff blocks (and `rawOutput.output`
  as a byte array); the single-object decode dropped 38 records across the two
  fresh captures. `search_replace` (grok's in-place edit) was also unmapped and
  landed as `unknown`; it now maps to `edit_file` (with defensive
  `deletefile`/`removefile` handling — grok exposes no distinct delete tool).
  Rescan: warnings 38 → 0, unknown 2 → 0.
- **Adapter rescans now reclassify `action_type` from the `unknown` sentinel.**
  `insertActionSQL`'s `ON CONFLICT` clause never refreshed `action_type`, so a
  rescan (`observer scan --force`) could not reclassify rows stored as
  `unknown` before a mapping fix landed — which blocked the grok
  `search_replace` fix above from healing the two live `unknown` rows. The
  conflict clause now upgrades **only** `unknown` → a real type; it never
  rewrites one known type to another and never downgrades to `unknown`/empty
  (all three invariants pinned by table-driven tests).

## [1.17.0] — 2026-07-09

### Added

- **Nine new tool adapters — the 10-tool adapter wave** (freebuff descoped).
  Observer now captures **26 adapters** total. Each new adapter ships with a
  testdata fixture, an operator doc, an integration-registry row, a dashboard
  tool color, and a `docs/cross-adapter-schema-mapping.md` section (§3.11–3.19):
  - **`qwen-code`** — Qwen Code CLI (Gemini-CLI fork), Claude-Code-shaped JSONL
    under `~/.qwen`; GROSS input netted against cached.
  - **`kiro-cli`** — AWS Kiro CLI; mode-dependent dual store (interactive flat
    bundles vs `--no-interactive` SQLite `conversations_v2` keyed by the RAW
    cwd, translated through crossmount); SigV4, native-exempt.
  - **`crush`** — Charmbracelet Crush; project-local `.crush/crush.db`
    discovered via `projects.json`; Unix-SECONDS timestamps.
  - **`kimi-code`** — Moonshot Kimi CLI; `wire.jsonl` `usage.record`
    (`inputOther` is already NET); no seed lane (DocAssisted only).
  - **`grok`** — xAI Grok CLI; 8-file ACP session bundles, with per-request
    token splits pulled from the GLOBAL `~/.grok/logs/unified.jsonl`
    correlated by `sid` (no timestamp heuristics).
  - **`devin`** — Devin CLI; SQLite `message_nodes` TREE walked along
    `main_chain_id` to dedupe regeneration branches so tokens never
    double-count; per-message `metadata.metrics` tokens.
  - **`aider`** — Aider; per-repo `.aider.chat.history.md` Markdown, with watch
    roots = discovered transcript FILE paths (a bounded breadth-first
    native-home walk memoized once per process); prose tokens GROSS→netted.
  - **`qoder`** — Alibaba Qoder CLI; Claude-Code-shaped JSONL under
    `~/.qoder/projects`; NO local model or tokens (server-side only —
    honest-zero, native-exempt).
  - **`goose`** — Block Goose; WAL SQLite `sessions.db` with SESSION-level
    tokens only (`accumulated_*` + `accumulated_cost`); input GROSS→netted vs
    `cache_read`; `SessionID` is store-scoped (`<id>@<sha8(store)>`) so the
    `YYYYMMDD_seq` ids can't collide across a WSL + Windows store pair.

  Fresh installs pick all nine up automatically; an EXPLICIT `enabled_adapters`
  list must add the new tool names (`qwen-code`, `kiro-cli`, `crush`,
  `kimi-code`, `grok`, `devin`, `aider`, `qoder`, `goose`) — the startup WARN
  names any that are missing.
- **Seeded session-handoff launchers for the new adapters** — `observer qwen`,
  `observer kiro`, `observer kimi`, `observer grok`, `observer qoder`, and
  `observer goose` accept `--continue-from <session-id>` to distill a handover
  and seed it as the tool's first prompt (**18 launchers total**). `qwen`,
  `kiro`, `grok`, `qoder`, and `goose` seed directly; `kimi` is DocAssisted
  (no `-p` seed lane). `devin`, `aider`, and `crush` deliberately ship no
  launcher (no scriptable seed lane).
- **The watcher and adapter registry now accept a FILE as a watch root**
  (not only a directory), which the `aider` adapter needs for its per-repo
  transcript-file watch set.
- **Guarded proxy-route config-lane writers** — `internal/proxyroute` gained
  `RegisterKimiCode` (TOML `base_url` in `~/.kimi-code/config.toml`),
  `RegisterCrush` (JSON map-merge in `crush.json`), and `RegisterQwenCode`
  (rewrites `~/.qwen/settings.json` `model.baseUrl`, stricter guard: refuses
  any custom host). Each backs up (`.bak`) and writes via temp/rename, skips
  benignly when the config is missing, is idempotent when already observer,
  and refuses a foreign URL; API keys are never touched. A new additive
  registry field `Capability.ProxyProbe` marks "writer ready, promotion
  pending a live probe"; these writers fire ONLY through `observer init` —
  batch under `--all` (honoring `--skip-proxy-route`), or one per-tool consent
  prompt in the interactive checklist (default NO). ⚠️ Once a tool is routed,
  stopping the daemon breaks it until reverted (the standard routed-tool
  caveat — see the daemon-restart runbook).
- **Per-adapter Backfill scan modes in the dashboard** — Settings → Backfill
  now derives one `scan-<tool>` row per integration-registry adapter (26 rows),
  backed by the generic `observer scan --force --adapter <tool>` lane
  (idempotent; overrides `enabled_adapters` for the run). A future adapter's
  Backfill row appears automatically.
- **Pricing: GPT-5.6 and Grok 4.5 model launches.** Added `gpt-5.6-sol`
  ($4/$20 since 2026-08-21; it launched at $5/$30), `gpt-5.6-terra` ($2.50 in / $15 out at launch), `gpt-5.6-luna`
  ($1 in / $6 out at launch; OpenAI cut Terra and Luna prices on 2026-07-30 —
  the current table reflects the cut), and a
  `gpt-5.6` family row. GPT-5.6 introduces the **first non-Anthropic explicit
  cache-write tier** (writes at 1.25× uncached input, reads keep the 90%
  discount); the write rate is wired into the cost table but INERT until a live
  5.6 response grounds the cache-write usage field. Added `grok-4.5` ($2/$6,
  the new xAI flagship — previously under-billed via the `grok` family row at
  4.3 rates) and `grok-build-0.1` / `grok-build` ($1/$2); bumped the `grok`
  family prefix to flagship rates. `docs/pricing-reference.md` updated.

### Changed

- **Adapter routability promotions.** `aider`, `goose`, and `grok` were
  live-grounded through the `:8820` proxy and promoted to `routable_now`
  (observer drives no route today; the launchers stay non-proxied).
  `kimi-code` and `crush` were promoted further to observer-driven **Proxy**
  routes after live turns landed `api_turns` rows through their config-lane
  writers. `qwen-code` stays route-blocked — its (empty) `modelProviders` map
  overrides `model.baseUrl`, so the env/base-URL lanes are grounded-dead and
  the writer needs a matching provider entry first.
- **Dashboard tool-identity colors** for the 10 previously-uncolored adapters
  (light + dark tokens, CVD-validated), plus the missing `tools.ts` entries.

### Fixed

- **Actions page window selector was a no-op.** The 7d/14d/30d window computed
  `windowDays` but never passed it to `/api/actions` (only the Timeline
  day-counts honored it). `/api/actions` gained the same optional `days`
  contract as `/api/sessions` (0 = unwindowed; legacy callers unchanged) and
  the page now threads the selected window.
- **antigravity-cli cross-OS + guard coverage.** Added the antigravity-cli
  cross-OS project-root anchors and its guard watcher-conformance row.

## [1.16.0] — 2026-07-07

### Added

- **Richer session-handoff content** — two complementary "full" carry modes.
  `full` carries the excerpted flow plus a `[msg <id>]` tag on every message
  and an MCP-hint line; a target with the Observer MCP pulls any full body on
  demand via the new **`get_session_message`** tool (always-on MCP tool count
  19 → 20), which re-reads ONE un-excerpted message by
  `(session_id, message_id|index)` from the source transcript and never
  persists it. `full_cache` inlines the un-excerpted read/tool bodies INTO the
  handover doc so the new session starts warm with zero MCP round-trips (uses
  the `FullTranscriptReader` capability — claude-code + codex; other tools
  degrade to `full` with a stated reason), size-capped by
  `[handoff] max_cache_bytes` (8 MB default). `models.TranscriptMessage` gained
  an `ID` lifted from each source format's own record id where grounded.
- **Antigravity CLI (`agy`) adapter** — the newer Antigravity CLI is now a
  first-class, separately-tagged adapter (`antigravity-cli`):
  plaintext-protobuf SQLite `.db` conversations parsed directly, `.pb`
  conversations via the existing transcript fallback, name-gated so the desktop
  and CLI layouts each claim only their own files, with
  `observer backfill --antigravity-cli-rescan` and an integration-registry row.
  Add `"antigravity-cli"` to an explicit `enabled_adapters` list to enable it.
- **`observer antigravity-cli` handoff launcher** (aliases `antigravity`,
  `agy`) — `--continue-from` distills a handover and seeds it via `agy -i`
  (non-proxied).
- **Community links** surfaced in the dashboard Settings page and the
  `observer init` footer.

### Changed

- Obs share flags nested under `[org_client.share.obs]`; the dashboard Settings
  Observability section is now plane-tagged (Plane A admin vs Plane B
  developer) for legibility.
- Website download counter refreshed (npm 14,893 / PyPI 9,242).

### Fixed

- Antigravity CLI sessions are now tagged `antigravity-cli` instead of blending
  into the desktop `antigravity` tool — the parse helpers hardcoded the tool
  constant; `ParseSessionFile` now re-tags every event to the adapter's own
  name at the boundary.
- MCP `observer serve` skips the SQLite `quick_check` so a large DB can't blow
  the init timeout.
- Session handoff resolves a foreign-OS project root for the doc + launch cwd
  (cross-OS WSL case).

## [1.15.0] — 2026-07-06

### Added

- **Session Handoff (continue-anywhere)** — `observer handoff <session-id>
  [--to <tool>]` distills any captured session from the source tool's OWN
  transcript files into a scrubbed `HANDOFF-<id>.md` the target tool reads in
  the project root, priced per carry mode (metadata / distilled /
  distilled_tail / full) at the target model. Fork from any stable point of
  the message history (snap table refuses cuts inside unresolved tool chains).
  NOT cache migration — provider caches are server-side and prefix-exact; the
  estimate's stay option (next-message predict band + live cache
  value-at-risk) is the honest surface of that fact. Surfaces: CLI
  (`observer handoff`, `handoff list`), dashboard session-detail
  "Continue in…" modal with fork picker
  (`GET /api/session/<id>/handoff/estimate` + `POST /api/session/<id>/handoff`),
  MCP `continue_session` (tool count 19 → 20). Transcript readers:
  claude-code, codex, cursor, cline, cline-cli, hermes, opencode. Node-local
  `handoffs` table (migration 055) stores counts/enums/hashes only — never
  the doc. Docs: `docs/session-handoff.md`.
- **Session Handoff — dashboard "Launch `<tool>` here" (embedded web
  terminal).** The Continue-in… modal can now START the target tool in the
  browser instead of only writing a handover file: for a launchable target
  (claude-code / codex / gemini-cli / pi) the daemon spawns
  `observer <tool> --continue-from <id>` in a PTY inside its own OS and
  streams the TUI into an xterm.js panel over a `/ws/launch/<handle>`
  websocket — working uniformly local, remote, or WSL-daemon/Windows-browser
  (no cross-OS shell). New pure-logic `internal/termsession` (PTY session
  registry behind an injected spawner; process-group reaping on unix,
  concurrent cap + idle reaper) and the `HandoffCapability.Launch` registry
  field. Server-derived argv only; CSWSH-defended (256-bit `crypto/rand`
  handle minted only by the Origin-checked `POST /api/session/<id>/launch`,
  plus `coder/websocket` cross-origin rejection). On by default, kill-switch
  `[handoff].allow_dashboard_launch`. `GET /api/launch/sessions` +
  `DELETE /api/launch/<handle>` for the live-session list. Unix-only PTY
  backend (native-Windows daemon reports unsupported → run under WSL). Docs:
  `docs/session-handoff.md` (Launch here), `docs/security.md` ledger.
- **Session Handoff — armed hook delivery (`--deliver hook`, claude-code).**
  `observer handoff <id> --to claude-code --deliver hook` arms the handover
  for the NEXT claude-code session in the project: it injects as SessionStart
  `additionalContext` (same seam as the advisor digest), one-shot, expiring
  after `[handoff] hook_ttl_minutes` (default 240). The payload is hard-
  budgeted to `[handoff] hook_max_bytes` (default 8192; Phase 0 D-P0.2's 8KB
  intact cap) — the compact doc when it fits, else the document head plus a
  pointer to read the on-disk `HANDOFF-*.md`. Doc content stays on disk; the
  `handoffs` row (migration 056: `hook_expires_at` / `hook_delivered_at` /
  `project_root`) records only the arming window and file path. The claim is
  a single guarded `UPDATE … RETURNING` (race-safe). Delivery dispatches on
  the target's `integration.HandoffCapability` inject set — only claude-code
  declares `inject_hook`; other tools error honestly.
- **Session Handoff — launcher `--continue-from` (prompt delivery).**
  `observer claude --continue-from <session-id>` and
  `observer codex --continue-from <session-id>` run the handoff for the
  launcher's OWN tool (delivery `inject_prompt`) and seed the rendered
  handover as the tool's first user prompt before exec'ing it — no
  copy/paste. Mirrors `observer handoff` flags (`--carry`, `--from-message`,
  `--from-time`; default fork = last message). claude gets the doc prepended
  as its leading positional prompt, codex appended as the trailing positional
  (TUI + `exec`); forwarding your own positional prompt errors honestly (two
  prompts — forward value-flags as `--flag=value`). Handovers over 100KB
  degrade to a marker-carrying pointer prompt (the full doc is on disk). The
  `observer handoff … --to claude-code|codex` output now prints a
  `--continue-from` tip. Delivery still dispatches on the target's
  `integration.HandoffCapability` — a prompt handoff to a tool without the
  lane errors honestly.
- **Session Handoff — `--continue-from` extended to `observer gemini` and
  `observer pi`.** Both now accept `--continue-from` (plus `--carry`,
  `--from-message`, `--from-time`), seeding the handover as the tool's first
  prompt: gemini via its `-i/--prompt-interactive` flag ("Execute the
  provided prompt and continue in interactive mode"), pi as a trailing
  positional message (pi `[messages...]` start an interactive session). The
  injection strategy is now a declared `promptInjection` descriptor (leading
  positional / trailing positional / flag value) applied by a shared
  `injectPrompt` helper — no `switch tool`; claude and codex are refactored
  onto the same helper. `hermes` stays deferred: its only prompt flag
  (`-z/--oneshot`, `chat -q`) is headless one-shot (answer once and exit),
  not an interactive seed, so wiring it would change the run mode.
  `opencode` (TUI positional is a project path), `copilot-cli` (headless
  `-p` only), `openclaw` (proxy runtime-block) and `cline-cli` (not
  verifiable on the grounding node) also remain deferred.
- **Session Handoff — best-effort target-session linker.** Every rendered
  handover carries a `<!-- superbased-handoff <shortid> -->` marker that
  rides into the target session on every delivery lane (injected prompt,
  SessionStart context, or the model reading `HANDOFF-<shortid>.md`).
  `observer handoff list` now runs a time-boxed best-effort sweep first:
  for each delivered handoff of the last 7 days still missing a target,
  it re-reads candidate sessions of the target tool in the same project
  (started after the handoff) via the shared transcript-reader dispatch and
  stamps `handoffs.target_session_id` on the first whose transcript carries
  the marker. The link is written once (guarded UPDATE); the list gains a
  `TARGET` column. Pure marker scan lives in `internal/handoff`
  (`ScanMarkers` / `ContainsMarker`); store seam adds `LinkTargetSession`,
  `ListUnlinkedHandoffs`, `CandidateTargetSessions`. Short-id is recovered
  from the delivered doc's file name (`delivery_ref`). Everything is
  best-effort — an unreadable candidate is skipped and one handoff's failure
  never aborts the sweep.
- **Session Handoff — `handoff_rehydration` cache accounting.** A handoff
  target's first turn is a large cold cache write BY DESIGN (the handover
  doc arrives as the first prompt / SessionStart context / an early
  `HANDOFF-<id>.md` read). It is now annotated as a new
  `cause=handoff_rehydration` (same `reanchor` kind, so kind-based
  denominators are unchanged) instead of a plain `reanchor`, so it no
  longer trips the advisor's `session_balloon` / `cache_write_waste`
  detectors or `observer cache-health`'s cause-concentration WARN. Fired
  live in cachetrack when the `superbased-handoff` marker is present on the
  first observed turn (proxy `parseRequest` body scan + Tier-2 store
  block-body scan), and applied retroactively by the advisor via
  `handoffs.target_session_id` (the belt for non-proxied targets). Docs:
  `docs/cache-tracking.md` → "Session-handoff accounting".
- **Session Handoff — implicit-cache lane consults the handoff marker.** The
  §15.3 implicit / OpenAI-Codex attribution path now mirrors the Anthropic
  lane: on the bootstrap turn with the `superbased-handoff` marker set,
  `ruleImplicitHandoffRehydration` fires `cause=handoff_rehydration` with the
  same `implicit_write` kind the plain reanchor uses, so every
  denominator/exclusion is unmoved (the kind routes to `bucketSkipped` +
  `isRateSkipped`, and the bootstrap turn is already excluded from
  `ImplicitCacheConsistency`) — only the cause differs. The marker flag,
  already scanned provider-agnostically by the proxy's `parseRequest`, is now
  threaded through the OpenAI branch of `buildCacheObserveInput` (it was
  previously dropped) and consumed by `observeImplicit`. Live coverage is
  proxy-only; a non-proxied **codex** Tier-2 target carries no reconstructed
  block bodies to scan, so that lane stays covered by the advisor's
  retroactive handoff-target belt.
- **Session Handoff — retention sweep + `observer doctor` probe (P4).** The
  node-local `handoffs` table is now pruned by the shared retention runner
  (`observer prune`, and `prune_on_startup` on `observer start` / `watch`)
  via `store.PruneHandoffRows`, gated by the new `[handoff] retention_days`
  (default 180; `0` = keep forever). The `prune` summary line reports
  `handoff_rows=<n>`. `observer doctor` gains a **handoff readers** check:
  per adapter it reports the declared transcript tier + delivery lanes and,
  where a session exists from the last 30 days and the adapter implements
  the reader, runs a read-only, time-boxed (2s) readability probe against
  the latest session — honest `read OK` / `metadata handover only` /
  reader-declared-but-unreadable WARN, dispatched on capability shape (no
  tool-name branching).

### Changed

- **The node/developer dashboard is now purely coding-agent (Plane B).** The
  general-observability surfaces — **Trajectories**, **Evals**, and the
  **Admission** policy editor / per-end-user budgets — were removed from the
  local dashboard nav. These observe an LLM *application* you host at the
  admin level (end-user traces, evals, and input guardrails), not your own
  coding assistant, so their home is the **admin dashboard** (`web2`, the
  Trajectories nav group). A node still captures and pushes obs data when
  `[observability]` is enabled; it just no longer renders the obs UI locally.
  The obs backend, `/api/obs/*` endpoints, and `observer obs …` / `observer
  eval` CLIs are unchanged. See the new [`docs/deployment-models.md`].
- **New two-plane documentation.** `docs/deployment-models.md` is the
  canonical explainer of the two deployment models — Plane A (general
  observability of a hosted LLM app) vs Plane B (coding-agent org/teams) — and
  is now Start-here #1. `CLAUDE.md`, `docs/README.md`, `docs/observability.md`,
  and the root `README.md` were updated to keep the two planes legible, backed
  by a full plane-separation audit
  (`docs/audits/plane-separation-audit-2026-07-06.md`) whose verdict is that
  every enforced code boundary between the planes holds.
- **Community & support card** added to the node dashboard Overview (star the
  repo, report a problem, refer/share, send feedback).

### Security

- **SQLite DSN path escaping (low; closes ledger item L8).** Every SQLite
  `file:` DSN now routes its filesystem path through the new one-owner helper
  `internal/platform/sqlitedsn.Escape`, which percent-encodes the characters
  the SQLite URI parser treats specially (`%`, `?`, `#`). Previously a database
  path containing `?` was truncated into the query string (and `%XX` sequences
  were mis-decoded), which could drop the read-only pragmas on adapter reads.
  Applied to all 13 DSN sites: the 8 external-database adapter readers
  (kilocode, opencode, openclaw, cline-cli, cursor, hermes, antigravity ×2),
  both backfill readers, the `observer import` read-only ATTACH, and both
  first-party database opens. Ordinary paths produce byte-identical DSNs.

## [1.14.0] — 2026-07-02

### Security

- **Whole-product security review + remediation** (see
  `docs/audits/security-review-2026-07-02.md`; tracked in `docs/security.md`).
  A six-surface review plus `govulncheck` found and fixed 4 high, 8 medium, and
  6 low findings; `govulncheck` reachable advisories went 28 → 0.
  - **Org server access control (high).** Three privileged `/api/org/*` routes
    (routing-policy publish, routing-summaries export, enrolment-token mint)
    were gated on SAML-session presence only, so any SSO-capable member could
    reach them — publish a fleet-wide routing policy, export every developer's
    email and spend, or mint an enrolment token for an arbitrary user (ingest
    impersonation). They now require org-admin authority (`admin_emails`).
  - **SAML signature bypass (high).** Bumped `goxmldsig` 1.4.0 → 1.6.0
    (GO-2026-4753, reachable from assertion validation), `golang.org/x/net`
    0.53 → 0.55, and the build toolchain to go1.25.11 (clears ~25 stdlib
    advisories including `html/template` XSS reachable from the org dashboard).
  - **Dashboard CSRF / DNS-rebinding (high).** The local dashboard exposed
    state-changing endpoints with no origin or Host validation; a malicious web
    page could drive them. Added a same-origin + loopback-Host guard and a
    non-loopback-bind warning.
  - **Watcher symlink escape (high).** A symlink planted under a watch root
    could be followed out of the tree and its contents excerpted into the DB;
    such symlinks are now skipped.
  - **Privacy / attribution (medium).** Ingested `user_email` is pinned to the
    authenticated pusher (was forgeable on aggregate rows), and `git_branch` is
    no longer shipped in the default metadata-only sharing posture.
  - **Denial-of-service hardening (medium/low).** Enforced the previously-dead
    `[watcher].max_file_size_mb`, added watcher panic recovery, a protobuf
    recursion-depth cap, and a proxy request-body size cap; plus a proxy
    guard-mask JSON backstop, WSL hook-command quoting, git `gitdir:` traversal
    rejection, and PowerShell path escaping.

### Added

- **Config auto-migration rail.** Deprecated config keys are now rewritten
  to their current names on disk instead of only being mapped in memory (which
  reprinted a `config: deprecation:` warning on every load). A new pure,
  table-driven registry (`internal/config/migrate`) surgically renames keys —
  preserving your values, comments, ordering, and every untouched section —
  drops keys with no analog, and stamps `[observer] config_version`. It runs
  automatically once on `observer start` (the daemon is the sole writer; a
  `config.toml.bak` backup is written first) and on demand via **`observer
  config migrate`** / **`observer config migrate --dry-run`**. Idempotent and
  fail-safe: a value it can't edit by line surgery is left untouched, never
  corrupted. Registry v1 migrates the decommissioned `[compression.code_graph]`
  / `[intelligence.code_graph]` blocks onto `[codeintel]`.

## [1.13.0] — 2026-07-01

### Added

- **Output Composition (verbosity) — code vs. explanation, by language, with
  estimated cost.** Measures what actually comes through an AI assistant's
  output: narrative explanation vs. shown (fenced) display artifacts vs.
  authored code (file writes + shell commands), resolved by language, at turn /
  session / aggregate levels. A new pure `internal/verbosity` layer owns the
  markdown fence scanner, a comprehensive extension/filename/fence-tag →
  language+category table, the byte breakdown, and the token/cost apportionment
  (output tokens split by per-class chars-per-token, priced at the model's
  output rate). Capture adds the node-local `actions.content_bytes` column
  (migration 054) — an exact byte length of the code the model authored in each
  action, computed at ingest from the untruncated tool input with the content
  itself discarded; it is deliberately **not** on the org-push wire. Surfaces:
  the `observer verbosity <session> | --by model|project|day | --unknown-ext`
  CLI, `GET /api/session/<id>/verbosity` + a SessionDetailPanel card, `GET
  /api/verbosity/aggregate` + an Analysis Output-composition section, and the
  always-on `get_output_composition` MCP read tool. Bytes are exact; token and
  dollar figures are labelled estimates.

### Changed

- **"CCR" reversibility surface renamed to "SROD" (Stash & Retrieve on
  Demand).** The user-facing label is renamed across the Compression page
  panel, the help glossary, the savings-by-mechanism donut, and the Settings
  label; internal identifiers are unchanged.
- **SROD stash previews.** The opaque "Top retrieved SHAs" list is replaced
  with a "What's getting stashed" preview — a short, scrubbed, single-line
  snippet of each recent stashed body (with size and a retrieved badge), read
  from the stash dir by the stash event's `body_hash`. Snippets are scrubbed
  for display (the stashed body is the model's raw pre-scrub tool output);
  LRU-evicted shas are skipped.

## [1.12.0] — 2026-06-30

### Added

- **Native code-intelligence engine (`internal/codeintel`), replacing
  codegraph.** A CGO-free code-intelligence subsystem built on a wazero
  (wasm) tree-sitter backend with `go:embed`'d grammars and per-language
  S-expression queries (data, not code). Exact-span parsing for Go (pure-Go
  AST), Rust, TypeScript/TSX, Python, and JavaScript/JSX, plus Core and
  Extended grammars (Kotlin, Swift, Scala, Bash, Lua) onboarded as data. A
  strangler-fig cutover keeps the `Provider` facade stable for every
  consumer (MCP, compression, dashboard). Pure core (`parse` / `resolve` /
  `semantic` / `analyze` / `query`) with injected I/O, pinned by
  `imports_test.go`; `internal/store/codeintel.go` is the one SQL seam;
  schema in migrations `050+`.
- **Scoped relation resolution.** Package/import-bound `CALLS` resolution
  for Go (self-receiver method binding + local-var receiver type inference)
  and module-import-scoped `CALLS` for TypeScript and Python, plus
  intra-file `CONTAINS` edges from span nesting and `end_line` on
  `get_relations` results.
- **`search_symbols` MCP tool** — Tier-C symbol search over the codeintel
  store.
- **Full-body near-clone detection** via body-shingle MinHash (W3) and a
  tuned TF embedder (Dim 256→512 + degenerate-skip; W4).
- **Aggressive code-collapse on the OpenAI/codex proxy paths**, so
  code-block compression now fires for codex traffic too.

### Fixed

- **Limit gauge no longer leaks across tools.** The session-detail 5h/weekly
  limit gauge read the latest snapshot by `(scope_hash, provider)` only, so a
  Claude Code subscription window leaked onto every other anthropic-default
  tool's session detail (e.g. cline-cli showed Claude Code's gauge despite
  producing no snapshots of its own). The gauge is now attributed to the tool
  that observed it; a tool with no proxied window shows the honest
  needs-proxy state.
- **Migration write-lock contention** — a lock-free fast path in
  `runMigrations` avoids contending the write lock on startup.
- **`CodeIntelDeleteProject`** is now fast and complete (fixed the per-file
  delete scan).

### Changed

- **Daemon restart readiness window** widened from 15s to 45s in
  `scripts/restart-daemon.sh`.

## [1.11.0] — 2026-06-27

### Added

- **Proxy routing for many more CLIs.** A shared `observer <tool>` launcher
  family plus a per-provider upstream seam (`/up/<id>` path prefix +
  `[proxy.upstreams]`) now route OpenAI- and Gemini-shaped traffic from
  `opencode`, `gemini-cli`, `copilot-cli`, `pi`, `cline-cli`, and `hermes`
  through the proxy for accurate token capture and conversation compression —
  each via its own mechanism (a launch-time base-URL env var, a `models.json` /
  `providers.json` custom provider, or a secret-free named provider with
  `key_env`). The launchers never write an API key. All live-verified.
- **Gemini conversation compressor.** A Google `generateContent` provider lane
  in the proxy (`providerForPath` → `parseGeminiResponse` / `parseGeminiStream`,
  accurate `usageMetadata` capture) plus a `generateContent` body compressor:
  deep-recursive tool-output compression at any nesting depth, content-addressed
  stash parity, and a pairing/alternation-safe budget drop pass for `contents[]`
  that never produces an invalid or 400-bound body. Default-off, like all
  conversation compression.
- **Adapter capability registry (`internal/integration`).** One data-owned row
  per adapter declares its proxy / route / hook / MCP / native-console / token
  capabilities; `observer init`, `observer doctor`, and the new
  `observer adapters` support-matrix command all dispatch on capability SHAPE,
  not tool name. Surface-specific routability buckets retire the old
  "permanently impossible" framing.
- **Cache-expiry warning system** (`cachewarm`): classifies live prompt caches
  into ok / soon / critical / cold with value-at-risk, and recommends the
  cheapest content-free keep-warm lever. Surfaced in the dashboard,
  `observer cache-status`, the MCP `cache_status` tool, and the VS Code status
  bar.
- **Real-time Live capture.** A Linux eBPF process-capture backend (with
  self-capture exclusion + exec-duration fallback), action-derived command rows
  (message↔command capture with no OS polling), all-adapter process attribution,
  and Codex limit tracking — surfaced on the Live page with row-click detail.
- **Broader trace + MCP coverage.** A full trace-coverage sweep captures user
  prompts, assistant text, reasoning, system prompts, and per-message
  `stop_reason` across the non-reference adapters; MCP config is now written for
  `cline` and `opencode` (incl. the cross-OS WSL bridge).
- **SuperBased favicons** on the local and admin dashboards.

### Fixed

- **Token & cost accuracy across adapters:** net cached tokens out of gross
  OpenAI-shaped input (gemini-cli), capture Gemini reasoning from the live
  `thoughts` key, correct the copilot-cli cache-tier ledger, propagate hermes
  session cost, resolve Cursor's real model from `store.db` when the hook
  reports `default`, capture the newer Antigravity `agy` CLI plaintext-SQLite
  conversations, and read OpenClaw's accurate per-call tokens from the
  trajectory trace.
- **Proxy:** detect OpenAI-compatible endpoints on non-`/v1` paths so custom
  upstreams with an `/api/v1` base still capture.
- **Org dashboard:** the Projects page no longer crashes when a project has no
  team overlap (a nil teams slice marshaled to JSON `null` and broke the
  `.length` read); show the real compression-savings figure in the milestone
  card; COALESCE action-count sums so pruned sessions don't 500.

### Notes

- Conversation compression stays default-off (opt-in); the privacy push seam is
  unchanged. OpenClaw remains a documented runtime-block — routing stalls inside
  the CLI's own `--local` startup, independent of credentials
  (`docs/plans/openclaw-runtime-block-followup-2026-06-27.md`).

## [1.10.0] — 2026-06-23

### Added

- **Teams (org) dashboard overhaul.** The org admin dashboard now shows
  significantly more by default and matches the primary dashboard's UI.
  Ported the `web/` design system into the org dashboard (`web2/`) and
  added a family of content-free, role-scoped rollups + pages: an
  enriched Overview (tokens, cache, reliability, errors, latency, tool/
  model mix, activity), **People**, **Tools/Models/Activity**,
  **Telemetry** (native-console vendor analytics), **Sessions** (scoped,
  audited, per-session drill-down), **Optimize/Routing** (savings +
  advise-vs-enforce), **Live** (who's working now), **Movers**, a
  print-friendly **Cost report**, **Suggestions** (content-free advisor),
  a global tool filter, and a ⌘K command palette.
- **Audited message-content viewer.** `GET /api/org/sessions/{id}/messages`
  surfaces the captured native-OTel message bodies (prompts / tool input/
  output) for a session — but only where the node already opted to share
  them (`full_content` / `admin_managed`). It is a read of already-shipped
  data: no new agent wire column and no agent migration. Viewing it is a
  distinct, deeper audited disclosure (`view_session_messages`), scoped
  like the session detail (out-of-scope ⇒ 404).
- **Admin-configurable message-content retention** (`[dashboard.content_retention]
  .otel_content_days`, default 0 = keep forever): a daily server-side sweep
  that NULLs old `otel_content` bodies while keeping their content hashes.

### Notes

- Privacy posture unchanged: content-free aggregation by default;
  per-developer disclosures (People / Sessions / Live / messages) are
  audited; project identity is the hash, never the raw path; the
  never-read body columns stay off the push seam. No remote content
  toggle — content sharing remains node-side opt-in / admin-provisioned.

## [1.9.0] — 2026-06-20

### Added

- **Next-Message Cost & Limit Predictor.** A low/mid/high cost band for
  your next user message (pure read-side math over `token_usage`, no
  proxy required) plus a proxy-only 5h/weekly subscription-limit gauge
  read from Anthropic rate-limit response headers. Surfaces:
  `observer predict <id>` (+ `--json`), the session-detail
  "Next-message cost predictor" card, and `GET /api/session/<id>/predict`.
  Default-on `[predict]` config; node-local `limit_snapshots`
  (migration 049). Distinct from the model-switch cache forecaster.
- **`scripts/restart-daemon.sh`** — a proxy-safe, atomic daemon-restart
  helper (route off → stop → relaunch → route on) with `--compression
  on|off`. Killing the daemon while a client routes through the proxy
  otherwise gives that session `ConnectionRefused`. See
  `docs/daemon-restart-runbook.md`.

### Fixed

- **Conversation compression no longer corrupts large requests.** The
  forward-path secrets scrubber applied line-oriented regexes across the
  whole serialized body; on compact JSON the generic `token:<value>`
  family's `\S+` could devour structural bytes to end-of-body, truncating
  the request into invalid JSON and triggering an upstream `400 unexpected
  character` on proxied Claude Code once a conversation grew past ~214KB.
  Scrubbing is now JSON-structure-aware (`scrub.ScrubForward`), and the
  proxy refuses to forward any compressor output that fails `json.Valid`,
  falling back to the original body. Verified live on ~1MB requests.
- **PreToolUse hook fails open on watchdog timeout** (exits 0, not
  non-zero) so a momentarily busy daemon can never block the host tool and
  cascade the session.
- **Retention size-cap prune no longer sheds recent activity.** A 30-day
  `actions` keep-floor plus a `SizeCapUnmet` warning replace the blind
  shed that could empty the table chasing a budget dominated by other
  tables (`token_usage` / cache).

### Changed

- **Contact email domain migrated `marmut.app` → `superbased.app`** across
  documentation, package metadata, and the website source.

## [1.8.4] — 2026-06-12

### Changed

- **Package homepage now points to https://superbased.app/.** The npm
  and PyPI package metadata (and their READMEs) link to the product
  homepage instead of the GitHub repository. Source, issue-tracker, and
  changelog links continue to point at GitHub.

No functional or binary changes from 1.8.3 — the bundled `observer`
binary is byte-for-byte identical. This release exists to refresh the
published package metadata.

## [1.8.3] — 2026-06-12

### Added — the Security and Routing pages became operable surfaces (the guard/routing usability arc)

The guard layer and model routing merged after the main usability arc
closed, so neither got its treatment: both pages were read-only
viewers and every routine operation meant hand-editing config and
hunting CLI flags. The arc (phases G1, R1, G2, R2, X3) applies the
same principles — dashboard controls for routine operations,
evidence-bearing consent dialogs, honest restart semantics, one
config-write seam, help-drawer coverage — to both:

- **Security**: a consent-gated mode control that shows the simulate
  evidence before enforce; the enforce-readiness card (a replay of
  real history under the enforce projection with per-rule blocking
  concentration); the approvals register UI (scoped, expiring, live
  immediately); event drill-down filters + top-rules rollup +
  session deep-links; effective-rules resolution (custom layers show
  their source); the MCP pin inventory with approve; a lint-gated
  guard-policy editor (422 with problems on malformed input, `.bak`
  swap-undo); compliance evidence buttons (report / export /
  verify-audit as jobs with downloads); budget guardrails suggested
  from observed spend with a daily burn-down meter; and the
  observe→enforce migration runbook (docs/guard-enforce-runbook.md).
- **Routing**: counterfactual "Preview savings" while routing is off;
  a `routing` Settings section (adoption-funnel knobs only; complex
  shapes and secrets stay file-only and survive every save); the
  advise-shadow readiness ladder with a consent-gated promote
  control; per-decision drill-down with plain-language reason codes;
  Channel A apply from the dashboard (dry-run preview with §R7.2
  parity evidence, one consent per file write, backups, per-file and
  unified revert, and an append-only audit ledger — `routing apply
  --history` is the CLI view); a lint-gated `[[routing.rules]]`
  editor riding the one config seam; calibration-demotion visibility
  (demoted rules marked in the rule table, honest about in-memory
  state); the first-30-days adoption runbook and a 9-recipe rules
  gallery (docs/model-routing.md), every recipe machine-verified
  through the real lint gate.
- **Advisor**: two navigate-only posture nudges close the loop —
  `guard_observe_idle` (recurring high-severity verdicts, zero
  tuning → review Security) and `routing_evidence_ready` (the shadow
  gate met, routing not promoted → review the Shadow card). Detector
  registry 18 → 20.

Help registry 240 → 254. Privacy invariants held throughout: no
remote enforce toggle exists for either feature; routing decision
rows, calibration, and the apply ledger are node-local.

### Added — help coverage for the Security / Routing / Suggestions pages; guard rule IDs resolve to their definitions

The three newest dashboard pages shipped with almost no links into the
help drawer (Security and Routing had zero; Suggestions had two),
while established pages carry one on nearly every element. The help
registry grows 217 → 240 entries: page-tab entries for Security and
Routing, a tile entry for every hero stat (guard posture, verdict
counts, audit chain; routing decisions, realized / would-have savings,
calibration cells; avoidable spend, open suggestions, sessions
scanned), a section entry for every table/board (verdict timeline,
enforcement coverage; advise shadow, policy rule table, decisions
feed, savings by tier, tier map, model health), and glossary entries
for the guard rule catalog, the allow/flag/ask/deny decision
vocabulary, and the anatomy of a suggestion card. Each entry states
what the element means, how it is calculated (formula + API source
where applicable), and cross-links its relatives. The stale
Suggestions tab entry ("Phase 1 ships four detectors") was rewritten
for the current 18-detector engine.

Guard verdicts no longer show bare rule IDs: a new /api/guard/rules
endpoint serves the built-in rule catalog (policy.Catalog — id,
category, severity, observe/enforce decision pair, doc one-liner, and
the remediation advice each rule carries), and the Security page's
verdict timeline renders the rule's actual definition with the ID as
the secondary line, full breakdown in a hover tooltip. Rules from
user/project/org policy layers (or an older daemon) degrade to the
bare ID as before.

### Changed — Routing page restyled to the dashboard design system; sidebar badges made uniform

The Routing page (merged with the model-routing PR) shipped with raw
inline-styled markup that didn't match the dashboard's design system —
plain text tables, no card surfaces, dead CSS classes. It now uses the
house primitives end to end (HeroStat tiles, card sections, the shared
table/pill/segmented-control patterns — mirroring the Security page
from the same arc) and honors the global TopBar window filter for its
windowed queries (savings / decisions feed / advise shadow; the
backend day clamps widened from 365 to the sibling pages' 36500 so
"All" means all-time). Sidebar nav badges are now uniform across data
pages: Live (sessions active in the last 15 minutes), Security (guard
verdicts), Search (FTS5-indexed excerpts — the searchable corpus), and
Routing (router decisions) join the existing badges; Overview and the
Configure group stay deliberately un-badged. The new counts ride
/api/status (`live_sessions` / `guard_events` / `router_decisions`)
and degrade gracefully against older daemons that don't serve them.

### Added — per-tool compression profiles now engage for hookless clients (header-signature tool resolution)

The compression profile router's per-tool tier (`[profiles.by_tool]`,
`observer profile assign tool:<name> …`, and `tool:` experiment
classes) previously engaged only for clients that feed the session
pid bridge — in practice just Claude Code, whose SessionStart hook is
the bridge's lone feeder. Every hookless client resolved `tool=""`
at the proxy and silently fell through to its per-provider profile
(deviation D20). The proxy now carries a header-signature fallback
(`internal/proxy/toolheaders.go`): on a bridge miss, an ordered table
of verified request-header signatures resolves the tool — Codex via
its `codex_cli_rs` User-Agent/`Originator` header, Kilo CLI via
`X-Title: Kilo Code` / `Kilo-Code/` UA, opencode via `X-Title:
opencode` / `opencode/` UA, and `claude-cli/` UA as a no-hooks safety
net. Hook-fed bridge identity always wins when present; a request
matching no signature degrades to the per-provider tier exactly as
before. Cline CLI sends only stock SDK headers (verified — nothing
distinctive to match) and intentionally has no row; it keeps its
per-provider profile.

### Fixed — cline-cli and hermes token double-counting (cross-source emission)

Every Cline CLI session's tokens and cost surfaced at **exactly 2×**
(operator-reported): the adapter emitted BOTH the session-level usage
aggregate (from `sessions.metadata_json.usage`) AND per-message
metrics rows (from `<id>.messages.json`), and nothing downstream
could merge them — the two shapes differ on both halves of the
store's `UNIQUE(source_file, source_event_id)` key, and the cost
engine's three-level dedup only pairs proxy↔jsonl rows. The aggregate
is now a fallback, emitted only for terminal-status sessions whose
messages.json carries no per-message `metrics` blocks (pre-metrics
cline builds).

The same defect class was confirmed live on hermes (the 2026-06-05
audit's H1 finding, previously documented as open): a hook-covered
session carried both the hook's per-API-call token rows and the
SQLite session aggregate, plus a `run_command` action from both
paths. The hermes watcher path now consults a `SessionHookChecker`
(mirroring cursor/clinecli) and, for hook-covered sessions,
suppresses the event classes the hook also emits (tool_calls + the
token aggregate) while keeping the SQLite-only classes (user_prompt,
assistant text, system_prompt). Also wired the clinecli adapter's
existing `SessionHookChecker` at the cmd assembly — the seam shipped
in v1.8.2 but was never injected, so cline-hook installs would have
double-counted the moment hook commands were registered.

Existing inflated rows in a node's DB are repairable with a targeted
delete of the redundant aggregates (`source_event_id LIKE
'tk:%:session_usage'` where per-message rows exist for the session);
new scans emit correctly.

### Changed — codex-safe profile gains the tools-defs trim (A6-gated)

The `codex-safe` compression profile's `compress_types` grows from
`["logs"]` to `["logs","tools"]`: tool **definitions** in the OpenAI
request envelope are trimmed (descriptions of 3+ paragraphs keep the
first 2; JSON-Schema `examples` stripped — names, types,
required-ness, enums never touched; tool_result bodies never
touched). A/B-gated per the profile content-refresh plan: run A6
(2026-06-11, hash-split through the productized experiments feature,
n=7 control / n=9 candidate, salted bug-fix tasks, gpt-5.4 through
the codex CLI) showed the trim firing on **117/117** candidate
requests (~0.8KB of definition prose per request, deterministic and
byte-stable so OpenAI's implicit prompt cache keeps hitting —
per-session `implicit_hit` was unchanged-to-better), with full
task-completion parity and ±0% turns. Honest sizing: on a lean
envelope (no MCP servers registered) the saving is sub-1% of session
cost — cost means could not distinguish the arms (+1.7%, 0.2 SE at
CV 18%); adoption rests on the deterministic positive trim, the
clean no-harm profile, and scaling — the trim grows with envelope
bulk, so MCP-registered codex installs save substantially more
(`codex-variant`, which has shipped the same trim since v1.7.23,
measured −10% on `-codex` models). Opt out by pinning
`compress_types = ["logs"]` in a custom profile. Full record:
`docs/plans/profile-content-refresh-ab-plan-2026-06-10.md` §8.

### Added — dashboard setup, health, and onboarding surfaces (usability arc)

A six-phase usability pass (2026-06-10 → 2026-06-11; plan + tracker at
`docs/plans/usability-review-2026-06-10.md`) rebuilt the dashboard
around one principle: every setup step the dashboard could previously
only *describe*, it can now *do* — with a preview of the exact file
edit and an explicit consent click before every write, and honest
status everywhere else. By surface:

- **One-click durable proxy routing** for Claude Code and Codex from
  the Compression tab's proxy banner (`POST /api/setup/claude` /
  `/api/setup/codex`): preview → consent → write, byte-equivalent to
  what `observer init` writes, with a 409-force path when the target
  config drifted from the preview.
- **Setup wizard + connected-tools panel.** A per-tool wizard (hooks /
  MCP / proxy route, one write per consent, `POST /api/setup/hooks|mcp`)
  on top of a read-only connected-tools matrix that probes each
  detected AI tool's hook/MCP/route state without touching anything.
  The MCP step is never pre-selected and carries the ~1,800-token
  per-turn schema-overhead note up front; a codex hook-trust card
  explains Codex's notify-command trust prompt.
- **Launch buttons** (dashboard + VS Code extension): open a detected
  AI tool from the connected-tools panel via a hardcoded-argv
  allow-list, with an honest `{spawned, command}` contract — the UI
  shows exactly what was executed and claims nothing beyond "the
  process started".
- **Doctor / health panel + failures surface.** The `observer doctor`
  checks (now 13) render in Settings → Health, and recent command
  failures group per command with session deep-links.
- **"Proxy routing gap" diagnostic.** Live verification produced the
  finding behind it: an AI tool durably routed at the proxy while the
  daemon is down *hangs retrying* — no bypass, no fast fail. Doctor
  and the Health panel now WARN when a tool is routed and capture is
  landing but no API traffic has arrived through the proxy in the same
  window. The restart-pending banner stays banner-only by explicit
  decision (no self-respawn).
- **MCP / org-share / OTel config sections + MCP value meter.** The
  remaining config groups become editable dashboard sections (the
  org-share section deliberately cannot touch enrolment identity), and
  the MCP meter weighs the per-turn schema overhead against the MCP
  calls actually observed on the node — it says "unused" when that is
  the truth.
- **Onboarding + first-run.** An empty Overview shows an onboarding
  checklist; a one-time toast fires on the first captured action;
  milestone cards ($10 saved / 100 sessions / one week observed) fire
  once each, show at most one at a time, and retire silently on
  established installs. A custom 404 page and a route-keyed error
  boundary keep the app shell alive when a single page crashes.
- **Quality-of-life.** A restart-pending banner that only clears on a
  real daemon restart (plus daemon uptime); a prune-now button
  (`POST /api/prune/run`); config undo (every dashboard config save
  keeps a `.bak`; one click swaps it back); Settings deep-links
  (`?section=`); an empty-state sweep with do-something buttons;
  suggestion cards gained navigate-to-the-fix actions; bare `observer`
  prints a status welcome instead of usage; `observer start`
  auto-opens the dashboard on a TTY (`--no-open` opts out); and
  `observer doctor` ends with `all checks passed ★` when they did.

### Added — live view, global search, budgets, experiments, privacy center, monthly statement

The arc's feature headliners, all local-only like everything else:

- **Live session view** (`/live`, `GET /api/live`): the most recently
  active sessions (≤8) with lifetime proxy-deduped cost/token rollups
  and a live action feed; polls every 5s only while the tab is
  visible.
- **Global search** (`/search`, `GET /api/search`, linkable `?q=`):
  full-text search over captured tool-output excerpts through the
  existing FTS5 index, with snippet highlighting and session context.
  Human browsing through search results does not feed the
  redundancy/freshness signals the observer computes for AI reads.
- **Budget guardrails** (`[intelligence].project_budgets_usd`, a
  root-path → USD map): per-project and global monthly budgets
  surfaced as banners at 80% and 100% (once per month per scope) and
  editable from Settings. Advisory only — nothing is ever blocked —
  and read fresh, so edits apply without a restart.
- **Profile experiments** (`[[experiments]]` + `observer experiment`):
  productized A/B testing for compression profiles. Sessions are
  hash-split into arms — no persisted arm state; reports recompute
  membership — and an active experiment outranks profile assignments
  and overlays for its traffic class. `observer experiment` and
  `GET /api/experiments` share one report engine. This is the same
  mechanism the profile content-refresh runs (A1/A2/A3) used by hand,
  now first-class.
- **Privacy center** (`/privacy`): a capture map of exactly what is
  and isn't recorded (with live config flags), a scrub tester that
  runs the secrets scrubber over pasted text entirely in memory
  (`POST /api/privacy/scrub-test` — nothing stored), and org-push
  transparency including the last enrolment payload, verbatim.
- **Monthly cost statement** (`/report`, `GET /api/report/monthly`):
  a print-friendly monthly statement — totals, spend by model / tool
  / project, savings telemetry (compression bytes and cache-read
  volume, deliberately not a dollar claim), top sessions by cost.
  Print chrome is hidden, so the browser's save-as-PDF produces a
  client-billable artifact.
- **Spend-spike detector**: the advisor's 18th detector warns when
  today's spend runs ≥2× the baseline of your prior *active* days
  (with a $5 floor) and links straight to the live view to see what
  is burning.

### Added — demo mode

Just looking? The dashboard can now seed itself with a synthetic demo
dataset: embedded fixture sessions are parsed through the real
claude-code adapter into a **temporary database**, timestamps rebased
to look fresh. The real `observer.db` is never read or written on any
demo path — the dashboard atomically swaps its data handle to the temp
DB and back. Data surfaces (sessions, cost, suggestions, live view,
search) show demo content under a persistent banner; operational
surfaces (doctor, watcher health, backfill status, connected tools)
deliberately stay real so demo mode never misreports the install's
health. Start from the empty-Overview offer or
`POST /api/demo/start|stop` (idempotent); stopping deletes the temp
DB.

### Added — storage manager + `observer db stats|vacuum|backup`

`observer db stats` breaks the database file down per user-visible
table — index and FTS5 shadow-table bytes folded into the table they
serve, SQLite internals bucketed — so "what is taking 400 MiB" has an
answer. `observer db vacuum` reclaims free pages and reports bytes
freed (honest limitation: it can report SQLITE_BUSY against a busy
daemon; re-run in a quiet moment). `observer db backup <path>` takes
an online snapshot via SQLite's `VACUUM INTO` — safe while the daemon
runs, and it refuses to overwrite an existing file. The same three
operations live in Settings → Storage (through the shared job
registry), alongside a documented restore procedure. Restore is
deliberately manual: stop the daemon, swap the file, start.

### Added — `observer db import` merges another observer.db

`observer db import <path> [--dry-run] [--json]` merges a second
observer database into this node's — built for the stranded-DB case
where a previous install (other OS, other home directory, Windows
side vs WSL side) accumulated history worth consolidating. The source
is first migrated to the current schema (it is opened read-write for
this — work from a copy), then ATTACHed read-only and merged in one
transaction of set-based INSERT…SELECTs: idempotent re-runs (natural
unique keys where the schema has them, conservative NOT-EXISTS
matching where it doesn't), project identities remapped by root path,
cross-row references re-attached, FTS re-indexed after commit.
`--dry-run` executes the same transaction and rolls it back, so its
per-table counts are exact, not estimates. Node-local state (cache
tracking, the session-PID bridge, watcher cursors, file-freshness
state, advisor state) deliberately does not transfer.

### Added — interactive `observer init`

`observer init` with zero flags on a real terminal now runs an
interactive checklist instead of writing everything at once: it
detects the installed AI tools, previews each pending config write
(the same dry-run rendering the dashboard wizard shows), and asks for
consent one write at a time. MCP registration is never pre-selected
and carries the ~1,800-token per-turn overhead note. EOF or ctrl-C
aborts cleanly, having written only what was already approved. Any
flag or redirected stdin/stdout keeps the existing batch behaviour,
so scripts are unaffected.

### Fixed — batch `observer init` writes the Claude Code proxy route it documented

v1.8.2 added the Claude Code proxy-route write (`env.ANTHROPIC_BASE_URL`
in `~/.claude/settings.json`) to the org-enroll wiring path and the
docs described `observer init` as writing it too — but the batch init
loop never gained the write. Batch `observer init` now writes the
claude-code route by default, exactly as documented; `--skip-proxy-route`
opts out and prints the manual hint instead.

### Fixed — `observer claude` no longer re-exports an expired OAuth token

The `observer claude` wrapper re-exports the stored Pro/Max OAuth
access token as `ANTHROPIC_AUTH_TOKEN` so routed traffic stays on the
OAuth path. When the stored token had *expired*, re-exporting it was
actively harmful: a stale env token suppresses Claude Code's own
refresh flow, and every request 401s until the user re-authenticates.
The wrapper now detects the expired case and launches with
`ANTHROPIC_BASE_URL` only — Claude Code refreshes its token itself.

### Fixed — Settings compression sub-panels showed zeros and dropped saves

The six per-group compression sub-panels in Settings resolved their
fields against the wrong config objects after an earlier field-path
refactor: they displayed zero values regardless of the real config,
and saves through them silently no-op'd. Field paths are now
prefix-inclusive, the convention is documented at the registry, and a
test pins each group panel to the object it edits.

### Fixed — `observer profile set` no longer materializes zeros

Writing one key through `observer profile set` round-tripped the whole
profile struct, so every key the operator had never set was written
back explicitly as its zero value — silently turning "unset, inherit"
into "explicitly zero" for the whole file. Profile writes are now
presence-preserving: only the keys already present in the file, plus
the one being set, are written.

### Fixed — Windows-bridged hooks no longer poison tool/cwd resolution

On a Windows-AI-tool + WSL-daemon install, the `wsl.exe`-bridged hook
processes registered init-class PIDs into the session-PID bridge. Any
hookless tool connecting to the proxy afterwards (Codex) then resolved
to the wrong tool identity and the poisoned entry's cwd — e.g.
`tool=claude-code` with a Windows path — corrupting per-tool profile
assignment and per-project overlay resolution. The hook-side process
walk now stops at init-class ancestors, the resolver ignores PID ≤ 2,
and hookless tools gained a `/proc/<pid>/cwd` fallback that restores
per-project config resolution for tools that never run hooks.

### Fixed — concurrent first-open no longer fails with SQLITE_BUSY

Two observer processes opening a freshly created database at the same
moment raced on the initial WAL-mode conversion, and the loser failed
with SQLITE_BUSY. The conversion now retries briefly instead of
failing the open.

### Changed — claude-code profile gains the tools-defs trim (A2-gated)

The `claude-code` compression profile's `compress_types` grows from
`["json","logs","code"]` to `["json","logs","code","tools"]`: tool
**definitions** in the request envelope are trimmed (descriptions of
3+ paragraphs keep the first 2; JSON-Schema `examples` stripped —
names, types, required-ness, enums never touched). A/B-gated per the
profile content-refresh plan: run A2 (2026-06-11, n=8/arm salted
refactors, Opus 4.8, Claude Code 2.1.167) measured **−12.5% total
cost** on valid samples vs the pre-A2 set with **zero**
`tools_changed` cache events across 106 candidate turns — the trim is
byte-stable across turns, so the historical V7-21 re-marshal concern
no longer applies on current binaries. Per-turn cache-read dropped
~32% (the tools block is part of Anthropic's cached prefix). The
master-config default `compress_types` is unchanged; opt out by
pinning `["json","logs","code"]` in a custom profile. Full record:
`docs/plans/profile-content-refresh-ab-plan-2026-06-10.md` §6.

### Changed — compression recipes are now per-provider profiles (Track R)

Recipes are promoted to first-class **compression profiles**, resolved
per traffic class at the proxy boundary instead of overlaying the whole
daemon's config. One daemon serving Claude Code **and** Codex now
applies each tool's tuned parameters simultaneously — Anthropic-path
traffic gets `claude-code`, OpenAI-path gets `codex-safe` out of the
box (editable via the new `[profiles]` config section: `default` +
`by_provider`). Sessions stick to the pipeline they first resolved, so
mid-session config edits never disturb in-flight compression state, and
profile/assignment edits apply to **new sessions without a daemon
restart** (any dashboard config save hot-reloads the router). The
master `[compression.conversation] enabled` switch is unchanged and
profiles never auto-enable compression.

**Deprecated:** `observer start --recipe <name>` no longer overlays the
config load chain; it maps onto `[profiles].default` for the run (all
proxy traffic) and warns. Two side effects of the removal: a dashboard
config save can no longer silently bake recipe values into config.toml
(the save-bakes-recipe footgun is gone), and recipe
`[compression.shell]` / `[compression.indexing]` keys no longer apply
to the watcher side — set those in config.toml directly if you relied
on them.

Later phases of the same arc extended the resolution chain and made
profiles fully user-ownable: a **per-tool assignment tier**
(`[profiles.by_tool]`, resolved from the session's tool identity,
outranking `by_provider`); **per-project overlays**
(`<project>/.observer/config.toml` — allow-listed by construction and
deliberately one-directional: a project file can turn compression OFF
for that project's sessions, never on); **custom profiles**
(`observer profile create --from <builtin> | set | delete`, stored
under `~/.observer/profiles/`, with the same CRUD in Settings;
built-in profiles stay immutable); plus `observer profile
list|show|assign` (including `assign tool:<name> <profile>`) and a
general `observer config set <dotted.key> <value> [--project <root>]`
setter that goes through the single config-write owner. Full
precedence per traffic class: experiment arm > `by_tool` >
`by_provider` > `default`, with the project overlay applied off-only
on top of whatever profile resolved.

### Added — model routing layer (P0–P2)

An opt-in, advise-first model-routing layer
(`docs/model-routing-spec.md` §R1–R26; operator doc
`docs/model-routing.md`) that picks the right model per kind of work
from observed evidence: a turn-kind classifier and tier table feed a
table-driven policy engine (six templates + custom rules, 14 lint
checks, cache-priced switch economics so stickiness comes from math,
not timers), wired to live traffic through two channels — **A** writes
each AI tool's own config (`observer routing apply`), **B** rewrites
the `model` field of proxied requests, gated by the `[routing]` master
switch (default OFF; `advise` logs decisions and touches nothing,
`enforce` rewrites same-provider-shape models only). Around the core:
effort downshifts with zero cache loss, reliability fallback chains +
key pools + local upstreams (Ollama / LM Studio / vLLM), an hourly
calibration job with evidence-gated auto-demote, counterfactual
`routing simulate`, a savings/shadow/explain CLI family, a dashboard
**Routing** page, and the §R17.5 MCP pair. Fail-open everywhere: a
routing failure can never break a turn that would have succeeded.
Privacy posture matches Teams (§R23): decision logs
(`router_decisions`) are node-local and privacy-sentinel-pinned; orgs
receive only an aggregate summary behind a node-side
`[org_client.share].routing_summary` opt-in (default false), and the
signed org policy registry has **no remote enforce toggle** — org
bodies' `enabled`/`mode` keys are structurally ignored.

### Added — Suggestions engine (advisor) Phases 1–4

A new **Suggestions** dashboard tab, `observer advise` command, and
`GET /api/suggestions` endpoint surface prescriptive, dollar-quantified
recommendations computed locally from captured activity — every estimate
shows its arithmetic. Four detectors ship: **session balloon** (the
flagship: a session's prompt window crossed ~150K tokens and every later
turn re-paid to carry the history; the nudge shows the fresh-session
counterfactual — worth $25–63 on real sessions during calibration),
**idle re-cache** (turns that paid to rebuild a prompt cache that expired
during a >5-minute break), **long-context crossings**, and
**trivial-model over-provisioning** (small sessions run entirely on Opus,
migrated from the Analysis tab's routing rule). Thresholds were calibrated
against a real two-month corpus (`docs/plans/advisor-calibration-2026-06-10.md`);
savings apply a 30% haircut for context the user genuinely needed.
Default-on (`[advisor]` config section), read-layer only, zero LLM cost.
Phases 2–4 (same day): thirteen more detectors (cache hit-rate /
write-waste / prefix-thrash on cachetrack verdicts, read-heavy +
effort over-provisioning, fast-tier premium, unrecovered-failure time
sinks with a noise gate, MCP schema tax, compression-off, not-proxied,
wasteful stale reads on the migration-038 split, quality regression,
web-search spend); dismiss/snooze with a 7-day cooldown (node-local
`advisor_state`, privacy-invariant-pinned); the in-session prevention
loop (a 14th MCP tool `get_suggestions`, freshness-tool advisories, and
an opt-in session-start digest injection — default off); and
`observer advise --digest`. Operator reference: `docs/advisor.md`.

### Added — cache tracking P0 closed

Anthropic prompt-cache observation, attribution, and forecasting now
ships P0 complete. The cachetrack engine (`internal/cachetrack/`)
observes every Anthropic Messages API request through the proxy,
enumerates blocks (tools → system → messages), deep-canonicalizes
each block (sorts nested map keys at every depth, strips
`cache_control` recursively, preserves numeric form), hashes a
rolling SHA-256 chain, and attributes per-turn outcomes against a
12-row decision table covering 9 kinds × 14 causes. Three NODE-LOCAL
tables back it (migrations 036 + 037): `cache_segments` (chain
points of interest), `cache_entries` (modelled live provider cache,
keyed by `UNIQUE(model, cache_scope, prefix_hash)`), and
`cache_events` (per-turn verdict with cause + diverged_seq +
predicted_kind + message_id). Default-on per spec §11; the privacy
sentinel at `tests/invariant/privacy_test.go::TestSelectUnpushedSinceExcludesCacheTables`
fails loudly if any of the three tables ever appear in the org-push
wire path.

Three operator-facing surfaces:

- `observer cache-health` reports the §10 mispredict-rate gate (≤
  5% over ≥ 200 graded events at P0) plus two secondary checks: a
  read:write consistency check that flags `*_rewrite` /
  `compaction_reset` events with `tokens_read > 3.0× tokens_written`
  (mechanically impossible shape for a real invalidation), and a
  cause-concentration WARN when a single non-`suffix_growth` cause
  exceeds 80% of graded events. Neither secondary check changes the
  rate gate's pass/fail; both surface the class of error the rate
  is blind to.
- `observer backfill --cache-rescan` re-walks claude-code transcripts
  through the Tier-2 cache engine to retrofit cache attribution onto
  historical sessions — useful after enabling `[cachetrack].enabled`
  with prior traffic, or after a cachetrack fix lands. Idempotent
  end-to-end via the cross-tier `CacheEventExistsForMessage` dedup
  gate (proxy-already-observed turns short-circuit on Tier-2). Picked
  up by `--all`.
- `[cachetrack].calibrate_log_path` enables a per-block JSON-Lines
  sidecar (one entry per block fed to `ObserveTurn`, with sha_raw +
  sha_canon + bounded canonical-bytes prefix for tools/system
  levels). Auto-stops after 200 blocks. Diagnostic tool for
  localizing chain-hash drift; the actual fix path for the P0 soak.

P0 closed at the 2026-06-09 soak: 147 graded events at 2.7%
mispredict rate (operator-accepted; the 200-event minimum deferred
as arbitrary), 0 `system_changed`, 0 inconsistent rewrites, no
dominant cause.

The P0 arc surfaced and fixed three latent defects worth highlighting:

- **Shallow canonicalize.** The pre-fix `CanonicalizeAnthropic` sorted
  only top-level keys and preserved nested objects byte-verbatim from
  the source RawMessage. Any nested key-order variation upstream
  would have produced a per-turn chain-hash drift. Fix is a deep
  `interface{}` round-trip with `json.UseNumber` — Go's encoding/json
  sorts `map[string]any` keys at every depth on `Marshal`. Equivalence
  test pinned: byte-different logically-equal tool defs canonicalize
  identically.
- **Per-request telemetry block.** Claude Code 2.1.169+ prepends a
  `{"type":"text","text":"x-anthropic-billing-header: ... cch=<NONCE>;"}`
  block at `system[0]`. The `cch=<NONCE>` changes every request, but
  Anthropic excludes it from cache identity (provider hits cache every
  warm turn despite the nonce churn). We were hashing what the
  provider ignored — the cumulative chain absorbed the nonce into
  every downstream segment, false-firing `system_changed →
  invalidation_rewrite` on every healthy warm turn (198/201 events
  on the f81cec3f soak, 13/15 on 39326aa9). Fix excludes the block at
  the `EnumerateAnthropicBlocks` system walk via prefix-match on
  `x-anthropic-billing-header:` (cc_version / cc_entrypoint may
  evolve, cch= is unbounded). Same shape as the canonicalize-side
  `cache_control` strip: provider-excluded telemetry, identity-
  neutral on both sides.
- **MispredictRate counted nothing.** `bucketOf` placed `KindMispredict`
  itself into `bucketSkipped` (correct for ReconcilePrediction's
  predicted-vs-observed bucket diff which demotes the matched entry).
  `MispredictRate` shared the same predicate so KindMispredict events
  were `continue`'d at the top of the loop AND the
  `if k == KindMispredict` numerator increment became dead code. The
  5% rate gate had silently graded every soak as 0.0000 since C9.
  Fix introduces a separate `isRateSkipped` predicate for the rate
  vocabulary (BelowMin / Reanchor / CompactionReset only;
  KindMispredict IS counted).

### Added — zero-usage rate carve-out

Follow-up post-P0: the 4 opus-4-8 `unknown` mispredicts on the
2026-06-09 soak were diagnosed as **zero-usage envelopes** (the
provider returned `input_tokens=0, output_tokens=0,
cache_read=NULL, cache_creation=NULL, http_status=NULL` — short
cancelled or partial streams). The engine emits `KindMispredict +
CauseUnknown` row-12 fallthrough because no rule matched AND no
usage signal arrived, but the turn is observationally vacant: no
token data to grade the engine's prediction against. Counting
these as mispredicts distorts the rate the same way the C9 rate
bug did.

Fix: `cachetrack.MispredictRateGraded` (new) skips KindMispredict
events whose `tokens_read=0 AND tokens_written=0` from BOTH the
numerator and denominator. `MispredictRate` (simple form) stays
for callers without per-event token data. `observer cache-health`
switched to the graded variant; rate on the same soak goes from
4/147=2.7% → 0/143=0.0% (more honest — the 4 events were
ungrade-able). The MispredictEvents diagnostic list still
includes them, now annotated `[zero-usage, excluded from rate]`
so operators can see the row-12 fallthroughs happened without
them distorting the gate.

Known limitation documented in
[`docs/cache-tracking.md#known-limitations`](docs/cache-tracking.md):
a small MCP `tools_changed` read:write WARN residual (~2 events
per ~150 opus-4-8 turns). Likely a real `tools_changed` (MCP
server connect/disconnect) where the prior cached prefix still
warm-reads the older tools-array slice; cause IS correct but the
read:write guard's 3.0× threshold may want a per-cause carve-out.
Revisit when MCP toggles dominate.

Operator reference at [`docs/cache-tracking.md`](docs/cache-tracking.md).
Implementation spec at
[`docs/plans/cache-tracking-implementation-spec-2026-06-08.md`](docs/plans/cache-tracking-implementation-spec-2026-06-08.md).

Files: `internal/cachetrack/`, `internal/store/cachetrack.go`,
`internal/store/store.go` (`SetCacheEngine` + Tier-2 wiring in
`Ingest`), `internal/proxy/proxy.go` (`CacheSink` interface),
`internal/adapter/claudecode/adapter.go::tier2Accumulator`,
`cmd/observer/cache_health.go`, `cmd/observer/backfill.go`
(`--cache-rescan` flag), `cmd/observer/proxy.go::buildProxy` (single
engine instance fed to proxy.New AND store.SetCacheEngine),
`internal/db/migrations/036_cache_tracking.sql`,
`internal/db/migrations/037_cache_events_message_id.sql`,
`internal/config/config.go::CacheTrackConfig`,
`tests/invariant/privacy_test.go::TestSelectUnpushedSinceExcludesCacheTables`.

### Added — server-side global Sessions sort

Clicking a Sessions-table column header now sorts the **whole filtered
set** on the server and then paginates — not just the loaded page.
Previously the table sorted client-side over one ≤50-row page, so "sort by
cost descending" surfaced the most expensive of the *visible* rows, never
the most expensive session overall (anyone with more than one page of
sessions was affected). `/api/sessions` gains `sort_by` / `sort_dir`
(allow-listed columns — SQL `ORDER BY` for cheap columns, a global
in-memory sort for the token/cost buckets) and returns `page_cost_usd` /
`page_ai_cost_usd` / `page_tool_cost_usd` so the footer reconciles with the
visible rows. The frontend `DataTable` gained an optional controlled
(`manualSorting`) mode. Per the `srinivasdrona` fork audit §7.C.

### Added — unpriced-token observability in the cost summary

`cost.Summary` now reports `unpriced_tokens` + `unpriced_turn_count`
alongside the existing `unknown_model_count`. These volume-weight the rows
that resolved to a pricing MISS (empty / unknown model, billed $0) so a
whole-adapter attribution regression is loud rather than hidden behind a
small distinct-model count. Per the fork audit §11.B.

### Fixed — cost engine rescues router- / provider-prefixed model strings

`LookupWithSource` now applies a last-resort normalization *after* the
exact / `:free` / date-strip / family lookups all miss: it strips router
prefixes (`capi:`, `sweagent-capi:`) and leading provider path segments
(`openrouter/anthropic/foo` → `foo`) and retries exact + family once. This
rescues model strings that previously hit a pricing MISS → $0 for *any*
adapter, while curated host-rate provider-qualified keys
(`deepseek/deepseek-v4-flash`) still win first. `auto` and the empty string
correctly remain a MISS (neither names a real model — their cure is
adapter-side). Per the fork audit §11.A.

### Fixed — GitHub Copilot CLI cost attribution (empty / `capi:`-prefixed model)

Copilot CLI process logs that lack the `[INFO] Using default model: …`
line emitted Tier-1 token rows with an **empty model → pricing MISS → $0
cost** (token counts were captured correctly; only the cost silently
dropped to zero). The adapter now recovers the model from the response
body's `"model"` field and, as a last resort, from the sibling
`session-state/<id>/events.jsonl` `selectedModel`, stripping Copilot's
`capi:` / `sweagent-capi:` routing prefixes (the dashed `claude-opus-4-7`
form is preserved — our pricing table keys on it). Historical rows already
persisted with an empty / `capi:` model re-attribute via
`observer backfill --copilot-cli-rescan`. Per the fork audit §7.A.

### Fixed — copilot token output double-counted

The copilot family (`copilot`, `copilot-cli`) emits **two `token_usage`
rows per turn** — a full-usage row plus a separate output-only row from a
second source file — which the adapter intended to merge on
`(session_id, message_id)`, but the store keys on
`(source_file, source_event_id)`, so they never merged and the turn's
output double-counted (a Copilot CLI session showed 304 output tokens for a
152-token turn). A scoped rollup-layer dedup now drops the output-only
"shadow" row when a full-usage sibling in the same session carries the same
output, at both surfaces that sum tokens (the cost engine + the
session-detail / messages CTEs). Gated to the copilot tools, so no other
adapter is affected.

### Fixed — GitHub Copilot CLI "Request-ID null" loses the turn's message id

Modern Copilot CLI (1.0.60+) process logs print `[DEBUG] response
(Request-ID null)` — the hex:colon Request-ID the older format carried
inline is gone — so the Tier-1 token row landed with the literal string
`"null"` as its `message_id` (visible in the messages timeline, and it broke
the `(session_id, message_id)` link to the Tier-3 events.jsonl row). The
adapter now recovers the real Request-ID from the sibling
`session-state/<id>/events.jsonl` `assistant.message.requestId`, matching
each `"null"` row to its event by output-token count + nearest timestamp.
This also restores the store-layer shadow merge **at ingest**: with the
Tier-1 and Tier-3 rows now sharing a `message_id`, the existing
`(session_id, message_id)` sweep drops the output-only shadow directly (the
rollup-layer dedup above remains a belt-and-suspenders fallback, and still
covers the VS Code `copilot` adapter). The `token_usage` UPSERT additionally
heals an existing `null`/empty `message_id` to a recovered value, so
`observer backfill --copilot-cli-rescan` fixes sessions that were already
ingested with the placeholder.

### Fixed — GitHub Copilot CLI cache-write tokens billed as input

Modern Copilot CLI (1.0.60+ serving Anthropic-via-Bedrock turns) reports
`cache_creation_tokens` inside `prompt_tokens_details`, and its
`prompt_tokens` is the GROSS prompt = input + `cached_tokens` (cache read) +
`cache_creation_tokens` (cache write). The Tier-1 parser netted out only the
cache-read portion, so the cache-write tokens were billed as net input (a
live turn: 16257 of a 16267-token prompt). The parser now captures
`cache_creation_tokens` and nets it out of input, surfacing it in its own
column so the cost engine bills it at the cache-write rate. The
`token_usage` UPSERT additionally lets `observer backfill
--copilot-cli-rescan` correct a previously-ingested row's input *down* when
it newly discovers cache-write tokens (scoped to the copilot tools — every
other adapter keeps the monotonic `MAX`, so a partial re-parse can't lower a
complete count).

### Fixed — Sessions tab undercounted long-running sessions vs the Cost tab

`/api/sessions` windowed sessions on `started_at` only, while `/api/cost`
and `/api/models` window by turn/token timestamp. A session that started
before the window but had recent turns therefore appeared in the Cost tab
but not the Sessions tab. The window predicate now also matches a session
with any in-window activity (action / `api_turn` / `token_usage`), so the
two tabs reconcile; the pagination total stays consistent. Per the fork
audit §6.B.

### Fixed — Sessions calendar per-tool cost

`/api/sessions/calendar?tool=X` filtered the per-day session *count* by
tool but rendered **all-tools** cost beside it, overstating per-tool spend
on the heatmap. The per-day cost rollup now honors the `tool` filter. Per
the fork audit §7.E.

### Fixed — empty marker-only sessions no longer surface on the dashboard

A Windows Claude Code probe session (CLAUDE.md loads into context, a
`settings.json` is touched, or a session is opened then closed without
work) fires a single hook event — `instructions_loaded` or
`config_change` — which routes through the `wsl.exe` bridge into the
WSL daemon DB. `store.Ingest`'s per-event `UpsertSession` then
bootstraps a contentless session whose only row is that one marker:
no tool calls, no `token_usage`, no `api_turns`. These surfaced on the
Sessions tab as ghost rows (e.g. `total_actions` 0/1, never ending).
Same class as the v1.8.2 `session_end` phantom fix, different trigger.

Unlike `session_end` (terminal — the real session always exists by the
time it fires), `instructions_loaded` / `config_change` fire **at
session start, before the watcher has parsed the transcript**, and they
legitimately attach to real sessions too — so they can't be dropped at
ingestion without losing data. The fix is a read-layer filter: a session
surfaces only when it has at least one substantive action OR any
`token_usage` OR any `api_turns` row. Applied as one shared predicate to
`/api/sessions` (list + pagination total + scored-count), the overview
session stat, and the calendar per-day counts so all three agree.
Non-destructive — `instructions_loaded` / `config_change` stay attached
to real sessions, only the contentless probes are hidden. Existing probe
rows already in a DB are cleaned out-of-band; new ones never appear.

Files: `internal/intelligence/dashboard/dashboard.go`
(`emptySessionMarkers` + `nonEmptySessionPredicate{S,Sessions}`
compile-time consts, wired into the three count paths),
`internal/intelligence/dashboard/dashboard_test.go`
(`TestAPISessions_HidesMarkerOnlySessions`).

## [1.8.2] — 2026-06-06

**Release headline.** Quality-of-life follow-up to the v1.8.0 Teams
shipment + release-pipeline hardening on top of v1.8.1's G8 fix, plus
three new AI-tool adapters (Hermes / Cline-CLI / Kilo Code two-product
pair) and the full **Observer Quest** website-arcade arc: a v1
6-world / 24-level NES platformer expansion, a 12-phase
addictive-modernization layer (skill tree + INSIGHT + mastery +
engine primitives + bestiary + daily challenge + ghost replays +
achievements + cosmetics + FTUE + a11y), a Phase 13 visual + content
expansion (character redesign + 3 new pickups + shoot mechanic +
7-biome remap + +50% level extensions), and a mobile-playable
redesign with dedicated touch band on the arcade and a polished
editorial column on the main page. 166 commits past v1.8.1.

### Added — Kilo Code adapters (legacy IDE extension + CLI)

Captures session data from both [Kilo Code](https://kilo.ai/) products:

- **`kilo-code`** — the legacy `kilocode.kilo-code` IDE extension
  (Cline + Roo Code fork). Persistence is byte-identical to Cline:
  `<vsCodeGlobalStorage>/kilocode.kilo-code/tasks/<taskId>/api_conversation_history.json`.
  The new `kilocode.LegacyAdapter` wraps the existing
  `internal/adapter/cline.Adapter` and re-tags every emitted event
  with `Tool = "kilo-code"` so dashboard rollups don't blur Kilo
  activity into Cline.
- **`kilo-code-cli`** — the current `@kilocode/cli` (npm package,
  binary `kilo`), a fork of sst/opencode. The all-new IDE extension
  is rebuilt on this CLI runtime. SQLite store at
  `~/.local/share/kilo/kilo.db` — **same path on Linux, macOS, AND
  Windows** (Kilo intentionally mirrors XDG everywhere; Windows does
  NOT use `%APPDATA%`/`%LOCALAPPDATA%` here). Schema is OpenCode-shaped
  (`message`/`part`/`todo`) plus Kilo-specific tables (`project`,
  `workspace`, `event`, `session_message`, `account`, `permission`,
  `session_share`). The new `kilocode.CLIAdapter` is a structural
  transposition of `internal/adapter/opencode/`, including the
  `stageMirrorIfForeign` cross-mount pattern (SQLite returns
  `SQLITE_IOERR_SHORT_READ` on a /mnt/c-mounted kilo.db while
  Windows is actively writing, so the trio copies into a per-source
  cache dir before SQLite opens).

**Token capture.** Per-assistant-message bundle on `message.data.tokens
= {total, input, output, reasoning, cache: {read, write}}` — mirrors
the OpenCode invariant. Step-finish parts carry per-step token slices
summing to the message-level bundle; the adapter surfaces them as
ToolEvents but NEVER as TokenEvents (would double-count). Step-start
parts are skipped entirely (informational marker; would 12× the
per-turn row count without adding signal).

**Pricing.** Three new entries cover the Kilo Gateway routing:
`kilo-auto/free` (zero — Gateway free tier confirmed live),
`kilo-auto/small` (Haiku 4.5 / GPT-4o-mini class alias for the
title-generation slot), and a `kilo-auto` family prefix (Sonnet 4
family rates for future paid tiers). Direct provider models
(`anthropic/claude-…`, `openai/…`) inherit family-prefix fallback
from existing pricing entries.

**Live capture confirmed 2026-06-06** on both WSL Ubuntu 24.04 and
Windows 11 — Kilo CLI `@kilocode/plugin@7.3.40`, 18 SQLite migrations
applied. Tools exercised: `read`, `write`, `bash`, `websearch`. See
`docs/plans/kilocode-adapter-plan-2026-06-06.md` (Phase-0 reality
check) and `testdata/kilocode/` (reference dumps of both captures).

**`enabled_adapters` default list grows from 15 to 17** with
`"kilo-code"` and `"kilo-code-cli"`. Existing users with an explicit
`enabled_adapters` list in `~/.observer/config.toml` must add both
strings to capture Kilo activity.

### Added — Hermes Agent adapter (Nous Research)

Captures session data from [Nous Research's Hermes
Agent](https://github.com/NousResearch/hermes-agent) — the open-source
multi-platform autonomous AI agent with 70+ built-in tools, MCP
client + server, and 18+ LLM providers. Distinct from the Hermes LLM
family (Hermes 3, 4) — this is the agent runtime.

**Capture strategy is hooks-primary + SQLite backfill** (same hybrid
model the cursor adapter uses):

- The Python plugin bridge at `~/.hermes/plugins/superbased-observer/`
  registers callbacks via `ctx.register_hook("post_tool_call", …)` /
  `"post_api_request"` / `"on_session_start"` / `"on_session_end"` /
  `"subagent_stop"` and fires `observer hook hermes <event>` as a
  fire-and-forget subprocess (0.5s timeout, exceptions swallowed).
- The watcher walks `~/.hermes/state.db` (or
  `%LOCALAPPDATA%\hermes\state.db` on Windows native, plus
  cross-mount candidates on WSL2) and emits ToolEvents + TokenEvents
  via `modernc.org/sqlite` read-only access. Filters
  `messages.active = 1` to skip rewound / compressed-out rows
  (schema-v14 reality-check finding the original plan missed).
- The two paths produce comparable rows; dedup happens via
  `(source_file, source_event_id)` UNIQUE — hook rows carry
  `"hermes:hook"`, backfill rows carry the absolute state.db path.

**Install:** `observer init --hermes` writes the Python plugin +
merges an `mcp_servers.superbased-observer` entry into
`~/.hermes/config.yaml`. Hermes auto-discovers plugins at startup —
no separate enable step. `--uninstall` removes both surgically.
`--dry-run` shows the would-be writes. `--skip-mcp` / `--skip-hooks`
gate each half independently.

**Backfill:** `observer backfill --hermes-rescan` walks every
state.db from `messages.id=0` for sessions that pre-date plugin
install (or were captured during an observer outage). Included in
`--all`.

**Tool taxonomy (70+ tools):** every Hermes tool folds into the
normalized action set — `read_file` / `write_file` / `patch` /
`terminal` / `search_files` / `web_search` / `web_extract` /
`browser_*` / `delegate_task` / `todo` / `clarify` / `memory` / etc.
The unknown-tool fall-through is `mcp_call` (Hermes is itself an MCP
host so most user-added tools are MCP-shaped); the raw name is
preserved in `actions.raw_tool_name`.

**Token capture:** Tier 2 approximate on both paths. Hook path lifts
`post_api_request.usage{input/output/cache/reasoning_tokens}` (the
plan originally targeted `post_llm_call` but the §17.1.F reality
check showed it carries no usage payload at all). SQLite path lifts
session-level aggregates. Provider prefix (`anthropic/`, `nvidia/`,
`openrouter/anthropic/`) is stripped before pricing lookup;
OpenRouter `:suffix` tails (`:free`, `:beta`, `:fast`) are preserved
so the dashboard distinguishes paid vs free tiers in the same model
family.

**Reality-check documentation:** the schema-v14 dump captured from a
live install (`testdata/hermes/sessions.sql` / `messages.sql`,
9 sessions / 62 messages) backs the SQLite integration tests
(coverage 80.9% on the new package). The §17.1 reality-check section
of `docs/hermes-adapter-plan.md` documents every delta between the
originally-researched v11 spec and observed v14 reality.

Docs: `docs/hermes-adapter.md` (operator reference),
`docs/hermes-adapter-plan.md` (research + reality check),
`docs/plans/hermes-adapter-implementation-plan-2026-06-05.md`
(per-file build order). 12 conventional commits;
`feat(adapter): add ToolHermes constant and EnabledAdapters entry`
through `feat(observer): backfill --hermes-rescan` +
`test(adapter): hermes SQLite integration tests` +
`docs(adapter): hermes adapter user docs + README + CHANGELOG`.

### Added — Cline-CLI adapter (npm-distributed Cline 3.0.20+)

Captures session data from [Cline CLI](https://docs.cline.bot/) — the
npm-distributed standalone Cline runtime, distinct from the existing
`cline` VS Code extension adapter (which now lives at
`internal/adapter/cline/`; the new CLI adapter at
`internal/adapter/clinecli/`). Persistence at
`~/.cline/data/db/sessions.db` (SQLite schema v1, 28 columns read)
plus per-session `~/.cline/data/db/<id>.messages.json` content-block
files emitting `user_prompt` / `assistant_text` / `tool_use` /
paired `tool_result` / per-API-call token rows.

**Tool taxonomy.** 28 tools — 10 core (read, write, bash, etc.) +
18 `team_*` coordination primitives (`team_create`, `team_join`,
`team_message`, `team_handoff`, …). Per-message `modelInfo`
override handles mid-session provider switching cleanly.

**Subagent + team linkage.** 5 new `ActionMetadata` fields —
`ParentSessionID`, `ParentAgentID`, `AgentID`, `IsSubagent`,
`TeamName`. Extends Invariant #50's IsZero coverage; no rename of
existing fields.

**Token capture.** Tier 2 per-API-call from a Phase 0 reality-check
upgrade (the originally researched Tier 1 session-level path was
upgraded after testdata showed per-call rows). Message-level
metrics roll up cleanly to session totals.

**V2 cross-mount fix.** WSL2 observers reading the Windows-side
`/mnt/c/Users/<u>/.cline/data/db/sessions.db` over the DrvFs bridge
need the same `stageMirror` pattern as opencode / kilocode —
copies the db into a per-source cache dir before SQLite opens so
mid-write Windows access doesn't surface `SQLITE_IOERR_SHORT_READ`.
Fixture tests caught zero of this; live operator end-to-end
surfaced it.

**SessionHookChecker dedup gate** ships by default so cline-cli
avoids the H1 hermes-audit trap (no `WARN` entries on the live
4-session install: 1 WSL + 3 Windows-native, 44 actions + 25 token
rows captured zero-loss). Opt-in `hooks.jsonl` tailer (byte-offset
cursor, partial-line tolerant) covers all 9 hook event types from
plan §6.

Install: `ToolClineCLI = "cline-cli"` constant + EnabledAdapters
default (15 → 16 prior to kilocode bumping it to 17);
`observer backfill --clinecli-rescan` (also picked up by `--all`).
49 sub-tests pass on Windows + WSL2.

Docs: `docs/clinecli-adapter.md` (operator reference),
`docs/plans/cline-cli-adapter-plan-2026-06-06.md` (build order +
reality check, including the Phase 0 schema-v1 upgrade),
`testdata/clinecli/` (live-install fixtures).

### Added — Observer Quest (website arcade expansion)

The public `superbased.app/arcade` rebrands to **Observer Quest** —
a 6-world (24-level) NES platformer + 1 Konami-hidden bonus world,
each world themed on a real SuperBased Observer subsystem. Ships as
12 commits on top of the Phase 3.1 website (no Go, no docs/distribution,
no release-pipeline impact). Plan-of-record:
`docs/plans/arcade-expansion-plan-2026-06-05.md`.

What changed for visitors:

- **Worlds + bosses.** Six worlds (THE WATCHER → VAULT → PROXY →
  COMPRESSOR → OBSERVATORY → AUDIT) with named bosses (Runaway Loop,
  Stale Read, Rate Limiter, Context Bloat, Token Oracle, The Audit).
  Each boss has a 3-4 phase state machine; final boss invokes every
  prior boss mechanic. +1 hidden 7th world (BUG STORM) unlocked by
  the Konami code on the title screen.
- **Characters.** 6-character roster (OBS default + WATCHER / PROXY /
  COMPRESSOR / INDEXER / AUDITOR), each tied to a boss kill. Character
  select overlay with 3×2 (responsive) grid.
- **Difficulty selector.** 3 tiers (Easy / Normal / Hard) recorded
  per score, per level, per difficulty. Per-difficulty best-score row
  on the title screen.
- **Mobile + touch parity.** Full play on phones + tablets with on-
  screen LEFT/RIGHT D-pad + A/B/pause buttons, multi-touch, orientation
  banner in portrait, safe-area handling, iOS audio unlock. HUD reflows
  at ≤720 / ≤480 px.
- **Save data v2.** Per-difficulty bests, per-level highscores + time-
  trial slots, tokens (lifetime / spent), character unlocks, secrets
  bitmap, meta-shop unlocks. Backward-compat migration from the v1
  `sb_arcade_high` integer.
- **Meta-shop.** 8 token-currency unlockables; 4 wired with active
  effects (+1 base life, starting magnet, world-map fast travel,
  time-trial mode). The other 4 are visible cosmetic / stub items.
- **First-play audio prompt** and **settings overlay** with save reset
  (gated by a confirmation modal — the v1 high-score integer is
  preserved on reset).
- **Bestiary.** 6 enemy types (carry-forward Crawler + Flyer plus new
  Splitter / Charger / Lobber / Tank) and a projectile system shared
  by lobbers + bosses.

What's out of scope for this slice (already noted in plan §15):

- Chiptune music (the MUSIC settings toggle persists state but is
  silent until a follow-on commit lands the mixer).
- Engine primitive library (climb / wind / belt / revGrav / secret /
  glyph) deferred; worlds 2-7 use existing primitives + denser
  platform layouts to express their themes.
- 6 remaining enemy types from the original plan (Phantom / Burrower /
  Slammer / Mimic / Echo / Glitch).

The Cloudflare deploy is unchanged — `website-deploy.yml` ships all
new `arcade*` assets automatically. Build-marker progression:
`phase-4-arcade-split` → `phase-4b-state-difficulty` → `...` →
`phase-4j-konami`.

### Changed — `/arcade` mobile is now editorial Simple View

Mobile visitors (`≤920px` viewport) to `superbased.app/arcade` used
to see the canvas + every stacked NES dialog overlay (title, audio
prompt, world-clear) shrunk to fit, which the operator flagged as
"the older version, dialog boxes stacked one on top of the other."
The arcade page now mirrors `superbased.app/`'s **Simple View**
pattern on mobile: the game canvas + HUD + overlays are hidden, the
render loop never starts, and an editorial single-page scroll surfaces
instead — sticky nav with logo + back-to-home, hero header with the
OBSERVER QUEST title + tagline + PLAY ON DESKTOP CTA, then six
section cards (What it is · Six worlds + bosses · Roster · Power-ups
× 22 · How to play · Get the observer), then a footer. Desktop gets
the same content via a top-right `☰ SIMPLE VIEW` toggle button (parity
with `/`). Build marker: `phase-4r-simple-view`.

Files: `website/arcade.html` (+ `#asimpleNav` / `#asimpleHeader` /
`#arooms-static` / `#asimpleFooter`), `website/arcade.css` (+ ~190
lines of simple-view styles incl. `body.simple` and
`@media (max-width:920px)` auto-fallback), `website/arcade/main.js`
(`isMobile()` + `simpleMode` state + `setSimple()` toggle; gates
`firstPlayPrompt()` and `boot()` so the rAF loop never starts on
mobile), `website/arcade/input.js` (early-exit when `body.simple` so
the virtual D-pad doesn't overlay the editorial cards).

(This mobile-as-editorial behavior was subsequently superseded by
the mobile-playable arc — see the "Changed — Observer Quest +
main page are now mobile-playable / mobile-polished" section
below.)

### Added — Observer Quest addictive modernization (Phase 0 → 12)

Layered on top of the v1 6-world expansion: a 12-phase
modernization arc transforming the arcade from "playable demo" to
"real game" with roguelike depth. Plan-of-record:
`docs/plans/arcade-addictive-modernization-plan-2026-06-05.md`.
Save schema v3 (additive-only over v2 — `cosmetics.deathStamp` +
`ftueSeen` added; no migration path needed beyond v2 → v3
detection).

**Phase 0 — instrumentation.** `__OBS_DEBUG` runtime surface
(`run`, `state`, `fx`, `enemies`, `projectiles`, `grant`, `goto`,
`setPlayer`); Playwright tape harness at `website/tools/shoot.mjs`;
12-test regression suite (persistence + save-migration). A
RED-then-GREEN P0 tape pair caught a real persistence bug
(`perma`/`fx` were dropped across world entry).

**Phase 1 — game-feel.** Hit-stop, screen shake, particle bursts,
sprite squash-stretch, coyote-time, jump-buffer, variable-height
jump. The bones of modern platformer feel.

**Phase 2 — combo system.** ×9 NES-honest cap (rolls back to 9,
never double-digit). Stomp / dash-through / phase-through all
participate. End-of-run summary with breakdown.

**Phase 3 — skill tree + INSIGHT currency.** 20-node global tree
(NOT per-character). Costs scale; nodes branch defense / mobility /
score / synergy. Lifetime-progression metaprogression at ~8-12
runs to complete.

**Phase 4 — pickups + shop overhaul.** 5 new pickups (FTS5 /
PHASE / DASH / HOVER / CLONE) on top of the 10 base. Tiers + 6
synergy bonuses. Run-shop redesign with rotating stock + reroll.
Meta-shop expanded with tabs + 10 cosmetics (8 trails + 5
coin-skins + 5 HUD themes). Three-currency HUD cluster
(◆ wallet / ₸ tokens / ◉ insight).

**Phase 5 — character active abilities + mastery.** E keybind +
touch button. 6 distinct abilities: FOCUS (slow-mo, OBS), PING
(reveal, WATCHER), BLINK (teleport, PROXY), CRUSH (stun,
COMPRESSOR), SCAN BURST (INDEXER), OVERDRAFT (AUDITOR).
Per-character mastery XP (+1/level, +5/world), tier thresholds
5 / 15 / 35. Cooldown HUD pip.

**Phase 6 — engine primitives.** 8 new level primitives: SPRING
(bouncepad), CRUMBLE (collapsing plat), BELT (conveyor), WIND
(zones + W3-2 windy biome), SECRET (closes the PING reveal
loop), GLYPH + DOOR (key-gated), CLIMB (ladders / vines),
REVGRAV (gravity-inversion). 16 of 24 levels re-authored to use
≥1 primitive (boss arenas + W7-1 intentionally untouched).

**Phase 7 — bestiary expansion.** 6 new enemy types: PHANTOM
(visibility cycle), BURROWER (surfaces-from-below), SLAMMER
(REVGRAV-dependent ceiling drop), MIMIC (disguised as coin),
ECHO (stomp-chain), GLITCH (teleporter). Elite variants
(palette-shifted +1 HP layer).

**Phase 8 — daily challenge + ghost replays.** Date-seeded run
configs with 4 modifiers (FAST AUDIT / LOW GRAV / COIN BLITZ /
LEGACY MODE). NES-honest single-digit streak chip (9, then
`9+`). 14-day calendar grid. +15 bonus insight. 10 Hz
position-trace ghost recorder + translucent paper-ghost playback
gated by PB. ~10 KB / ghost.

**Phase 9 — achievements.** 24 achievements across 6 categories
(5 reachable run 1, 8 in runs 2-5, 11 long-tail). ovAchievements
4-col grid; ★ N/24 chip on the title screen.

**Phase 10 — cosmetics + audio.** Trails / coin-skins / HUD
themes / death-stamps. New audio events (`Sound.achievement`,
`Sound.dailyStreak`). Title-screen music (`Music.play('title')`)
wired live.

**Phase 11 — FTUE.** 3×2 currency/system primer modal + "I'M IN"
gate. Mobile pass on Phase 8 / 9 / 10 surfaces.

**Phase 12 — reduced-motion + a11y.** CSS reduced-motion
hardening. ARIA dialog roles. Esc-to-close. Polite live-region
announcer. Real fps sampler.

Plus a self-driven multimodal visual-verification pass caught 3
visible bugs the 94 green asserts missed: daily-could-force-locked-
character HUD desync, death-stamp placement + ghost-replay copy,
and `[hidden] { display:none !important; }` global rule restoring
HTML semantics. **Methodology established:** assertion tapes
catch logic regressions; multimodal screenshot-reads catch paint
bugs. Both layers required for visual-affecting changes.

56 commits between `d61d933 → 10d7a66`.

### Added — Observer Quest Phase 13 (visual + content expansion)

Closes the operator-surfaced gaps the v1 modernization arc left
open: every world reading as night-city, characters looking
identical when swapped, levels feeling "rather short," only 15
pickups + no projectile verb. Plan-of-record:
`docs/plans/arcade-phase-13-visual-content-expansion-2026-06-06.md`.

**§1 character redesign.** Shared 8×8 humanoid `PLAYER_ART`
replaces the per-character `S_ART` glyph. Three lever-pulls
deliver distinct silhouettes at a glance: per-character body
palette (`CHAR_PAL`), 3×3 chest emblem (`CHAR_EMBLEM` — `S` /
`O` / `>` / `[]` / `#` / `?`), head pip (`CHAR_PIP` — antenna /
visor / crown / diagonal / top-hat / none). `drawGhost` re-uses
the new sprite.

**§2 power-ups + shoot mechanic.** Catalog grows 15 → 18. New
pickups: **BLASTER** (X-key fires a horizontal teal
`kind:'player'` projectile, kills basic enemies in one hit,
staggers tank / lobber; HUD chip `BLAST × N M`; 5 charges per
pickup), **TIME STOP** (3 s hard-freeze via `fx.freezeUntil`),
**MULTI-SHOT** (3 projectiles per fire at ±14 px y-offsets).
Touch parity via a 7th `.t-fire` button. Shoot is a pure pickup
verb (no skill-tree node).

**§3 biome remap.** Seven distinct biomes — meadow / cavern /
sky islands / volcanic / desert / snow-capped mountains / jungle.
`WORLD_SKY` + `WORLD_GROUND_TINT` per-world tables; `skyline:true`
now only on W3. Six new render functions: `drawMeadow` /
`drawCavern` / `drawSun` / `drawLava` / `drawPeaks` / `drawCanopy`.

**§4 level extension.** All 18 standard levels +50% width (boss
arenas at 1800 untouched). New tail content per level: 4-10 plats,
2-3 enemies, 2-3 flyers, 1 BLASTER / FREEZE / MULTI pickup, 10-15
coins. Primitive extensions where natural. W1 4200-5000 →
6300-7500 … W6 5200-6200 → 7800-9300. Save-state best-times
survive cleanly (per-difficulty keys are content-agnostic).

**Operator-driven follow-up fixes.** RTK → NOISE CHAMBER rename
(7-site sweep), W3 boss reachable (lower cruise + periodic
ground swoop), enemies revert at `level.ground` gaps
(`overGroundGap` helper wired into 7 patrol AIs), W4 boss
reachable (re-anchor `groundTop` each frame, fixes growth-driven
drift), debug URL shortcut (`?debug=1&world=N&level=N&char=ID`),
W2/W3/W4 biome density fix, ESC pause + controls cheat-sheet +
djump rebalance on first standard levels.

**§5.2 acceptance closures.** Projectile + freeze + multi-shot +
HUD-chip tapes (4 tracked); 7 light-theme biome captures; 6
tail captures. Surfaced a real W2 light-theme cavern regression
(gray pillars against pale sky read as a city skyline — the very
"every world is night-city" silhouette Phase 13 was meant to fix).

**W2 cavern light-theme fix (`d8d84e7`).** `drawCavern` branches
`fillStyle` on `THEME_LIGHT` — pillars in `COLOR.gold` α 0.28,
stalactites + stalagmites in `COLOR.gold` α 0.42. Same shapes,
warm color temperature; structures read as torch-lit cavern
strata rather than cold gray skyscrapers. Closes the
carry-forward finding flagged through three handovers.

20 commits between `549373c → d8d84e7`.

### Changed — Observer Quest + main page are now mobile-playable / mobile-polished

Supersedes the v1 "mobile is editorial Simple View" arcade behavior
(see the older section above) — operator surfaced via screenshot
that mobile visitors to `superbased.app/arcade` landed on stacked
editorial cards instead of the playable arcade even though the
touch overlay (D-pad + A/B/E/X/pause via `.t-btn`) had been wired
for several phases. Four commits closed the mobile gap end-to-end;
two cosmetic-sweep follow-ups polished the result.

- **`d79a71d` arcade mobile playable.** Flipped `simpleMode`
  default to `false`; dropped `@media (max-width:920px)`
  game-element `display:none !important` rules; prefixed editorial
  show-rules with `body.simple` so they're opt-in only. Copy:
  "PLAY ON DESKTOP" → "PLAY GAME". `shoot.mjs` gained `--touch`
  flag (Playwright `hasTouch + isMobile`) so headless captures
  actually trigger input.js's touch-overlay DOM append.
- **`422d0d3` touch-band redesign.** Dedicated 200 px band above
  the HUD on portrait (88 px in landscape after `3c9f06b`)
  reserves space for the touch cluster — buttons never overlap
  the canvas. Two-row portrait cluster: `X E` upper / `◀ ▶ ... B A`
  lower. Single-row landscape: `◀ ▶ ... X E B A`. Pause moved to
  top-LEFT (out of overlap with the SIMPLE VIEW toggle at
  top-right).
- **`275c558` main-page mobile editorial.** Killed the duplicate
  `.mtopbar` (and its meaningless hardcoded `★ 10/10` chip);
  `#simpleNav` is the single sticky header; `#simpleHeader` +
  `#simpleFooter` force-shown on mobile; `.grid-3` → 1 column to
  kill the orphan-card layout; `shoot.mjs` gained `--no-debug-wait`
  so non-arcade pages can be captured without the `__OBS_DEBUG`
  global timeout.
- **`28dc1f6` round-2 polish.** Five operator findings: ▶ GAME
  VIEW warp at narrow dark mode (font + padding tighten at the
  920 break + a 360-break for very narrow phones); PLAY THE FULL
  GAME removed from the top hero (GET STARTED carries an arcade
  CTA); per-room paper-borders + teal box-shadow removed for
  desktop parity; DASHBOARD tile grid overflow at 480 px fixed
  via `minmax(0, 1fr)` + 480-break collapse; CONTACT US ↔ PLAY
  THE FULL GAME size parity with full-width stacked CTAs.
- **`c9b7064` `#simpleNav` opaque.** Four selectors bumped from
  0.93-0.95 α to fully opaque hex (`#0D0D12` dark / `#DCE7EE`
  light — same as `--base` so the sticky reads as a continuation
  of the surrounding background). Kills scrolled-content
  bleed-through.
- **`3c9f06b` landscape touch band tighten 96 → 88 px.**
  Single-row cluster needs only `.t-jump`'s 68 px + 12 px bottom
  margin = 80 px → 88 px leaves a comfortable 8 px top margin
  while recovering 8 px of usable game canvas.

Operator decisions baked into this arc: mobile arcade MUST be
playable (overrides Phase 3 brief §8 "desktop-only" intent);
mobile main page stays editorial (no touch controls are wired in
`website/index.html` and the path forward is responsively-polished
editorial, NOT a touch overlay); no per-room boundaries on mobile;
GET STARTED CTAs full-width same-size; top hero hook = NPM INSTALL
+ GITHUB only on mobile.

14 tracked mobile-specific capture tapes added (4 arcade + 10
main-page + narrow variants). Multimodal-verified across portrait
380×820, landscape 820×380, narrow 320×700, iPhone SE landscape
568×320, desktop 1280×720.

### Added — admin Invite UX

- `GET /api/org/members` (admin-only, samlSession-secured) returns
  the active SCIM-provisioned org users sorted by email. Powers a
  `<select>` dropdown on the dashboard's `/invite` page and the
  Settings → Enrolment tokens section, replacing the
  paste-the-UUID free-text input that v1.8.0 shipped. Non-admin
  callers get 403 and the UI falls back to the free-text input so
  the page stays usable.
- New `rollup.Member` + `rollup.MembersResult` types pin the wire
  shape via x-go-type; `rollup.ListActiveMembers` is the seam.
  Handler in `internal/orgserver/dashboard/api.go`.

### Added — distribution README DRY mechanism

- `npm/observer/README.md` and `pypi/observer/README.md` shared
  ~780 byte-identical lines that silently drifted when one channel
  was updated without the other. The shared body now lives in
  `docs/distribution/README-body.md`; each channel's
  `README.template.md` carries the channel-specific shell and
  includes the body via a single `<!-- @@INCLUDE:... -->` marker.
  `make sync-distribution-readmes` regenerates; `make
  verify-distribution-readmes` is a CI drift gate that builds into
  temp files and diffs against committed (never mutates the working
  tree). Zero content drift introduced by this commit — both
  rendered READMEs are byte-identical to the prior committed state.

### Added — release-pipeline hardening

- `npm-release.yml` gains a top-level `concurrency:` block
  (`group: npm-release-${{ github.ref }}`, `cancel-in-progress:
  false`). Defends against re-pushed tags racing on artifact
  uploads / `npm publish` / `vsce publish` per
  [[feedback-npm-release-workflow-double-fire]]. The serialised
  run waits instead of cancelling — killing a publish mid-stream
  risks half-published registry state.
- New `vscode-preflight` job queries the Marketplace via `vsce
  show superbased.superbased-observer --json` BEFORE the
  `vscode-package` matrix runs. Fails fast (~30s) with the
  remediation hint if the tag's version is already listed,
  instead of after ~25 min of matrix builds + `vsce publish`
  errors. `vscode-package`'s `needs:` is now `[build,
  vscode-preflight]`. With v1.8.1's G8 stamp fix, the v1.8.0
  failure mode now has three defence layers.

### Fixed — Teams test regression (2026-06-03 second run)

Six follow-ups closing the residual findings in
`docs/teams-test-regression-2026-06-03.md`. Issues 1–4, 6 (most),
and 7 from the original 2026-06-02 set remain fixed; the new arc
closes the boot regression and the 5b dashboard-403 root cause that
landed in v1.8.0.

- **deploy/observer-org IdP boots again (N1).** The v1.8.0
  attempt to pin baseurlpath via `idp-config-override.php` did
  `require '/var/simplesamlphp/config/config.php.dist'`, but
  `kristophjunge/test-saml-idp` ships SimpleSAMLphp at
  `/var/www/simplesamlphp/` and has no `.dist` — the require
  fatal'd, the IdP served the fatal as metadata, and the org
  server's `NewSAML` couldn't parse `<br>` as
  `<EntityDescriptor>`. Fix: remove the override.php entirely;
  replace with a compose-level entrypoint that `sed`s the pin
  in-place against the image's own complete `config.php`, then
  exec apache2-foreground. Idempotent across restarts.
- **IdP healthcheck no longer reads PHP fatals as Healthy (N3).**
  SimpleSAMLphp returns HTTP 200 even on a PHP fatal-error
  body, so the prior `curl -fsS` check passed while the body
  was malformed. New check pipes the response through `grep -q
  EntityDescriptor`, so an unparseable metadata body fails
  compose's healthcheck and N1-style regressions surface in
  `compose ps` instead of hiding.
- **SAML resolver detaches from r.Context() (5b).** Issue 5b's
  ACS 403 + infinite SSO loop traced to `samlSession.CreateSession`
  passing `r.Context()` straight to `ResolveSAMLUser` — a
  browser disconnect or write-timeout firing mid-ACS canceled
  the DB query, surfaced as `api.store.memberByEmail: context
  canceled`, and crewjam translated the failure to 403. Same
  shape as the v1.7.3 proxy-insert detach
  ([[feedback-proxy-detached-insert-context]]). Fix: derive a
  bounded `context.WithTimeout(context.Background(), 10s)` for
  the resolver call. Regression test seeded in
  `saml_test.go::TestCreateSessionDetachesContext`.
- **Dashboard renders data again (5b dashboard half).** Even
  after the resolver detach, every `/api/org/*` endpoint kept
  returning 403 because `requireAdmin` walks
  `OrgConfig.AdminEmails` and the dev `config.toml` had no
  `[org]` section at all. Fix: dev config now ships `admin_emails
  = ["user1@example.com", "admin@example.com"]` so both the
  kristophjunge default user and the quickstart-provisioned
  admin can see whole-org rollups.
- **`observer-org quickstart` survives cold `docker compose
  build` (N2).** The whole flow ran under a 120s budget; a cold
  Go-image build trivially exceeds that and got SIGKILL'd. Fix:
  `runComposeUp` runs under `cmd.Context()` directly (no internal
  timeout — operator is watching the build), and only the
  post-up readiness + SCIM + mint steps live under the 120s
  budget.
- **`observer enroll` actually wires `ANTHROPIC_BASE_URL` (N4).**
  The v1.8.0 auto-wire claim covered hooks + MCP + (codex)
  proxy-route, but Claude Code's `ANTHROPIC_BASE_URL` was a
  print-only hint. The single biggest remaining onboarding gap
  per the regression doc. New `(*proxyroute.Registrar).RegisterClaudeCode`
  writes `"env": { "ANTHROPIC_BASE_URL": "http://127.0.0.1:<port>" }`
  into `~/.claude/settings.json`, preserving every other
  top-level key (hooks, mcpServers, permissions, ...) and every
  other `env` key. Idempotent; refuses non-loopback existing
  values without `--force`; treats another local-observer
  port-9999-style entry as AlreadySet rather than clobbering.
- **`org status` "Last push" resets on re-enroll (N5).** Prior
  behaviour left a stale prior-run timestamp after re-enrol
  because `Enroll` cleared the bearer + cursor but not
  `schema_meta.org_last_push_payload` / `org_push_log`. New
  `Store.ClearLastPushState` (called inline from `Enroll`)
  drops both atomically.
- **Server-side `actions.source_file` ambiguity documented
  (N5).** Migration files are immutable once shipped, so the
  column rename is not in scope; ingest.go now carries a
  comment explaining that in metadata-only mode (v1.8.0+) the
  column holds the sha256 hex of the path rather than the path
  itself, and how to disambiguate by length / sibling
  `source_file_hash` column.

### Fixed — v1.8.2 re-test follow-ups (2026-06-04)

Three concerns surfaced by the v1.8.2 re-test
(`docs/teams-test-regression-v1.8.2-2026-06-04.md`). N1/N3/N4/N5 from
the 2026-06-03 regression doc are confirmed fixed; these close the
two new blockers the v1.8.2 first cut introduced plus the N4
operational caveat.

- **Issue 5b is finally fixed (the SSO loop).** v1.8.2's resolver
  detach removed the `403` half, but post-ACS the browser bounced
  between `/saml/sso → IdP → /saml/acs → /saml/sso` at ~10
  round-trips/sec until the tab crashed. Root cause:
  `requireSAMLWeb` redirects unauthenticated `/` to `/saml/sso`, so
  crewjam records `/saml/sso` as the RelayState entry URL, and the
  post-ACS redirect lands the (now-authed) user back on `/saml/sso`
  — which re-initiates SSO unconditionally. Fix:
  `internal/orgserver/auth/saml.go::SAML.SSO` now checks
  `sessions.UserID(r)` first and 302s to `/` when the session is
  valid, skipping crewjam's `HandleStartAuthFlow`. Regression
  test: `auth/saml_test.go::TestSSOShortCircuitsWhenAuthenticated`.
- **N6 — dev `admin_emails` actually loads now.** v1.8.2 added the
  allow-list under `[org]` in `deploy/observer-org/config.toml`, but
  the config struct reads from `[dashboard]` (the section header
  didn't exist in the file). TOML silently dropped it →
  `cfg.Dashboard.AdminEmails` empty → admin endpoints 403, aggregate
  endpoints render zeros. Fix: rename the section header to
  `[dashboard]`. Server now also emits a startup `WARN` when the
  allow-list is empty so a future misplaced key surfaces as a
  boot-time signal, not a silent dashboard-zeros mystery. New
  config-load test `TestLoadDevComposeConfig` would have caught the
  misplacement.
- **N4 caveat — proxy-down warning + symmetric unenroll cleanup.**
  v1.8.2's `RegisterClaudeCode` writes `ANTHROPIC_BASE_URL` into
  the *shared* `~/.claude/settings.json`, so every Claude Code
  session on the host immediately routes through the proxy. If
  the proxy isn't running (e.g. operator forgot `observer start`),
  every Claude Code instance breaks with connection-refused — the
  v1.8.2 re-test caught this when the tester's own driving
  session dropped. Two-part fix:
  - Enroll now does a 200ms TCP-dial probe of the proxy port
    after the settings.json write and emits a loud `WARNING:
    observer proxy is not running` block with the remediation
    command.
  - New `(*proxyroute.Registrar).UnregisterClaudeCode` symmetric
    to RegisterClaudeCode: drops `ANTHROPIC_BASE_URL` when it
    points at any loopback (any observer install), preserves a
    deliberate third-party proxy entry, drops the entire `env`
    block when it becomes empty. `observer unenroll` calls it
    best-effort after `c.Unenroll(ctx)`.
- **D1 — Projects rollup now works under default privacy posture.**
  v1.8.0 stripped raw `project_root` server-side in metadata-only
  mode, but the rollup queries kept filtering
  `WHERE project_root != ''` — every project-dimension aggregate
  (`project_count`, `top_projects`, `/api/org/projects`,
  `/api/org/teams/{id}.top_projects`) was permanently empty. D1 in
  docs/teams-test-open-issues-2026-06-04.md. Fix is server-side
  only:
  - `internal/orgserver/rollup/cost.go::spendCTE` now reads
    `project_root_hash` (the column the privacy fix preserves)
    with `LEFT JOIN sessions s ON s.id = t.session_id AND
    s.user_id = t.user_id` so proxy-fed `api_turns` whose own
    `project_root_hash` is empty (their `project_id` was `NULL`
    on the agent → no hash from the agent-side `LEFT JOIN projects`)
    still inherit the session's hash via `session_id`.
  - `overview.go`, `projects.go`, `teams.go`, `budgets.go` all
    switched to aggregate / filter on `project_root_hash`.
  - New `ProjectIDFromHash` helper — the URL `{id}` is now
    derived from the hash's first 16 chars (the hash already IS
    `sha256(rawRoot)`).
  - Wire shape unchanged: `project_root` JSON field still ships,
    carrying the hash hex in metadata-only mode. Full-content
    mode also populates `project_root_hash` (via the agent's
    `hashOrComputed` path), so aggregation works for both modes
    without forking the queries.
  - Regression test `rollup_test.go::TestProjects_MetadataOnlyMode`
    seeds the production-reality fixture (raw column empty, only
    the hash + one proxy-fed turn with NO hash but a valid
    session reference) and proves the JOIN-fallback path.

### Changed — docs reorg Plan C (2026-06-04)

- `b89faec`. Moved 13 tracked audits → `docs/audits/` and 16 tracked
  plans → `docs/plans/`. ~200 path-ref rewrites across ~40 docs.
  `docs/README.md` Audits/Plans/Subdirs sections rewritten. After
  Plan C, only two transient docs remain at `docs/` root:
  `adapter-audit-playbook.md` (reusable methodology) and
  `handoff-2026-05-16-design-parity.md` (legacy naming, kept for
  historical continuity). Pairs with the Plan A categorized index +
  the Plan B handovers move from earlier in the v1.8.2 chain.

### Added — Cloudflare-Pages website pipeline + Phase 2/3/3.1 redesign (2026-06-04 / 2026-06-05)

The `marmutapp/superbased-observer-private` repo now owns publishing
the marketing site at `https://superbased.app`. The public mirror
stays focused on the binary + package distribution surface — the
site source is excluded from the orphan via release.sh.

- **Phase 1 takeover** (`e6a6ab4`, 2026-06-04). Mirrored the prior
  screenshot-app `~/superbased/website/` (48 files, 5.0M) verbatim
  into `./website/` plus the `.github/workflows/website-deploy.yml`
  workflow that fires Cloudflare Pages on every `website/**` push to
  main. Account `8907a11bce2894c499edf7e34f4691f6`, project
  `superbased-website`, secrets `CLOUDFLARE_API_TOKEN` +
  `CLOUDFLARE_ACCOUNT_ID` on the private repo.

- **Phase 2 redesign** (`a763244`, 2026-06-05). Replaced the
  screenshot-app pages with a side-scrolling NES-skinned slide deck
  (10 stages + Konami bonus, support pages re-skinned to the same
  palette). Operator rejected mid-iteration as "skin on a slide
  deck, not a real game"; superseded by Phase 3.

- **Phase 3 real playable platformer** (`918319f`, 2026-06-05). Real
  HTML5 Canvas side-scrolling platformer with character `Obs` (the
  S logo with eyes), 10 buildings → NES dialog rooms (HOOK / PAIN /
  FIX / PAYOFF / INTEGRATIONS / INSTALL / DASHBOARD / MCP / TRUST /
  GET STARTED), Konami bonus Stage 11, NES contact-modal end-gate.
  Mobile vertical card fallback. Simple-view editorial layout
  toggle. Built by Claude Design from
  `docs/plans/website-phase-3-real-game-brief-2026-06-05.md`.
  Separate `/arcade` (`arcade.html` + `arcade.js`) is a full
  enemy-stomping platformer with power-ups + coin shop + lives.

- **Phase 3.1 iteration** (`78f668c`, 2026-06-05). Light/dark
  theme system (PAL.dark/PAL.light palette swap, `body.light` CSS
  overrides, theme-toggle button, `localStorage.sb_theme`
  persistence, logo auto-swap via `.js-logo` class). Contact modal
  title `★ CONTACT ★` → `★ GET IN TOUCH ★`. Arcade grew 3 → 5
  levels (`COLD START` / `RATE LIMIT` / `CONTEXT WINDOW` /
  `TOKEN STORM` / `THE AUDIT`). Splash hint upsized to
  `clamp(17px,2vw,22px)` Space Grotesk for prominence.

- **Phase 3.1 follow-up fixes** (`697a54c` / `12168b9` / `24e0a6b` /
  `602bb5b` / `2f357e7`). "3 AGENTS" stat-card wrap (force-fit 26px
  nowrap). Arcade theme accents stuck on dark because
  `LEVELS[].accent: COLOR.teal` was a value copy at IIFE load time;
  switched to string keys + `COLOR[lvl.accent]` resolution at
  render time. Top-left expanded `#topnav` panel with all 8 site
  destinations (HOME / ARCADE / SECURITY / PRIVACY / TERMS / EULA
  / GITHUB / NPM + PYPI + VS CODE). Support pages
  (security/privacy/terms/legal/eula) get the same theme system +
  proper brand-logo image (auto-swaps logo.png/logo-dark.png) +
  theme toggle. Cache-proof inline-style/width/height attributes
  on the support-page brand image so a stale cached site.css can't
  render the 920×240 wordmark at native size.

- **Contact-modal cleanup** (`22ef9b5`). Replaced the three founder
  rows (legal@superbased.app + santosh@ + sanjay@) with a single
  `contact@superbased.app` row + inline X/LinkedIn/YouTube/GitHub
  socials. Personal founder emails removed (kept private).
  ENTERPRISE plan CTA mailto also swapped to `contact@superbased.app`.

- **Release-pipeline website-private invariant** (`b7dde46`).
  `website/` + `design/website/` added to
  `scripts/release.sh::PRIVATE_ONLY_PATHS` (so `git rm --cached`
  drops them from the public orphan), to the `.gitignore` heredoc
  appended to the orphan tree (so any future drop-in clone of the
  public repo classifies them correctly), and to a new
  `site_leaks` post-stage sanity-check grep so a regression that
  silently lets either tree through into the public push fails
  the release.

- **New tracked plan docs:**
  `docs/plans/website-phase-2-redesign-2026-06-05.md` (the
  superseded slide-deck plan; kept for traceability of the
  rejected approach) and
  `docs/plans/website-phase-3-real-game-brief-2026-06-05.md` (the
  brief the operator handed to Claude Design — palette/fonts/game
  mechanic/level layout/verbatim content/acceptance criteria;
  remains the canonical hand-off if Phase 3 needs to be
  re-derived). Both indexed in `docs/README.md` Plans section.

- **Live verification corner cases captured in memory:**
  `feedback_cloudflare_pages_html_strip.md` (Pages auto-308 from
  `/foo.html` to `/foo` clean URL — don't read as a misconfig).
  `feedback_cloudflare_email_obfuscation.md` (Pages rewrites every
  `mailto:` to `/cdn-cgi/l/email-protection#hex` so a live curl
  grep for `contact@superbased.app` returns 0 even when correct —
  decode the XOR hex to verify).

## [1.8.1] — 2026-06-03

**Release headline.** Hotfix for the v1.8.0 release run: lint cleanup +
fixes the VS Code Marketplace publish that failed with "v1.7.28
already exists" because the VSIX manifest version wasn't being
stamped in lockstep with the release tag. No Go behaviour changes —
the agent + org-server interop story from v1.8.0 stands.

### Fixed
- VS Code Marketplace + Open VSX publish now build VSIXes with the
  correct release-tag version. `scripts/sync-npm-version.sh` stamps
  `vscode/package.json` alongside the six npm packages, and the
  `vscode-package` CI job invokes it before `vsce package` (the
  npm-publish stamp runs in parallel, too late for the VSIX build).
- `internal/store/orgpush.go::SelectUnpushedSince` carried a
  `//nolint:gocyclo` annotation explaining why the four sequential
  per-table loops keep the function long-but-regular.
- Four call sites in `internal/db/db.go`, `internal/orgserver/server.go`,
  and `cmd/observer-org/scrub.go` carry `//nolint:gosec` annotations
  on `fmt.Sprintf` SQL fragments whose table/column args come from
  in-package allowlists (gosec G201 is a false positive for those).
- `cmd/observer/org.go` enrol-followup if/else chain rewritten as a
  switch (gocritic).
- Stale `scrubConfigDefaultPath` package var removed from
  `cmd/observer-org/scrub.go`.

## [1.8.0] — 2026-06-03

**Release headline.** Closes the Issues 1+2 privacy leak the
2026-06-02 teams test caught, and ships the operator-experience
surround the same test asked for: a per-node opt-in for full content,
quickstart admin bring-up, dev-auth bypass, observer doctor
org-awareness, and a golden-path CI smoke. The wire shape changes —
all v1.7.x and v1.8.x agents and servers interoperate gracefully (see
"Compat" below).

### Privacy posture (Issues 1+2 + the privacy invariant test blind spot)

- The Teams push seam at `internal/store/orgpush.go` shipped raw
  `actions.target` (run_command bodies + task_complete prose),
  `actions.source_file`, `projects.root_path`, `projects.git_remote`,
  and `token_usage.source_file` / `project_root` to the org server.
  The privacy invariant test had a blind spot — it asserted
  `target=main.go` was present as proof of populated payload.
- v1.8.0 ships **sha256-hex hashes** (`target_hash`, `source_file_hash`,
  `project_root_hash`, `git_remote_hash`) on the wire by default; raw
  content / path columns are stripped at the seam unless the **node
  operator** opts in via `[org_client.share].full_content = true` in
  their local config. A per-action allowlist
  (`target_action_allowlist = ["read_file", "edit_file", ...]`) ships
  raws for safe action types without enabling full content. The org
  admin cannot flip these remotely — they live solely in the node's
  TOML.
- Migration 034 (agent) + migration 003 (server) add the denormalized
  hash columns; on-disk rows are backfilled at first boot.
- `observer-org scrub-content --all --confirm` purges already-landed
  content from pre-v1.8.0 server DBs, preserving the hash counterparts
  so dedup + rollups still function. A startup WARN flags any
  remaining leaked content.
- The privacy invariant test now sentinels every string column the
  seam reads and asserts none leak in metadata-only mode.

### Compat

- **v1.7.x agent → v1.8.x server**: ingest computes hashes from raws
  on the fly; rows land with both shapes populated.
- **v1.8.x agent → v1.7.x server**: new hash keys are ignored by the
  older schema (additive); the metadata-only payload's empty raw
  fields are accepted with no migration drama.
- `SelectUnpushedSince` gains two trailing parameters
  (`ShareOptions`, `ScopeOptions`); call sites updated. Zero values
  preserve the safer metadata-only posture.

### Push scope (Issue 4)

- The push cursor seeds at the current high-water id at `observer
  enroll` time (already true since v1.7.x; M2.1 of the remediation
  added a regression test).
- `observer org status` now reports the share mode, the
  per-action / project-root allow/denylists in effect, and per-table
  historical-vs-eligible row counts.
- `observer org backfill --all --confirm` rewinds the cursor to 0 so
  the entire local corpus becomes eligible (explicit opt-in;
  dry-run by default).
- `observer org preview` exposes the existing
  `/api/enrolment/last-payload` via the CLI for "exactly what is my
  agent shipping" inspection.
- `[org_client.scope]` adds `project_root_allowlist` /
  `project_root_denylist` so a node can push only specific projects.

### Admin setup (Issue 5 + the eleven setup-friction points)

- `observer-org quickstart` orchestrates the whole dev bring-up:
  compose up → /healthz wait → SCIM provision admin → dev-auth login
  → mint enrolment token → print Dashboard URL + dev-auth curl + a
  ready-to-share `observer enroll` link.
- `[server].dev_auth = true` exposes `POST /auth/dev/login` (a
  password-free session-issuing endpoint) for local stack inspection.
  Logs a startup WARN and reports `dev_auth:true` on `/healthz` so
  monitoring catches a misconfigured production server.
- `deploy/observer-org/idp-config-override.php` pins the dev IdP to
  `http://localhost:8088/simplesaml/`, fixing the entityID-dynamism
  trap that produced unreachable redirects + 403 at the ACS
  (Issue 5a) and the SSO loop (Issue 5b) on a WSL2 host browser.
- New `GET /healthz` and `GET /readyz` probes.

### Node setup (the node-side friction items)

- `observer enroll --link http(s)://host/enrol/<code>` accepts the
  magic-link form admins share from quickstart, no manual URL split.
- A successful enrol auto-writes a default `[org_client]` block
  (enabled, push_interval, max_push_bytes, share, scope) into
  `~/.observer/config.toml` if absent. Idempotent; never re-encodes
  the file. `--write-block=false` skips for managed-config installs.
- `observer doctor` now reports enrolment state, share mode (warns
  loudly when `full_content=true`), allow/denylists, and the last
  push status.
- The OS-keychain-unavailable WARN now fires once per host downgrade
  (sentinel-driven), and antigravity decrypt-failure warnings are
  collapsed across files so the initial-scan burst on `observer
  start` is bounded.

### Robustness

- Root `.gitattributes` enforces LF tree-wide (covers Issue 6 — a
  Windows checkout no longer breaks the dev-stack `keygen.sh`).
- `observer org push-now` reports the cursor + max ids + last push
  when there's nothing to push, so the operator can tell why.
- New CI workflow `.github/workflows/teams-golden-path.yml` runs an
  end-to-end smoke against PRs touching the org code paths or
  compose stack: brings up the stack, enrols a synthetic agent,
  seeds an action with a raw command body, pushes via metadata-only
  mode, and asserts the wire shape (raw withheld, hash shipped, no
  grep-detectable leak).

### Documentation

- `docs/teams-getting-started.md` gains a "Local in 5 minutes"
  section using quickstart + dev-auth + enroll --link.
- `docs/plans/teams-test-findings-remediation-plan-2026-06-03.md` is the
  point-of-record for the remediation arc.

## [1.7.28] — 2026-06-02

**Release headline.** VS Code extension Marketplace listing polish.
The v1.7.27 listing rendered with broken wordmark images (relative
paths don't get rewritten for subfolder READMEs on Marketplace) and
led with descriptive copy rather than an actionable quick start.
v1.7.28 fixes both — no Go changes, no breaking changes, just a
better first impression for users hitting the Marketplace page.

### Fixed (v1.7.28)

- VS Code extension Marketplace listing showed broken logo images.
  Relative `<picture>` URLs in `vscode/README.md` don't get
  path-rewritten by Marketplace's markdown renderer when the README
  lives in a subfolder (`vscode/`, not the repo root). Fixed by
  switching to absolute `raw.githubusercontent.com` URLs pointing at
  the public repo's main branch.

### Changed (v1.7.28)

- VS Code extension README rewritten as an onboarding-first
  Marketplace landing page. Leads with a **5-minute quick start**
  (numbered steps from install through "your AI session shows up
  with accurate token counts"), followed by a surface-by-surface
  table that names the exact command or click to reach each surface.
  Earlier ordering led with descriptive "what this extension does"
  copy that buried the actionable parts.

- `scripts/release.sh` public-repo carve-out now includes
  `docs/vscode-extension.md` + `docs/vscode-extension-user-guide.md`.
  These were referenced from the rewritten README's "Going deeper"
  section but were previously private-only (the
  default `docs/*` exclusion stripped them from the public repo).
  Added to all three sites the script enforces: the
  `git add --force` re-staging list, the `.gitignore` allowlist, and
  the docs-leak sanity-check regex.

### Compatibility (v1.7.28)

- **No code changes.** Same observer binary as v1.7.27 (same SHA256,
  same behaviour). Pure docs + manifest release.
- VS Code extension auto-updates on next launch for users on v1.7.27.

## [1.7.27] — 2026-06-02

**Release headline.** SuperBased Observer is now a **VS Code extension**.
The same observer binary that ships via npm + PyPI now also ships as
`superbased.superbased-observer` on the VS Code Marketplace and Open VSX,
with 5 platform-tagged VSIXes (linux-x64, linux-arm64, darwin-x64,
darwin-arm64, win32-x64) per release. The extension wraps the existing
CLI + dashboard + proxy + MCP server with a UX shell — status bar with
today's spend, sidebar with Today / Sessions / Discovery / Costs trees,
embedded dashboard webview, file-freshness decorations, budget +
watcher-lag notifications, daemon crash recovery, contributed terminal
profile that pre-exports the proxy env vars, CodeLens on
`CLAUDE.md` / `AGENTS.md` / `.cursorrules`, and a native Get Started
walkthrough. Zero telemetry. All seven plan milestones (M0 → M6) +
the user-walkthrough follow-up (M6.1) shipped in one session.

### Added (v1.7.27)

#### VS Code extension

- `vscode/` — full TypeScript extension under `superbased.superbased-observer`
  publisher, version 1.7.27. Bundles the observer binary per platform
  via the new `vscode-package` matrix CI job + `vscode-publish` job in
  `.github/workflows/npm-release.yml`. 118 unit tests (~5.7 s green).
  - **Binary manager** with 4-step precedence: `observer.binary.path`
    setting → `$PATH` → bundled in VSIX → download from GitHub Releases
    with SHA256 verification.
  - **Three-mode daemon lifecycle** (`observer.daemon.mode = detect |
    managed | auto`) with lockfile safety so the extension never
    spawns a second daemon over the same database. Crash recovery via
    exponential backoff `[1 s, 2 s, 5 s]`; 4th failure surfaces an
    "Open Output Channel" / "Retry" toast.
  - **Today-spend status bar** polling `/api/analysis/headline?days=1`
    every 60 s. Click → open dashboard.
  - **Native sidebar** with four `TreeView`s: Today (60 s), Sessions
    (60 s + onSave), Discovery (5 min), Costs 7d (5 min).
  - **Embedded dashboard webview** hosting the React SPA via iframe,
    with `portMapping` so Codespaces / Remote-SSH work without
    operator intervention.
  - **File-freshness decorations** via the new `/api/file/state`
    endpoint — small dot in the explorer + Markdown hover with last-
    read-by, edits in 24 h, stale re-reads flagged, tools touched.
    5-min TTL cache with in-flight dedup.
  - **Budget + watcher-lag notifications** with sensible dedup
    (budget once/day, watcher-lag once/5 min/file).
  - **Contributed terminal profile** "AI Coding Tool (Observer-proxied)"
    pre-exporting `ANTHROPIC_BASE_URL`, `OPENAI_BASE_URL`, and
    `ENABLE_TOOL_SEARCH=true`.
  - **CodeLens on `CLAUDE.md` / `AGENTS.md` / `.cursorrules`**
    surfacing `Refresh from Observer learnings` and `Preview suggestions`.
  - **Native walkthrough** via `contributes.walkthroughs` — 7 steps
    with completion-event tracking, rendered in VS Code's Get Started
    view on first install.
  - **Zero telemetry, zero outbound network calls** except first-install
    binary download from GitHub Releases. All `/api/*` traffic to
    `127.0.0.1`.

#### Go side

- **`/api/file/state?path=<abs>`** — new dashboard endpoint
  (`internal/intelligence/dashboard/file_state.go`) returning
  `{last_read_at, last_read_by, edit_count_24h, stale_rereads_24h,
  tools_touched[]}` for one file. Four single-row queries against the
  existing `actions` + `sessions` tables; no new schema. Drives the
  VS Code extension's `FileDecorationProvider` + `HoverProvider`.
  Field name pinned as `stale_rereads_24h` (not `_avoided_24h`) —
  observer flags stale re-reads via `actions.freshness='stale'`,
  doesn't prevent them.

#### Release pipeline

- **`vscode-package`** matrix CI job (5 targets) + **`vscode-publish`**
  job added to `.github/workflows/npm-release.yml`. Both gated on
  `VSCE_PAT` presence with an inline `id: gate` step — no-op
  gracefully when secrets are absent so previously-passing releases
  stay green. OVSX has an additional `OVSX_PAT` gate with
  `continue-on-error: true`.

### Docs (v1.7.27)

- **`docs/vscode-extension.md`** — user-facing reference (commands,
  settings, surface tour).
- **`docs/vscode-extension-user-guide.md`** — long-form prose user
  guide (quick start, daily workflow, per-AI-tool integration for
  Claude Code / Cursor / Codex / Cline / Copilot, customisation,
  troubleshooting).
- **`docs/vscode-extension-tracker.md`** — implementation tracker for
  the M0 → M6 + M6.1 build-out.
- **`docs/vscode-marketplace-publish-process.md`** — canonical
  publish runbook with 7 named gotchas (G1 AzDO PAT scope, G2 indexing
  lag, G3 OVSX namespace auto-create, G4 Eclipse Publisher Agreement,
  G5 no-republish-same-version, G6 VSIX secret leakage, G7
  multi-target). Pairs with `docs/pypi-release-process.md`.
- **`docs/release-runbook.md`** updated: pipeline diagram includes
  vscode-package + vscode-publish jobs; output enumeration lists the
  5 Marketplace + 5 OVSX VSIXes alongside npm + PyPI; new
  Marketplace + OVSX section with `VSCE_PAT` + `OVSX_PAT` setup.
- **`.env.example`** at repo root + `vscode/.vscodeignore` belt-and-
  braces `.env` exclusion so secrets never ride into a VSIX.

### Compatibility (v1.7.27)

- **No breaking changes.** CLI surface unchanged; existing npm + PyPI
  installs continue working identically. The new
  `/api/file/state` endpoint is additive — pre-1.7.27 dashboard
  consumers don't notice it. The VS Code extension is a new
  distribution channel, not a replacement.
- **Marketplace listing** for v1.7.27 ships with the real SuperBased
  brand icon (replacing the placeholder used for the v1.7.26
  linux-x64 smoke publish), all 5 platforms instead of just linux-x64,
  and the new walkthrough.

## [1.7.26] — 2026-06-02

**Release headline.** Hotfix for v1.7.25: the PyPI wheels
uploaded in v1.7.25 were 24 KB and did NOT contain the observer
binary. Root cause: hatchling's default file-collection respects
`.gitignore`, and `pypi/observer/.gitignore` listed
`src/observer/_bin/observer` (intentionally — to keep staged
binaries out of git). The interaction silently dropped the
binary from the wheel. v1.7.25 has been yanked from PyPI.

### Fixed (v1.7.26)

- `pypi/observer/pyproject.toml` — explicitly excludes
  `src/observer/_bin` from the `[tool.hatch.build.targets.wheel]
  packages` glob and pulls the binary back in via
  `[tool.hatch.build.targets.wheel.force-include]`, which
  bypasses gitignore filtering. Wheels now contain the binary
  again (~21 MB compressed, was 24 KB).
- CI guard in `publish-to-pypi`: after retagging each wheel,
  unzip-inspect to verify `_bin/observer{,.exe}` is present and
  > 1 MB. Fails the workflow loudly instead of shipping empty
  wheels.

### Compatibility (v1.7.26)

- No behavior changes for npm users (npm v1.7.25 was fully
  functional; the bug was PyPI-only).
- PyPI users on v1.7.25 should upgrade to v1.7.26:
  `pip install --upgrade superbased-observer`.

## [1.7.25] — 2026-06-02

**Release headline.** PyPI distribution alongside npm:
`pip install superbased-observer` (or `uv tool install` /
`pipx install`) now installs the same prebuilt observer binary
shipped on npm. Five platform-tagged wheels per release —
`manylinux2014_{x86_64,aarch64}`, `macosx_*_{x86_64,arm64}`,
`win_amd64` — published from the same `v*` tag-push that drives
the npm release. Versions are kept in lock-step.

### Added (v1.7.25)

- `pypi/observer/` package source layout with hatchling-based
  build (`pyproject.toml`), thin Python launcher
  (`observer/__main__.py`) that `os.execv`s the bundled binary,
  and a per-platform wheel build flow mirroring the npm matrix.
- `publish-to-pypi` job in `.github/workflows/npm-release.yml`:
  builds the 5 wheels and uploads via `PYPI_TOKEN_OBSERVER` +
  `pypa/gh-action-pypi-publish`. Runs in parallel with the npm
  `publish` job; gated to the private repo same as the rest.
- `pypi/observer/README.md` long-description rendered on PyPI
  (mirrors npm README with pip-flavored install + troubleshooting
  sections).
- Root `README.md` install section gains a pip / uv / pipx
  sub-section alongside the existing npm sub-section.
- npm `README.md` adds a one-line cross-reference to the PyPI
  package so users see both options.
- `docs/plans/pypi-package-plan-2026-06-02.md` captures the full design
  doc (per-platform wheels vs sdist tradeoff, wheel-build
  mechanics, workflow integration, risks).

### Compatibility (v1.7.25)

- No schema migrations, no API changes, no behavior changes for
  existing users.
- `pip install` and `npm install -g` produce byte-identical
  `observer` binaries — the wheel + tarball pull from the same
  CI artifact.

## [1.7.24] — 2026-06-02

**Release headline.** Codex per-event token rows: each
`token_count` event in a codex rollout now lands as its own
`token_usage` row, with a new `turn_id` column grouping them
back to the user-turn. The dashboard's Session Detail panel
adds a Turn / Inference toggle on codex sessions so operators
can drill from the per-turn rollup (default, preserves existing
UX) into per-inference billing detail. Plus: canonical
`PRIVACY.md`, recipe-naming clarity sweep (`codex-variant` =
OpenAI's `-codex` reasoning fork; `codex-safe` = plain GPT
under codex CLI; both are recipes for the codex CLI), and a
one-shot backfill migration (033) for legacy codex rows whose
ON CONFLICT preserved the pre-v1.7.24 `message_id = TurnID`
shape.

### Schema (v1.7.24)

- **Migration 032** — `token_usage` adds `turn_id TEXT` column
  + `idx_token_usage_session_turn` index. NULL on existing
  rows; dashboard's `COALESCE(turn_id, message_id, source_event_id)`
  fallback keeps them rendering correctly without a backfill.
- **Migration 033** — one-shot backfill of legacy codex rows:
  moves the old `message_id` (which IS the TurnID) into
  `turn_id`, replaces `message_id` with `source_event_id`.
  Idempotent. Non-codex rows untouched.

### Added (v1.7.24)

- `?detail=inference` query parameter on
  `/api/session/<id>/messages`; default behavior unchanged.
- Frontend Turn / Inference SegmentedControl in the Session
  Detail panel's Messages section (visible only on codex
  sessions — Anthropic adapters already emit one row per
  upstream `msg_xxx`, the toggle would be a no-op there).
- `PRIVACY.md` canonical privacy doc at repo root.

### Changed (v1.7.24)

- **Codex adapter MessageID semantic** shifts from per-turn
  to per-model-inference: `MessageID = "tk:<file>:L<n>"`
  (the per-event identifier) instead of the old `TurnID`.
  `TurnID = turnID` is now stored separately on the
  `TokenEvent` struct and persisted to the new column.
  This aligns codex with claudecode's "MessageID = upstream
  API-call identifier" contract.
- **Recipe TOML headers** rewritten to lead with model-family
  decisions: explicit USE-WHEN / DO-NOT-USE blocks with
  example model IDs + a Naming clarification paragraph for
  the codex-* recipes. Same clarity in README and npm
  README compression tables.
- **README + npm README** updated with stronger privacy
  paragraph + PRIVACY.md link. npm README adds a "Measured
  savings" sub-section under Compression with v1.7.23
  empirical numbers and honest caveats.

### Fixed (v1.7.24)

- Stale "`code` compressor is opt-in only" comment in npm
  README (claude-code recipe has had `code` in defaults
  since v1.7.23 / V7-24).
- Legacy codex rows whose `message_id` was preserved as
  pre-v1.7.24 TurnID-UUID after the v1.7.24 adapter
  re-emitted under ON CONFLICT (migration 033).

## [1.7.23] — 2026-06-01

**Release-arc summary (v1.7.6 → v1.7.23).** 18 versions consolidated
into a single release covering the V7-1 through V7-26 work-stream:
new MCP knowledge tools (`get_file`/`get_symbols`/`get_relations`/
`retrieve_stashed` batch + codegraph BFS), Windows Job Object for
`observer codex`, the V7-19 critical `buildAllow([])` nil-trap fix
(inverted the codex-variant recipe in v1.7.6-v1.7.18), the V7-21
tools-defs gate, the V7-22 → V7-24 compression measurement arc that
ended with restoring `compress_types=["json","logs","code"]` as the
`claude-code` default after n=8 A/B (−6.9% mean cost vs OFF), the
V7-25 stash-vs-Anthropic-cache finding (stash stays disabled by
default), and the V7-26 codex baseline (inconclusive on gpt-5.4;
codex-safe recipe unchanged). Operators MUST set
`ENABLE_TOOL_SEARCH=true` in the launching shell when using Claude
Code with observer's proxy — without it, Claude Code's SDK eager-
inlines MCP schemas under `ANTHROPIC_BASE_URL` and the proxy becomes
a net loss. Full empirical writeup in
`docs/v1.7.23-compression-savings-empirical-2026-06-01.md`.

Headline (v1.7.23): **Re-measured the v1.7.22 catastrophic regression
on the V7-22 binary and found it gone.** V7-22's preceding fixes
(V7-19 nil-trap + V7-21 tools-defs gate) closed enough of the
re-marshal pathway that per-type compression no longer cascades on
the V7-22+ binary. n=8 Claude Code B-arm with per-arm prompt salts on
V7-22 binary `0a2b7900...`: **−6.9% mean cost vs n=4 OFF baseline**
($1.069 vs $1.148), CV 7.6% (tighter than OFF's 7.5%), zero tail
outliers (max cost $1.168, max turns 18). The `claude-code` recipe
default `compress_types` is restored to `["json","logs","code"]` —
the empirical winner. Operators MUST set `ENABLE_TOOL_SEARCH=true`
in the launching shell when using this recipe; without it Claude
Code's SDK eager-inlines MCP schemas under `ANTHROPIC_BASE_URL`
(~+21K tokens/turn), turning the proxy into a net loss. Plus: stash
is documented as cache-breaking on Anthropic traffic (V7-24: n=1
showed +25% cost / +97% cache_creation) and stays disabled by
default. Full empirical writeup:
`docs/v1.7.23-compression-savings-empirical-2026-06-01.md`.

### Fixed (v1.7.23)

- **Default `CompressTypes` restored to `["json","logs","code"]`**
  (`internal/config/config.go:703`). V7-22's defensive `[]` flip was
  based on n=4 on V7-21 binary; V7-24 n=8 on V7-22 binary shows the
  cascade is gone. The compressor implementations were already kept
  in place; this just re-enables them in the default allow-set.
- **`claude-code.toml` recipe → `compress_types = ["json","logs","code"]`**
  in both `docs/recipes/` and `internal/config/recipes/` (mirrored
  to satisfy `TestRecipes_InternalAndDocsAreIdentical`). Inline
  comments capture V7-23's empirical baseline and the `ENABLE_TOOL_SEARCH`
  operator requirement.
- **`claude-code.toml` recipe — stash documented as DO NOT ENABLE**
  on Anthropic traffic (V7-24). Stash's content-replacement breaks
  Anthropic's prefix cache, costing more than the bytes-on-wire
  savings. Disabled by default; operators can opt in for measured
  workloads but shouldn't expect savings.

### Updated tests (v1.7.23)

- `internal/config/config_test.go::TestDefaultCompressTypesIsEmpty`
  renamed to `TestDefaultCompressTypesIsJSONLogsCode`; assertion
  flips from `len(got) == 0` back to `{"json","logs","code"}`.
  Comment captures the V7-24 n=8 measurement and the historical
  default lineage.
- `internal/config/recipes_test.go::TestLoadRecipe_ClaudeCode`
  assertion flips from `len == 0` to `["json","logs","code"]` plus
  a new check that `Stash.Enabled` is false. Comment captures the
  V7-24 rationale.

### Backwards compatibility (v1.7.23)

- **Anyone using no explicit `[compression.conversation]` block** sees
  the default flip from `[]` (v1.7.22) back to `["json","logs","code"]`.
  This is the **same default value as pre-v1.7.22** — operators who
  were on v1.4.40-v1.7.21 see no semantic change relative to that
  era; operators who were on v1.7.22 see compression re-enabled.
  Per the V7-24 measurement, this is empirically a **net win** on
  Claude Code traffic; codex and other OpenAI traffic see the same
  default but the fast-path early-return makes it a no-op when no
  event fires.
- **The `claude-code` recipe** behavior reverts to the v1.4.40+
  semantic — per-type compression on. Other knobs unchanged.
- **The `codex-variant` recipe is unchanged** — still `[]`. The V7-21
  $0.270 measurement holds; codex operators see no behavior change.
- **The `codex-safe` recipe is unchanged** — still `["logs"]`.
- **Operators who want v1.7.22 passthrough behavior** opt out by
  setting `compress_types = []` in their config or recipe override.

### Operator note (v1.7.23)

**Set `ENABLE_TOOL_SEARCH=true` in your shell when using Claude Code
with observer's proxy.** Claude Code's SDK disables its
`ToolSearch:optimistic` deferred-MCP-loading feature under
`ANTHROPIC_BASE_URL`. Without the override, all MCP tool schemas
(observer's 17 + any Google Auth/Drive/Calendar/Gmail) are eager-
inlined into every request — ~+21K tokens per turn on the reference
rig. Observer's proxy forwards `tool_reference` blocks byte-identically,
which satisfies the SDK's documented safety condition for the override
(`strings ~/.local/share/claude/versions/*/claude | grep ENABLE_TOOL_SEARCH`).

For operators wanting to verify: the `cost-check.sh` script in
`docs/skills/observer-cost-tuning/scripts/` reads observer's
`/api/cost` endpoint and shows real per-tool $/turn from your
actual sessions.

---

## v1.7.22 (superseded by v1.7.23)

Headline (v1.7.22): The first **real Claude Code A/B** against the
proxy (n=4 OFF + n=4 B-arm via observer on `:8831` running the V7-21
binary with the `claude-code` recipe `compress_types =
["json","logs","code"]`, `mode = cache_aware`) measured a **+60% cost
regression and +88% turn-count regression vs no-proxy Claude Code**.
The model was doing nearly 2× the work to complete the same refactor
task. Root cause is the same shape as V7-19: every per-type
compression event bypasses the fast-path early-return in
`runAnthropic` and triggers `serializeAnthropic` re-marshal. The
`marshalEnvelope` helper sorts top-level keys alphabetically + escapes
HTML off, producing a byte-different shape than Claude Code's native
ordering. Anthropic's prefix cache (which keys on the first ~N bytes)
misses; `cache_creation` doubles; the model loses visibility into
prior content and re-derives → V7-11 cascade. v1.7.22 flips the
default `compress_types` from `["json","logs","code"]` to `[]` and
mirrors the change in the `claude-code` recipe. Per-type compression
becomes opt-in everywhere — operators who want it (e.g. cache-cold
short sessions where logs/code byte savings outweigh the re-marshal
tax) opt in explicitly. The codex-variant recipe (which V7-21 made a
small net win vs OFF at $0.270 codex / $0.30 OFF) and the codex-safe
recipe (still `["logs"]` — explicit operator opt-in) are **untouched**.
Plan + BC analysis:
`docs/plans/v1.7.22-claude-code-passthrough-plan-2026-06-01.md`.

### Fixed (v1.7.22)

- **Default `CompressTypes` flips to `[]`**
  (`internal/config/config.go:703`). The 2026-06-01 Claude Code A/B
  showed `["json","logs","code"]` triggered the V7-11 re-derivation
  cascade because every per-type compression event re-marshals the
  envelope through `marshalEnvelope` (alphabetical key order),
  producing a byte-shape Anthropic's prefix cache won't hit. Empty
  default → fast-path early-return on every turn → byte-identical
  forwarding → cache hits hold. The compressor implementations
  (`compressToolResults`, `LogsCompressor`, `CodeCompressor`,
  `JSONCompressor`, etc.) are kept; they just don't fire by default.
- **`claude-code.toml` recipe → `compress_types = []`** in both
  `docs/recipes/` and `internal/config/recipes/` (mirrored to satisfy
  `TestRecipes_InternalAndDocsAreIdentical`). Inline comments capture
  the V7-22 measurement + opt-in path.

### Updated tests (v1.7.22)

- `internal/config/config_test.go::TestDefaultCompressTypesIncludesCode`
  renamed to `TestDefaultCompressTypesIsEmpty`; assertion flips from
  `{json,logs,code}` to `len(got) == 0`. Comment captures the V7-22
  finding (+60% cost / +88% turns under prior default) and the
  historical default lineage (`["json","logs"]` → `["json","logs","code"]`
  in v1.4.40 → `[]` in v1.7.22).
- `internal/config/recipes_test.go::TestLoadRecipe_ClaudeCode`
  assertion flips from `["json","logs","code"]` to `len == 0`. Comment
  captures the V7-22 rationale + opt-in path.

### Backwards compatibility (v1.7.22)

- **Anyone using no explicit `[compression.conversation]` block** sees
  the default flip from `["json","logs","code"]` to `[]`. For Anthropic
  traffic this is unambiguously a win (the A/B measurement was −60%
  cost). For OpenAI traffic the codex-variant + codex-safe operators
  already had explicit configs so no change; operators with no config
  hitting OpenAI would also see the change but their behavior was
  governed by the same fast-path/slow-path split as Anthropic, so the
  outcome there is also expected to be neutral-to-positive.
- **The `claude-code` recipe** behavior changes from per-type-on to
  per-type-off. The recipe's other knobs (`mode = cache_aware`,
  `target_ratio = 0.85`, `preserve_last_n = 5`) are unchanged.
- **The `codex-variant` recipe is unchanged** — still `[]`. Codex
  operators see no behavior change from V7-21's $0.270 cost mean.
- **The `codex-safe` recipe is unchanged** — still `["logs"]`. That's
  an explicit opt-in to logs compression and respects operator intent.
  If real-world codex-safe usage hits the same re-marshal regression
  it can be addressed in a future release.
- **Operators who want pre-v1.7.22 per-type behavior** opt in by
  setting `compress_types = ["json","logs","code"]` (or any subset)
  in their config or recipe override.

### Documentation (v1.7.22)

- **New: `docs/skills/observer-cost-tuning/`** — a Claude Code skill
  + operator guide explaining the **~+36% per-turn cost overhead**
  observers see when routing Claude Code through observer's proxy.
  Diagnosis: Claude Code's SDK disables `ToolSearch` deferred MCP
  loading whenever `ANTHROPIC_BASE_URL` is set, which forces all
  registered MCP tool schemas (observer's 17 tools + any Google
  Auth/Drive/Calendar/Gmail tools the operator has registered) to
  be eagerly inlined into every request's prefix — ~+17K tokens of
  prefix per request, ~+36% per-turn cost vs no-proxy (measured
  n=3 OFF / n=3 valid B-arm, 2026-06-01). This is an SDK behavior,
  not a proxy bug; v1.7.22's `compress_types = []` default already
  makes the proxy byte-passthrough on Anthropic traffic. The skill
  presents two operator tiers (**hooks-only** = `observer init
  --claude-code --skip-mcp` → 0% overhead; **full MCP** = default
  → +36% overhead, in exchange for the 17 MCP tools being callable
  from Claude Code in-session) and explicitly marks the **light MCP**
  tier (subset-of-tools knob) as **planned for v1.8.x**. Ships with
  three reference files (operator-guide.md, setup-matrix.md,
  why-toolsearch-disabled.md) + a runnable `scripts/cost-check.sh`
  that reads observer's own `/api/cost` endpoint to show actual
  per-tool $/turn over a chosen window. Discoverable from
  `docs/architecture.md` (mcp row) and `docs/claude-code-smoke.md`
  (cost-tuning callout). Operators install the skill by symlinking
  `docs/skills/observer-cost-tuning/` into `~/.claude/skills/`;
  automated install via `observer init --claude-code --skill` is
  tracked for v1.8.x.

### Open follow-ups (post-V7-22)

The **real** structural fix is to make `serializeAnthropic` produce
byte-stable output that matches Claude Code's (and OpenAI clients')
native key ordering, OR to do byte-level in-place tool_result
substitution instead of re-marshaling the full envelope. Either
approach would let operators turn on per-type compression AND keep
the prefix cache hits. Tracked as a v1.7.23+ or v1.8.x follow-up:
- **Option A**: parse the original body's top-level key order once,
  restore it in `marshalEnvelope`. Smaller change.
- **Option B**: byte-level rewriting — when a tool_result content
  shrinks, find it by offset in the original body and splice the new
  content in. Larger change but more thorough.

Headline (v1.7.21): The V7-19 quantitative validation (n=8 codex-variant
runs through the V7-19-fixed binary, 2026-06-01) showed the catastrophic
+9-11% regression was gone but a **residual +10% proxy overhead
remained** vs the no-proxy baseline. Cache-hit ratios across the n=8
B-arm and n=10 OFF were statistically identical (+0.5%), so the
already-flagged "C16 read-cache breaks `prompt_cache_key`" hypothesis
was disconfirmed. The real cause: `compressToolDefinitions` (Anthropic
+ OpenAI Responses + OpenAI Chat — all three pipeline.go sites) ran
**unconditionally**, with no gate from `compress_types`. Whenever a
tool entry's description tail or `parameters.examples` shrank — i.e.
on every real tool schema — the early-return fast-path was bypassed,
`serializeAnthropic` / `serializeOpenAIResponses` re-marshaled the
envelope, and `json.Marshal` reordered top-level keys + rewrote HTML
chars. This doesn't break the prefix cache (the new shape stabilises
and re-caches), but **every re-marshaled turn permanently inflates
prior-turn bytes carried forward** — net-new input per turn is ~14%
larger than no-proxy. The hit is universal across providers, not
codex-specific: Claude Code on the default `compress_types =
["json","logs","code"]` recipe paid the same overhead (just hidden
in the noise of larger conversation footprints — we have no Claude-
Code-traffic empirical data; the lumen C-arm tested the claude-code
recipe applied to codex traffic, not real Claude Code). v1.7.21 adds
`Tools ContentType = "tools"` as a sentinel and gates all three
`compressToolDefinitions*` call sites behind `allow[types.Tools]`.
Default `compress_types` stays `["json","logs","code"]` (tools NOT
included), so every shipped recipe stops trimming tools and the +10%
overhead disappears for current operators. Operators who want to
preserve the trim explicitly opt in via `compress_types = [...,
"tools"]`. Plan + BC analysis:
`docs/plans/v1.7.21-tools-defs-gate-plan-2026-06-01.md`.

### Added (v1.7.21)

- **`types.Tools ContentType = "tools"` sentinel**
  (`internal/compression/conversation/types/detect.go:27`). Unlike
  the other content types (json/code/logs/text/diff/html), `Tools`
  is **not** returned by any detector — it only appears as a key in
  `buildAllow`'s map. Sole consumer: the gate at the three
  `compressToolDefinitions*` call sites.
- **Regression tests pinning the V7-21 contract**
  (`internal/compression/conversation/pipeline_test.go`):
  - `TestPipeline_ToolsDefsGated_NotInCompressTypes_NoTrim` — default-
    list recipe (no `"tools"` in `compress_types`) → tool-defs trim
    skipped → body forwarded byte-identically → `examples` survives,
    description tail survives, fast-path taken.
  - `TestPipeline_ToolsDefsGated_InCompressTypes_DoesTrim` — opt-in
    recipe (`"tools"` added) → tool-defs trim fires as before →
    description tail trimmed, `examples` stripped.
- **V7-21 compendium row** in
  `docs/v4-codex-compression-recipe-and-issues.md` documenting the
  finding, the +14% net-input vs the +10% cost ratio, the cache-hit
  parity, and the BC blast radius.

### Fixed (v1.7.21)

- **`compressToolDefinitions` gated behind `compress_types` at all
  three pipeline sites** (`internal/compression/conversation/
  pipeline.go:358` Anthropic, `:447` OpenAI Chat, `:509` OpenAI
  Responses). Pre-v1.7.21 the trim ran unconditionally; post-v1.7.21
  it only fires when `compress_types` includes `"tools"`. The
  `allow := buildAllow(p.cfg.CompressTypes)` value is also hoisted
  out of the immediate `compressToolResults` call so each pipeline
  path computes it once.
- **`TestPipeline_EmptyCompressTypes_SkipsAllPerTypeCompression`
  extended to assert no `tools` mechanism event** — the V7-19 +
  V7-21 combined contract. Pre-v1.7.21 this test allowed `tools` to
  fire under empty `compress_types`; that gap was the V7-21 footprint
  in the regression suite.

### Backwards compatibility (v1.7.21)

- **All shipped recipes stop trimming tools.** `claude-code` (default
  list `["json","logs","code"]`), `codex-safe` (`["logs"]`), and
  `codex-variant` (`[]`) all omit `"tools"` — operators on any
  shipped recipe see tool-defs trim stop firing. Wire effect: the
  envelope's `tools` field is forwarded byte-identically. Net effect:
  removes the ~$0.03/session (~10%) re-marshal overhead measured on
  codex-variant; same effect on claude-code (unmeasured but
  structurally identical).
- **Cold-cache regression risk** — `compressToolDefinitions`'s own
  doc comment says: "*on warm turns it produces zero net savings on
  the wire (the tools field is cached either way)*". The savings
  materialise on cache-cold turns (first message of a session, or
  after the cache TTL elapses). Multi-turn sessions: re-marshal tax
  dominated; v1.7.21 is a clear win. Very-short sessions with large
  tool schemas: the cold-cache savings *might* exceed the
  per-session re-marshal tax; operators with this profile opt in
  via `compress_types = [..., "tools"]`.
- **The default `CompressTypes` list in `internal/config/config.go:
  703` is unchanged.** Tools is opt-in everywhere.

Headline (v1.7.20): Dashboard analysis-headline "prior month same day"
window overflowed past first-of-current-month when the prior month
was shorter than today's day-of-month (e.g. on May 31, the
`[priorMonthStart, priorMonthStart + (now - monthStart))` window
ended at May 1 ~14:00 UTC instead of April 30 23:59), silently
double-counting MTD turns in the prior-month baseline. The bug
surfaced as a CI failure on `TestAnalysisHeadline_PriorMonthSameDay`
during the V7-19 validation cycle (PR #36, 2026-05-31). For
operators viewing the Analysis tab on the 29/30/31 of a 31-day
month after a 30-day prior month, the displayed `vs_prior_month_pct`
KPI was wrong — typically showing a smaller (or inverted)
month-over-month delta than reality. Fix is a one-line clamp:
`if priorMonthSameDayEnd.After(monthStart) { priorMonthSameDayEnd =
monthStart }` at `internal/intelligence/dashboard/analysis.go:71`.
A new deterministic test `TestAnalysisHeadline_PriorMonthShorterThanCurrentDay`
pins the May-31 regression case under an injected clock so the
guarantee holds regardless of when CI runs.

### Fixed (v1.7.20)

- **Analysis headline prior-month window clamp**
  (`internal/intelligence/dashboard/analysis.go:75`). When prior
  month is shorter than today's day-of-month (any 31st in a row
  preceded by a 30-day month — Mar 31, May 31, Jul 31, Oct 31, Dec
  31 — plus Mar 29/30/31 after Feb), the prior-month-same-day
  comparison window now correctly stops at `monthStart` instead of
  leaking into the current month. The fix is additive — it only
  changes behavior on days where the window would have overflowed.
- **Clock injection on `dashboard.Server`** (`dashboard.go:75`).
  New unexported `now func() time.Time` field defaults to
  `time.Now().UTC()`; tests override to pin date-sensitive handlers.
  Only the analysis-headline handler is wired through `s.now()` in
  this PR (the other 7 `time.Now().UTC()` sites in the dashboard
  package are unchanged and remain candidates for follow-up if
  their tests start flaking on a calendar boundary).

### Added (v1.7.20)

- **Regression test `TestAnalysisHeadline_PriorMonthShorterThanCurrentDay`**
  (`internal/intelligence/dashboard/analysis_test.go`). Pins
  `now = 2026-05-31 14:00 UTC` via the new `Server.now` override and
  seeds:
  - prior-month turn at Apr 15 12:00 UTC (always inside prior month)
  - MTD turn at May 1 08:00 UTC (inside the buggy overflow window
    `[May 1 00:00, May 1 14:00)` — without the clamp, this leaks
    into `priorMonthSameDayUSD` and the assertion `=0.30` fails
    with `0.9000…`).

Headline (v1.7.19): **Critical** — `buildAllow([])` nil-trap silently
inverted the codex-variant compression recipe shipped in v1.7.6. The
recipe sets `compress_types = []` intending "compress nothing per
type" (the V7-11 mitigation). `buildAllow([])` returned `nil`, and 5
downstream gates use `if allow != nil && !allow[ct] { continue }` —
which short-circuits to `false` when `allow == nil`, meaning every
content type was allowed (compressed) instead of denied (skipped).
Net effect for every operator on v1.7.6 + codex-variant recipe: the
**most aggressive** per-type compression ran (including the
destructive `text` head-tail compressor), stripping ~3.8 MB of tool
output per typical session, triggering the V7-11 re-derivation
cascade. Empirical (lumen A/B against codex 0.133 + ChatGPT-Plus,
gpt-5.4 × medium, strict-prompt n=10): the codex-variant arm cost
**+9-11% MORE** than the no-proxy baseline — the exact opposite of
the recipe's stated goal. v1.7.19 fixes the nil-trap at two layers
(defense in depth): `buildAllow` now returns a non-nil empty map for
empty input, and all 5 call sites drop the `allow != nil &&` guard
so nil-map access correctly returns the zero value. Full
investigation in `/tmp/lumen-ab/INVESTIGATION-codex-regression.md`
(empirical evidence + code trace + git archaeology + remediation plan).

### Fixed (v1.7.19)

- **V7-19 `buildAllow([])` returns non-nil empty map**
  (`internal/compression/conversation/pipeline.go:622`). Empty input
  now produces an empty map that, when accessed with `!allow[ct]`,
  correctly returns `true` for every key — expressing the intended
  "deny all per-type compression" semantics. Nil input also returns
  an empty map for symmetry.
- **5 call sites drop the `allow != nil &&` guard**:
  - `internal/compression/conversation/openai.go:989` (Responses API
    per-type)
  - `internal/compression/conversation/openai.go:1327` (Chat
    Completions per-type)
  - `internal/compression/conversation/anthropic.go:328` (Anthropic
    per-type)
  - `internal/compression/conversation/budget.go:286` (budget
    enforcer compressMessageTextSection)
  - `internal/compression/conversation/budget.go:320` (budget
    enforcer compressStructuredOutputSection)
  
  New gate: `if !allow[ct] { continue }`. Go nil-map access returns
  the zero value (false), so `!allow[ct]` correctly returns true on
  a nil-or-empty map → skip per-type compression.

### Backwards compatibility (v1.7.19)

- **`compress_types = []` now correctly compresses nothing per type**
  (matching the codex-variant recipe's documented intent). Operators
  who relied on the v1.7.6-v1.7.18 buggy behavior (silently maximum
  compression under `compress_types = []`) will see different output.
  Practical impact: the buggy behavior was the V7-11 cascade trigger
  the recipe was supposed to FIX — operators were never benefiting
  from it, only paying for it.
- **`compress_types` unset / nil** now also means "compress nothing"
  (same as empty). Pre-v1.7.19 nil meant "compress all" via the
  short-circuit. The only call sites that pass nil are the public
  `Pipeline.Run` path through `buildAllow(p.cfg.CompressTypes)`, and
  every shipped recipe + default sets a non-empty `compress_types` —
  so this BC change is observable only in the explicit
  `compress_types = []` recipe (which got the wrong behavior anyway).
- **The always-on transformers (tools-defs trim + C16 read-cache
  substitution) are NOT under `buildAllow`'s gate** and continue to
  fire regardless of `compress_types`. Their cache-key impact is a
  separate issue (open follow-up in the V7-19 investigation doc).

### Closed V7 issues (v1.7.19)

- **V7-19** — `buildAllow([])` nil-trap inverts codex-variant recipe.
  Was the catastrophic regression measured against the V4 codex
  compression doc's V7-11 mitigation strategy — the recipe was
  literally doing the opposite of its stated goal. Investigation
  surfaced by lumen A/B test on 2026-05-31, fixed same day.

Headline (v1.7.18): Two compression-telemetry fixes surfaced by a
live A/B test against `usernametba/lumen` on 2026-05-31 (codex-CLI +
ChatGPT-Plus, n=1 per arm). **V7-18 Bug 1** clips negative
`tokens_saved_est` / `cost_saved_usd_est_*` columns when the
conversation pipeline runs in pass-through mode (codex-variant recipe
with `compress_types=[]`) — per-turn JSON re-marshaling + envelope
overhead can make `compressed_bytes > original_bytes` (measured
~3.7% inflation on an 8-turn audit run), and pre-fix `observer cost`
reported negative dollar savings which misled operators into
believing the codex-variant recipe was actively HURTING them. **V7-18
Bug 2** populates `compression_events.body_hash` on the `tools`
mechanism Event construction sites (anthropic + 2× openai paths) so
`store.CountUniqueCompressions` (v1.7.12 V7-9) actually deduplicates
the per-turn re-emission of identical tool-schema events. Both fixes
are observability-only — no compression behavior changes.

### Added (v1.7.18)

- **V7-18 Bug 2 BodyHash on tools-mechanism Events**: the three
  tool-definition compressor sites — `internal/compression/
  conversation/anthropic.go::compressToolDefinitions`,
  `openai.go::compressOpenAIResponsesToolEntry`, and
  `openai.go::compressOpenAIChatToolEntry` — now populate
  `Event.BodyHash = bodyHashHex(string(raw))` matching the v1.7.12
  V7-9 pattern wired on the logs/code/json compressor sites.
  Cross-turn dedup: OpenAI's Responses API re-sends the full `tools`
  array on every turn, so before this fix `compression_events`
  recorded N events for the same logical tool definition over an
  N-turn conversation. `store.CountUniqueCompressions(ctx, sessionID)`
  now returns the correct deduped count (1, not N).
- **V7-18 Bug 1 clip negative `tokens_saved_est`** in
  `cost.Engine.Summary`: `savedBytes` is now floored at 0 before
  flowing into `TokensSavedEst` and the three USD savings columns
  (`CostSavedUSDEst`, `CostSavedUSDEstInputTier`,
  `CostSavedUSDEstCacheReadTier`). Negative savings have no
  operational meaning — they're an artifact of the conversation
  pipeline's per-turn envelope overhead under pass-through recipes,
  not an actual cost increase from compression. Raw
  `original_bytes` / `compressed_bytes` on the row are preserved
  unchanged so operators can still see wire inflation via the JSON
  summary or direct SQL queries against `api_turns`.

### Backwards compatibility (v1.7.18)

- Both fixes are observability-only. No proxy behavior changes — the
  conversation pipeline still runs identically, `compression_events`
  rows still emit (now with stable body_hash on the tools mechanism),
  cost rollups still compute identically except that previously-
  negative `cost_saved_usd_est_*` values now read 0.
- Existing operators reading the JSON summary will see
  `cost_saved_usd_est_*` go from "occasionally negative" to "always
  ≥ 0". Dashboards graphing the savings column may show a one-time
  jump if they previously aggregated negative values (most don't).
- The CLI `SAVED` column was already clipping for display (renders
  `0B (0%)` when savings are non-positive), so no CLI-output drift.
  This fix moves the clip from the renderer up to the engine so JSON
  consumers see the same clipped value as the CLI.
- `compression_events.body_hash` was nullable in v1.7.12 (migration
  031); v1.7.18 fills it on the tools mechanism path only. Pre-
  v1.7.18 rows stay NULL and are excluded from the dedup query, same
  as the other compressor paths from v1.7.12.

### Closed V7 issues (v1.7.18)

- **V7-18** — compression telemetry surfacing surfaced by the
  lumen A/B test (2026-05-31). Both sub-bugs fixed:
  - Bug 1: negative `cost_saved_usd_est_*` under pass-through
  - Bug 2: tools-mechanism `body_hash` wiring gap

Headline (v1.7.17): Three diagnostic improvements from the V3/V4
carry-forward backlog. **V3-4** ships a per-user hook-events.jsonl
log at `~/.observer/hook-events.jsonl` so operators can debug "why
didn't the hook fire?" without raising the log level. **V3-5** adds
a `LATENCY_MS` column to `observer cost` surfacing the
proxy-observed mean request → response time per group bucket from
`api_turns.total_response_ms`. **V4-2** restores the
`observer cost --filter <substring>` flag (lost in the v1.7.2 cobra
flatten) for narrowing rollups by key substring with OR semantics.

### Added (v1.7.17)

- **V3-4 hook-event log**: every observer hook invocation appends one
  JSONL row to `~/.observer/hook-events.jsonl` with `{ts, event,
  bytes, session_id?, tool?, action}`. Per-process mutex + O_APPEND
  for race safety across goroutines and processes. Best-effort —
  HOME unset / mkdir fails / write fails = silent no-op. The hook
  MUST NOT break the host tool (spec P1).
- **V3-5 proxy latency in `observer cost`**:
  - `cost.Row.AvgLatencyMS` field on the JSON summary (omitempty when
    zero — JSONL-only buckets emit 0 → field absent).
  - `LATENCY_MS` column in the CLI table, appears only when at least
    one row has a populated value. Pure JSONL summaries keep the
    v1.7.16 column layout — no observable change for non-proxy users.
  - Rows with `total_response_ms = 0` (JSONL adapter path + pre-v1.4.x
    proxy rows) are excluded from the mean — including them would
    skew the average downward.
- **V4-2 `observer cost --filter`**:
  - Repeatable flag; multiple filters are OR-combined.
  - Case-insensitive substring match against `Row.Key`.
  - Totals are NOT recomputed — they represent the full window's
    activity. Operators wanting filtered totals use
    `--group-by none --filter ...`.

### Backwards compatibility (v1.7.17)

- V3-4: new file under `~/.observer/`. No existing files touched, no
  schema migrations. Operators can `rm` the file at any time.
- V3-5: `LATENCY_MS` column shows only when populated; CLI layout
  unchanged for JSONL-only summaries. `AvgLatencyMS` uses `omitempty`
  in JSON — pre-v1.7.17 consumers reading specific fields see no drift.
- V4-2: `--filter` is purely additive. Pre-v1.7.17 invocations
  without the flag behave identically.

### Closed carry-forward items (v1.7.17)

- **V3-4** — hook event log file
- **V3-5** — per-turn proxy latency in observer cost
- **V4-2** — observer cost --filter flag restore (lost in v1.7.2)

Headline (v1.7.16): V7-17 — V7-12 response-surface polish from the
notes file. Four items shipped: in-band `warnings: [...]` array,
regex fallback when codegraph is unavailable, drift signal
(`index_lines` + `live_lines`) when codegraph is stale, and
`include_nearby` opt-in for sibling-symbol context. Closes the V4
codex compression doc — including the notes file's stretch items —
fully observer-side.

### Added (v1.7.16)

- **Warnings array (item 1)**: top-level `warnings: [...]` on every
  V7-12 tool response. Closed-set tag strings:
  `codegraph_unavailable`, `codegraph_stale`,
  `index_changed_mid_query`, `regex_fallback_language_unsupported`.
  Agents pattern-match on the literals rather than parsing free
  text. `internal/mcp/warnings.go` is the single source of truth.
- **Live regex parser (item 2 + 4 foundation)**: new
  `internal/codegraph/livesym` package with `Parse(path) → (syms,
  langUnsupported, err)`. Supports Go (function / method / type /
  interface), TypeScript/TSX (function / class / interface / type),
  JavaScript/JSX (function / class), Python (function / async def
  / class). EndLine is `-1` in v1.7.16 — honest "regex can't tell"
  rather than fragile brace-counting; future tree-sitter integration
  can lift the limitation.
- **Regex fallback when codegraph unavailable (item 2)**: get_symbols
  now returns approximate matches via livesym when
  `codegraph.Available() == false`. Matches carry the real name +
  kind + start_line + language; end_line = 0 (existing "unknown"
  sentinel); per-result `degraded: true`; envelope warning
  `codegraph_unavailable`. Unsupported extensions return empty matches
  + `regex_fallback_language_unsupported` warning — honest "we can't
  help here" rather than misleading silence.
- **Drift signal (item 4)**: when `codegraph.Stale(absPath)` fires,
  get_symbols runs the live regex parser alongside the index query
  and surfaces both positions per match via new `index_lines`
  (`{start, end}`) and `live_lines` (`{start, end}`) fields on
  `symbolMatch`. Steady-state (no drift) keeps both fields omitted —
  v1.7.15 response shapes preserved byte-identical when codegraph is
  up-to-date.
- **`include_nearby` opt-in (item 1 — naming overlap with V7-17 item
  1 unintentional)**: get_symbols requests can set `include_nearby:
  N` (>0) to get `nearby_symbols: [...]` per match — up to N before
  + N after by `start_line`, same file. Capped server-side at 20 per
  side. Default 0 = omitted field, v1.7.15 BC.

### Backwards compatibility (v1.7.16)

- Every new field uses `,omitempty`. Pre-v1.7.16 callers reading only
  the legacy keys see no observable change in steady-state responses.
- The `degraded: true` flag stays semantically identical. `warnings`
  is additive context, not a replacement.
- `index_lines` + `live_lines` are populated ONLY when they differ;
  agreement = both fields omitted.
- `nearby_symbols` opt-in via request flag; absent flag = absent
  field.
- Regex fallback only fires when codegraph is unavailable. Operators
  with codebase-memory-mcp installed see identical behavior to
  v1.7.15.

### Closed V7 issues (v1.7.16)

- **V7-17** (capture of the V4 notes-file polish bundle) — all 4
  items shipped. Full V4 codex compression document is now closed
  observer-side. Remaining pure-deferrals (V7-5 operator-script,
  V7-7 methodology, V7-10 upstream codex bug) are not in observer
  scope.

Headline (v1.7.15): V7-1 Windows Job Object — `observer codex` now
attaches its codex.exe child to a Job Object configured with
`KILL_ON_JOB_CLOSE`. If the wrapper dies for any reason (clean exit,
watchdog `Stop-Process` hammer, SIGKILL), Windows automatically
closes the wrapper's handles and codex.exe terminates with no
zombie left behind to keep writing to its rollout JSONL.
v1.7.5 documented the failure mode + shipped the operator-script
workaround (`observer codex --exclusive` enumerates and terminates
zombies before exec); this PR closes the loop with an observer-side
fix that prevents the zombie from forming in the first place.

Closes the V4 codex compression issues doc's last observer-codeable
remainder. Remaining V7 items (V7-5 operator-script, V7-7
methodology, V7-10 upstream codex bug) are not in scope for
observer.

### Added (v1.7.15)

- New `internal/jobobject` package:
  - `AttachProcess(*exec.Cmd) (io.Closer, error)` — creates an
    anonymous Job Object with `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`
    and assigns the started process to it. cmd MUST have been
    `Start()`'d already (its `Process` populated).
  - Windows-only impl uses `golang.org/x/sys/windows`
    (`CreateJobObject` / `SetInformationJobObject` /
    `AssignProcessToJobObject`). Non-Windows builds compile to a
    no-op stub returning a no-op Closer so the call site doesn't
    need build tags.
  - Returned Closer holds the Job Object handle; `Close()` is
    idempotent. Operators wanting an explicit kill (vs. waiting
    for wrapper process exit) call `Close()` to fire
    `KILL_ON_JOB_CLOSE` on every assigned process immediately.
- `cmd/observer/codex.go` split `child.Run()` into
  `child.Start()` + `child.Wait()` so `AttachProcess` can wedge
  between them. Attach failure is non-fatal: logged to stderr,
  spawn continues without V7-1 protection.

### Backwards compatibility (v1.7.15)

- Non-Windows builds: AttachProcess is a no-op stub. Linux + macOS
  operators see zero observable change. POSIX signal forwarding
  already cascades wrapper death to children, so the protection is
  unnecessary outside Windows.
- Windows builds where AttachProcess fails (rare — would require
  the OS to refuse `CreateJobObject` or `AssignProcessToJobObject`,
  e.g. due to existing-job restrictions): stderr log line, codex.exe
  continues to run unprotected — same behavior as v1.7.14.
- `child.Run()` → `child.Start()` + `child.Wait()` refactor at
  the call site is semantically identical: same stdio, same exit
  code, same `*exec.ExitError` unwrap path.

### Closed V7 issues (v1.7.15)

- **V7-1** — Windows codex.exe zombie. Observer-side fix complete;
  operator-script workaround (`observer codex --exclusive`) stays
  available as a belt-and-suspenders measure for hosts that boot
  with pre-existing zombies from previous (pre-v1.7.15) sessions.

Headline (v1.7.14): V7-14 operator CLI — `observer mcp-audit` with
five subcommands (`list` / `stats` / `top-paths` / `denied` /
`purge`). The audit log shipped in v1.7.8 (migration 030 + writer)
required raw SQL to interrogate; this PR adds an operator-facing
read surface so "why was X denied?", "which file is the agent
re-reading?", and "is the MCP load growing?" become one-liners.
Every read subcommand supports `--json` for machine consumption;
`purge` requires both `--older-than` and `--yes` for destructive
hygiene.

### Added (v1.7.14)

- New `internal/mcp/audit/reader.go` — read-side queries on the
  `mcp_audit` table:
  - `List(ctx, db, opts)` — filtered row list (session, tool,
    since, only-denied, limit); default cap 50 to keep CLI output
    tractable.
  - `StatsSummary(ctx, db, since)` — aggregate counts (total / ok /
    denied / truncated) + per-tool breakdown.
  - `TopPaths(ctx, db, since, limit)` — most-requested
    `path_requested` values, grouped + summed bytes + ok/denied
    split. Excludes NULL paths so tools without a path argument
    don't drown the signal.
  - `Purge(ctx, db, olderThan)` — destructive deletion; rejects
    `olderThan <= 0` as a footgun.
- New `observer mcp-audit` CLI (`cmd/observer/mcp_audit.go`):
  - `list [--session ID] [--tool NAME] [--since DUR] [--limit N] [--json]`
  - `stats [--since DUR] [--json]`
  - `top-paths [--since DUR] [--limit N] [--json]`
  - `denied [--since DUR] [--limit N] [--json]`
  - `purge --older-than DUR --yes`
  - `--since` accepts Go-style duration strings (`30m`, `24h`,
    `168h` for 7d, etc.); empty/`0` = all time.
  - `purge` requires both `--older-than` and `--yes` so a
    misclick on the flag set doesn't wipe history.
- New `printListRows` / `printStats` / `printTopPaths` helpers use
  `text/tabwriter` (matching `observer cost`'s output cadence).
- Tab-aligned table format for human reading; per-row JSON
  marshalling for scripts.

### Backwards compatibility (v1.7.14)

- Pure-additive — no existing CLI surfaces change. New top-level
  subcommand under `observer mcp-audit`. Older operators not setting
  any new flags see no behaviour difference.
- `audit.Stats` / `audit.TopPath` / `audit.ListRow` are new
  exported types in `internal/mcp/audit`; reader functions are
  additive on top of the existing async-writer surface.

### Closed V7 issues (v1.7.14)

- **V7-14** — MCP audit log + operator CLI. The schema + writer
  shipped in v1.7.8 (PR #25); this PR ships the operator surface.
  V7-14 is now fully closed.

Headline (v1.7.13): V7-8 cross-process stash-dir detection. The proxy
that initialises stash compression now advertises its active dir in
a sidecar file under the observer home (`~/.observer/.proxy-stash-dir.txt`).
`observer serve` reads the sidecar at startup and surfaces one of
three outcomes: aligned (Info), mismatch (Warn with both paths +
recovery hint), or no proxy yet (Info pointing at sidecar path).
Decouples cross-process discovery from any shared registry — works
across multiple observer instances on the same host with last-
writer-wins on the sidecar.

### Added (v1.7.13)

- New `internal/stashalign` package:
  - `WriteSidecar(homeDir, stashDir)` / `ReadSidecar(homeDir)`
    round-trip the active proxy-side stash dir via the
    `.proxy-stash-dir.txt` sidecar. Atomic write via tmp+rename so a
    concurrent read never sees a partial path. Missing sidecar reads
    as `("", nil)`; other I/O errors propagate so operators can
    distinguish "no proxy yet" from broken permissions.
  - `CompareDirs(mcpDir, proxyDir)` returns `(ok bool, hint string)`.
    Resolves trailing slashes + symlinks via `filepath.EvalSymlinks`
    so operators symlinking the stash dir to a shared volume still
    align cleanly. Mismatch hint names both paths and the specific
    remedy ("repoint one side, or start both with same --config").
  - `DefaultObserverHome()` returns `~/.observer/` — one place for
    the home-dir constant.
- Proxy side (`cmd/observer/proxy.go`): after `stash.New` succeeds,
  writes the sidecar. Failures log Warn and continue — stash
  compression still works.
- MCP server side (`cmd/observer/serve.go`): after `stash.New`
  succeeds, reads the sidecar and compares. Three outcomes logged
  distinctly so operators can grep their startup log.

### Backwards compatibility (v1.7.13)

- Sidecar write is best-effort — proxies that fail to write
  (e.g. read-only home dir) still serve compression normally.
- MCP servers that find no sidecar log Info, not Warn — operators
  running an older proxy version (no sidecar) don't get a
  false-positive alarm.
- The detection is advisory: nothing changes in retrieve_stashed's
  call shape or the stash's contents. Operators ignoring the warning
  fall back to v1.7.12 behavior (silent misses on mismatched dirs).

### Closed V7 issues (v1.7.13)

- **V7-8** — cross-process stash-dir mismatch detection. The latent
  failure mode from the V4 codex compression doc — proxy and MCP
  server pointed at different dirs — now surfaces a loud warning at
  startup instead of silent retrieve_stashed misses.

Headline (v1.7.12): V7 backlog cleanup — three independent fixes
that close the smaller correctness/telemetry items from the V4 codex
compression document. **V7-3** strips codex's shell envelope before
content classification so wrapped JSON / Diff / HTML payloads
classify on their inner content, not as Logs. **V7-9** adds
`compression_events.body_hash` so the "comp_events per turn" metric
stops being inflated 30-50× by re-compression of the same body
across turns; new `store.CountUniqueCompressions(ctx, sessionID)`
returns the deduped count. **V7-13 Gap 5 (b)** logs a one-shot
warning per `observer serve` lifetime when the codebase-memory-mcp
DB is re-indexed between startup and a subsequent query, so
operators know which sessions might have spanned the boundary.

### Added (v1.7.12)

- `internal/compression/conversation/types.Detect` now pre-strips
  codex's shell envelope (`Exit code: N\nWall time: X.Xs\nOutput:\n`)
  before classification. Wrapped JSON → JSON, wrapped Diff → Diff,
  etc. Bodies without the envelope pass through unchanged via the
  `\A` regex anchor. Negative exit codes and the three Wall-time
  suffix variants (`Xs` / `X seconds` / bare `X`) all recognised.
  (V7-3.)
- `compression_events.body_hash` column (migration 031) — sha256-hex
  of the pre-compression body. Populated at the 10 single-body Event
  construction sites in `budget.go`, `anthropic.go`, and `openai.go`.
  Pre-v1.7.12 rows stay NULL and are excluded from the dedup query.
  Partial index `idx_compression_events_turn_body_hash WHERE
  body_hash IS NOT NULL` keeps the index small. (V7-9.)
- `store.CountUniqueCompressions(ctx, sessionID)` returns
  `COUNT(DISTINCT body_hash)` within a session — the correct answer
  to "how many unique tool_result bodies actually hit the
  compressor", not the inflated "N turns × same body" gross count.
- `codegraph.Client` captures startup mtime and emits a one-shot
  warning on every subsequent query when the DB file's mtime has
  changed since `Open`. Atomic CAS gate prevents concurrent queries
  from flooding the logs. Wired into all 10 DB-hitting public query
  methods. (V7-13 Gap 5 b.)

### Backwards compatibility (v1.7.12)

- The V7-3 envelope strip only fires when the body STARTS with the
  exact three-line codex envelope. Bodies that merely contain the
  phrase later (e.g. shell scripts that print "Exit code:" diagnostic
  text) pass through unchanged. Verified by the
  `\A`-anchored regex + the trailing-not-leading test case.
- V7-9 migration is additive (ALTER TABLE … ADD COLUMN nullable);
  existing aggregate queries (`SUM(original_bytes)`,
  `COUNT(*) BY mechanism`) keep working unchanged. Only the new
  `CountUniqueCompressions` reader needs the column.
- V7-13 Gap 5 (b) is observability-only — no query results change.
- `bodyHashHex` takes a string (not []byte) to match the
  pipeline's existing tool_result representation. No public-API
  change.

### Closed V7 issues (v1.7.12)

- **V7-3** — codex shell envelope misclassification.
- **V7-9** — compression_events accounting dedup.
- **V7-13 Gap 5 (b)** — codegraph re-index warning. V7-13 is now
  closed modulo Gap 1 (declined by operator in v1.7.11 — disk-path
  encode-in-marker variant) and Gap 2 (iv) (per-conversation pinning
  sidecar — deferred to v1.8.x).

Headline (v1.7.11): `mcp__observer__retrieve_stashed` extended to
batch (array of shas in one call) and line-range slicing
(`start_line` / `end_line` per call). Closes the V7-12 retrieval
arc — fourth and final of the four V7-12 tools alongside `get_file`
(v1.7.8), `get_symbols` (v1.7.9), `get_relations` (v1.7.10). New
top-level `[intelligence.mcp].features` allow-list (V7-16) lets
operators gate the four V7-12 tools as a bundle. V7-8 stash-dir
advisory log line at `observer serve` startup surfaces
proxy ↔ MCP-server alignment to operators eyeballing logs.
Pre-extension callers (`sha: "X"` single-string form) see a
byte-identical response — pinned by
`TestRetrieveStashed_BackwardsCompat_SingleStringByteIdentical`.

### Added (v1.7.11)

- `mcp__observer__retrieve_stashed` accepts `sha: string | string[]`.
  Array form returns the new `{ok, responses: [...]}` envelope with
  per-sha `ok` / `reason` / `content` / `returned` /
  `total_lines_in_blob`. **Array-of-one ALWAYS returns the envelope**
  shape — array literal == explicit caller intent (D-2 in
  `docs/plans/v1.7.11-stash-retrieval-correctness-plan-2026-05-31.md`).
- Optional `start_line` / `end_line` slice the blob (1-based,
  inclusive). Single-string + range augments the legacy shape with
  `returned: {start, end, total}` + `total_lines_in_blob`; array
  + range applies the range to every sha uniformly.
- New `Stash.ReadSlice(sha, startLine, endLine)` in
  `internal/stash/`: returns sliced bytes + total line count. Fast
  path `startLine == 0 && endLine == 0` is byte-identical to
  `Stash.Read`. Bumps the blob's mtime so slice-only reads keep the
  whole blob warm for LRU eviction (V7-13 Gap 2).
- New `[intelligence.mcp.retrieve_stashed]` config: `enabled`
  (default true), `max_shas_per_call` (default 25, matches
  `get_symbols`'s batch cap).
- New `[intelligence.mcp].features` list (V7-16): top-level
  allow-list scoped to the four V7-12 tools. Default `[]` = no
  filter applied; non-empty = strict allow-list. The 13 built-in
  observability tools are NOT subject to the filter — see D-3 in
  the v1.7.11 plan doc for the scope decision rationale.
  Precedence: per-tool `enabled = false` always wins.
- Per-tool kill switch:
  `[intelligence.mcp.retrieve_stashed].enabled = false` keeps
  proxy-side stash compression active while denying the agent the
  retrieval surface (asymmetric-trust scenarios).
- V7-8 transparency: `observer serve` startup logs
  `mcp: stash dir active dir=… max_total_mb=…` at Info level when
  the stash is initialized. Operators verify proxy ↔ MCP-server
  alignment by comparing both processes' startup logs. Automatic
  cross-process detection remains future work.
- Audit semantics (V7-14): one `mcp_audit` row per resolved sha.
  N shas in an array call → N rows. `path_requested` encodes the
  sha as `stashed://<sha>` so `WHERE path_requested LIKE
  'stashed://%'` queries sweep retrieve_stashed activity uniformly.
- New operator reference `docs/mcp-retrieve-stashed-reference.md`:
  TOML, schema, all three response branches with examples,
  failure modes, audit semantics, V7-16 gating, V7-8 alignment,
  worked multi-elision example.

### Backwards compatibility (v1.7.11)

- Pre-extension callers using `sha: string` with no other new
  parameters get the v1.7.10 response shape **byte-identical**
  (including pretty-print indentation). Pinned by
  `TestRetrieveStashed_BackwardsCompat_SingleStringByteIdentical`
  + `_MaxBytesNoNewKeys`.
- `Options.RetrieveStashedDisabled` is a negative flag (default
  false) so existing test wiring (`Options{Stash: st}` without
  any new fields) still registers the tool — no observable change
  for v1.7.10 callers.
- The new `Options.Features` field defaults to nil/empty, which
  skips the V7-16 filter entirely. v1.7.10 behavior preserved.

### Closed V7 issues (v1.7.11)

- **V7-12** — full four-tool retrieval surface ships.
- **V7-13 Gap 2** — already-shipped `Chtimes` mtime-bump-on-read +
  raised `MaxTotalMB=1024` default confirmed; documented in the
  plan doc. Per-conversation pinning sidecar deferred to v1.8.x.
- **V7-16** — features list + BC contract pinned.

Headline (v1.7.10): `mcp__observer__get_relations` — the third of
four V7-12 retrieval-surface MCP tools. Codegraph-native graph
traversal: ask "what calls handleClick within 2 hops?" and get back
the reachability set as a flat list (depth + via_edge) in one MCP
turn. No recursive grep, no multi-round-trip discovery. Pairs with
v1.7.8 `get_file` (byte-level) and v1.7.9 `get_symbols` (per-symbol
bodies) — `get_relations` is the cheaper metadata-only alternative
for impact-analysis questions where you don't need bodies.

### Added (v1.7.10)

- New `mcp__observer__get_relations(project_root, file, name, fqn?, kind, depth?)`
  MCP tool. `kind` enum: `callers` (inbound CALLS), `callees`
  (outbound CALLS), `contains` (outbound CONTAINS). Returns
  `{ok, anchor, kind, depth, results: [{symbol, depth, via_edge}], truncated, degraded}`.
  Single anchor per call; ambiguous (file, name) → `ok: false`
  with `candidates: [...]` so the agent can immediately re-call
  with a pinned `fqn`. (V7-12, third of four.)
- **BFS via single recursive CTE** in SQLite — cycle-safe via
  `UNION` dedup on `(id, depth, via_edge)`, depth-bounded in the
  recursive step, shortest-path-wins via outer
  `GROUP BY n.id MIN(depth)`. One query per call regardless of
  reachable-set size.
- Two new public methods on `*codegraph.Client`:
  `Reachable(ctx, anchorID, direction, maxDepth, maxResults)`
  (returns `[]Reachable` plus truncated flag) and
  `CountEdgesByKind(ctx, kind)` (used to detect "CONTAINS not
  populated by codebase-memory-mcp" and surface a `degraded: true`
  hint instead of misleading empty success).
- New `[intelligence.mcp.get_relations]` config block: `enabled`
  (default true), `max_depth` (default 5), `max_results` (default
  100). Path-safety knobs shared with `[intelligence.mcp.get_file]`.
- New operator reference `docs/mcp-get-relations-reference.md`:
  TOML, schema, response examples (success / ambiguous / degraded),
  CONTAINS-edge population caveat, cycle-termination guarantees,
  audit-log queries, common flows (impact analysis, reachability,
  structural orientation).
- Cross-references added in `docs/codex-compression-recipe.md`,
  `docs/mcp-get-file-reference.md`, and
  `docs/mcp-get-symbols-reference.md`.

### Changed (v1.7.10)

- `internal/mcp.Options` gains `GetRelations` + `GetRelationsEnabled`
  fields. Backward-compatible.

Headline (v1.7.9): `mcp__observer__get_symbols` — the second of four
V7-12 retrieval-surface MCP tools. Batched symbol lookup: one MCP
turn returns N symbol bodies across M files via the codegraph index,
bypassing codex's shell tool (which would re-feed `LogsCompressor`).
Pairs with v1.7.7 marker enrichment + v1.7.8 `get_file`: marker tells
the agent *what's* in the elided range, `get_symbols` fetches the
bodies + optional callers/callees in a single batched call. Includes
the V7-15 fqn disambiguation ranking (less the `is_exported` factor,
which the codegraph schema doesn't carry today; documented).

### Added (v1.7.9)

- New `mcp__observer__get_symbols(project_root, requests: [{file, name?, fqn?, kind?, include_relations?, include_body?}, ...])`
  MCP tool. Returns unified envelope
  `{ok, results: [{request, ok, matches, ambiguous, disambiguation_hint, degraded, reason}], truncated, degraded}`.
  Up to 25 requests per batched call. (V7-12, second of four.)
- **Discovery mode**: omit `name` and `fqn` to get every user-facing
  symbol in the file (functions, methods, classes, interfaces,
  types) — without body. Cheap preview; agent picks bodies to fetch
  in a follow-up batched call.
- **V7-15 ranking** for ambiguous matches: exact-fqn (SQL-time) →
  kind filter (SQL-time) → `start_line` ASC → `fqn` ASC → `file` ASC
  → `id` ASC. `ambiguous: true` fires when len(matches) > 1 and no
  fqn pinned; `disambiguation_hint` carries a literal recipe
  (`Use fqn (e.g. "Editor.handleClick") to ...`). `is_exported`
  factor deferred (codegraph schema lacks the column).
- **`include_relations: true`** adds `callers_count`/`callees_count`
  totals + top-N `callers`/`callees` lists with name/fqn/kind/file/
  start_line per entry. Caps configurable via
  `[intelligence.mcp.get_symbols].max_callers` /
  `.max_callees` (default 20 each, V7-12 spec).
- **200 KB total body cap** per response, deterministic truncation
  in input order so OpenAI's prefix cache stays stable across
  re-calls.
- **Stale-codegraph protection**: per-request `degraded: true` when
  `codegraph.Stale(file)` returns true. Recovery suggestion in
  `reason` directs the agent to `get_file`.
- New `[intelligence.mcp.get_symbols]` config block: `enabled`,
  `max_callers`, `max_callees`. Path-safety knobs (allow/deny lists,
  max response KB) shared with `[intelligence.mcp.get_file]` — one
  place to keep in sync.
- Five new public methods on `*codegraph.Client`:
  `FindSymbols(ctx, file, name, fqn, kind)`, `CallersOfSymbol`,
  `CalleesOfSymbol`, `CountCallers`, `CountCallees`. The two
  per-symbol caller/callee accessors return rich `Caller` rows
  (name, fqn, kind, file, start_line) for V7-12 `include_relations`;
  the existing `CallersOf([]string)` stays for v1.7.7 marker
  enrichment which only needs names.
- New operator reference `docs/mcp-get-symbols-reference.md`: TOML,
  schema, V7-15 ranking explanation, `is_exported` deviation
  rationale, body-cap algorithm, common flows, audit-log queries.
  Public-doc carve-out via `scripts/release.sh` (3-site sync).

### Changed (v1.7.9)

- `cmd/observer/serve.go` now wires `mcp.Options.CodegraphClient`
  from `[compression.code_graph].path` (with `FindProjectDB(cwd)`
  fallback). This Options field was declared but never assigned in
  serve.go pre-v1.7.9, so `check_file_freshness` / `get_file_history`
  silently returned empty `structure: {}` enrichment in production.
  Bonus fix bundled with v1.7.9 since `get_symbols` needed the wiring
  anyway.
- Refactored `internal/mcp/tools_get_file.go:readSlice` into shared
  `internal/mcp/fileread.go` so `get_file` and `get_symbols`
  truncate identically. Wire-shape unchanged — `getFileResult.Lines`
  serializes as the same `{start, end, total}` JSON.
- `internal/mcp.Options` gains `GetSymbols`, `GetSymbolsEnabled`
  fields. Backward-compatible: nil values plus
  `GetSymbolsEnabled: false` keep existing test wiring intact.

Headline (v1.7.8): `mcp__observer__get_file` — the first of four V7-12
retrieval-surface MCP tools. v1.7.7's marker enrichment told the
agent *what* lives in an elided range; `get_file` lets it fetch the
bytes directly, bypassing codex's shell tool (which would re-feed
`LogsCompressor` and re-truncate the response). Bundled with the
V7-13 Gap 4 path-scoping defenses and the V7-14 audit log schema.

### Added (v1.7.8)

- New `mcp__observer__get_file(project_root, path, start_line?, end_line?)`
  MCP tool registered when `[intelligence.mcp.get_file].enabled` is
  true (default). Returns `{ok, path, project_relative_path, lines,
  body, size_bytes, truncated}`. Pairs with the v1.7.7 marker
  enrichment: agent reads the marker, sees what's in the elided
  range, calls `get_file` for the bytes without re-triggering
  compression. (V7-12, first of four PRs.)
- New `[intelligence.mcp.get_file]` config block: `enabled`,
  `allow_extensions` (default ~25 source-code extensions), `deny_paths`
  (default `.env*`, `*.key`, `*.pem`, `.git/**`, `node_modules/**`,
  `.ssh/**`, `.aws/**`, etc.), `max_response_kb` (default 100).
  Path-safety defenses (V7-13 Gap 4): project-root containment via
  `filepath.EvalSymlinks` (symlink-escape attempts denied),
  allow-extension allow-list, deny-glob list, response-size cap.
  Deny-glob syntax supports `*`, `?`, `<dir>/**`; unsupported
  patterns (character classes, braces, escapes) log one warning
  per startup so silently-dead rules are visible.
- New `mcp_audit` SQLite table (migration 030) + writer package
  `internal/mcp/audit`. Every `get_file` call (success or denial)
  writes one row with tool name, session id, request hash,
  requested path, response size, OK flag, deny reason, and call
  duration. Operator-facing for "why was X denied?" and "what files
  is the agent reading?" — queryable today via `sqlite3 ~/.observer/
  observer.db 'SELECT ...'`; managed CLI deferred to v1.8.x.
  Async buffered writer (drop-oldest on overflow + once-per-minute
  log throttle) keeps the MCP hot path under the V7-14 latency
  budget. (V7-14, minimal scope; operator CLI follow-up.)
- New `[intelligence.mcp.audit] enabled` switch (default true).
  Local-only forensic value; opt-out emits one stderr line at
  startup so the operator's choice is visible.
- New `docs/mcp-get-file-reference.md` operator guide: config
  reference, tool schema, defense-layer rationale, audit-log
  example queries, accepted-risk discussion (TOCTOU, symlink
  semantics). Public-doc carve-out via `scripts/release.sh`.
- Cross-reference in `docs/codex-compression-recipe.md` linking
  the v1.7.7 marker enrichment to v1.7.8's `get_file` retrieval
  path for codex-variant model operators.

### Changed (v1.7.8)

- `internal/mcp.Options` gains `GetFile`, `GetFileEnabled`, and
  `AuditWriter` fields. Backward-compatible: nil `AuditWriter`
  defaults to `audit.NewNoopWriter()` so existing tests that
  construct `mcp.Server` without audit wiring still work.

Headline (v1.7.7): LogsCompressor marker enrichment — codex-variant
models reading `… [231 lines elided: 3 ERRORs,
12 WARNs]` distrust the marker and re-derive via shell tools — the
+121% gpt-5.3-codex × high regression measured in the v4 batch
(`docs/v4-codex-compression-recipe-and-issues.md`). v1.7.7 makes the
marker self-documenting: when the producing tool's argument carried
a file path (and codebase-memory-mcp is installed + the index isn't
stale), the marker reads
`… [231 lines elided from src/components/Editor.tsx: 3 ERRORs,
12 WARNs; preserved 5 anomalies; file contains fn handleClick,
class Editor, fn useEffect (codegraph)]`. Both enrichment layers are
opportunistic — zero hints produces byte-identical output to
pre-v1.7.7. (V7-11 mitigation (e); V7-13 Gap 3 + Gap 5 prerequisites.)

### Added (v1.7.7)

- New optional `HintedCompressor` interface in
  `internal/compression/conversation`. Compressors implement
  `CompressHinted(body, hints)` to opt into receiving filename +
  codegraph symbol context; the Registry detects via type assertion
  and falls through to the basic `Compress` when not implemented.
  LogsCompressor opts in; JSON / Code / Text / Diff / HTML stay
  on the bare interface. (V7-11 (e) part 1)
- `codegraph.SymbolsInFile(ctx, absPath)` — returns the top-N
  user-facing symbols defined in `absPath` (functions, methods,
  classes, interfaces, types). Sorted by `start_line ASC` for
  determinism; capped at LIMIT 50; filters noise kinds (variables,
  parameters) at the SQL layer. Schema-tolerant — missing schema /
  unavailable client returns nil + nil.
- `codegraph.Stale(absPath)` — advisory check returning true when
  the file's mtime exceeds the codegraph DB's mtime + 5s slack.
  Caller pattern: skip symbol pre-fetch when stale so the marker
  doesn't claim a function exists at a line where the file no
  longer has it. Fail-open. (V7-13 Gap 3 mitigation)
- `Pipeline.WithCodegraph(c CodegraphLookup)` — chainable builder
  mirroring `WithStash`. The proxy opens codegraph via the explicit
  `[compression.code_graph] path = "..."` config key (override) or
  `codegraph.FindProjectDB(cwd)` (auto-discover) and passes a narrow
  adapter through. Best-effort: missing codegraph degrades marker
  enrichment to filename-only without aborting startup.
- New optional `[compression.code_graph] path` config key for
  operators with multi-project setups who want to pin the graph.db
  consumed by marker enrichment.

### Changed (v1.7.7)

- LogsCompressor elision marker is now self-documenting when hints
  are present. The G32 level breakdown + E27 anomaly lift-out from
  prior releases are preserved unchanged; the new filename + symbol
  enrichments compose additively. (V7-11 (e) part 2)
- `codegraph.Open` no longer passes `immutable=1` in the SQLite DSN.
  The hint told SQLite to skip page locking — safe only when the
  file is guaranteed unchanged. codebase-memory-mcp's indexer
  re-writes the graph DB concurrently with observer's read-only
  queries, so the hint risked torn-page reads. Plain `mode=ro` uses
  normal page-level locking and is concurrent-write safe. Throughput
  cost: ~3-5% on read latency — well worth the correctness gain.
  (V7-13 Gap 5 mitigation)

Headline (v1.7.6): codex-friendly compression. The v4 codex compression A/B
session (`docs/v4-codex-compression-recipe-and-issues.md`,
2026-05-29) measured up to +121% cost regression on `*-codex`
reasoning models under the Anthropic-style default
`compress_types = ["json", "logs", "code"]` — JSON sentinel
substitution destroys data values codex relies on, and the
LogsCompressor middle-truncation pass triggers re-derivation
cascades on reactive reasoning models. v1.7.6 ships five small,
additive surfaces giving operators the knobs and recipes to opt
out without source modifications, plus a per-session warning when
the proxy detects the misconfiguration. (#…)

### Added (v1.7.6)

- `[compression.conversation.logs]` config block exposing
  `max_lines`, `head`, `tail` knobs for LogsCompressor truncation.
  Default 200/100/100 (unchanged from the prior hardcoded
  constructor). Set `max_lines = 0` to disable middle truncation
  entirely — the codex-variant recipe's setting. (V7-11 mitigation b)
- `observer start --recipe <name>` flag selecting an embedded
  compression recipe applied between defaults and the on-disk
  config files. Three recipes ship: `claude-code` (Anthropic
  default formalised), `codex-safe` (logs-only; gpt-mini family),
  `codex-variant` (`compress_types = []`; `*-codex` family).
  Recipes live at `internal/config/recipes/*.toml` (embedded) with
  byte-identical mirrors at `docs/recipes/*.toml`; a sync test
  pins both copies in lockstep.
- `docs/codex-compression-recipe.md` operator-facing guide: when
  to pick which recipe, the OpenAI-vs-Anthropic cache-architecture
  asymmetry, override patterns, troubleshooting. Public-doc
  carve-out alongside the recipe TOMLs.
- `cost_saved_usd_est_input_tier` + `cost_saved_usd_est_cache_read_tier`
  columns in `observer cost --json`, `/api/cost?bucket=day`, and
  the cost summary envelope. Operators wanting upper/lower bounds
  alongside the weighted column read these directly. (V7-6)

### Changed (v1.7.6)

- Proxy emits one stderr warning per session when an OpenAI-shape
  request's model matches the codex-variant family
  (`(?i)(?:^codex-|-codex(?:-|$))` — gpt-5.3-codex,
  gpt-5.3-codex-low/medium/high/xhigh, codex-agent, etc.) AND
  `[compression.conversation] compress_types` is non-empty.
  Per-session dedup via a bounded `sync.Map` on the Proxy struct
  (cap 10k). Operator transparency contract preserved: at most ONE
  additive stderr line per session, ZERO on clean configurations.
  Switching to `observer start --recipe codex-variant` silences it.
  (V7-2 lightweight)
- `compression_cost_saved_usd_est` USD column now weights by the
  row's realized input vs cache_read share rather than the
  single-tier `pricing.Input` multiplier. **Behavior change for
  codex / OpenAI sessions**: this column drops ~10× to match
  realistic savings (codex is cache_read-dominant; cached input is
  ~10× cheaper than net input). Anthropic sessions unchanged.
  Two new explicit-tier columns sit alongside for upper/lower
  bounds. (V7-6)
- `[compression.conversation.stash] max_total_mb` default 256 →
  1024 MB. Code-agent workloads churn large file reads at a rate
  that fills 256 MB fast; the new cap better matches typical
  working sets. Opt-in stash is still default-off so existing
  deployments see no disk-usage change unless they had explicitly
  enabled stash. (V7-13 Gap 2 ii)

### Documentation (v1.7.6)

- `docs/plans/v1.7.6-codex-friendly-compression-plan-2026-05-30.md` plan
  doc captures the per-item scope, checklist, decisions, and
  rationale (untracked persistent, mirrors the v1.7.5 plan-doc
  pattern).
- `scripts/release.sh` carve-out 3-site sync extended with
  `docs/codex-compression-recipe.md` + `docs/recipes/*.toml`.

## [1.7.5] — 2026-05-28

Headline: three follow-on fixes for `docs/observer-platform-
issues-v6.md` findings surfaced during v1.7.4 verification against
the v4 codex compression A/B benchmark. V6-1 is a real bug in
v1.7.4's post-flight capture-rate check (envelope-type mismatch
silenced every warning). V6-2 and V6-3 are observer-side
mitigations for two codex-cli design choices that prevent capture
even after the v1.7.4 `--exclusive` mitigation handles V5-1. None
of the three is a true fix — V6-2 and V6-3 need upstream codex
changes (forward `-c` overrides to the inner app-server; raise the
inner-pipe TTFB timeout) — but the combined v1.7.5 mitigations
should make the v4 batch runnable once the operator updates
`$CODEX_HOME/config.toml` per the V6-2 pre-flight warning. (#22)

### fix(codex): match session_meta envelope in post-flight capture-rate check (V6-1)

`parseRolloutForCapture` in `cmd/observer/codex_capture_check.go`
only matched top-level envelope type `session_configured` with
`payload.session_id`. Real codex 0.130.0-alpha.5 rollouts use
top-level `session_meta` with `payload.id`. The mismatch meant the
post-flight check silently dropped every codex 0.130+ rollout —
`sessionID` stayed empty, the file was rejected, the helper returned
`""` on the "nothing to validate" path, and the V6-2/V6-3 capture
failures the helper was designed to surface stayed invisible to the
operator. v1.7.4 shipped this bug end-to-end (the test fixture
matched the wrong assumption, not real codex).

Fix: envelope-type matcher now accepts BOTH `session_meta` (codex
0.130+) AND `session_configured` / `session_start` / `turn_context`
(legacy / co-existing per `internal/adapter/codex/adapter.go:945-957`),
and reads either `payload.id` or `payload.session_id` — preferring
`id` when both are present (mirrors `sessionContext` at
`internal/adapter/codex/adapter.go:161` which declares both fields).
Test fixture updated to emit the real codex 0.130 shape; a sibling
fixture pins the legacy shape so the dual-tolerance is
table-covered. Pinned by `TestParseRolloutForCapture_SessionMetaPrimary`,
`TestParseRolloutForCapture_LegacySessionConfigured`,
`TestParseRolloutForCapture_PrefersIDOverSessionID`. Refs
`docs/observer-platform-issues-v6.md` §V6-1.

### feat(codex): pre-flight config.toml openai_base_url warning (V6-2)

Codex 0.130+ silently drops the wrapper's argv-injected
`-c openai_base_url=…` override. The outer `codex exec` parses
the override into its own TOML state but does NOT forward it to the
inner spawned `codex app-server` child that makes the HTTP call.
The inner reads only `$CODEX_HOME/config.toml`, so capture
fails silently UNLESS the operator has manually added
`openai_base_url = "<proxy>/v1"` to that file.

v1.7.5 adds a pre-flight warning that reads
`$CODEX_HOME/config.toml` (cross-mount aware via
`crossmount.AllHomes()`, mirrors the codex adapter's WatchPaths)
and emits ONE stderr line per misconfigured CODEX_HOME root, naming
the exact `openai_base_url = "<proxy>/v1"` line to add. Three
warning branches: file absent ("does not exist; create with …"),
key absent ("no openai_base_url; add `…`"), wrong URL ("sets
openai_base_url=`<got>` but the proxy is `<want>`"). Trailing-slash
and `<proxy>` vs `<proxy>/v1` shapes both accepted. Honors the
existing `--no-app-server-check` escape hatch. Pinned by 7 branch
tests at `cmd/observer/codex_config_check_test.go`. The warning
makes the otherwise-silent capture loss loudly visible; the actual
fix is the operator editing config.toml once. An opt-in
`--write-config-toml` flag (surgical edit + sidecar-marker crash
recovery) is tracked as a v1.7.6 follow-up if the warning-only
path proves insufficient. Refs
`docs/observer-platform-issues-v6.md` §V6-2.

### feat(proxy): TLS pre-warm at observer start + flusher.Flush hygiene (V6-3)

The V4-1 retry pattern from v1.7.2 recurs in v1.7.4 even with
the chatgpt-auth streaming gate: codex's inner-pipe TTFB timeout
(~15s) fires before the proxy can deliver chatgpt.com's first SSE
event, because the proxy pays a 500ms–1.5s TLS handshake on a cold
connection pool. Each request opens a fresh TCP+TLS connection
from the proxy to chatgpt.com (codex's direct calls reuse a
persistent connection from a single `codex exec` invocation, but
the proxy splits each request into a fresh upstream call). Total
TTFB pushes past codex's timeout; codex retries 5×; api_turn
never lands.

Two layers in v1.7.5:

1. **Pre-warm at `observer start`**: new `Proxy.Prewarm` method
   fires HEAD requests against `[proxy].prewarm_targets` (defaults:
   `https://chatgpt.com/`, `https://api.openai.com/`) via the
   proxy's upstream `http.Client`. This populates the
   `http.Transport` connection pool with warm TLS sessions, so the
   first real codex request reuses an established connection.
   Non-blocking goroutine from `ListenAndServe`; per-target timeout
   5s; all errors logged at info-level, never abort startup. Operators
   on egress-restricted networks can disable via
   `[proxy].prewarm_targets = []`.

2. **`flusher.Flush()` after `WriteHeader(resp.StatusCode)`** on
   the streaming path only (gated by `isStream`). Defense-in-depth:
   pushes the `HTTP/1.1 200 OK` status line + response headers to
   codex's inner pipe within RTT instead of waiting for the first
   body byte. Doesn't fix the upstream TTFB inside `doWithRetry`
   (that fires BEFORE WriteHeader), but ensures that when WriteHeader
   IS called on an SSE response, no buffering layer adds extra
   latency. Gated on isStream so the non-stream path keeps its
   single-write semantics — flushing in that path would let the
   client return before the synchronous `insertTurnDetached` lands
   the api_turn row, exposing a pre-existing race.

The pre-warm is the primary fix; the flush is hygiene. Together they
should keep total TTFB under codex's ~15s timeout for cell smoke
tests. The long-reasoning-model edge case still depends on upstream
codex raising its inner-pipe TTFB timeout. Pinned by
`TestProxy_PrewarmFiresHEADPerTarget`,
`TestProxy_PrewarmTolerates5xxAndTimeouts`,
`TestProxy_PrewarmEmptyTargetsSilent`,
`TestProxy_PrewarmNilTargetsUsesDefault`,
`TestProxy_ServeFlushesAfterWriteHeader`. Refs
`docs/observer-platform-issues-v6.md` §V6-3.

### docs(v6): track observer-platform-issues-v6.md + Resolution blocks + gotcha sections

`docs/observer-platform-issues-v6.md` promoted from untracked
persistent doc to tracked, with Resolution blocks under each
finding (V6-1 / V6-2 / V6-3) and an updated summary table. Mirrors
the v1.7.3 treatment of v3/v4 docs and the v1.7.4 treatment of v5.
The doc stays private-only on the public release (in
`PRIVATE_ONLY_PATHS = (docs)` per `scripts/release.sh:81`); the
operator-facing guidance ships in `docs/codex-shared-app-server-
gotcha.md` (public carve-out) where two new sections cover V6-2's
manual config.toml fix and V6-3's pre-warm config knob.

`docs/release-runbook.md` gains a v1.7.5 follow-up subsection
covering the new behavioral defaults (pre-warm fires 2 HEAD requests
at startup; operators on egress-restricted networks set
`[proxy].prewarm_targets = []`).

## [1.7.4] — 2026-05-28

Headline: observer-side mitigation for V5-1 — codex-cli's global
`\\.\pipe\codex-ipc` named pipe (Windows) / `app-server-control.sock`
(POSIX) lets the first long-running `codex.exe app-server` process
intercept every subsequent `codex exec` call on the host. When that
holder was spawned without observer's `-c openai_base_url=…` override
(typically by the VS Code Codex extension or Codex Desktop), the
call's HTTP traffic bypasses observer's proxy entirely — no `api_turn`
row, no compression telemetry. The v4 codex compression A/B benchmark
blocked at Phase 1 pre-fix because per-cell capture was
non-deterministic. Observer can't fix the IPC bypass — true fix has
to come upstream in codex (4 options proposed in
`docs/observer-platform-issues-v5.md` §V5-1) — but this release
detects the bypass, warns loudly, and offers `--exclusive` as a
one-flag operator workaround. **Operator transparency contract**: at
most one additive stderr line per `observer codex` invocation when
shared app-servers are present, **zero new output on a clean host**,
codex exit code never changed by the new checks. (#21)

### feat(codexipc): cross-platform codex app-server detection + termination

New `internal/codexipc/` package provides Detect / Terminate
primitives the wrapper uses. Windows path runs a PowerShell CIM query
against `Win32_Process` for `codex.exe` / `Codex.exe` entries via
`ConvertTo-Csv`, filters CommandLine matching `app-server`, excludes
`--type=` Electron child processes (per the v5 doc's reproducer
heuristic). POSIX path stats `${CODEX_HOME:-~/.codex}/app-server-
control.sock` as a microsecond fast path; if absent, returns empty
without spawning `ps`. Only when the sock is present does it run
`ps -A -o pid,comm,args` and hand bytes to the platform-agnostic
parser. `classifySource` labels detected processes as
`vscode-extension` (`.vscode/extensions/openai.chatgpt-…`),
`codex-desktop` (`Codex.app`, `AppData\Local\Programs\Codex`,
`/opt/Codex/`), or `unknown`. Termination uses
`taskkill /F /PID <pid>` on Windows and `syscall.Kill(pid, SIGKILL)`
on POSIX; OS errors surface verbatim so the per-PID operator line can
name access-denied / EPERM clearly. Pure parsers and `classifySource`
live in the platform-agnostic file so unit tests run on any host;
table-driven tests pin the v5 doc's PID 10072 / PID 35388 reproducer
plus the negative cases (`codex exec`, `--type=renderer` children,
non-codex processes).

### feat(codex): V5-1 wrapper-side mitigation — pre/post-flight + --exclusive + --detect-only

Three new flags on `observer codex`:

- `--exclusive` — opt-in. Terminates detected shared app-servers
  before exec. Operator-hostile but bounded; prints intent + per-PID
  outcome + a "re-launch your VS Code Codex extension / Codex Desktop
  manually after this run" recovery hint **before** acting. Never
  silent kills.
- `--detect-only` — inspection-only. Runs pre-flight, prints summary,
  exits 1 if any detected, 0 otherwise. CI-gate friendly. Mutually
  exclusive with `--exclusive` (errors out with a clear message).
- `--no-app-server-check` — universal escape hatch that skips both
  pre- and post-flight checks silently. For scripts that have
  verified the host is clean or that want zero detection latency.

Pre-flight (default ON, warn-only when shared app-servers detected):
one concise self-contained stderr line names PIDs + sources, suggests
`--exclusive`, mentions `--no-app-server-check`, links
`docs/codex-shared-app-server-gotcha.md`. Single line so it's
greppable in CI logs and not noisy. Detection runs once per
invocation and the result is cached for `--exclusive` termination +
post-flight cross-reference; no double scan.

Post-flight (default ON, swallows errors): records `cmdStart` before
`child.Run`; on exit (success OR failure) walks `CODEX_HOME` for
rollout-*.jsonl files with `ModTime() >= cmdStart`, extracts
`session_id` from `session_configured` envelopes, counts inner
`event_msg`/`token_count` events. Uses `bufio.Reader.ReadString` per
`feedback_jsonl_parser_cursor` (Scanner is wrong for live-written
JSONL with CRLF + empty lines). Compares per-session JSONL counts
against `api_turns` rows the proxy recorded. Emits one stderr line
per branch:

- `0 of N captured` + preflight non-empty → "confirms V5-1 bypass
  from the shared app-server(s) above"
- `0 of N captured` + preflight empty → "no shared app-server was
  detected at pre-flight; please report as a V5 follow-up"
- `X of N captured` (0 < X < N) → "partial V5-1 bypass"
- all captured → silent (happy path stays quiet).

Cross-mount `CODEX_HOME` is walked via `crossmount.AllHomes()` so a
wrapper running in WSL2 finds `/mnt/c/Users/<u>/.codex`. Mirrors the
codex adapter's WatchPaths logic at
`internal/adapter/codex/adapter.go:59`. New tests cover the flag
defaults, mutex error, `--no-app-server-check + --detect-only`
contradiction (kind skip note + exit 0), the single-line pre-flight
warning format, and all 4 capture-rate branches including the
preflight-cross-reference variants and the CRLF + partial-last-line
parser tolerance. End-to-end WSL smoke confirmed: clean host → silent
+ exit 0; fake rollout JSONL + missing api_turns → "0 of 3 codex
turn(s) reached observer's proxy" line fires.

### docs(codex): document V5-1 shared app-server gotcha + Resolution + carve-out sync

`docs/codex-shared-app-server-gotcha.md` (NEW, tracked + public
carve-out from v1.7.4+) is the operator guide referenced from
`observer codex --help`. TL;DR block up top (the `--detect-only` +
`--exclusive` recipes), then the mechanism, `--exclusive` trade-offs,
`--detect-only` CI-gate pattern, `--no-app-server-check` escape
hatch, manual termination recipes for hosts where `--exclusive`
can't run (elevated processes), limitations (cross-mount WSL→Windows
wrapping isn't covered; pre-flight is a snapshot; auto-restart isn't
done), and cross-links to V5-1 §"Suggested upstream fixes" and the
adapter-audit-playbook red-flag pattern.

`docs/observer-platform-issues-v5.md` (NEW, promoted from untracked
persistent doc to tracked) gains a Resolution block under V5-1
explaining the wrapper-side mitigation, the additive-stderr default,
and the note that true fix still requires upstream codex changes.
The "Status of the v4 batch" table flips V5-1 from "NEW BLOCKER" to
"Mitigated in v1.7.4 (`observer codex --exclusive` / `--detect-only`
+ pre/post-flight detection); true fix still upstream".

`docs/adapter-audit-playbook.md` §5 gains a fixed-name IPC discovery
red-flag pattern — generalized guidance for future adapter audits:
when adding a wrapper for a new external tool, search the tool's
source for `pipe`, `socket`, `IPC`, `app-server`, `daemon`; if the
IPC name isn't parameterized by a per-invocation key
(CONFIG_HOME, account, model), the wrapper needs detection +
termination support like `internal/codexipc/`.

`docs/release-runbook.md` gains a "v1.7.4 follow-up — V5-1
observer-side mitigation" subsection mirroring the v1.7.3 format,
with a `grep -n` verification command for the 3-site carve-out sync.
`scripts/release.sh` adds `docs/codex-shared-app-server-gotcha.md`
to all three carve-out sites (git add --force block, .gitignore
negation heredoc, docs_leaks grep alternation), mirroring the v1.7.3
add of `docs/proxy-live-test-recipe.md`.

## [1.7.3] — 2026-05-28

Headline: a sweep of fixes uncovered while live-validating compression A/B
benchmarks against codex+ChatGPT-Plus auth on WSL — every codex turn through
the proxy was effectively unusable pre-fix (~120 s wall per turn with 5
spurious `Reconnecting...` retries, and the resulting `api_turn` rows
dropping silently). After this release, the same trivial turn runs in
~10 s with zero retries and lands a fully-attributed row. Plus the Claude
Code 20-minute Windows hook deadlock V3 caught, the antigravity log spam
that drowned post-mortem diagnostics, and a release-notes tie-off for
slsa-verifier version.

### fix(proxy): force streaming path on chatgpt-auth so codex stops retrying

`chatgpt.com/backend-api/codex/responses` returns SSE bodies with an
empty/missing `Content-Type` header. The proxy's `isStream` gate checked only
`Content-Type: text/event-stream`, so chatgpt-auth requests fell into
`io.ReadAll` and were buffered single-lump before any byte returned to the
client. Codex's inner `app-server` has a ~15 s "wait for first byte" timeout
on its stdio pipe; the buffered path tripped it ~5× per turn, codex emitted
`Reconnecting... N/5 (timeout waiting for child process to exit)`, and each
turn ballooned from ~10 s to ~2 min wall. One-line gate change: force
`isStream = true` when the request transited the chatgpt-auth route, so the
existing `teeStream` flushes each 4 KiB chunk through to codex as it arrives.
The `looksLikeSSE` content-sniff at proxy.go:642 stays as defensive
belt-and-suspenders. Pinned by `TestProxy_ChatGPTAuthStreamsBytesIncrementally`
(TTFB < upstream gap). Refs `docs/observer-platform-issues-v4.md` V4-1.

### fix(proxy): resolve openai session_id from body + canonical hyphen headers

OpenAI requests landed `api_turn` rows with `session_id = ""` because the
insert site only ran an Anthropic body extractor, then fell through to
`X-Session-Id` (which codex doesn't set). Codex traffic showed up as
`<unattributed>` in `observer cost --group-by session`, blocking per-cell
benchmark aggregation. New `resolveAPITurnSessionID` helper: for OpenAI,
`extractOpenAISessionID(body)` → `Session-Id` → `Thread-Id` →
`X-Client-Request-Id` → `X-Session-Id` → `SessionResolver`. Header names are
HYPHEN-separated canonical (codex 0.130+ emits `Session-Id`, not
`session_id`; `textproto.CanonicalMIMEHeaderKey` treats them as distinct).
Live-verified 2026-05-28 against codex 0.133 + chatgpt auth — the thread_id
from codex output matches the captured session_id byte-for-byte. Refs
`docs/observer-platform-issues-v4.md` V4-4.

### fix(proxy): detach api_turn insert from r.Context() so client-close doesn't drop turns

Live-test side-effect: codex closes its read side the instant the final SSE
event lands, but SQLite's BEGIN IMMEDIATE + WAL write under contention takes
a few ms. The race cancelled `r.Context()` mid-insert and every codex
chatgpt-auth turn lost its `api_turn` row with
`store.InsertAPITurn: context canceled`. Pre-existing provider-agnostic
mechanism bug at all 5 insert sites in `proxy.go` (594, 620, 657, 672, 688)
— masked previously by the buffered + retry-storm path which never gave the
client a chance to close cleanly. New `insertTurnDetached(turn, label)`
helper derives a 10 s timeout from `context.Background()`, mirroring the
established shutdown idiom at `proxy.go:325`. The helper takes no
`context.Context` argument — regression-proof. Pinned by
`TestInsertTurnDetached_IgnoresAlreadyCancelledOuterContext` +
`TestProxy_InsertContextSurvivesClientClose`.

### fix(hook): process watchdog + skip quick_check so hook can't pin the host

V3 batch caught `observer hook` subprocesses hanging 20+ minutes on
post-`end_turn` for Claude Code sessions on Windows. Both pair 4 OFF
(opus-4-7[1m] xhigh) and pair 14 ON (opus-4-6 low) exhibited the same
pattern — model finished cleanly with `stop_reason = end_turn`, then `.out`
stayed 0 bytes while the Stop/SessionEnd hook subprocess blocked
indefinitely. The "observer hook MUST NEVER block the host" invariant was
documented but unenforced. Two changes:

1. **Process-level watchdog** wired into `newHookCmd`:
   `time.AfterFunc(maxRuntime, os.Exit(2))` armed at the start of every
   `observer hook ...` Run; `defer stop()` disarms on a clean return.
   Default 30 s, overridable via `--max-runtime` and
   `OBSERVER_HOOK_MAX_RUNTIME`. Covers ALL hang causes — DB contention,
   stuck syscall, network — not just one hypothesis.
2. **`db.Options.SkipIntegrityCheck`**: hook subprocesses now skip the
   `PRAGMA quick_check` probe that contended with the daemon's WAL holder
   (the contention the existing `feedback_hook_db_open_no_timeout` memory
   identified). Daemons, tests, and backfill keep the probe.

Refs `docs/observer-platform-issues-v3.md` V3-1 + `v4.md` V4-3.

### chore(watcher): dedup adapter warnings by (adapter, path, message)

V3 batch caught the antigravity adapter dominating ~96% of all stderr lines
on Windows — every poll cycle (~30 s per file) re-emitted the same OSCrypt /
unrecoverable WARN for the lifetime of each unrecoverable `.pb` file. The
~469 KB observer.err on pair 4 OFF contained literally zero usable
diagnostic data about the 20-min hook deadlock above. New per-process
`warningDeduper` keyed on `adapter|path|message`; first occurrence per
TTL window logs at WARN, identical repeats drop silently. Default 5-minute
TTL via `Options.AdapterWarningTTL` (0 → default, negative → disable for
diagnostics). Map growth capped by a sweep threshold (1024 entries).
Provider-agnostic — covers every adapter, not just antigravity. Refs
`docs/observer-platform-issues-v3.md` V3-3.

### docs(release): name slsa-verifier v2.7.0+ in the release notes template

v1.7.2's release body advertises a `slsa-verifier verify-artifact` command,
but doesn't say the older v2.6.0 fails with
`unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1`. The
runbook and `teams-operations.md` note v2.7.0+; release notes now do too.
Applies from this release onward (workflow runs as-of-tag, so v1.7.2's
release body stays frozen per maintainer's "leave older tags" call).

## [1.7.2] — 2026-05-27

### fix(release): stage the provenance file, not its artifact directory

The v1.7.1 fix generated SLSA provenance correctly, but the `public_release`
staging step failed (`cp: -r not specified; omitting directory`):
`download-artifact` extracts each artifact into a directory named after it
(`artifacts/multiple.intoto.jsonl/`) with the real file inside, and the
`find … -name '*.intoto.jsonl'` matched the directory first. Added `-type f` so
it selects the file. v1.7.1's `public_release` job failed before creating the
release, so there is no public v1.7.1 GitHub Release — v1.7.2 is the first
complete public release of the v1.7 line (Teams M0–M5 + cache fix + docs) with
SLSA L3 provenance attached. No product code changes.

## [1.7.1] — 2026-05-27

### fix(release): attach SLSA provenance to the public release

v1.7.0's release workflow generated everything except SLSA provenance: the
reusable generator halts on a private repo (it won't record a private repo's
name in the public Rekor transparency log), so its `final` job exited 27 and no
`*.intoto.jsonl` was produced — while the release notes still advertised it.
Two fixes: (1) `private-repository: true` overrides the guard (the builder
identity is already public via the cosign-verify instructions, so Rekor exposes
nothing new); (2) `upload-assets: false` keeps the provenance as a workflow
artifact, and the `public_release` job now stages the `.intoto.jsonl` onto the
**public** GitHub Release next to the binaries it attests (the generator's own
upload would target the private repo's release). A missing attestation now fails
`public_release` hard rather than shipping a release that falsely claims SLSA L3.
No product code changes — v1.7.1 is v1.7.0 with working provenance.

## [1.7.0] — 2026-05-27

Headline: the **Teams & Org Visibility** feature (M0–M5) lands in full — an
optional, self-hosted `observer-org` server for org-wide cost/activity rollups
(SAML SSO, SCIM 2.0, Ed25519-signed content-free pushes) plus a default-off
OpenTelemetry exporter. It is purely additive: anyone who never enrols runs a
byte-identical solo-local tool (`make test-invariant` is the gate). This release
also carries a conversation-compression cache-accuracy fix and clarified
compression docs.

### fix(compression): compress the cache_control marker block uniformly

`cache_aware` mode previously protected the `tool_result` block carrying the
SDK's rolling `cache_control` marker from compression. Because the SDK rolls
that marker forward every turn, the protected block went on the wire with two
different byte representations across consecutive turns — breaking Anthropic's
byte-hash prefix cache from that block onward, so `cache_creation` surged
(+65–245%) and ON-proxy cost ran +16–33% vs OFF. The fix compresses every
`tool_result` block uniformly (each compressor is a pure function of the block's
bytes, so a block serialises identically whether or not it currently carries the
marker), restoring cross-turn byte-stability and the prefix-cache hits. The
`preserveMsg`/`preserveBlock` plumbing and the dormant
`BudgetOptions.PreserveBlockIdx` are removed; `findLastCacheBreakpoint` stays
(still unit-tested). Regression-pinned by
`TestPipelineCacheAware_MarkerRollPreservesPriorBytes` and
`TestPipelineCacheAware_CrossTurnInvariance`.

### docs(compression): mode × provider matrix + recipes

New `docs/compression-modes.md` (canonical reference), plus a condensed matrix +
per-provider recipes in the README and npm README, clarify what each
`[compression.conversation].mode` does on Anthropic (Claude Code) vs
OpenAI/Codex traffic: `cache`/`cache_aware` target Anthropic's content-hash
prefix cache (`cache_control` is an Anthropic Messages API concept), while the
proxy's OpenAI path is mode-agnostic (OpenAI prompt caching is automatic and
server-side). `cache_aware` is the shipped default and the recommended Claude
Code mode; `token` is the clearest choice for Codex. Also removes three
never-wired config knobs the npm README had documented (`prefix_bytes`,
`min_bytes_to_compress`, `[compression.conversation.weights]`).

### feat(teams): M5 — hardening, release, documentation

Final milestone of the Teams & Org Visibility feature: takes it from "works on
the maintainer's machine" to "ships to customers". All additive; the solo-local
UX stays byte-identical and `make test-invariant` / `go test -race ./...` stay
green.

- **Linting tightened.** `.golangci.yml` adds `errorlint`, `gosec`, `gocritic`,
  and `gocyclo`; `gofumpt` replaces `gofmt` as the canonical formatter (`make
  fmt` runs `go tool gofumpt`, pinned via the `tool` directive) and
  golangci-lint now runs in CI. Every finding the new linters surfaced is fixed
  or justified per-line — dead code deleted, `errors.Is`/`%w` wrapping, the
  excelize/Rollback errcheck gaps, `slices.Concat`, two internal renames
  (`cost.Breakdown`, `antigravity.ConversationsDirs`); 35 SQL findings carry
  per-line `//nolint` (SQL structure is built from constants, values bound via
  `?`). Two documented, scoped deviations: `gocyclo` is enforced at
  complexity 30 (not the spec's 15 — the pre-Teams tree has ~250 functions over
  15) with the 20 monsters path-excluded and 15 as the post-Teams ratchet
  target; `gosec` G115 (noisy, memory-safe in Go) and gosec-on-tests are
  excluded with rationale.
- **Supply chain.** `scripts/release.sh` gains a `dry-run` subcommand and
  CycloneDX SBOM generation (`syft`) for both binaries. The release workflow
  builds + pushes the `observer-org` Docker image to
  `ghcr.io/marmutapp/observer-org`, **cosign**-signs it keyless (OIDC) by
  digest, and generates **SLSA Level 3** provenance for both binaries via the
  official `slsa-github-generator`. SBOMs + provenance + observer-org binaries
  attach to the release; the release notes carry the `cosign verify` command.
- **Kubernetes.** New Helm chart `charts/observer-org/` (singleton Deployment,
  PV for the DB, referenced Secret for the five server keys, Service, optional
  Ingress, hardened nonroot security context, configurable resources). A CI
  `helm` job lints + templates it and `helm install`s into a kind cluster.
- **Customer docs.** `docs/teams-getting-started.md`,
  `docs/teams-architecture.md`, `docs/teams-operations.md`, and a README
  "Teams & Org Visibility" section.

After this milestone the Teams & Org Visibility feature (M0–M5) is complete.

### feat(teams): M4 — OTel exporter with GenAI semconv v1.41.0

Fifth milestone of the Teams & Org Visibility feature: the "second rail". An
agent can emit one `gen_ai.client` span per `api_turns` row to any OTLP/HTTP
endpoint (Datadog, Grafana/Tempo, Honeycomb, Dynatrace, SigNoz, or a plain
OpenTelemetry Collector), so customers with an existing observability backend
ingest SuperBased Observer's data without running the org server. It requires
**M0 only**, never couples to the org server, and is OFF by default — a
solo-local install builds no OTLP client and makes zero exporter network calls.

- **`internal/exporter/otel`** — `Exporter{New,Start,Stop}` tailing `api_turns`
  and emitting one span per turn to a batching OTLP/HTTP exporter. `New` never
  dials (the SDK connects lazily), so a bad/unreachable endpoint is a logged
  export failure, not a startup error. Span start = the turn timestamp,
  duration = `total_response_ms`; errored turns carry `codes.Error`.
- **Attribute mapping** — GenAI v1.41.0 standard attrs (`gen_ai.provider.name`,
  `operation.name`, `request`/`response.model`, `response.id`,
  `response.finish_reasons`, `usage.input`/`output_tokens`, `error.type`) plus
  the SuperBased `sbo.*` namespace (`project.root`, `session.id`, `cost.usd`,
  `cache.read_tokens`, `web_search.requests`, `tool.adapter`,
  `action.normalized_type`, `freshness.classification`,
  `redundancy.is_stale_reread`). `sbo.org.id` is emitted only when enrolled;
  `sbo.user.email` only when enrolled **and** `emit_user_email = true`.
- **Row tail** — `store.SubscribeAPITurns` drains `api_turns` in id-order pages
  and persists the published-id high-water mark in a `schema_meta` `otel_cursor`
  row, so a restart resumes exactly past the last delivered turn (at-least-once).
- **Opt-in prompt content** — `emit_prompt_content = true` (default false)
  attaches a `gen_ai.client.inference.operation.details` event. The observer
  does not persist raw prompt/completion bodies (no-content-in-DB invariant), so
  the event carries the available content metadata (prompt/message hashes, error
  message); the data-volume implications are documented in `doc.go`.
- **Semconv transition** — emits the v1.41.0 names; advertises
  `OTEL_SEMCONV_STABILITY_OPT_IN=gen_ai_latest_experimental` by default, env
  overridable. The contrib `genai/semconv` Go package does not exist at any
  version, so the `gen_ai.*` keys are defined as constants against the v1.41.0
  spec; resource `service.name` uses the released semconv v1.40.0 package.
- **Config + wiring** — new `[exporter.otel]` section (all fields default to the
  safe option, OTEL_* env vars override at construction); wired into
  `observer start` as a P1-isolated goroutine that flushes on shutdown and never
  cancels the proxy/watcher/dashboard/push-loop.
- **Reference dashboards** — `docs/exporters/otel/` Grafana 11 + Datadog
  dashboards and Prometheus recording rules, with a README documenting the
  Collector `spanmetrics` pipeline they assume.
- **Tests** — `testing/synctest` for the row-tail cadence + restart-from-cursor;
  `tracetest` in-memory unit tests for span emission, error status, and
  prompt-content gating; an OTLP/HTTP integration test against a fake collector
  asserting the on-the-wire protobuf attribute set field-by-field.

Deps (pinned): `go.opentelemetry.io/otel` + `/sdk` +
`/exporters/otlp/otlptrace/otlptracehttp` v1.43.0, `semconv/v1.40.0`.

### feat(teams): M3 — org dashboard, drill-down audit, budgets

Fourth milestone of the Teams & Org Visibility feature: the data the server has
been ingesting becomes useful. An org admin logs in via SAML and sees
overview / team / project rollups, drills down into per-developer data (which
is audited), configures budgets with webhook alerts, and manages bearers and
team-lead roles. Still purely additive — the agent never imports a server
package and the `tests/invariant/` gate stays green.

- **`internal/orgserver/rollup`** — the six aggregation queries (overview,
  teams, team detail, developers, projects + detail, budgets, audit) over the
  pushed + identity tables, behind a read-through TTL cache (60 s overview /
  30 s team-project-developer / 5 s audit). Spend is a proxy-deduplicated UNION
  of `api_turns.cost_usd` and `token_usage.estimated_cost_usd` (the matching
  rows dropped), mirroring the local dashboard so org spend reconciles within
  the spec's ±2 % drift bound. Team spend is developer-attributed; the project
  list carries a cross-team overlap indicator. A golden test pins the JSON wire
  shapes.
- **`/api/org/*` endpoints** — the generated dashboard `ServerInterface`
  (a compile-time routing-conformance gate) implemented by hand-written
  handlers, mounted behind a `samlSecurity` middleware. **Role scoping is
  enforced per request in the handler** (defence in depth): an org admin (email
  in `[dashboard] admin_emails`) sees everything; a team lead
  (`org_team_members.role = 'lead'`) sees only their teams — team detail /
  developers off-team is **403**, an out-of-scope project id is **404**.
- **Drill-down audit** — `GET …/developers` writes a `view_team_developers`
  `audit_log` row (with the `X-Forwarded-For` source IP) **before** the data is
  fetched and refuses the disclosure if the audit write fails;
  `POST /api/org/audit/log-drill-down` records the explicit "show breakdown"
  click. `GET /api/org/audit` is scoped + paginated (admin sees all, lead sees
  their teams).
- **Budget engine** — a `budgets` table (per-team/project monthly cap, JSON
  alert thresholds, last-fired high-water mark) with CRUD; an evaluator
  goroutine in the server polls every `budget_poll_seconds` (default 60 s),
  computes rolling-30-day spend per scope, and fires the OpenAPI `BudgetAlert`
  webhook once per newly-crossed threshold (async, exponential backoff to 1 h,
  then dropped). Wired into `Server.Run`, drained on shutdown.
- **Admin actions** — list a developer's issued bearers and **Revoke** a jti
  (writes `revoked_bearers`, audited); **promote/demote** a team member's role
  (audited). Enrolment-at-time bearer jtis are now indexed (`issued_bearers`)
  so Revoke has a concrete target.
- **`web2/` org dashboard SPA** — a self-contained Vite + React 18 + Tailwind 3
  + react-router + recharts app (mirrors `web/`'s tooling), embedded into the
  `observer-org` binary and served at root behind the SAML session. Pages:
  Overview, Teams (+ detail), Projects (+ detail, overlap), Audit, Settings
  (budgets, enrolment-token mint, SCIM/SAML info). Every view opens on
  aggregates; the per-developer breakdown is behind a "Show developer
  breakdown" button that records the drill-down **before** fetching the data.
  Built + embedded via **`make web-build-org`**.
- **Migrations** — server migration `002` adds `budgets`, `audit_log`, and
  `issued_bearers`.
- **Tests** — rollup query + golden tests; dashboard handler tests (scoping,
  audit-before-data, budget CRUD, revoke, role); budget evaluator tests
  (crossing ladder, fire-once-per-crossing, live webhook); a full-stack
  org-dashboard E2E (SAML admin sees aggregates, lead gets 403 off-team) with a
  route-conformance phase.

### feat(teams): M2 — agent enrolment, push loop, ingest

Third milestone of the Teams & Org Visibility feature: the agent↔server data
path. An enrolled agent ships content-free activity rollups on an interval; the
server verifies, deduplicates, and stores them; the local dashboard shows the
enrolment status and exactly what was last shared; the developer can unenrol at
will. Still purely additive — nothing runs and no keychain is touched unless
`[org_client] enabled = true` **and** the agent is enrolled (the
`tests/invariant/` gate, including a new privacy test, stays green).

- **`internal/orgclient`** — the push client: `Enroll` (generates an Ed25519
  keypair, exchanges the compound one-time token for a bearer, seeds the push
  cursor from the current high-water ids so only post-enrolment activity is
  ever shared), `PushOnce` (reads content-free rows above the cursor → gzip →
  per-push Ed25519 signature → POST; advances the cursor on 200), `PushLoop`
  (interval-paced, re-reads enrolment each cycle, 250 ms→30 s ±25 % jittered
  backoff on retryable failures, stops cleanly on an auth failure), plus
  `Status` / `Unenroll` / `LastPayload`. `testing/synctest` covers the timer.
- **Server ingest** — `POST /api/agent/push` now enforces the per-push
  signature (`X-SBO-Timestamp` + `X-SBO-Agent-Signature`, verified over the
  exact gzip bytes against the enrol-bound key; missing/invalid/out-of-skew →
  **401**), then ingests via the new `internal/orgserver/ingest` package: one
  transaction, `INSERT OR IGNORE` keyed by the schema's composite keys, so
  re-pushes deduplicate server-side. Returns **200**
  `{accepted_rows, deduped_rows, next_cursor}`; every row is tagged
  `pushed_by_user_id` = the authenticated pusher.
- **Compound enrolment token** — `EnrollResponse` now echoes the resolved
  `user_id` so the agent records its own identity without decoding the bearer.
- **Agent CLI** — `observer enroll <org-url> <token>`, `observer unenroll`,
  `observer org status`, `observer org push-now`.
- **Dashboard** — additive, independently-degrading endpoints
  `GET /api/enrolment/status`, `GET /api/enrolment/last-payload` (the exact
  content-free JSON last shared, byte-for-byte), `POST /api/enrolment/unenroll`;
  a header "Enrolled in &lt;Org&gt;" badge (absent when not enrolled) and a
  Settings → Enrolment page (org/user/server, last push, "View raw push
  payload" drawer, "Unenrol").
- **Daemon** — `observer start` runs the push loop as a goroutine when org mode
  is enabled; it never propagates an error, so a failing push cannot bring down
  the proxy, watcher, or dashboard (P1).
- **Privacy** — the single SQL seam (`store.SelectUnpushedSince`) and the
  `orgcontract` row types carry no content columns; a new invariant test pushes
  a corpus whose every content column holds a distinctive secret and asserts
  none of those bytes ever cross the wire.

### feat(teams): M1 — org server skeleton, SAML, SCIM, enrolment

Second milestone of the Teams & Org Visibility feature. Stands up
`observer-org` as a runnable server: an admin can run it, point a SAML IdP
at it, SCIM-provision users, log into a placeholder dashboard, mint an
enrolment token, and have an agent exchange it for a bearer. No data flows
yet — `POST /api/agent/push` authenticates and ACKs **202** but does not
ingest (M2). Still purely additive: the agent and the solo-local UX are
unchanged (the `tests/invariant/` gate stays green).

- **`cmd/observer-org`** — new binary with `serve` / `migrate` /
  `new-enrolment-token` / `dump-config` / `doctor` subcommands (cobra +
  slog, mirroring `cmd/observer`). `doctor` runs an 8-point health check.
  `make build-orgserver` → `bin/observer-org`.
- **`internal/orgserver/db`** — server SQLite (WAL, pure-Go driver) +
  migration `001_initial.sql`: identity tables (org singleton, members,
  teams, memberships, project→team), auth tables (argon2id-hashed
  enrolment tokens, jti revocation list), and content-free data tables
  (sessions/actions/api_turns/token_usage with `pushed_at` +
  `pushed_by_user_id`, empty until M2).
- **`internal/orgserver/auth`** — Ed25519 bearer minting/validation (no
  JWT lib), HMAC-SHA256 session cookies (no session lib), SAML SP via
  `crewjam/saml` with a custom session provider, and per-prefix
  middlewares (`RequireBearer` / `RequireSAMLSession` / `RequireSCIMToken`).
- **`internal/orgserver/scim`** — SCIM 2.0 Users + Groups via
  `elimity-com/scim` over SQLite; the 12 common operations have
  happy + sad path tests.
- **`internal/orgserver/api`** — the generated `ServerInterface`
  (`EnrollAgent` runs token-burn → pubkey-bind → 90-day bearer;
  `PushBatch` → 202), the SAML-protected enrolment-token mint endpoint,
  and request-id / logging / rate-limit middleware.
- **OpenAPI** — `docs/openapi/orgserver.yaml` extended with the SCIM,
  SAML, dashboard, and admin surfaces; codegen scoped to the `agent` tag
  so only enroll + push generate stubs.
- **Deploy** — `Dockerfile.observer-org` (distroless static) +
  `deploy/observer-org/docker-compose.yaml` (keygen + dev SAML IdP + org
  server) + `deploy/observer-org/README.md` (run guide, nonroot ownership
  notes, rootless-Docker/WSL2 dev-box setup). New deps: `crewjam/saml`,
  `elimity-com/scim`, `golang.org/x/crypto/argon2` (already pinned). The
  image runs as distroless **nonroot** (uid 65532): the Dockerfile seeds
  `/var/lib/observer-org` with nonroot ownership (before `VOLUME`) so the
  server can create `server.db`, and `keygen.sh` chowns the seeded secrets
  to 65532 so the read-only config mount is readable — verified by bringing
  the full compose stack up (metadata 200 / dashboard 302 / SCIM 401↔200).
- **E2E** — `tests/e2e/orgserver` drives the full flow (SCIM-provision →
  real signed SAML login → mint → exchange → bearer-authorised push)
  through the assembled handler.

### feat(teams): M0 — schema, identity, and wire-contract foundations

First milestone of the Teams & Org Visibility feature (spec:
`docs/teams-features-spec-2026-05-25.md`). Purely additive plumbing — no
behavioural change for any user who never enrols. A solo-local install's
dashboard responses are byte-identical, proven by a new invariant suite.

- **Migrations 028/029**: six org-mode tables (`org_enrolment`,
  `org_members`, `org_teams`, `org_team_members`, `org_project_team`,
  `org_push_log`) and nullable `org_id`/`user_email` columns on
  `actions`/`sessions`/`api_turns`/`token_usage` with partial indexes
  (`WHERE org_id IS NOT NULL`) so solo-local installs pay no index cost.
- **`internal/identity`**: a `Stamper` that attributes ingested rows to
  the enrolled org/user. No-op (and NULL columns) when not enrolled;
  wired into the watcher and proxy store via a chainable `WithStamper`.
- **`internal/orgcontract`**: the single source of truth for the
  agent↔server wire types (push envelope, the four content-free pushed
  row types, enrolment + bearer claims), golden-tested.
- **OpenAPI 3.1 spec** (`docs/openapi/orgserver.yaml`) for the agent
  protocol, with `oapi-codegen` client/server stubs reusing the
  orgcontract types via `x-go-type`. New `make` targets: `test-invariant`,
  `gen-openapi`, `verify-openapi`.

## [1.6.29] — 2026-05-25

### feat(cursor): watch store.db directly so prompt rows work on Windows + backfill

Operator report: the system-prompt + prompt-budget rows worked on WSL
Cursor CLI but not on Windows (CLI or IDE). Root cause was NOT a
Windows bug — the rows were emitted only while parsing a transcript,
and the watcher only re-parses on transcript growth. Sessions parsed
before the feature shipped sit at EOF and never re-enter, so they
never got the rows; the WSL sessions that worked were created fresh
after deploy, the Windows ones were older. (Verified: Windows CLI
session 90dd2512 HAS a store.db but had zero rows.)

Fix: the cursor adapter now watches the store.db blob stores
**directly** as their own session files, instead of reading them as a
sibling on the transcript-parse path.

- `WatchPaths` adds `<home>/.cursor/chats` alongside `…/projects` (for
  every crossmount home → covers WSL + Windows /mnt/c).
- `IsSessionFile` matches `.cursor/chats/<ws-hash>/<conv>/store.db`
  (`matchesStoreDBShape`; excludes the -wal/-shm sidecars).
- `ParseSessionFile` dispatches store.db paths to `parseStoreDBFile`,
  which emits the system-prompt + prompt-budget rows; the transcript
  path no longer emits them.
- Because the store.db files were never watched before, the watcher's
  full-scan discovers them as never-seen files and parses from offset
  0 — which **auto-backfills every existing CLI session** (Windows AND
  WSL) without a manual rescan, and picks up new ones + budget
  refreshes as the store.db grows. Decoupled from transcript growth.
- Project root for these rows is resolved from the sibling transcript's
  slug (`projectRootForStoreDB`) so they share the exact project
  attribution of the session's activity rows (the chats/ path doesn't
  encode the workspace, and the root blob's embedded workspace field
  proved unreliable across surfaces).

Tests reworked to parse the store.db path directly
(`TestParseSessionFile_EmitsSystemPromptFromStoreDB` /
`…EmitsPromptBudgetSections`, plus an `IsSessionFile` store.db
assertion and project-root-from-slug coverage). Verified end-to-end
against the operator's real Windows store.db (90dd2512: system prompt
+ tools/rules/skills/subagents rows, correct project attribution,
zero token events).

**Cursor IDE — investigated, partially infeasible.** The IDE does NOT
write `~/.cursor/chats/store.db`; its agent conversations live in
`AppData/Roaming/Cursor/User/globalStorage/state.vscdb` under a
`cursorDiskKV` table, in the SAME content-addressed blob model
(`agentKv:blob:<hash>` + `bubbleId:<conv>`). The **system prompt IS
there** (`{"role":"system",...}` blobs), but the **prompt-budget
section index is NOT** (zero "Tool definitions" markers — the IDE
doesn't persist the per-section token budget). So the IDE could get a
system-prompt row eventually but never the prompt-context budget rows,
and even the system prompt needs reverse-engineering the
`bubbleId:<conv>` → blob mapping for per-conversation attribution
(the store is shared across all workspaces). Deferred as a separate
task; IDE tokens + activity remain captured via the hook path
regardless.

### feat(platform): pathnorm — unified never-fail path normalizer

New `internal/platform/pathnorm` package that consolidates every
foreign-path translation observer has accumulated across adapters
(`file://` URIs, Windows extended-length `\\?\` prefixes, UNC-to-WSL
rewrites, Git Bash `/c/...` → `/mnt/c/...`, Windows drive-letter
absolutes, `~/` expansion, surrounding-quote stripping) into a
single sequential pipeline. `crossmount.TranslateForeignPath` is
now a 3-line wrapper, so every existing caller auto-upgrades.

Bug fixes carried by the migration:

- **cline + gemini** (Class B): both adapters called `git.Resolve`
  on a Windows-shaped cwd without translating, walking up from
  observer's own CWD and landing on observer's `.git` in the worst
  case. Now route through `pathnorm.Normalize` first.
- **copilot**: `decodeFileURI` rewritten in terms of
  `pathnorm.NormalizeWithFormat` with the `FormatFileURI` gate.
  Windows-side workspace URIs now canonicalise to `/mnt/d/...` on
  Linux instead of `d:/...` — strict improvement (stat-able / git-
  resolvable from a Linux observer).
- **antigravity** `decodeFileURIToRoot` (used by recovery output)
  migrated; `decodeFileURIToPath` (display-only) kept hand-rolled
  per existing test pins.

Package contract: every layer has a pass-through fallback — no
error returns. 56 subtests across 6 test functions pin the format
matrix (`FormatFileURI`, `FormatWindowsDrive`, `FormatQuoted`, …).

### feat(antigravity): fold agy CLI layout into the existing adapter

Google Antigravity now ships two surfaces — the desktop IDE and the
`agy` CLI — that both write conversation `.pb` files under
`~/.gemini/`, but to **different** subtrees:

```
desktop : ~/.gemini/antigravity/conversations/<uuid>.pb
cli     : ~/.gemini/antigravity-cli/conversations/<uuid>.pb
```

Pre-1.6.29 the adapter only matched the desktop subtree. CLI
sessions were silently invisible to the watcher — operators who
installed `agy` saw no rows in the dashboard regardless of how
many conversations they recorded.

**Implementation** (single feature, no new adapter package — `agy`
is folded into the existing `internal/adapter/antigravity`):

- **Layout classifier** (`adapter.go`) — new `Layout` enum +
  `classifyLayout()` exhaustively returns `LayoutDesktop` /
  `LayoutCLI` / `LayoutUnknown`. CLI is checked before desktop
  because the desktop substring `/.gemini/antigravity/` is a prefix
  of the CLI form `/.gemini/antigravity-cli/`. `matchesSessionShape`
  + `defaultRoots` cover both layouts under every crossmount home.
- **CLI metadata resolver** (`metadata_cli.go`) — CLI installs ship
  no desktop-style `state.vscdb`; metadata is synthesised by
  parsing `~/.gemini/antigravity-cli/log/cli-*.log` for the
  conversation_uuid → project_uuid binding (the CLI emits two
  consecutive `glog` lines: `Conversation using project ID: <uuid>`
  + `Created conversation <uuid>`), then reading the project's
  `name` + `gitFolder.folderUri` from
  `~/.gemini/config/projects/<project-uuid>.json`. Memoised by
  log-dir mtime via the existing `indexCache` map under a `"cli:"`
  key prefix. `lookupIndexEntry` now dispatches by layout —
  desktop hits `state.vscdb` as before, CLI hits the new path.
- **`agy` gRPC discovery** (`process.go`) — `discoverNativeLinux`
  / `discoverNativeMac` / `discoverViaPowerShell` extended to
  recognise `agy` / `agy.exe` / `antigravity` / `antigravity.exe`
  basenames in addition to `language_server_*`. A new
  `requiresCSRF` policy gates the `--csrf_token` cmdline check:
  desktop `language_server` processes always carry it; CLI
  embedded servers may not (the CLI uses a different localhost
  auth). Empty-CSRF rows for CLI processes now pass through to
  the gRPC fan-out instead of being dropped at parse time.
- **`RetrySuggested` adapter signal** (`internal/adapter/adapter.go`
  + `internal/watcher/watcher.go`) — new bool on `ParseResult`.
  The watcher now persists the cursor (MAX-of-old-and-new) when
  it's set, so fresh CLI `.pb` files that fail decrypt + gRPC on
  the first attempt stay visible to `pollCursors` for retry on the
  next tick. Antigravity sets it for CLI files within a 24h
  freshness window; stale failures still mark-unrecoverable +
  advance the cursor so backfill doesn't burn ~30s per file
  forever.
- **Backfill + rescan coverage** —
  `antigravity.AntigravityConversationsDirs(homes)` now returns
  the desktop AND CLI conversation dirs per home. Existing
  `--antigravity-project-root` / `--antigravity-rescan` flags
  inherit; no new flags.
- **Diagnostics** (`internal/diag/doctor.go`) — new
  `antigravity.family` check reports presence + `.pb` counts of
  both layouts plus the configured `network_recovery` setting.
  Emits StatusWarn when CLI `.pb` files exist but
  `network_recovery` is off (the CLI doesn't ship an oscrypt
  secret equivalent to the desktop install, so local decrypt
  cannot succeed for CLI files — gRPC fallback is the only
  practical recovery). A startup nudge in `cmd/observer/main.go`
  emits the same warning at daemon-start time so the operator sees
  the gap before opening the dashboard.
- **UI auto-refetch** (`web/src/lib/useApi.ts`) — `useApi()` gains
  optional `refreshMs` + `refreshWhenHidden` opts. Pages now poll
  while the tab is visible: Sessions = 5s, SessionDetailPanel +
  messages = 2s while the slide-over is open, TopBar status = 5s,
  Sidebar status = 5s. Lets fresh CLI conversations land in the
  dashboard without manual reload.

**Caveat preserved from the audit**: true local-decrypt parity for
CLI `.pb` files was not solved in this ship (operator explicitly
descoped the decrypt research path). Practical recovery on this WSL
host depends on `agy` being alive long enough for the embedded gRPC
server's `GetCascadeTrajectory` to succeed, OR an `antigravity-bridge`
hop to a Windows-side `agy.exe`. Both paths now have the discovery
plumbing to find the server; the gRPC call itself reuses the
existing fan-out code.

**Newly-observed agy-side limitation (2026-05-24)**: empirically,
agy's `ConvertTrajectoryToMarkdown` gRPC endpoint surfaces ONLY the
first persisted turn pair for an ongoing conversation, even when
agy is alive and actively producing assistant responses (verified
via `text_drip` log lines for subsequent turns). The `.pb` file on
disk grows with each turn but the additional bytes are encrypted
content agy reads back only through its own in-memory cache;
`ConvertTrajectoryToMarkdown` apparently reads from a separate
persisted-state view that lags. The bridge output is also NOT
monotonic — for one conversation observer captured "hey" →
"Hey! How can I help you today?" via an earlier bridge call, then
on a later call the same endpoint returned the user message but
not the assistant response.

**Fallback: transcript.jsonl synthesis (2026-05-24, supersedes
history.jsonl as primary)**. agy's CLI writes a per-conversation
plaintext trace at
`~/.gemini/antigravity-cli/brain/<uuid>/.system_generated/logs/transcript.jsonl`
containing both user inputs AND assistant responses (plus every
tool invocation). This is the canonical source of truth for what
the conversation actually contains — strictly richer than the
bridge's `ConvertTrajectoryToMarkdown` output. Adapter now reads it
on every CLI parse and synthesises:

  - `user_prompt` events for `source=USER_EXPLICIT/type=USER_INPUT`
    entries (with the `<USER_REQUEST>...</USER_REQUEST>` wrapper
    stripped via `extractUserRequestText`)
  - `task_complete` events for `source=MODEL/type=PLANNER_RESPONSE`
    entries with non-empty `content` (assistant text replies)

Tool-call breadcrumbs (`MODEL/GREP_SEARCH`, `MODEL/RUN_COMMAND`,
`MODEL/VIEW_FILE`, `MODEL/LIST_DIRECTORY`) are deferred to v2 — the
bridge's structured payload already covers them on the happy path
and parsing the tool-args / per-type result shape is a larger
surface.

`SourceEventID` is keyed off `(conversation_uuid, step_index)` so
re-parses are idempotent — the same transcript entry always
generates the same ID, and the
`(source_file, source_event_id)` UNIQUE constraint dedupes at the
store. Bridge-surfaced events and transcript-surfaced events use
distinct prefixes (`antigravity-struct-payload:...` vs
`antigravity-cli-transcript:...`), so the application-level
`Target`-text dedup is what prevents duplicate rows for the same
turn from both sources.

**history.jsonl downgraded to safety net**. Kept as a fallback for
the (so far unobserved) case where `brain/<uuid>/` is missing —
catches user-side messages only, no assistant content. Three exit points were wired:

  - **decrypt-success path**: tops up emitted events with any
    history entries the classifier missed (effectively no-op for
    the desktop layout — `cliRootsFor` returns empty there).
  - **gRPC-success path**: tops up the bridge's markdown +
    structured merge with history entries the bridge didn't expose.
    This is the primary win: every CLI session that bridges
    *partially* gets the user-typed turns filled in.
  - **decrypt + gRPC double-failure path**: if history.jsonl has
    any entries for the conversation, return them as the entire
    `ParseResult` instead of marking the file unrecoverable. New
    `historyOnlyResult` helper. Brand-new sessions where the
    bridge hasn't booted yet still surface user inputs.

The constraint that assistant responses depend on the bridge
remains — `history.jsonl` only records user-typed text. Observer
now captures: every user message reliably (from history.jsonl) +
every assistant response the bridge happens to surface at the
moment of the parse. This is the best obtainable result without
solving the CLI .pb decrypt cipher.

Verified against the operator's live host: conversation 739cbb33
previously had 2 actions in the DB (the original "Just say ok" /
"ok") and zero rows for the three follow-up messages typed in
agy. After the fallback ships, `probe-cli` returns 5 ToolEvents
for the same file — 2 from the bridge plus 3 `history.user_input`
events for "my name is bash 2", "22", and "23". Same idempotency
test passed across re-parses: same input → same SourceEventIDs →
zero duplicate inserts.

**RetrySuggested gating refinement (also 2026-05-24)**: the initial
v1.6.29 implementation set `RetrySuggested=true` for any fresh CLI
file when decrypt + gRPC both missed. That produced a tight 2-second
retry loop on Linux-side CLI files whose originating agy session
had exited (no Linux-native server hosts the conversation, no path
to recovery short of the user restarting agy). Replaced with a
`shouldRetryCLIFailure` helper that only flags retry when the host
is WSL AND the path is Windows-side (`/mnt/c/...`) — the only
failure mode with plausible transient recovery (bridge invocation,
agy.exe boot, network blip across WSL interop). Everything else
falls back to `markUnrecoverable` + cursor advance.

**Tests**: +12 new test functions / 56+ subtests across
`adapter_test.go`, `metadata_cli_test.go`, `process_test.go`, and
`watcher_test.go` covering layout classification, CLI metadata
resolution against a fixture cli log, `agy` exe matching, CSRF
optionality, and the RetrySuggested wire-up.

### perf(antigravity): per-conversation bridge endpoint cache

Operator-reported regression against v1.6.29: capture latency for an
actively-written CLI conversation was "a couple of minutes" rather
than the dashboard's 8-second poll cadence. Root-caused to the
Windows-side bridge: every `pollCursors` tick re-invoked the bridge
twice per `.pb` file (`convert` + `structured`), and each invocation
cold-started `powershell.exe`, ran a fresh Win32 + Get-NetTCPConnection
discovery against ~17 candidate processes (3 agy.exe + 7 Antigravity.exe
+ 7 language_server_*.exe on the operator's host), then serially
fanned out across each server's endpoints with a 5s timeout per failed
attempt. Steady-state cost was 50–60s per file.

The bridge now accepts `--endpoint <url>` / `--csrf <token>` flags;
when set, `discover()` is skipped and the gRPC call goes directly to
the named server. On any successful invocation (pinned OR cold-cache),
the bridge emits a `bridge-endpoint=<url>\tbridge-csrf=<token>` line
to stderr.

The adapter (`internal/adapter/antigravity/adapter.go`) gains a
`convEndpointCache` keyed by conversation UUID. Bridge wrappers
(`callBridgeConvertCached` / `callBridgeStructuredCached`) read the
cache before invoking, pass the cached pin via the new flags on hit,
and parse the stderr hint to populate / refresh the cache on every
success. On pinned-call failure the entry is invalidated and the
call retried via full discovery — so server restarts and workspace
closures self-heal.

Both bridge subcommands share the cache: a successful `convert`
populates the same entry that the immediately-following `structured`
call reads. Pre-fix that meant two ~30s discoveries per file; post-fix
it's one cold discovery (first invocation only) + N ~200-500ms pinned
calls. Empirically ~50× steady-state speedup for live conversations
under continuous polling.

**Tests**: `cmd/antigravity-bridge/main_test.go` covers the new flag
parser (space-separated, `=`-form, empty-CSRF, probe positional
ordering). `internal/adapter/antigravity/bridge_test.go` covers the
stderr hint parser (single line, amidst noise, CRLF, empty CSRF,
absent hint, empty stderr) and the cache round-trip (cold → remember
→ retrieve → overwrite → invalidate, plus refusal to store empty
endpoints / conversation IDs).

### fix(antigravity): desktop IDE plaintext brain/overview.txt fallback

Operator-reported (2026-05-24): "Antigravity IDE chats are not being
updated in the sessions data — earlier this was getting updated."
Root-caused to a silent format change in the desktop IDE: the `.pb`
encryption cipher rotated to one oscrypt can't currently decrypt
(same blocker that gated CLI recovery), AND the IDE now writes a
plaintext per-turn trace to a path observer wasn't reading:

```
<gemini-root>/antigravity/brain/<uuid>/.system_generated/logs/overview.txt
```

This is the desktop counterpart of the CLI's
`brain/<uuid>/.system_generated/logs/transcript.jsonl` — identical
JSONL schema (`step_index`, `source`, `type`, `status`, `created_at`,
`content`, `tool_calls`), just renamed. The CLI transcript reader
handles both verbatim; only the path resolver needed extending.

Three sites updated:

- `desktopRootFor` walker (`metadata_cli.go`) — mirrors the existing
  `cliRootsFor` for the desktop layout. Returns the
  `<gemini-root>/antigravity` parent of both the encrypted
  `conversations/` and plaintext `brain/` subtrees.
- `transcriptPathFor` resolver (`metadata_cli.go`) — single entry
  point that picks `transcript.jsonl` vs `overview.txt` by
  `classifyLayout`. Callers no longer repeat the conditional.
- `augmentResultFromHistory` + `historyOnlyResult` (`history_cli.go`)
  — both stopped gating on `LayoutCLI`. The `decrypt → augment` /
  `decrypt+gRPC fail → escape hatch` paths now surface desktop
  overview.txt content. `history.jsonl` fallback remains CLI-only
  (desktop has no analogue).
- Caller gates at `adapter.go:431` + `:507` (`if classifyLayout(path)
  == LayoutCLI`) removed so desktop sessions reach the augmentation
  path.

Verified on the operator's host via `probe-cli`: conversation
`c15725c6` (a /mnt/c desktop file the bridge couldn't reach due to a
file-lock race on the cached .exe) went from **0 events / "no cipher
mode produced a validating plaintext"** to **3 events surfaced from
overview.txt** (1 user prompt + 2 assistant responses), with a
warning naming the source. 115 desktop `brain/` dirs exist on the
operator's host — all now eligible for surfacing when their
overview.txt arrives.

### fix(antigravity): transient bridge errors must not poison the unrecoverable cache

Operator-reported follow-up to the c15725c6 case: a one-off bridge
failure (`copy bridge to /mnt/c/.../antigravity-bridge.exe: open ...:
permission denied` — Windows AV scan or another bridge invocation
briefly holding an exclusive lock on the cached .exe) wrote a sticky
unrecoverable marker keyed on the current (`size`, `mtime`).
`lookupUnrecoverable` short-circuited every subsequent poll tick
without re-attempting recovery — so even after the AV released the
file, the .pb stayed stranded until the operator either manually
deleted the marker or the conversation genuinely grew.

New `ErrBridgeTransient` sentinel in `bridge.go` wraps the two
environmental failure modes: `powershell.exe` missing from `PATH`,
and `bridgePathForPowerShell` errors (cache-copy permission denied,
no writable /mnt/c destination, file-lock races). `onUnrecoverableFailure`
gains a `recoveryErr error` parameter; when the recovery error is
`errors.Is(recoveryErr, ErrBridgeTransient)` the function holds the
cursor at fromOffset, sets `RetrySuggested=true`, and skips the
unrecoverable marker entirely. Next poll tick re-enters the recovery
path; if the environment has self-healed, the file lands normally.
Permanent decrypt failures (`no cipher mode produced a validating
plaintext`) still mark unrecoverable as before — that's a per-file
fact, not an environment fact.

**Tests**: `bridge_test.go` adds `TestOnUnrecoverableFailureHonorsTransientBridgeError`
+ `TestOnUnrecoverableFailurePermanentErrorMarks`. `desktop_overview_test.go`
adds `TestDesktopRootFor` (4 subtests), `TestTranscriptPathFor` (4
subtests), `TestDesktopOverviewTxtParsesAsTranscript` (end-to-end:
write a desktop overview.txt fixture → resolve via
`transcriptPathFor` → parse → synthesize → assert 2 ToolEvents),
`TestHistoryOnlyResultDesktop` (verifies the escape-hatch path for
desktop), `TestHistoryOnlyResultDesktopNoOverviewReturnsNil` (no
plaintext source → return nil so caller marks unrecoverable as
before).

**Operator action** to apply the fix to already-marked stale files:

```bash
sqlite3 ~/.observer/observer.db \
  "DELETE FROM adapter_unrecoverable_files WHERE adapter='antigravity' \
   AND reason LIKE '%permission denied%';"
```

Going forward, transient bridge errors don't write markers in the
first place — no maintenance needed for new occurrences.

### fix(antigravity): graceful copyIfNewer fallback on bridge-cache lock

Sibling-issue surfaced same session (2026-05-24): a separate operator
report — desktop conversation `f7c9f417` plus CLI-from-bash session
`56633544` weren't capturing token usage even though equivalent
WSL-Linux-side sessions worked. Root cause: same Windows AV /
in-use-by-running-powershell lock on the `/mnt/c/.../observer/
antigravity-bridge.exe` cache copy that surfaced on c15725c6, but
this time falling AFTER the unrecoverable-marker fix. The bridge
call hard-errored before reaching the gRPC layer — no convert, no
structured, no tokens.

`copyIfNewer` now falls back to the existing cached `.exe` when the
overwrite fails (`permission denied`). The newest bridge code is
deferred to the next call when the lock releases; the older cached
binary still satisfies the invocation contract (subcommand args,
stdout payload, stderr endpoint hint) — every contract observer
relies on has been stable across recent changes, and the new
`--endpoint`/`--csrf` flags fall through to legacy behaviour when
the receiving binary doesn't understand them. Strict improvement
over the prior hard-fail.

### feat(antigravity): derive desktop project root from overview.txt metadata

Sibling-issue to the above: `f7c9f417` (a fresh desktop conversation
on the operator's Antigravity IDE) showed `[antigravity]` placeholder
in the dashboard's Project column instead of the actual workspace
path. Root cause: `state.vscdb`'s `trajectorySummaries` blob (the
existing project-attribution source for desktop conversations) is
flushed by Antigravity periodically, not per-turn — fresh
conversations get no entry, `lookupIndexEntry` returns nil, and
`projectRoot` defaults to `[antigravity]`.

The IDE's own `ADDITIONAL_METADATA` stamp inside every
`USER_INPUT` already carries the active workspace context:

```
Active Document: c:\programsx\regulation\regulation-saas\scripts\security\README.md (LANGUAGE_MARKDOWN)
Other open documents:
- c:\programsx\regulation\regulation-saas\src\app\...
- c:\programsx\regulation\clearpath-website\src\components\Footer.tsx
...
```

New `internal/adapter/antigravity/project_root_metadata.go`:
`extractProjectRootFromTranscript` parses USER_INPUT metadata, walks
each candidate document path (Active Document first, then Other
open documents in transcript order), translates via
`pathnorm.Normalize` to WSL-canonical form (`c:\foo\bar` →
`/mnt/c/foo/bar`), and runs `git.FindRoot` until a working tree
matches. Returns the first git root found; "" on miss.

Wired into both `historyOnlyResult` (the decrypt+bridge-fail escape
hatch) and `augmentResultFromHistory` (the post-success augmentation
path). Only fires when the existing `projectRoot` is the
`[antigravity]` placeholder, so authoritative `state.vscdb` data
still wins when present.

Verified end-to-end on the operator's `f7c9f417`: project went from
`[antigravity]` → `/mnt/c/programsx/regulation/regulation-saas` (the
nested git root closest to the active document, correctly preferred
over the parent `/mnt/c/programsx/regulation`). CLI-from-bash
sessions whose `ADDITIONAL_METADATA` block carries only the
timestamp (no Active Document) correctly no-op and keep their
existing project attribution from the `config/projects/<uuid>.json`
resolver.

**Tests**: `project_root_metadata_test.go` adds 6 functions:
`TestCandidateDocumentPaths` (regex parsing + dedup ordering),
`TestCandidateDocumentPathsEmptyMetadata` (CLI-from-bash no-op),
`TestExtractProjectRootFromMetadata_WalksToGitRoot` (end-to-end
fixture: writes `.git/HEAD` + walks up), `TestExtractProjectRootFromMetadata_NoGitReturnsEmpty`,
`TestExtractProjectRootFromTranscript_PrefersFirstUserInput`,
`TestExtractProjectRootFromTranscript_NoUserInputReturnsEmpty`.

### fix(antigravity): CLI index cache invalidates on log file append

Operator-reported (2026-05-24): an `agy` session launched from
PowerShell (`791a7ab9`) landed with `[antigravity]` placeholder for
its Project column even though `~/.gemini/config/projects/<uuid>.json`
existed and the corresponding `cli-*.log` carried the
`Conversation using project ID: <uuid>` binding line.

Root cause: `lookupCLIIndexEntry`'s cache was keyed by the log
**directory** mtime. On Linux ext4 (and via the WSL2 9p protocol
over drvfs / virtiofs), appending to an existing file does NOT bump
the parent dir's mtime — only file create/rename/delete do. agy
writes the binding line to the open `cli-*.log` at the moment the
new `.pb` file is created, which is also the moment the watcher
fires. Race: if observer probed `lookupCLIIndexEntry` milliseconds
before the binding-line append (e.g. on a quick initial scan that
found the dir but not the binding), the cache held an empty result
keyed at the current dir mtime. Subsequent lookups got a cache hit
on the same dir mtime → returned nil → fell back to `[antigravity]`
forever.

Fix: new `cliLogFreshnessUnix(logDir)` helper returns `max(dir
mtime, latest cli-*.log file mtime)`. Captures both file-create AND
file-append events. Cost: 1 readdir + N stats per call (N ≤ 10 in
practice), well under the existing `parseCLILogBindings` pass on
cache miss.

**Tests**: `cli_log_freshness_test.go` adds 3 functions —
`TracksFileAppends` (the regression), `AddsFileBumpsFreshness`
(sanity), `IgnoresNonCLIFiles` (an unrelated `readme.txt` write must
not influence freshness above dir-mtime).

### perf(antigravity): bump cold-cache bridge timeout to 90s + size-versioned cache filename

Operator-reported sibling issue: Windows-side session token capture
was failing across the board (`f7c9f417` desktop, `56633544` and
`791a7ab9` CLI). Two compounding causes:

1. **Cold bridge timeout too tight**: the 30s timeout killed the
   first bridge invocation before its serial fan-out across 10–17
   candidate gRPC servers (3 agy.exe + 7 antigravity.exe IDE shell +
   7 language_server_*.exe on the operator's host) could find the
   workspace-matching server. Empirically the right server is
   reached in ~30–60s on a busy host. Without a single successful
   bridge call, the per-conversation endpoint cache stayed empty,
   and every future poll paid the full fan-out cost again — tight
   no-progress loop.
2. **Cache file lock**: the running observer constantly invokes the
   cached `/mnt/c/.../observer/antigravity-bridge.exe` via
   powershell, so the file is effectively always opened-for-execute.
   Overwriting an open Windows .exe fails. Without versioning, every
   new `make build` would change the source size, `copyIfNewer`
   would fail with permission-denied, the graceful-fallback would
   keep using the OLD cached binary, and new bridge code (the
   `--endpoint`/`--csrf` flags this session shipped, plus stderr
   `bridge-endpoint=` hints for cache population) NEVER reached
   production — defeating the conv-endpoint cache entirely.

Fix:
- `bridgeColdCallTimeout = 90 * time.Second` constant for unpinned
  calls; pinned (cache-hit) calls keep the original tighter timeout.
- `windowsCacheDestinationFor(srcSize)` returns
  `<dir>/antigravity-bridge-<size>.exe`. Each source size lands in
  its own filename, sidestepping the lock entirely. Old cached files
  linger harmlessly until the OS clears the temp dir.

End-to-end verified on operator's `791a7ab9`:

- Before: bridge `convert` killed at 30s; transcript fallback fired
  → 2 ToolEvents / 0 TokenEvents / project `[antigravity]`.
- After: bridge `convert` succeeds in ~30s, bridge `structured`
  follows (cache hit, ~1s) → 2 ToolEvents / **1 TokenEvent** /
  project `/programsx/superbased-observer`.

Long-lived daemon process additionally benefits from the in-memory
conv-endpoint cache: only the FIRST poll-tick per conversation pays
the ~30s cold-call cost; subsequent ticks complete in ~1–2s.

### fix(antigravity): DB-aware transcript dedup (Phase 1)

Closes a universal-duplication bug observed across every multi-turn
CLI conversation on the operator's host. Sample:

```
1e235146  6 turns  →  DB held 11 user_prompt rows (5 struct + 6 transcript)
bd6051ba  6 turns  →  DB held  8 user_prompt rows (2 struct + 6 transcript)
739cbb33  6 turns  →  DB held  7 user_prompt rows (1 struct + 6 transcript)
```

**Root cause** (verified by row-id ordering on `1e235146`): the
existing dedup in `synthesizeTranscriptEvents` compared transcript
USER_INPUT Targets against `res.ToolEvents` of the **current parse
cycle only**. A later parse cycle that reached the transcript path
with an empty `res.ToolEvents` — typical when decrypt-fail led to
`historyOnlyResult`, or when decrypt-success emitted zero events —
saw no coverage and re-emitted every transcript entry. The
`antigravity-cli-transcript:*` SourceEventID namespace doesn't
collide with the prior `antigravity-struct-payload:*` rows, so the
UNIQUE constraint accepted them.

**Fix**: new `TargetCoverageReader` interface
(`internal/adapter/antigravity/adapter.go`) consulted before dedup;
`internal/store/store.go::LoadActionTargets` returns the distinct
`(action_type, target)` pairs already persisted for the source file;
`cmd/observer/main.go::antigravityTargetCoverageShim` wires it into
the adapter alongside the existing `UnrecoverableTracker`. Both
`augmentResultFromHistory` and `historyOnlyResult` now merge DB-loaded
targets with in-memory `res.ToolEvents` before calling synth, so
later cycles dedup correctly against rows written by earlier cycles.

Empirical: on `1e235146`'s 11→6 row reduction, every transcript
Target byte-matches an existing structured Target except the last
turn (`Hellooooo`, which was typed after agy.exe had stopped writing
the .pb file — correctly retained as the one transcript-only turn).

Tests: `TestSynthesizeTranscriptDedupesAgainstExtraCoverage` in
`transcript_cli_test.go` pins the new path; existing tests updated
for the new signature without behavior change.

### feat(antigravity): structured-trajectory snapshot persistence (Phase 2)

agy.exe holds each conversation's cascade trajectory in memory only.
Once the originating instance terminates, `GetCascadeTrajectory`
against any sibling instance returns `trajectory not found` — and
observer's only fallback is the plaintext transcript path, which
has zero token data.

**Fix**: every successful bridge / native gRPC response is now
snapshotted to `~/.observer/antigravity-snapshots/<uuid>.bin`.
Future polls that find the originating agy gone reach the
`loadSnapshotEnrichment` fallback in `fetchStructuredEnrichmentWSL`
+ `fetchStructuredEnrichmentNativeAt`, surfacing the most-recently
captured trajectory (model attribution, per-turn tokens, the works)
instead of empty enrichment.

Snapshot reconciliation (`reconcileWithSnapshot`): when the bridge
returns a fresh payload, parse both new + cached, keep whichever
yields more TokenEvents. Protects against the case where a random
fan-out lands on a "junior" agy.exe returning a valid-looking but
truncated 1-turn response — without reconciliation we'd demote the
better cached snapshot.

Storage: ~150 KB per conversation in steady state. An `observer
doctor` prune step is queued separately.

### perf(antigravity): originating-server pin via cli-*.log scan (Phase 3)

The bridge's previous routing was "fan out to every running agy.exe
instance via PowerShell + WMI + per-server timeout". That walked
10–17 candidates per cold call, costing 30–90s.

**Fix**: parse each `cli-*.log` file's startup lines to extract the
language_server PID + listening ports, plus every `Created
conversation <uuid>` line. Result is a `conv UUID → (PID, HTTPSPort,
HTTPPort)` map. Both `callBridgeConvertCached` +
`callBridgeStructuredCached` now try log-derived endpoint candidates
**before** falling through to fan-out. Cached by log-dir freshness
(`cliLogFreshnessUnix`), so steady-state polling pays a single map
lookup.

Live verification on operator's host (2026-05-24):

```
1e235146:  fan-out fully bypassed → originating-server pin
           http://...:63353 failed → https://...:63353 OK (~1s)
c79f9f41:  TokenEvents went from 1 → 2; the originating-server pin
           reached the agy.exe that actually hosted the conv, where
           random fan-out had been landing on a junior instance.
```

Tests: `log_scan_test.go` (7 functions) pins the parser end-to-end
including PID/port extraction from the real-format log fixture and
the preferred-first endpoint candidate ordering.

Design doc: `docs/plans/antigravity-token-coverage-design-2026-05-24.md`
covers all three phases plus the Phase 4 (cipher reverse-engineering)
groundwork for full historical backfill.

### feat(web,api): on-demand full-text fetch + drop 4 KB ingest cap

Closes operator-reported gap in the Sessions → Messages table: the
clipboard buttons could only copy ≤4 KB (raw_tool_input) or ≤2 KB
(tool_output, FTS5 excerpt), even when the operator's prompt or the
captured tool result was much larger. The truncation was applied at
**ingest time**, so historical rows lost the bytes permanently.

**Storage** (migration 027 — `actions.raw_tool_output TEXT`):

- New column persists the full untruncated tool_result body per
  action, mirroring the existing `raw_tool_input` length-merge
  ON CONFLICT semantics so adapter re-scans keep the richer of the
  in-flight vs final body without ever regressing.
- `UpdateActionOutcome` also writes the column on post-hook merge
  paths so hook-captured pre-completion bodies get upgraded by the
  later JSONL adapter pass when the latter sees more bytes.

**Capture** (drop the legacy caps, add a 1 MiB safety belt):

- New `internal/contentcap` package — `Cap(s, max)` returns the body
  with a trailing `…(content truncated at N bytes)…` marker if it
  exceeded `max`. `DefaultMaxBytes = 1 << 20` (1 MiB).
- `internal/scrub.MaxRawInputBytes` bumped from 2 KiB → 1 MiB
  (`scrub.Truncate` callers across cowork / cline / claudecode /
  codex / copilotcli pick up the new ceiling automatically).
- Every adapter site that previously did `truncate(body, 4000)` for
  `ToolOutput` now routes through `contentcap.Cap`: cowork
  assistant_text + tool_result, cursor read-file + thinking + assistant
  response + transcript walker, codex assistant_text + reasoning,
  cline assistant_text, claudecode assistant_text, openclaw
  assistant_text, opencode assistant_text + reasoning + subtask +
  todo. The Claude Code `Stop` hook in `cmd/observer/hook.go`
  matches.
- Opencode's two 200-char `RawToolInput` caps (subtask /
  todo) lifted to the 1 MiB ceiling for consistency.
- The FTS5 indexer (`action_excerpts`) keeps its 2 KiB excerpt cap
  unchanged — search performance trumps copy-fidelity for that
  surface.

**Serving** (new endpoint + `/messages` elision):

- New `GET /api/action/<id>/full_text` returns the untruncated
  `raw_tool_input` + `raw_tool_output` for one action on demand.
  Returns 404 on unknown id, 400 on malformed path.
- `/api/session/<id>/messages` now caps inline `full_text` at 4 KiB
  (preview only), sets `full_text_elided: true` on rows that exceeded
  the cap, and surfaces `has_full_output: true` whenever
  `actions.raw_tool_output` is non-empty. Timeline payload stays
  bounded regardless of how large any single row's raw content grew
  post-migration.
- New `action_id` field on every `toolCallRow` so the frontend can
  call the on-demand endpoint without an extra round-trip.

**UI** (`SessionDetailPanel.tsx::ToolCallRowView`):

- `CopyOnClick` gains an optional `resolveValue` callback awaited on
  click; the primary + excerpt copy buttons now fetch the full body
  via `/api/action/<id>/full_text` and copy the resolved text when
  `full_text_elided` / `has_full_output` is set. Cached per-row so
  repeated clicks don't refetch.
- New **View** button appears on rows with elided content; opens a
  centered modal (z-[60], above the SessionDetailPanel slide-over)
  showing both `raw_tool_input` + `raw_tool_output` side-by-side
  with copy buttons inside. Escape + backdrop click close.

**Tests**:

- `internal/contentcap`: 6 cases covering passthrough, exact-fit,
  over-cap marker, zero/negative max default behavior.
- `internal/store`: `TestInsertActions_RawToolOutputLengthMerge`
  pins ON CONFLICT length-merge — re-ingest with longer body
  upgrades, shorter is ignored.
- `internal/intelligence/dashboard`: `TestAPIActionFullText` covers
  happy path (returns untruncated input + output), 404 on unknown
  id, 400 on malformed id, 404 on unsupported sub-resource.
- `internal/adapter/cursor`: existing 4000-cap test renamed +
  rewritten as `TestBuildEvent_BeforeReadFile_CapsAtContentcapDefault`
  to pin the new contract (under-cap passes through; over-cap gets
  the contentcap marker).

### fix(cost): net OpenAI-shape input against cached to stop double-billing

Closes operator-flagged cost-engine over-charge for codex /
OpenAI-shape sessions. Audit on session
`019e5adb-9206-73c3-9465-acf799bb335f` (2026-05-24) found the
dashboard reporting $0.01136 for a single 3299-net-input turn that
should have cost ~$0.00339 — a 3.4× overbill caused by the cached
portion being billed at BOTH the full input rate AND the discounted
cache_read rate.

**Root cause**: OpenAI / Codex `prompt_tokens` (a.k.a.
`input_tokens`) is the TOTAL prompt count INCLUDING the cached
portion; `cached_tokens` / `cached_input_tokens` is a SUBSET of it.
The Anthropic API reports `input_tokens` already-NET so the cost
engine's `inputCost = Input × input_rate + CacheRead × cache_rate`
math is correct for Anthropic but wrong for OpenAI — the cached
tokens get charged twice.

**Fix** (adapter-local, forward-only — historical rows stay
over-billed in dashboard rollups until they fall out of the window):

- `internal/adapter/codex/adapter.go` modern path
  (event_msg/token_count): emit `InputTokens = last.input_tokens -
  last.cached_input_tokens` (clamped at 0).
- `internal/adapter/codex/adapter.go` legacy path (top-level
  type=token_count): track NET cumulative input per session and
  emit per-turn deltas of NET, not deltas of gross with a separate
  cached subtraction (the prior shape gave negative-clamped-to-zero
  deltas when cached grew faster than gross).
- `internal/proxy/provider.go` OpenAI non-streaming response shape:
  `shape.InputTokens = max(0, PromptTokens - CachedTokens)`.
- `internal/proxy/streaming.go::applyOpenAIUsage`: same netting,
  with CacheReadTokens populated first so the netting step can read
  it off the result struct.
- `internal/adapter/copilotcli/log.go::emitTokenEvent` (Tier-1 OTel
  / debug-log path): same netting. Docstring previously confessed
  "InputTokens is the gross prompt total per Anthropic/OpenAI
  convention" — that convention is OpenAI's, and the cost engine's
  is Anthropic-net; updated to reflect the actual NET contract.
- `internal/adapter/copilotcli/events.go` session.shutdown
  modelMetrics handler: same netting (DB pattern matched the log
  path's gross shape across all 9 sampled rows: input always >=
  cache_read with 51-91% cache hit ratios).
- `internal/adapter/copilotcli/events.go` session.compaction_complete
  handler: same netting (compactionTokensUsed.inputTokens follows
  the same OpenAI-gross convention as the rest of Copilot CLI's
  token surfaces; tested against both old-schema {input,
  cachedInput} and new-schema {inputTokens, cacheReadTokens}
  variants).
- `internal/adapter/cursor/adapter.go::BuildStopTokenEvent`: same
  netting. Cursor's stop-hook payload uses Anthropic-style field
  NAMES (`cache_read_tokens`) but populates `input_tokens` with the
  OpenAI-style GROSS total — confirmed empirically against session
  93bcba3c (2026-05-24): a trivial 2-turn "say hello" conversation
  reported input_tokens=11615 with cache_read_tokens=11490 (99%),
  which is only coherent if input_tokens is the total prompt and
  the 11490 cached tokens are a subset (net new = 125, correct for
  the turn). Resolves the cursor item flagged in commit 0a6a252.
- `internal/intelligence/cost/engine.go` TokenBundle.Input
  docstring: pinned the NET contract explicitly so future provider
  integrations don't reintroduce the bug.

**Tests**:

- `cost.TestComputeBreakdown_OpenAIShape_NoDoubleBill` — pins the
  contract using the exact 019e5adb numbers (13923/10624/17/10);
  also asserts the computed total is significantly below the
  pre-fix wrong total as an anti-regression.
- `codex.TestParseTokenCount_NetsInputAgainstCached` — covers both
  parser paths (modern + legacy cumulative).
- Updated existing tests (4 proxy + 4 codex + 6 copilot-cli) that
  pinned the old gross-input contract — all now assert NET with
  explanatory comments tying back to the cost-engine TokenBundle
  docs.

**Audit coverage** (every TokenEvent emission site in the tree):

| Adapter | Shape | Status |
|---|---|---|
| claude-code, cline, cowork, claudecode-via-proxy | Anthropic native (`cache_read_input_tokens`) | NET ✓ |
| antigravity (classify + structured) | Protobuf-derived, normalized to net | NET ✓ |
| opencode | Upstream-verbatim, normalized to net | NET ✓ |
| pi, openclaw | Anthropic-native (Claude chat models) | NET ✓ |
| copilot VSCode (legacy + modern) | Never sets cache_read | N/A — no bug possible |
| codex JSONL (modern + legacy) | OpenAI gross → **fixed** | NET ✓ |
| proxy OpenAI (non-streaming + streaming) | OpenAI gross → **fixed** | NET ✓ |
| copilot-cli (log + shutdown + compaction) | OpenAI gross → **fixed** | NET ✓ |
| cursor IDE (stop hook) | Anthropic field names but OpenAI-gross values → **fixed** | NET ✓ |
| gemini-cli (legacy + JSONL) | Gemini API native is gross-shape; flagged | Pending (0 rows in operator DB, no immediate impact) |

### docs(cursor): WSL cursor-agent CLI first-session token-capture window

Investigation of WSL Cursor CLI session 251876cf (2026-05-24)
surfaced why it has conversation text but **zero token rows** —
and it is NOT a cursor-agent limitation. The session ran in the
22-minute window BEFORE observer registered hooks into the WSL-side
`~/.cursor/hooks.json`. Precise timeline (UTC):

```
19:12:57  cursor-agent CLI freshly installed on WSL
19:18:28  ~/.cursor/cli-config.json written (cursor-agent's config)
19:19:30  WSL CLI session 251876cf ran  ← no Linux hooks.json yet
19:41:46  ~/.cursor/hooks.json created  ← observer registers Linux
          cursor hooks (detect-then-register, 22 min too late)
```

Corroborating evidence: every cursor hook token row in the DB has
project_root `/c:/programsx/...` (Windows) — all prior working
cursor hooks came from the **Windows IDE** (registerCursorWindows,
live since 2026-05-08). There had never been a Linux-native cursor
hook row because the WSL `~/.cursor/hooks.json` didn't exist until
19:41:46. cursor-agent uses `~/.cursor/` as its home (store.db +
transcripts live there), so the hooks.json observer wrote at
19:41:46 is in the right place for future sessions.

Confirmed cursor-agent stores token usage NOWHERE on disk — the
content-addressed blob store (`~/.cursor/chats/<ws>/<id>/store.db`)
holds system_prompt / tools / conversation blobs with no numeric
usage fields, and no SQLite db under `~/.cursor` has a token column.
So the `stop` hook is the only viable token-capture path for the
CLI, exactly as it is for the IDE.

No code change. This is the inherent detect-then-register latency of
the auto-register-on-start model: a freshly-installed tool's very
first session(s) run before observer has registered its hooks.
Confirmed self-resolved — a WSL cursor-agent session run after
19:41:46 (852adff6) fired the `stop` hook and captured tokens
(input=7696 net, cache_read=5018).

### feat(cursor): capture system prompt from store.db blob store

Cursor sessions now surface a `system_prompt` row in the Messages
table, matching what codex and claude-code already show. Operator-
requested after noticing cursor's large per-turn input was opaque
(it's the agent harness — system prompt + tool defs + `<user_info>`
context — re-sent every turn, not the user's message).

Neither cursor's hook payloads (stop / beforeSubmitPrompt /
sessionStart / afterAgentResponse) nor the agent-transcript JSONL
carry the system prompt. The only on-disk source is cursor-agent's
per-session content-addressed blob store at
`<home>/.cursor/chats/<workspace-hash>/<conv>/store.db`, which holds
the prompt as a `{"role":"system","content":"..."}` blob (exactly one
per session; verified against the operator's live data — a 1959-char
"You are an AI coding assistant, powered by Composer…" prompt).

Implementation (`internal/adapter/cursor/storedb.go` +
`scan.go::ParseSessionFile`):

- The watcher derives the `.cursor` root from the agent-transcript
  path it's already parsing (so a Windows-side cursor read from WSL
  via /mnt/c works via `crossmount.TranslateForeignPath`), globs
  `chats/*/<conv>/store.db`, opens it read-only with a busy timeout,
  and scans blobs for the single `role:"system"` JSON blob (binary
  Merkle-node blobs are prefix-filtered out cheaply).
- Emits an `ActionSystemPrompt` row mirroring the codex shape: full
  scrubbed body in `raw_tool_input` (now uncapped at 1 MiB per the
  earlier full-text work), 200-char preview in `target`, `MessageID`
  `system:<hash>`, content-hashed `SourceEventID`
  `cursor-sysprompt:<conv>:<hash>` so re-scans dedup via the store's
  UNIQUE index.
- Emitted BEFORE the watcher's hook-deferral gate, because the live
  hook path captures tokens + activity but never the system prompt —
  so the row lands whether or not the cursor hook is registered.

Tests: `TestParseSessionFile_EmitsSystemPromptFromStoreDB` (synthetic
store.db with system + binary + user blobs; pins extraction,
field shape, and re-scan idempotency). Verified end-to-end against
the operator's real store.db.

#### Prompt-budget breakdown rows (token reconciliation)

To answer "why is a turn's input so large for a trivial message," the
watcher also surfaces cursor's per-section prompt-token budget. The
root blob carries a protobuf section index — `system_prompt`, `tools`,
`rules`, `skills`, `mcp`, `subagents`, `summarized_conversation`,
`conversation` — recording each section's token + char COUNT (the
tool/rule/skill content itself is NOT persisted anywhere on disk;
verified 2026-05-25). For the operator's `3cedf573` session the
breakdown was system 476 / **tools 6,122** / rules 4,426 / skills 940
/ subagents 174 / conversation 643 tokens — summing to ~12.8K, which
reconciles the ~12.5K gross turn-1 input. So the large input is the
agent harness (tools + rules dominate), not the user's message.

- New Go protobuf walker (`storedb.go::pbWalk` / `parseSectionIndex`)
  decodes the section index defensively (malformed/truncated fields
  abort cleanly — the format is undocumented and may drift).
- The current budget is pinned via `meta.latestRootBlobId` (a session
  accumulates multiple root blobs as it grows; picking by scan order
  would be non-deterministic), with a marker-scan fallback.
- Emits one zero-cost informational row per non-empty scaffolding
  section (`prompt_section.tools` / `.rules` / `.skills` /
  `.subagents` / …), skipping `system_prompt` (own content row) and
  `conversation` / `summarized_conversation` (the captured turns).
  Token/char counts live in `target` + body; NO `token_usage` row is
  emitted — the tokens are already billed inside each turn's
  `input_tokens`, so a separate token row would double-count.
  Content-name-keyed `SourceEventID` dedups on re-scan.
- These rows use a NEW `prompt_context` action type (not
  `system_prompt`), so the dashboard renders them as "Prompt context"
  rather than mislabeling a "Rules" / "Tool definitions" row as
  "System prompt". `models.ActionPromptContext` added; frontend
  `actions.ts` registers both `system_prompt` ("System prompt") and
  `prompt_context` ("Prompt context") explicitly (previously
  `system_prompt` only got a humanized fallback label).
  NB: cursor does NOT persist the tools/rules/skills/subagents
  *content* anywhere on disk (verified across `~/.cursor` — no
  workspace rules, no tool-schema blobs; skills exist as SKILL.md
  files but cursor sends a token-budget index, not the files), so
  these rows are inherently count-only. The system prompt is the lone
  section whose content is stored.
- Test: `TestParseSessionFile_EmitsPromptBudgetSections` (synthetic
  root blob built via protowire encoders; pins section emission,
  the system_prompt/conversation/empty-section skips, and zero
  token events). Verified end-to-end + deterministic across re-scans
  against the operator's real store.db.

### fix(cursor): canonicalize Windows cursor-agent CLI workspace roots

Windows cursor-agent CLI (cursor-agent.exe, invoked from WSL via
`wsl.exe`) sends `workspace_roots` as a raw Windows backslash path,
e.g. `C:\programsx\superbased-observer` (verified against session
90dd2512, 2026-05-24). `decodeWorkspaceRoot` returned that verbatim,
so the token row landed under a non-canonical project root that
isn't stat-able from a WSL observer and doesn't match the `/mnt/c/...`
form pathnorm produces everywhere else.

Fix: `decodeWorkspaceRoot` now routes its result through
`crossmount.TranslateForeignPath` (thin wrapper over
`pathnorm.Normalize`). `C:\...` and `file://` URIs canonicalize to
`/mnt/c/...`; already-native Linux paths and the IDE's `/c:/...`
forward-slash form are left untouched (pathnorm doesn't recognize the
`/c:/` prefix as foreign), so existing Cursor IDE rows don't
fragment. Test: `TestBuildStopTokenEvent_WindowsCLIWorkspaceRoot`.

Separately confirmed the Windows cursor-agent CLI token-capture path
is otherwise sound: the `stop` hook fires with full token data (BOM-
prefixed — observer strips it at `internal/hook/cursor.go:38`), and
the current handler captures it correctly. An earlier Windows CLI
session (90dd2512) missed its token row for an environmental/
transient reason (the hook is delivered through `wsl.exe` cold-spawn
and the `stop` handler reads the transcript across the `/mnt/c`
mount, pressuring the 250 ms ingest deadline under daemon WAL
contention) — NOT a logic bug; re-running the captured payload
through the current binary produces the correct row.

**Historical impact** (NOT backfilled): on 2026-05-24 there were
1,007 codex JSONL rows with `cache_read_tokens > 0` plus all
OpenAI-shape proxy rows. These stay over-billed in any dashboard
view that includes them; new rows from this point on bill
correctly. Anthropic-shape adapters (claude-code, antigravity,
cowork, claude-via-proxy) are unaffected — their `input_tokens`
already-net.

### fix(web): SessionDetailPanel copy buttons use full_text

Roll-forward of an earlier session's fix that landed in the working
tree but missed the CHANGELOG: the primary `CopyOnClick` in
`ToolCallRowView` now copies `tc.full_text || tc.target ||
tc.raw_tool_name` instead of the display-truncated `tc.target`. The
excerpt copy already preferred `tc.full_text`. Tooltip-show
condition also widened to trigger when `primaryFull.length >
primary.length` so the operator sees the longer text on hover even
when display fits in 140 chars.

## [1.6.28] — 2026-05-23

### fix(hook): cmd.exe-safe quoting for codex on Windows

Closes operator-reported regression against v1.6.25–v1.6.27:
@superbased/observer 1.6.27 + Codex CLI 0.133.0 on Windows
generates `hooks.json` entries wrapped in POSIX single quotes:

```
"command": "'C:\\Users\\...\\observer.exe' hook codex SessionStart --config 'C:\\Users\\...\\config.toml'"
```

Codex on Windows spawns each hook through **cmd.exe**, which doesn't
recognise `'...'` as a quoting style — the literal `'` becomes part
of the argument, cmd.exe fails to find a binary whose name starts
with a single-quote, and every hook fires exit 1. PreToolUse,
PostToolUse, SessionStart, Stop, UserPromptSubmit, and
PermissionRequest were all affected.

Root cause: the v1.6.25 Git-Bash-on-Windows fix wrapped every Linux/
default registrar's binary path + `--config` path via
`shellQuoteIfNeeded` (POSIX single-quote). That was correct for
Claude Code, which always invokes hooks through Git Bash. It was
**wrong for Codex**, which spawns hooks through whatever the host's
default shell is (`/bin/sh` on Linux, `cmd.exe` on Windows).

**Fix** (`internal/hook/register.go`): the codex registrar now uses
a new shape-aware quoter, `codexCmdQuoteIfNeeded`, that picks
between POSIX single-quote (for Linux/macOS paths — codex spawns
via `/bin/sh`) and cmd.exe-safe double-quote (for Windows-shaped
paths — codex spawns via `cmd.exe`). Path-shape detection
(`isWindowsPath` = contains backslash) rather than `runtime.GOOS`
so cross-platform tests can exercise both shapes without OS
mocking. `configFlagSuffix` gets a `Quoted` variant so codex's
`--config` path picks up the same shape-aware quoting.

Post-fix, the operator's reported path renders as the exact
unquoted shape their workaround already showed working:

```
"command": "C:\\Users\\...\\observer.exe hook codex SessionStart --config C:\\Users\\...\\config.toml"
```

A path with spaces (e.g. `C:\Program Files\observer\observer.exe`)
gets cmd.exe-safe double-quoted instead of POSIX single-quoted:
`"C:\Program Files\observer\observer.exe" hook codex …`.

**Scope of fix**: codex registrar only. Claude Code stays on
`shellQuoteIfNeeded` (single-quote) because Claude Code always
uses Git Bash on Windows — that quoting is correct there. Cursor
stays on `shellQuoteIfNeeded` because the operator hasn't reported
a regression there and we don't have authoritative info on what
shell Windows-native Cursor uses to spawn hooks; if a regression
surfaces, applying the same `codexCmdQuoteIfNeeded` pattern is a
~5-line follow-up.

Tests: 4 new pinning the post-fix shape.
`TestRegisterCodexUsesCmdSafeQuotingForWindowsBinaryPath` asserts
clean Windows paths render unwrapped (no POSIX `'D:\…'` wrapper).
`TestRegisterCodexWrapsWindowsPathWithSpacesInDoubleQuotes`
asserts Windows paths with spaces wrap in cmd.exe `"…"`.
`TestRegisterCodexLinuxPathStaysPosixQuoted` confirms the Linux
single-quote behaviour is preserved (no regression for non-Windows
codex installs). `TestRegisterCodexHonoursCmdSafeConfigPath`
covers the `--config` flag path through the same quoter.

`go vet ./...` clean; `go test ./... -count=1` 51/51 green.

## [1.6.27] — 2026-05-23

### feat(web,dashboard): themed Tooltip primitive + cache 5m/1h tier surfacing

Two threads land together: the dashboard's hover hints become themed
+ design-token-aware, and Anthropic's cache-creation 5m vs 1h tier
split now surfaces in the Sessions table + SessionDetail panel
(previously the split flowed end-to-end through the backend but the
UI collapsed it into a single "Cache W" bucket).

**Tooltip primitive** (`web/src/components/primitives/Tooltip.tsx`).
Replaces every native HTML `title="..."` hover hint with a themed
surface (`--bg-3` background, `--line-3` border, `--shadow-2`
elevation, optional arrow via `FloatingArrow`). `@floating-ui/react`
powers placement — flip / shift / offset / arrow positioning.
Hover-or-focus triggers with a 200ms restMs delay (matches OS-native
tooltip cadence); escape-to-close; multi-line support; max-width
default 280px with per-callsite override. Pinned in
`vite.config.ts` `manualChunks` as `vendor-floating-ui`
per `[[feedback_vite_manualchunks_clsx]]` so it doesn't get swept
into `vendor-recharts`. 49 KB / 18 KB gzipped vendor chunk.

Two-div internal layout — outer div carries `floatingStyles`
(positioning transform), inner div carries `useTransitionStyles`
output (scale-in animation). Without this split the transition's
transform would clobber the placement transform and tooltips would
render at the body origin (fixed pre-release after operator caught
the regression in QA).

**Migration sweep** — roughly 80 HTML `title=` callsites across
13 pages + 14 primitives migrated to the new primitive. Title-
forwarding primitives (Pill / IdLink / ToolBadge / ComboChip /
DensityBar / ActiveFilterChips / SlideOver close / CopyOnClick)
now wrap their `title` prop in Tooltip internally — every caller
that already passed `title=` to those gets themed tooltips with no
per-callsite change. The HelpInd `?` chip surfaces the new look
across every column header. Component `title=` props on PageStub /
ChartShell / StatCard / etc. are unchanged (those have always been
display labels, not browser tooltips).

**Cache tier surfacing**. The Sessions table's "Cache W" column
now hovers a 5m/1h breakdown panel — absolute counts + percentage
split + a note about the 60% 1h premium when it's engaged.
Backend lifts `cache_creation_1h_tokens` out of
`cost.TokenBundle.CacheCreation1h` on the per-session rollup
(`internal/intelligence/dashboard/dashboard.go::handleSessions`).
The SessionDetail panel's Token Buckets section splits "Cache
Write" into "Cache Write (5m)" + "Cache Write (1h)" sub-rows
when the session actually carried 1h-tier writes (sub-row is
omitted entirely when `cache_creation_1h_tokens == 0` — non-
Anthropic sessions stay at the original 4-bucket shape).
Anthropic-only feature; other providers see no change. `types.ts`
gains the matching `cache_creation_1h_tokens` on `SessionRow` and
`cache_creation_1h` on `SessionDetail.tokens`.

### fix(hook): Unregister symmetry + wsl.exe-prefix guard on Linux/default heuristics

Two review follow-ups from v1.6.26 brought forward into the same
ship. (Re-stated here because v1.6.26 was a private-only release;
the public mirror at 1.6.25 didn't see them.) Cross-binary
`observer uninstall` now cleans up entries written by a
differently-installed observer via the content-heuristic
(`filterClaudeGroups` / `filterCodexGroups` / `unregisterCursor`
removal loop). `isObserverClaudeEntry` and `isObserverCursorEntry`
reject wsl.exe-wrapped commands so the Linux/default and
Windows-WSL-bridge registrars match disjoint shapes.

## [1.6.26] — 2026-05-22

### fix(hook): Unregister symmetry + wsl.exe-prefix guard on Linux/default heuristics

Two review follow-ups to v1.6.25's drift-refresh fix.

**Unregister symmetry.** Three byte-exact `startsWith(h.Command,
binaryPath)` call sites remained in the uninstall path while v1.6.25
converted every Register-time site to the content-heuristic. Concrete
failure mode: user registers observer-A at `/tmp/observer-A`, later runs
`observer uninstall <tool>` from observer-B at `/usr/local/bin/observer`
— the unregistrar sees observer-A's entries as foreign and leaves them
orphaned. The Register path's argument ("syntax distinctive enough that
collision is essentially impossible") applies equally to Uninstall.

**Fix** (`internal/hook/register.go`): `filterClaudeGroups`,
`filterCodexGroups`, and the `unregisterCursor` removal loop all switch
to `isObserverClaudeEntry` / `isObserverCodexEntry` /
`isObserverCursorEntry`. The now-redundant `binaryPath` parameter is
dropped from the two filter helpers and their call sites in
`unregisterClaudeCode` / `unregisterCodex`.

Three new tests pin the cross-binary uninstall path:
`TestUnregisterClaudeCodeRemovesCrossBinaryEntries`,
`TestUnregisterCursorRemovesCrossBinaryEntries`,
`TestUnregisterCodexRemovesCrossBinaryEntries` — each installs against
`/tmp/observer-A` then uninstalls from `/usr/local/bin/observer` and
asserts no observer-A entries remain.

**wsl.exe-prefix guard on isObserverClaudeEntry + isObserverCursorEntry.**
Pre-fix, the v1.6.25 content-heuristic matched ANY command containing
` hook claude-code ` (or ` hook cursor `) — including the wsl.exe-wrapped
shape that the Windows-bridge registrar (`registerClaudeCodeWindows` /
`registerCursorWindows`) writes. If a user has both observer modes
registered against the same `settings.json` (rare but possible after
switching from a WSL-launched to a Windows-native observer on the same
host), the Linux/default registrar would silently rewrite the WSL-bridge
entries into native shape — chronic entry flap if the user alternates
modes.

**Fix**: both Linux/default helpers now require the cmd NOT to start
with `wsl.exe ` or `MSYS_NO_PATHCONV=1 wsl.exe `, mirroring
`isObserverWindowsClaudeEntry` / `isObserverWindowsCursorEntry`'s
positive guard from the opposite direction. The two pairs now match
disjoint command shapes. Codex has no Windows-bridge variant so
`isObserverCodexEntry` is unchanged.

New `TestObserverEntryHeuristicsAreDisjoint` pins the contract: native
shape → only Linux/default helper returns true; wsl-wrapped shape (with
or without MSYS prefix) → only Windows helper returns true; foreign
command → neither.

`go vet ./...` clean. `go test ./...` all 51 packages green.

## [1.6.25] — 2026-05-22

### fix(hook): content-heuristic drift refresh for claude-code/cursor/codex registrars

Closes operator-reported "Claude Code effort column on the dashboard is empty
for every recent session despite the v1.6.22 sidecar pipeline being in place."
`~/.claude/settings.json` had hooks registered to a stale npm-bundled observer
v1.4.30 binary (pre-dates the v1.6.22 `recordClaudecodeEffort` write), so every
PreToolUse / PostToolUse fire silently no-op'd on the sidecar. `observer doctor`
detected the drift (`⚠ hooks.binary`) but the on-start `autoRegisterHooks` self-
heal refused to refresh because `findClaudeGroupWithObserver` /
`hasConflictingClaudeHook` used a byte-exact `startsWith(h.Command, binaryPath)`
detector — a stale observer at a *different* binary path failed the prefix
match and got mis-classified as a foreign third-party hook. Same gap in
`findCodexGroupWithObserver`, `hasConflictingCodexHook`, `hasStaleObserverEntry`,
`filterStaleObserverEntries`, `hasCursorConflict`. The Windows registrar already
used the right pattern — content-heuristic on the ` hook claude-code ` token
sequence regardless of binary path prefix (`isObserverWindowsClaudeEntry`) — so
cross-binary upgrades on Windows refreshed silently while the Linux/default path
stayed broken.

**Fix** (`internal/hook/register.go`): three new content-heuristic helpers —
`isObserverClaudeEntry`, `isObserverCursorEntry`, `isObserverCodexEntry` — each
matching the ` hook <tool> ` token. Seven existing helpers rewritten to use them
and the now-redundant `binaryPath` parameter dropped. Trade-off documented inline:
a third-party command containing the literal ` hook <tool> ` substring would be
misclassified as observer and silently rewritten — same trade-off the Windows
registrar has accepted in production since v1.6.22; the syntax is distinctive
enough that accidental collision is essentially impossible.

After the fix ships, every future `observer start` self-heals stale-binary
entries automatically without `--force`. Historical sessions cannot retroactively
populate `effort_level` — effort lives only on hook stdin at fire-time and the
v1.4.30 binary swallowed those payloads.

### fix(hook): single-quote binary path in Linux/default registrars for Git Bash on Windows

Closes follow-on diagnosis after the drift-refresh landed and Claude Code hook
fires still exited 127 with stderr `/usr/bin/bash: line 1: D:programsxsuperbased-
observerbinobserver.exe: command not found` — note the stripped backslashes in
the error. Root cause: Claude Code on Windows always invokes hook commands
through Git Bash (per `docs/claudecode-hook-capture.md`), regardless of which
terminal launched the app. The Linux/default `registerClaudeCode` /
`registerCursor` / `registerCodex` registrars wrote the binary path unquoted
(`D:\programsx\...\observer.exe ...`), and Git Bash interpreted the backslashes
as shell escape sequences (`\p` → `p`, `\s` → `s`, etc.), producing
`D:programsx...observer.exe` and failing to find the binary. This is the
**inverse** of the MSYS_NO_PATHCONV bug already fixed for `claude-code-windows`
— that one was about path PREFIXING (Git Bash auto-translating `/`-rooted args);
this one is about ESCAPE STRIPPING. Affects only the Windows-native observer ↔
Windows-native Claude Code path, which neither the Linux registrar (assumes
POSIX) nor the `claude-code-windows` registrar (assumes WSL bridge) covered.

**Fix** (`internal/hook/register.go`): wrap `r.opts.BinaryPath` via
`shellQuoteIfNeeded` in all three Linux/default registrars' cmd construction.
Windows paths get single-quoted (`'D:\programsx\...\observer.exe'`); POSIX
paths with no special chars pass through unchanged, preserving existing test
fixtures + diff hygiene on Linux/macOS hosts. Single-quote is the same idiom
`configFlagSuffix` already uses for the `--config <path>` argument. Bonus: also
fixes paths containing spaces (`C:\Program Files\observer\observer.exe`) which
previously split on whitespace in argv.

End-to-end verified live on Windows: 26 `claudecode_effort` sidecar rows
captured across 4 sessions while the maintainer's normal Claude Code workflow
continued, all carrying the correct `xhigh` effort level matching the dropdown
selection.

### Tests

Six new tests in `internal/hook/register_test.go`. Three cross-binary-refresh
tests (`TestRegisterClaudeCodeCrossBinaryPathRefresh`,
`TestRegisterCursorCrossBinaryPathRefresh`,
`TestRegisterCodexCrossBinaryPathRefresh`) install against `/tmp/observer-A`,
re-register against `/usr/local/bin/observer`, and assert the file refreshes
silently. Three Windows-quote tests
(`TestRegisterClaudeCodeQuotesWindowsBinaryPath`,
`TestRegisterCursorQuotesWindowsBinaryPath`,
`TestRegisterCodexQuotesWindowsBinaryPath`) register with a `D:\...\observer.exe`
BinaryPath and assert the JSON-decoded command starts with the single-quoted
shape. Existing `TestRegisterClaudeCodeConflict` / `TestRegisterCodexConflict`
still pass — genuine foreign commands lack the ` hook <tool> ` token and remain
flagged.

## [1.6.24] — 2026-05-21

### fix(opencode): capture per-message effort level (variant)

Closes operator-reported "Only the CLI session was captured but without
effort level." OpenCode CLI stores per-(provider, model) effort selection
in `~/.local/state/opencode/model.json` under `variant.<provider>/<model>`,
and the CLI stamps the chosen level ("low" / "medium" / "high") onto every
assistant message's `data.variant` JSON field. Pre-fix the adapter's
`messageData` struct had no `Variant` field, so JSON unmarshalling
silently dropped the key — every CLI assistant row had `Metadata.EffortLevel`
NULL.

**Fix** (`internal/adapter/opencode/adapter.go`): add
`Variant string `json:"variant"`` to `messageData`. Stamp
`Metadata = effortMetadata(msg.Variant)` on every assistant-side ToolEvent
emit site (completion, tool, assistant_text, subtask, reasoning, step_finish).
User prompts intentionally stay nil (variant is on the assistant response,
not the user message). Mirrors codex's `withEffort` pattern.

Empirical asymmetry — the Windows Desktop variant does NOT emit `variant`
today (verified 2026-05-21 against a live Desktop session). Only the CLI
does. F1's wiring picks Desktop effort up automatically if a future
Desktop release starts stamping the field.

### fix(opencode): cross-mount mirror unblocks Windows Desktop sessions

Closes operator-reported "the desktop one was completely missed." When the
adapter opened a `/mnt/c`-mounted opencode.db (WSL2 reading the Windows-side
OpenCode Desktop store) while Windows was actively writing the WAL,
`modernc.org/sqlite` returned `disk I/O error (SQLITE_IOERR_SHORT_READ
4618)` on every read — every Windows Desktop session never landed. Verified
by reproducing the failure mode with the adapter's exact DSN against the
live Windows-side path.

**Fix** (`internal/adapter/opencode/adapter.go`): new `stageMirrorIfForeign`
helper. When the source path lives under a `crossmount.AllHomes()`-detected
non-native home, copy the SQLite trio (`.db` + `-wal` + `-shm`) into a
per-source mirror dir under `os.UserCacheDir()/superbased-observer/
opencode-mirror/<sha8>/`, open the mirror, return the mirrored path.
Refresh skips the copy when every source sibling is older than (and matches
size with) the mirror sibling — WAL is checked separately because its mtime
ticks every flush.

`openReadOnlyDB` calls into the helper so both `latestWatermark` and the
load functions benefit. The mirror is fully transparent: SourceFile on
emitted events still references the original `/mnt/c/...` path so the
watcher's `(source_file, source_event_id)` UNIQUE constraint is preserved
across native + foreign hosts.

Cost: ~2.3 MB I/O per refresh per foreign source under steady-state load.
Negligible compared to the data the fix unblocks (11 messages + 60 parts
in a single 30-second Desktop turn during the audit).

### fix(opencode): translate foreign cwd before git.Resolve

OpenCode Desktop on Windows records `path.cwd` as a Windows-style path
("C:\\programsx\\superbased-observer"). Per
`[[feedback-foreign-path-git-resolve]]`, calling `git.Resolve` on a
Windows-style path from a Linux host causes `filepath.Abs` to treat the
string as relative, prepend the observer's CWD, and `git.Resolve` walks
UP that bogus path — landing on observer's own `.git` in the worst case.

**Fix**: wrap `cwd` through `crossmount.TranslateForeignPath` before
`git.Resolve` in `resolveProjectRoot`. Mirrors the existing wiring in
`claudecode/adapter.go:1055` and `codex/adapter.go:2494`. Only relevant
once the v1.6.24 cross-mount mirror unblocks Windows Desktop ingestion
in the first place — pre-fix there were no foreign-cwd rows to misroute.

### feat(opencode): capture reasoning + step-finish parts

OpenCode's `part` table contains two part types the adapter dropped pre-
v1.6.24: `reasoning` (the model's visible chain-of-thought body — 11
per Desktop session in the audit corpus) and `step-finish` (per-step
token + cost slice — 10 per Desktop session). The reasoning COUNT
survived via `TokenEvent.ReasoningTokens`, but the actual reasoning TEXT
and the per-step granularity were both lost.

**Fix**:
- `loadReasoningEvents` mirrors `loadAssistantTextEvents`: each non-empty
  reasoning part emits one `ActionTaskComplete` row with
  `RawToolName="opencode.reasoning"`, body in `ToolOutput` (scrubbed,
  capped 4000 chars), `DurationMs` derived from `time.{start,end}`.
- `loadStepFinishEvents` emits one `ActionUnknown` ToolEvent per
  step-finish with `RawToolName="opencode.step_finish"`,
  `Target=finish_reason`, full step-finish JSON in `RawToolInput`.

**Critical design contract — no TokenEvent emit from step-finish.** The
message-level `data.tokens` bundle is the SUM across that message's
step-finish parts; emitting TokenEvents from step-finish would double-
count against `loadTokenEvents`. step-finish surfaces as observability
metadata only, NOT as a token-attribution source. Documented inline so
a future audit doesn't accidentally "fix" this into a double-count.

### docs

`docs/audits/opencode-audit-2026-05-21.md` documents the full audit: live
ground-truth tables, per-finding evidence, cross-platform inventory of
OpenCode storage locations, deferred carry-forward (X1 backfill on next
daemon restart; X2 snapshot-vs-append note; X3 session.title/version
not lifted; X4 Windows Desktop variant emit policy).

## [1.6.23] — 2026-05-21

### fix(store): token counts now MAX-upgrade on re-emit (Copilot snapshot staleness)

Closes operator-reported "total cost for Copilot sessions doesn't fully
add up after new session-level updates land." Root cause: snapshot-based
adapters (Copilot's modern adapter) re-emit the same
`source_event_id = requestID + ":usage"` with REFINED token counts as an
in-flight request progresses (partial → mid → complete state in the
JSONL snapshot's `result.metadata`). Pre-fix, `InsertTokenEvents` ON
CONFLICT preserved the EXISTING counts and only upgraded the `model`
label — so a partial-state row with `(in=100, out=0)` could permanently
persist even when the final state arrived with `(in=150, out=200)`.

**Fix** (`internal/store/store.go::InsertTokenEvents`): change the ON
CONFLICT clause to `MAX(existing, new)` for every token-count column
(`input_tokens`, `output_tokens`, `cache_read_tokens`,
`cache_creation_tokens`, `cache_creation_1h_tokens`,
`reasoning_tokens`). Token counts are monotonically non-decreasing per
logical event — newer ≥ older always — so MAX is universally correct:
re-emit with identical counts → no-op; re-emit with refined (larger)
counts → upgrade; accidental regression (smaller new value from an
adapter bug) → existing larger value preserved.

`estimated_cost_usd` follows the same monotonic-upgrade pattern (a
proxy-sourced row may later get a non-zero cost when initial emit had
none; the larger non-zero value wins on conflict).

Live evidence from the maintainer DB (2 of 4 copilot token rows show
the partial-state pattern: `request_59a80a92...:usage` has `in=0,
out=177` and `request_dbbb2805...:usage` has `in=0, out=137` — the
complete versions never landed because the conflict-resolution rule
silently dropped them).

**Universal scope** (not Copilot-only): the fix applies on conflict
across all adapters. JSONL adapters (claude-code, codex, cowork,
antigravity, cursor-hook) emit final-on-write events where re-parse
produces identical counts — MAX returns the same value, no behavioral
change. Snapshot/patches adapters (Copilot modern, potentially
opencode/openclaw if they re-emit) get the refinement upgrade.

### fix(watcher): per-file mutex eliminates fsnotify/poller race

Closes operator-reported `store.SetCursor: database is locked (5)` and
`store.UpsertProject: database is locked (5)` warnings in the watcher
log. Root cause: `processFile` is called by TWO independent goroutines
for the same source file — the fsnotify-debounced `fire()` and the
poller's `pollCursors()`. Both `BEGIN IMMEDIATE` against SQLite; one
holds the write lock while the other waits. On slow filesystems
(WSL2 `/mnt/c`, OneDrive-synced directories) the holder's transaction
can exceed the 30s `busy_timeout` window, surfacing as
`SQLITE_BUSY (5)` on the waiter.

Pre-fix the doc-comment claimed the race was "safe via UNIQUE
constraints" — true for data integrity (the loser's retry hits the
UNIQUE index and silently dedupes), but the wasted-acquisition cost +
visible WARN spam was poor. The race also meant the cursor on the
loser's processFile was never advanced — the next poll re-processed
the same bytes a second time, doubling the work for the steady-state
file-growth case.

**Fix** (`internal/watcher/watcher.go`): add a `sync.Map`-backed
per-file `sync.Mutex` keyed by `source_file`. `processFile` acquires
the file's mutex before reading the cursor and releases it after
SetCursor. fsnotify and poller for the same file now queue instead of
race. Inter-file contention is still handled by SQLite's `busy_timeout`
backoff (unchanged).

**Data integrity unchanged**: pre-fix retry path via UNIQUE constraints
+ idempotent `SourceEventID` already prevented data loss. This fix is
about reducing wasted work and eliminating the misleading WARN logs;
no operator action required.

### fix(cursor,cost): four bugs from the 2026-05-21 cursor adapter audit

Closes the four high-impact findings from
`docs/audits/cursor-audit-2026-05-21.md`. Each was a silent dropout invisible
to existing tests and CI — only visible by reconciling the live
hook captures at `/tmp/cursor-hook-capture/` (Cursor 3.4.20,
2026-05-19) against the live DB.

**F1 — `model:"default"` (Cursor's Auto mode) silently billed $0.**
The pricing table had no `default` entry and no family prefix that
`default` matched. All 8 cursor token rows in the maintainer DB
(model=default, ~120K input + 7.7K output + 245K cache_read across
the corpus) were billing at zero. Pinned to Composer 2.5 Fast rates
($3 / $15 / $0.30 per 1M) per cursor.com/blog/composer-2-5 — that's
the underlying default model behind the Auto router. Also added
explicit pins for `composer-2.5` ($0.50 / $2.50) and
`composer-2.5-fast` ($3 / $15) so direct model-name picks resolve
without a family-prefix fallback. The new `default` entry is
override-friendly via Settings → Pricing — Cursor's bundled-usage
economics differ from the API-list-equivalent baked-in rates, and
the maintainer-facing UI surfaces this for adjustment.

**F2 — postToolUse `duration` field name mismatch.** Cursor's
`postToolUse` payload sends `"duration": 6.332` (float, in SECONDS);
observer's `rawHookPayload` struct expected `"duration_ms"` (int64).
Result: 0 of 79 cursor actions in the live DB had a non-zero
`duration_ms`. The struct now reads both — `DurationSecs` (the
postToolUse seconds float) is converted to ms in `BuildAfterOutcome`,
falling back to the legacy `DurationMs` for events that genuinely
emit it (afterAgentThought, postToolUseFailure).

**F3 — postToolUse `tool_output` body not captured.** The
postToolUse payload carries the tool's response (Read body, shell
stdout, etc.) but `OutcomeUpdate` had no slot for it. Extended
`OutcomeUpdate.Output` + `Store.UpdateActionOutcome` signature to
carry the output through, with FTS5 indexing into `action_excerpts`
via the new `Store.WithIndexer` binding (best-effort; index failures
log but don't fail the row update).

**F4 — beforeReadFile `content` body not captured.** Cursor's
beforeReadFile payload carries `content` (the file body cursor just
read). `BuildEvent` now stamps it on `ev.ToolOutput` (scrubbed +
capped at 4000 chars matching the cross-adapter convention). With
the indexer wired in `handleCursorHook`, the body lands in
`action_excerpts` the same way claudecode's Read body does. Closes
the cross-tool body-visibility gap for cursor.

### Plumbing

- `Store` gains an optional `indexer *indexing.Indexer` field with
  a `WithIndexer` chainable setter. `Store.Ingest` falls back to
  this when `IngestOptions.Indexer` is nil — daemon watchers
  continue passing their long-lived indexer through opts; hook
  handlers attach via the chainable setter on hook entry.
- `handleCursorHook` (`cmd/observer/hook.go`) now creates an
  `indexing.Indexer` from `cfg.Compression.Indexing.MaxExcerptBytes`
  and binds it to its Store. Both Ingest-path emission
  (beforeReadFile.content) and UpdateActionOutcome-path enrichment
  (postToolUse.tool_output) populate `action_excerpts` cleanly.
- `Store.UpdateActionOutcome` signature extended with
  `toolOutput, toolName, target string`. Existing callers updated;
  Cursor's `OutcomeUpdate` now carries the tool name and derived
  target so the FTS5 row matches the surrounding action's columns.

### docs

- `docs/audits/cursor-audit-2026-05-21.md` — full audit using the
  `docs/adapter-audit-playbook.md` methodology. Captured field-map
  per event for Cursor 3.4.20. Seven findings ranked by severity;
  eight G-ok rows of verified-correct behavior; carry-forward
  items for future sessions.

### Validation

Live empirical evidence from `/tmp/cursor-hook-capture/`
(post-v1.6.18 captures on Cursor 3.4.20):
- F1 reproduction: `Lookup("default")` returned `PricingSourceMiss`
  before this ship; returns `PricingSourceExact` with Composer 2.5
  Fast rates after.
- F2 reproduction: postToolUse-7yNeQw.json has `"duration": 6.332`;
  test `TestBuildAfterOutcome_PostToolUseDurationSecondsTranslated`
  pins the seconds→ms translation.
- F3/F4 reproductions: corresponding test pins for tool_output
  capture and beforeReadFile.content truncation.

### Deferred to a follow-up (per audit doc §4)

- F5 — observability fields (`composer_mode`, `cursor_version`,
  `stop.status`, `stop.loop_count`, `attachments[]`) still ignored.
  All five fit `actions.metadata` (JSON) cleanly; deferred for a
  metadata-batch ship rather than smearing across this one.
- F6 — soften v1.6.18 walker-dead-code docstring on Cursor 3.4.x.
  Doc-only; not yet edited in this ship.
- F7 — delete `/tmp/cursor-tee-shim.sh` and re-register hooks.
  Operator-approval cleanup — kept current here to avoid breaking
  the maintainer's running session.

## [1.6.22] — 2026-05-21

### feat(claudecode,hook): per-turn `effort.level` capture for Claude Code on both Linux CLI and Windows Desktop

Closes a gap operator-reported 2026-05-21: Claude Code's effort
dropdown (Max / Extra High / High / Medium / Low) was changing real
behavior turn-to-turn, but the dashboard's per-action **Effort** column
(landed in v1.6.18) stayed empty for every claude-code row. Three
distinct fragilities lined up underneath that one symptom; each is
fixed in this ship.

**Why the JSONL alone can't carry effort.** Exhaustive JSON-key scan
across hundreds of `.jsonl` files on both Windows and Linux corpora
returns zero hits for `effort` / `reasoning_effort` / `budget_tokens` /
`thinking_budget`. Effort is a request-side
`thinking: {budget_tokens: N}` parameter that the Anthropic API never
echoes back into the response stream. Per
`code.claude.com/docs/en/hooks`, `effort.level` IS exposed to the
PreToolUse / PostToolUse / Stop / SubagentStop hook payloads — and
that's the only per-turn source. Observer registers all four events
already, but `HandleApprove` was discarding the payload.

**What this ship adds:**

- **Migration 026** — new `claudecode_effort` sidecar table keyed
  `(session_id, tool_use_id)` storing `effort_level`, `event_name`,
  `received_at`. The Anthropic `toolu_xxx` block ID is already the
  `source_event_id` for tool_use rows in `actions`, so joins are
  natural without a schema change to `actions`.
- **`store.UpsertClaudecodeEffort`** — single in-tx upsert that
  populates the sidecar AND runs an `UPDATE` on any matching
  already-inserted action row's `metadata.effort_level`. Race-safe in
  either ordering: hook fires before JSONL ingest (sidecar lookup
  catches it on parse) or after (UPDATE stamps the row immediately).
- **`recordClaudecodeEffort`** in `cmd/observer/hook.go` — extracts
  `(session_id, tool_use_id, effort.level)` from PreToolUse + new
  PostToolUse dispatch; no-ops cleanly when `effort.level` is absent
  (which the docs say happens on models that don't support effort).
- **`claudecode.Adapter.WithEffortLookup`** — JSONL parse-time
  enrichment via per-session cached map; fail-safe on lookup errors
  (parse still returns events).
- **`claude-code-windows` registration target** — mirrors
  `cursor-windows`. Writes hooks into a Windows-side
  `.claude/settings.json` with `wsl.exe -d <distro> -- <linux-bin>` so
  Claude Desktop on Windows can fire hooks into the WSL-side observer
  binary. Auto-surfaced via `Registry.Installed()` when crossmount
  detects a Windows-side `.claude/`.

### fix(hook): three E2E fragilities that broke the chain on first ship

Discovered during empirical Desktop-side validation:

1. **Git Bash MSYS path translation** — Claude Code on Windows runs
   hook commands through Git Bash (per the upstream docs). Git Bash's
   MSYS layer auto-rewrites POSIX-shaped `/home/...` arguments into
   `C:/Program Files/Git/home/...` before they reach the program being
   spawned, so `wsl.exe -d Ubuntu-20.04 -- /home/.../bin/observer`
   became `wsl.exe -d Ubuntu-20.04 -- C:/Program Files/Git/home/.../
   bin/observer`, which wsl.exe could not find inside the Linux distro,
   exit-127 every fire. JSONL attachment records captured the symptom
   verbatim:
   ```
   {"type":"hook_non_blocking_error", "exitCode":127,
    "stderr":"/bin/bash: C:/Program Files/Git/home/.../observer: No
    such file or directory"}
   ```
   Fix: prefix every registered Windows-side wsl.exe command with
   `MSYS_NO_PATHCONV=1 ` so Git Bash skips POSIX→Win32 conversion. The
   env-var assignment is bash-only — silently ignored by macOS/Linux
   `sh -c` and by cmd.exe — so it's safe to set unconditionally on the
   Windows registrars without OS branching. Same fix mirrored to
   `cursor-windows` (Cursor on Windows uses the same Git Bash hook
   execution path). `isObserverWindowsClaudeEntry` /
   `isObserverWindowsCursorEntry` updated to recognise both the old
   prefix-free and new MSYS-prefixed shapes, so refresh-on-drift
   silently upgrades existing user registrations.

2. **`selectTools` whitelist missing `-windows` variants** —
   `cmd/observer/init.go::selectTools` had a local `supported` map
   hard-coded to `{claude-code, cursor, codex}` that silently dropped
   `claude-code-windows` and `cursor-windows` from `observer init
   --all` even though both registrars existed and `Installed()`
   surfaced them. Auto-register-on-start was unaffected (uses
   `hookSupported` directly), but the explicit `init` path needed the
   fix. Cursor-windows had been quietly broken for users running
   `observer init` explicitly; bonus fix included.

3. **`db.Open` deadlined by HookTimeout** —
   `recordClaudecodeEffort` initially fenced both `db.Open` and the
   upsert under `cfg.Observer.Hooks.HookTimeout()` (~250-500ms write-
   side budget). While the long-running daemon holds the WAL hot, a
   per-process hook invocation's `db.Open` reliably busts that budget
   on the `quick_check` integrity probe and silently drops the effort
   write. Split the deadlines (mirrors the cursor/codex hook
   handlers): unbounded `context.Background()` for `db.Open`,
   `HookTimeout` only on the actual write. Sidecar writes now land in
   <50ms in steady state.

### Migration

- `db.Open` applies migration 026 (new `claudecode_effort` table)
  automatically on next daemon start. Zero risk: pure additive
  CREATE — no existing data touched.
- Existing `claude-code` + `cursor` hook registrations on the Linux
  home are untouched. Windows-side `settings.json` / `hooks.json`
  entries previously written by Phase 2 / the cursor-windows v1.4.45
  ship get refreshed in place with the new `MSYS_NO_PATHCONV=1`
  prefix on the next `observer start` or `observer init --all
  --force` (refresh-on-drift recognises both shapes as ours).

### What this doesn't fix

- The target session `bd834194-1b9c-480f-bd14-f126a5f35a55` that
  prompted this investigation **cannot be retroactively backfilled** —
  no hooks fired during its lifetime because the Windows-side
  `settings.json` hadn't been written yet. Only sessions started AFTER
  the registration write AND after Claude Desktop is restarted to
  re-read settings.json will capture per-turn effort.
- Models that don't support the `effort` parameter (per Anthropic's
  docs) will still leave the column blank. The hooks fire and exit 0;
  `recordClaudecodeEffort` no-ops cleanly when `effort.level` is empty
  in the payload. Opus 4.7 and other extended-thinking-capable models
  do emit it.

### Verified

- Empirical end-to-end on Claude Desktop v2.1.138 (2026-05-20, fresh
  install): hooks fire exit 0; `claudecode_effort` sidecar populates;
  dashboard Effort column shows the per-turn value across Max → High
  → Low ladder changes.
- `go test -race ./...` — 51 packages OK (one inherent concurrent-
  migration test flake under 51-package parallel load; passes 5/5 in
  isolation).
- `go vet ./...` — clean.

### Docs

- New `docs/claudecode-hook-capture.md` — verified Claude Code hook
  envelope, dual-registration model, MSYS gotcha, sidecar contract.
- `docs/provider-mapping.md` — `claude-code-windows` cell added,
  MSYS_NO_PATHCONV note appended to both Windows registrars' rows.

## [1.6.21] — 2026-05-20

### fix(release): gate npm-release.yml to the private repo so the public-repo orphan push doesn't double-fire

Hotfix for a second failure-mode surfaced by v1.6.19/v1.6.20: the
`.github/workflows/` directory rides along in the orphan tree
force-pushed to the public repo by `scripts/release.sh public`
(it's not in `PRIVATE_ONLY_PATHS` — intentional, for transparency).
The v* tag push to the public repo then also fires `npm-release.yml`
there. The public repo has no `NPM_TOKEN_OBSERVER` secret (and
shouldn't — npm publish belongs to the maintainer side), so the
`publish to npm` job fails with `ENEEDAUTH`. The `build`,
`public_release`, etc. jobs also wastefully run there, only
"working" because `gh release edit + upload --clobber` is
idempotent against the same release the private run just created.

**What this ship changes:**

- `frontend` job gains `if: github.repository == 'marmutapp/superbased-observer-private'`.
  Every other job in the workflow chains on `needs: frontend`
  transitively (build → publish → release; build → public_release),
  so skipping `frontend` on the public repo short-circuits the whole
  pipeline cleanly — all jobs report as "Skipped" instead of running
  and failing.
- No change to behavior on the private repo: every existing condition
  still holds because `github.repository == 'marmutapp/superbased-observer-private'`
  is true there.

**What didn't change:**

- `ci.yml` (the pre-merge gate) is intentionally left ungated. It
  fires on `push: main` on the public repo when the orphan commit
  lands, runs the same typecheck + build + test pass against the
  public-tree source, and succeeds. That's a useful free
  cross-check (does the scrubbed public tree still build + pass
  tests?), not a duplicate publish.
- The orphan tree still includes `.github/workflows/` so the
  workflow source remains visible on the public repo. Browsers
  see the same YAML the maintainer ships; CI just doesn't fire.

## [1.6.20] — 2026-05-20

### fix(release): public_release job — fail-fast on missing PAT + unauth'd tag-wait

Hotfix for a confusing failure mode hit on the first v1.6.19 release.
Before `PUBLIC_REPO_TOKEN` was set, the `public_release` job's
`Wait for v* tag on public repo` step ran `gh api --silent 2>/dev/null`
against the public repo's ref endpoint. With `GH_TOKEN` empty (unset
secret evaluates to ""), gh CLI sends an empty bearer token and the
API returns 401 — but the `--silent 2>/dev/null` swallowed it and the
loop kept retrying. After 12 iterations (120s) the job errored with
"Public tag not present" even though the tag was right there on the
public repo, accessible to anonymous curl. The operator chased a
non-issue ("did release.sh public actually push the tag?") before
realizing the PAT secret was missing.

**What this ship changes:**

- `Wait for v* tag on public repo` step now uses **unauthenticated
  curl** against `api.github.com/repos/superbasedapp/observer/git/ref/tags/<tag>`.
  The public repo's ref endpoint is readable anonymously, so the wait
  doesn't need a PAT. The step explicitly switches on HTTP status:
  200 → success, 404 → keep polling (expected during the wait
  window), 403 → rate-limit backoff, anything else → log + retry.
- New explicit `Sanity-check PUBLIC_REPO_TOKEN is set` step right
  after the wait. Fails fast with a one-line "see runbook" pointer
  if the secret isn't configured, instead of letting the downstream
  `gh release create` step fail with the cryptic
  `gh: ... HTTP 404` (GitHub returns 404 for unauthorized cross-repo
  writes to avoid leaking repo existence — harder to debug than "PAT
  not set").

**Net effect:** the first-time setup failure mode now produces an
actionable error in the workflow log instead of a 2-minute
silent-401 wait. No behavior change for anyone whose PAT is already
set; the wait step's curl is functionally equivalent to the prior
gh-api call when both are reaching the public ref endpoint.

No code changes outside `.github/workflows/npm-release.yml`. No
schema migration. No daemon restart. Patch lands as v1.6.20 rather
than v1.6.19.1 because npm's strict SemVer 2.0.0 rejects 4-part
versions — the npm-publish step would error on a 1.6.19.1 tag.

## [1.6.19] — 2026-05-20

### chore(release): public-repo GitHub Release with per-platform binary archives

Adds direct-download binaries on the public repo's Releases tab so
users who don't want to install via npm can `curl` the right archive
for their architecture. Builds on the existing cross-compile pipeline
that already produces the 5 platform binaries for npm — same
artifacts, now also surfaced as tarball/zip downloads on
`github.com/superbasedapp/observer/releases`.

**What ships per release:**

| Asset | Platform | Contents |
|---|---|---|
| `observer-vX.Y.Z-linux-x64.tar.gz` | Linux x86_64 | `observer` + `antigravity-bridge.exe` |
| `observer-vX.Y.Z-linux-arm64.tar.gz` | Linux arm64 | `observer` + `antigravity-bridge.exe` |
| `observer-vX.Y.Z-darwin-x64.tar.gz` | macOS Intel | `observer` |
| `observer-vX.Y.Z-darwin-arm64.tar.gz` | macOS Apple Silicon | `observer` |
| `observer-vX.Y.Z-win32-x64.zip` | Windows x86_64 | `observer.exe` |
| `SHA256SUMS` | — | sha256 of all 5 archives, verifiable via `shasum -a 256 -c` |

**Pipeline changes:**

- `scripts/release.sh public` now accepts an optional `<version>` arg.
  When set, it force-pushes the same `v*` tag to the public remote
  pointing at the orphan commit's sha. `scripts/release.sh full
  <version>` passes the version through automatically; the legacy
  `scripts/release.sh public` (no version) form still works for
  tree-only refreshes that don't bump the release version.
- `.github/workflows/npm-release.yml` gains a `public_release` job
  that runs in parallel with `publish` (only needs `build`), waits
  for the v* tag to exist on the public repo (polls up to 2 min),
  bundles each platform's `bin/` folder into a tarball or zip,
  computes `SHA256SUMS`, and calls `gh release create --repo
  superbasedapp/observer`. Idempotent on retry — uses
  `gh release edit` + `gh release upload --clobber` if the release
  already exists.
- New repo secret on the private repo: `PUBLIC_REPO_TOKEN`. Fine-
  grained PAT with `contents: write` on the public repo only. **Must
  be set before the v1.6.19 tag lands** or the new job will fail
  with a `gh: HTTP 404` from the release-create step. Setup steps
  in `docs/release-runbook.md` under "Required CI secret".

**Backwards compatibility:** existing npm distribution flow is
unchanged. The `public_release` job is additive; if it fails (e.g.
missing PAT, public-tag push lagged), the npm publish + private
GH Release jobs are unaffected. Re-running the failed job after
fixing the underlying cause picks up where it left off.

**Body composition:** the public Release notes are the matching
CHANGELOG.md section plus a `### Downloads` addendum that lists the
five archives, verification command, and a pointer to the npm
package for users who prefer that install path. Same extraction
logic as the private release job — `awk` from `## [<version>]` to
the next `## [` header.

### fix(store): copilot-cli rescan FK 787 — stale LastInsertId on UPSERT-UPDATE

User on a Windows-native daemon reported repeated rescan failures:

```
watcher.Scan: process failed adapter=copilot-cli
  path=C:\Users\sdrona\.copilot\session-state\<uuid>\events.jsonl
  err="freshness.UpsertFileState: constraint failed: FOREIGN KEY constraint failed (787)"
```

8 of 79 copilot-cli session files erroring per rescan cycle. Root
cause: the single-row `insertSingleAction` path (`internal/store/store.go:1124`)
takes `LastInsertId()` unconditionally after `INSERT ... ON CONFLICT
DO UPDATE`. Per SQLite docs, UPSERTs that take the UPDATE branch
**do not change last_insert_rowid** — so on a re-scan that hits the
UPDATE branch, `LastInsertId()` returns the connection's previous
true-INSERT rowid. If retention has pruned that earlier row,
`UpsertFileState` then writes the stale `last_action_id` and trips
the actions(id) foreign-key constraint (SQLITE_CONSTRAINT_FOREIGNKEY,
extended code 787).

The batch `InsertActions` path (lines 290–428) already documented
and handled this exact issue with an existence pre-check (see its
inline comment at line 314). The single-row path didn't. This ship
brings the single-row path in line:

- Add the same `SELECT id FROM actions WHERE source_file = ? AND source_event_id = ?`
  pre-check before the UPSERT.
- On the UPDATE branch (row already existed): bind `a.ID` to the
  pre-check's `existingID`, so downstream `UpsertFileState` writes
  a valid `last_action_id`.
- On the INSERT branch (no pre-existing row): keep using
  `LastInsertId()`, which is reliable for genuine inserts.

Regression test pins the bug with the user's exact error message:
`TestIngestFileAction_RescanAfterRetentionDoesNotFKFail` in
`internal/store/store_test.go` reproduces the failure pre-fix (FK
787 surfaces in `err.Error()`) and passes post-fix. The test pins
`db.SetMaxOpenConns(1)` so the connection-level `LastInsertId`
staleness carries deterministically across operations — same regime
as a long-running daemon doing serial work on a single
high-contention connection.

No DB migration. No daemon restart required for users who upgrade
across this version — but the existing erroring sessions on disk
will keep producing the same warnings until the rescan runs against
the v1.6.19 binary.

### chore(antigravity,cost): adapter audit + Gemini 3.x Pro/Flash pricing pins

Bundles the deliverables from the end-to-end Antigravity adapter
audit at `docs/audits/antigravity-audit-2026-05-19.md`. The audit followed
`docs/adapter-audit-playbook.md` against the live antigravity corpus
(8,808 rows / 4 source-mounts / 7 distinct model SKUs) and the four
live Gemini sessions served by the running Linux-native
`language_server` processes.

**Headline finding resolved as a non-bug.** The kickoff doc's flagged
signal — "`reasoning_tokens = 0` across all 8,808 antigravity rows
despite adapter wiring at `structured.go:394`" — turned out to be a
**stale-corpus artifact**. Every row in the live DB predates commit
`6d37da7` (v1.4.53, 2026-05-15) which replaced `case 3: r.output =
f.Varint` with `case 9: r.reasoning + case 10: r.output`. Live probes
(`TestTokenRowDump` + `TestStructuredReasoningTokenCapture`) confirm
the production parser correctly emits non-zero ReasoningTokens for
fresh Gemini sessions (e.g. `162c4ab9` turn 0: `.9 = 598`, `.10 =
28`). **Aggregate cost is unchanged** because `.3 == .9 + .10` and
reasoning bills at the output rate (memory
`[[feedback-reasoning-tokens-billed]]`) — pre-v1.4.53 `.3 ×
output_rate` ≡ post-v1.4.53 `(.9 + .10) × output_rate`.

**Five verified-correct surfaces (G-ok-1 through G-ok-5):**
- Field-map complete for `1.3.1.17.2.*` usage; `1.3.1.17.3` =
  error/status strings (correctly skipped); `1.3.1.17.4` = 16-byte
  trace IDs (non-token); `1.3.1.4.*` mirrors `1.3.1.17.2.*` per turn
  (parallel duplicate emit; capturing only one is correct).
- Cross-tier emit is mutually exclusive by construction (Path A
  `classify()` vs Path B `applyStructuredEnrichment()`). Live data is
  **100% structured tier** (all 8,808 eventIDs start with
  `antigravity-struct-token:`); zero classify-tier rows.
- Re-parse idempotency intact: zero duplicate `(source_file,
  source_event_id)` tuples across all 8,808 rows.
- Store-layer dedup correctly excludes antigravity — all four
  `DELETE FROM token_usage` sweeps in `internal/store/store.go` are
  scoped to other tools (copilot-cli ×2, claude-code+codex
  tuple-dedup, claude-code snapshot-drift).

**Actionable findings shipped:**

0. **Gemini 3.5 Flash added** — `gemini-3.5-flash` exact entry pinned
   at Standard-tier rates per Google's Developer API pricing card
   (2026-05-19): Input $1.50 / Output $9.00 / CacheRead $0.15 per
   1M tokens. The entry also serves as a family prefix via
   `familyKeys()`, so `gemini-3.5-flash-experimental` (or any future
   flash-suffix SKU) resolves to Flash rates rather than falling to
   the `gemini-3` Pro-family entry. Google has no `gemini-3.5-pro`
   on its official pricing page as of this date — hypothetical 3.5
   Pro SKUs deliberately fall through `gemini-3.5-flash` (prefix
   doesn't match) to the `gemini-3` family (Pro rates), the
   conservative default. Batch / Flex / Priority tiers and grounding
   per-query fees ($14/1000 = $0.014/call) are NOT modelled —
   per-tier pricing and `GroundingPerRequest` field structural work
   remains in Workstream B (kickoff doc post-v1.6.18 §2). Per-hour
   cache storage ($1/1M tokens/hr) also deferred — shape doesn't
   fit the current per-call Pricing struct.

1. **B1 — Gemini 3 Flash family-prefix resilience**
   `gemini-3-flash-<unknown>` SKUs (any hypothetical Flash variant
   not pinned in the explicit `-preview/-agent/-high/-medium/-low`
   set) fall through the family-prefix matcher to the `gemini-3`
   family and bill at **Pro rates** ($2/$12 + LC ladder) instead of
   Flash ($0.50/$3) — ~4× over-bill. Gemini 2.5 is robust because
   `gemini-2.5-flash` and `gemini-2.5-flash-lite` are both pinned as
   family entries. Adds the missing `gemini-3-flash` family-prefix
   entry at Flash rates. Zero current live rows affected; pure
   resilience against future Antigravity SKUs.
2. **B2 — Gemini 3 Pro effort SKUs pinned explicitly**
   `gemini-3-pro-{low,medium,high}` were not pinned. 3,831 live
   `gemini-3-pro-high` rows resolved correctly via the `gemini-3`
   family-prefix fallback (Pro rates by coincidence), but the
   resolution is load-bearing on the matcher. Three new explicit
   entries paralleling the existing `gemini-3.1-pro-*` set. Zero
   behavioral change for any current row; pure resilience.
3. **C1 — `probe_e371fdb1_test.go` removed** (164 lines).
   Added in v1.6.11 to investigate session `e371fdb1` being "not at
   all being picked up". That session now extracts 17 rows / 17,595
   input tokens in the live DB — the underlying wrong-workspace-stub
   bug was fixed. Probe has served its purpose.

**Test coverage added:**
- `TestTable_AntigravityInternalSKUs` extended with three subtests
  pinning `gemini-3-pro-{high,medium,low}` to `PricingSourceExact`.
- New `TestTable_Gemini3FlashFamilyResilience` locks in the
  Flash-family fallback (asserts `gemini-3-flash-experimental` /
  `gemini-3-flash-foo-bar` resolve to Flash rates, not Pro rates).

**Carry-forward (operator decisions, documented in audit doc §X1/X2):**
- 8,808 historical rows could be back-filled with reasoning
  breakdown by invalidating their parse cursors. Aggregate cost is
  already correct; this updates the per-row column only. Most rows
  source from Windows-side `.pb` files (non-decryptable locally
  per `[[project-antigravity-windows-cipher]]`).
- 310 blank-model rows across 3 `.pb` files (160 file-missing, 150
  in-disk). Self-correctable for the 150 via parse-cursor reset; the
  current parser may resolve a model on re-attempt. Outcome
  unverified pre-action.
- Explicit `gemini-3.1-flash` and `gemini-3.1-flash-lite` family
  pins deferred pending an authoritative pricing card distinguishing
  3.1 Flash full from 3.1 Flash-Lite. Workstream B (pricing audit)
  follow-up.

**What didn't change:**
- The antigravity adapter source (`internal/adapter/antigravity/*.go`)
  is unchanged except for the probe deletion. The wiring is correct
  as of v1.4.53; the audit confirmed it.
- No schema migration. Schema stays at version 25.
- No daemon restart required — cost is computed at read time, so
  pricing.go edits take effect on the next dashboard query.

## [1.6.18] — 2026-05-19

### feat(cursor): capture finalized assistant thinking + response via afterAgent* hooks

Closes a long-standing visibility gap reported on session
`32c83fe8-3763-4f29-b127-a0968203db01`: the assistant's thinking text
was visible in Cursor's UI but completely missing from the observer
dashboard. The cursor adapter's prior coverage relied on the `stop`
event's transcript walker (`BuildStopTranscriptEvents`) to back-fill
assistant prose by reading the `agent-transcripts/<conv>.jsonl` file
the stop payload's `transcript_path` references — but on modern
Cursor (3.4.x), **that file no longer materializes**. Cursor moved
conversation storage to a SQLite store at
`User/globalStorage/state.vscdb` (key namespaces `composerData:<conv>`
+ `bubbleId:<conv>:<bubble>`, both of which carry the finalized
thinking text in `thinking.text`). The walker is dead-code on
current builds.

The v1.4.45 docstring at `internal/adapter/cursor/adapter.go` had
also rationalized away `afterAgentThought` and `afterAgentResponse`
as "fires per text/thought delta — high overhead." That claim was
verified false against captured live payloads in
`/tmp/cursor-hook-capture/` (operator's 2026-05-19 tee-shim
experiment): both events fire **once per finalized block**, with the
full text and a single `duration_ms` per thought (no per-token
streaming). The original concern doesn't apply to the current
Cursor build.

**What this ship adds:**
- New constants `EventAfterAgentThought` + `EventAfterAgentResponse`
  in the cursor adapter, with a fresh package-level docstring
  documenting the pivot from the v1.4.45 design.
- New `Text` field on `rawHookPayload` (json `text`) used by both
  events.
- New `BuildEvent` switch cases:
  - `afterAgentThought` → `models.ToolEvent` with
    `RawToolName: "cursor.thinking"`,
    `ActionType: ActionTaskComplete`,
    `PrecedingReasoning` = preview of the thinking text,
    `ToolOutput` = full body (truncated to 4000 chars),
    `DurationMs` = Cursor's rendered "Thought for Ns" timer.
    Empty-text events (rare metadata-only fires observed in
    capture dumps) are dropped.
  - `afterAgentResponse` → `models.ToolEvent` with
    `RawToolName: "cursor.assistant_response"` and the same
    preview/body shape used by the now-dormant transcript
    walker's `cursor.assistant_text` row. Empty-text events
    likewise dropped.
- `afterAgentThought` + `afterAgentResponse` appended to the
  registered Cursor hook event list in `internal/hook/register.go`
  (`cursorEvents`).

**Deliberately NOT changed:**
- Token counts. `afterAgentResponse` carries the same
  `input_tokens`/`output_tokens`/`cache_read_tokens`/
  `cache_write_tokens` fields as `stop`. We keep `stop` as the
  single source of per-turn token truth — emitting a `TokenEvent`
  from both would double-count via two distinct `(source_file,
  source_event_id)` pairs that map to the same generation. If a
  future Cursor build makes `stop` unreliable, this is the place
  to revisit.
- The dead JSONL walker. Left in place for two reasons: (1) older
  Cursor versions may still write the file (graceful fallback);
  (2) a state.vscdb reader is the natural future replacement and
  belongs in its own ship.

**New tests:**
- `TestBuildEvent_AfterAgentThought` — fixture mirrors the real
  payload shape captured for session 32c83fe8 in /tmp.
- `TestBuildEvent_AfterAgentThought_EmptyTextDropped` — guards the
  empty-text skip.
- `TestBuildEvent_AfterAgentResponse` — pins the response row shape
  + asserts no token/duration fields leak from the response payload
  into the row (those belong to the thought row + stop event).

**Live impact**: All cursor sessions ingested after the hooks are
re-registered (operator runs `observer init cursor` or the next
`observer start` auto-registration cycle) will start capturing
thinking + response prose. Historical sessions are NOT backfilled —
the data is in state.vscdb but the adapter has no reader for it
yet. Backfill is a follow-up patch (the operator-confirmed
Workstream B carry-forward of a state.vscdb reader).

Memory entry added: `feedback_cursor_after_agent_events.md` —
documents the v1.4.45 → v1.6.18 design pivot + the
single-source-of-truth principle for token counts.

### feat(dashboard): Effort column on Session Detail Messages table

The per-turn reasoning effort is already stored in
`actions.metadata.$.effort_level` (sourced from
`codex.collaboration_mode.settings.reasoning_effort` per
[[project_codex_v0_130_schema]], antigravity SKU-encoded
low/medium/high per [[project_antigravity_skus]], and any other
adapter that captures a reasoning-effort knob). It was already
surfaced on individual `toolCallRow` entries in
`/api/session/<id>/messages` but never bubbled up to the parent
`messageRow`, so the Session Detail panel's Messages table had no
way to show it. This patch closes that gap.

**Backend** (`internal/intelligence/dashboard/dashboard.go`):
- New `EffortLevel string` field on `messageRow` (omitempty).
- Aggregation in the action-scan loop: first non-empty
  `effort_level` from any contained action wins (all actions in a
  single turn share the same effort_level — codex picks it
  per-turn, antigravity bakes it into the SKU).

**Type surface** (`web/src/lib/types.ts`):
- `MessageRow.effort_level?: string` mirroring the existing
  `permission_mode` shape.

**UI** (`web/src/components/SessionDetailPanel.tsx`):
- New "Effort" column between Model and In. Renders the value
  uppercase in a tight mono font (matches the existing Msg ID
  column treatment); shows the standard `—` placeholder when
  empty (Anthropic models, copilot, etc. — adapters that don't
  expose an effort knob).
- Header `title` attribute documents the column's data sources so
  someone hovering at 2am understands why some rows are blank.
- Table `min-w-[1180px]` → `min-w-[1260px]` to accommodate the
  new column.
- SlideOver `width={1400}` → `width={1480}` per the operator's
  explicit request. The doc-comment block tracks the panel's
  width history (880 → 1200 → 1400 → 1480, each bump unlocking
  another column).

No new tests in this dashboard increment — the messages endpoint's
existing `TestHandleSessionMessages_*` golden-output tests cover
the new field via JSON marshalling (omitempty drops it when
unused, so no fixture regressions), and the column is a thin
presentational add.

## [1.6.17] — 2026-05-19

### fix(cost): long-context output rate is 1.5× standard, not 2× (OpenAI + Gemini Pro)

Acts on the pricing audit at
[`docs/audits/pricing-audit-2026-05-19.md`](docs/audits/pricing-audit-2026-05-19.md)
against `internal/intelligence/cost/pricing.go`. The audit
cross-checked every observed `(tool, model)` pair in the live
`token_usage` table against authoritative provider price cards
(Anthropic, OpenAI, Google Gemini, xAI). All standard rates, cache
tiers, and `WebSearchPerRequest` fees verified clean — but the
**long-context output rate** was systematically wrong across two
provider families: pricing.go used 2× the standard output rate above
the LC threshold, but both OpenAI and Google publish the rule as **2×
input / 1.5× output**. Every LC turn was over-billed by 33% on the
output side.

**Live-corpus impact**: 177 of 447 `gpt-5.4` rows (40% of gpt-5.4
traffic) cross the >272K threshold today — those rows' cost numbers
in the dashboard were 33% inflated on the output portion. Gemini Pro
+ gpt-5.5 LC traffic is zero in the current corpus so the structural
fix has no historical-cost delta for those models, but the same bug
class would have manifested as future volume hit the thresholds.

**Numeric changes** (`pricing.go`):
- `gpt-5.4.LongContextOutput`: `30 → 22.50`
- `gpt-5.5.LongContextOutput`: `60 → 45`
- 7 Gemini Pro entries (`gemini-3.1-pro-preview`,
  `gemini-3.1-pro-{low,medium,high}`, `gemini-pro-agent`, `gemini-3.1`
  family, `gemini-3` family): `LongContextOutput: 24 → 18`
- 2 Gemini 2.5 Pro entries (`gemini-2.5-pro`, `gemini-2.5` family):
  `LongContextOutput: 20 → 15`

**Test changes** (`engine_test.go`):
- `TestTable_LongContextDefaults` golden values updated to pin the
  corrected rates.
- New regression test
  `TestCompute_LongContextOutputIs1p5xNot2x` runs end-to-end (table
  lookup → `Compute`) across 6 representative SKUs, asserting the LC
  *output* rate is exactly 1.5× standard. Guards against silent
  reintroduction.

`TestCompute_ReasoningTokensBilledAtOutputRate` intentionally
unchanged — its inline `Pricing{LongContextOutput: 60}` is a synthetic
LC-dispatch fixture, not a claim about a real published rate.

### fix(cost): refresh xAI rates for the 2026-05 retirement schedule

`docs/x.ai/docs/models` lists `grok-code-fast-1` as retired
2026-05-15, with requests now billed at `grok-4.3` pricing
($1.25 / $2.50 per 1M). The current grok-4.x line (`grok-4.3`,
`grok-4.20-0309-*` reasoning / non-reasoning / multi-agent) all share
the same $1.25 / $2.50 card. Pre-2026-05-19 this table carried the
September-2025 launch rates ($0.20 / $1.50 for `grok-code-fast-1`,
$2 / $6 for `grok-4-20`), which under-bills `grok-code-fast-1`
post-retirement (6× input / 1.67× output) and over-bills `grok-4-20`
rows by 60% / 140%. Live-corpus impact: 1 row across both entries —
trivial historical dollars, but the entries were structurally wrong
going forward.

Numeric changes:
- New explicit entries: `grok-4.3`, `grok-4.20` (covers the 0309-*
  family).
- `grok-4-20` (historical alias), `grok-code-fast-1`, `grok-code`
  family, `grok` family prefix — all updated to $1.25 / $2.50.
  `CacheRead` falls back to 10% × Input ($0.125) via `fillDefaults`,
  matching how other xAI entries handle the absent published
  cache rate.

`TestTable_OtherProviderPricing` table updated with the new values
plus an explicit row asserting `grok-code-fast-1` resolves to the
grok-4.3 rate (the post-retirement-redirect invariant).

### Audit deferrals (not in this patch)

The pricing audit surfaced two additional gaps deferred for operator
review:

- **`copilot/auto` framing** (carry-forward from v1.6.16 F1) —
  recommend passthrough (accept $0), pending memory entry.
- **`GroundingPerRequest` field** — Gemini grounding-with-search
  ($0.014–$0.035/call) not modelled in the `Pricing` struct.
  Adapter side has no grounding count yet, so the engine field is
  not load-bearing today.
- **`WebSearchPerRequest` backfill** on gpt-4.1 / gpt-4o / o-series —
  zero live impact today; revisit when live web_search counts appear
  on these models.

See the audit doc §10 for the recommended sequence.

## [1.6.16] — 2026-05-19

### fix(copilot): capi-* model fallback + thinking-text preceding-reasoning capture

Acts on the VS Code Copilot Chat adapter audit at
[`docs/audits/copilot-vscode-audit-2026-05-19.md`](docs/audits/copilot-vscode-audit-2026-05-19.md)
against the maintainer's live 8-file modern corpus (8.2 MB combined,
4 substantive requests across 3 substantive sessions). The audit's
token-math reconciliation was clean — all 4 token buckets sum
zero-delta against `result.metadata.{promptTokens, completionTokens}`
ground truth — so no cost-engine work in this patch. The two fixes
below close the model-attribution coherence gap (F1) and the
reasoning-prose observability gap (F2) the audit surfaced.

**F1 — `capi-*` resolvedModel IDs silently bill $0.** Copilot
sometimes returns internal routing identifiers in
`result.metadata.resolvedModel` like
`capi-cus-ptuc-h100-oswe-vscode-prime` (CUS/NOE prefixes, H100/H200
GPU codes, OSWE/VSCODE channel tags) when its backend routes to a
custom-tier model without exposing a public name. **2 of 4** live
token rows had `capi-*` resolvedModel values; neither is in
`internal/intelligence/cost/pricing.go`, so the cost engine returned
$0 for them. Fix: when `resolvedModel` starts with `capi-`,
`emitModernTurn` now falls through to `modelId` (typically
`copilot/auto`) — collapsing the unpriced one-off into the canonical
Copilot routing bucket. New regression test:
`TestParseModern_CapiResolvedModelFallsBackToModelId` pins both the
public-resolvedModel preserved path (`grok-code-fast-1` survives)
and the capi-* fallback path. Pre-existing test
`TestParseModern_Kind2_AppendsNewTurn` updated to reflect the new
expected behavior. The deeper pricing question — what
`copilot/auto` should bill at, given the user pays a per-seat
subscription rather than per-token — is deferred to a later cost-
engine pass; this patch only fixes the attribution coherence.

**F2 — assistant thinking-text reasoning prose now surfaced.**
Modern Copilot interleaves `response[*].kind="thinking"` entries
between user prompt and tool calls. The adapter was already
capturing the *token count* via
`result.metadata.toolCallRounds[*].thinking.tokens` (always 0 in
this corpus — the field exists for forward-compat with
thinking-capable models), but the *prose* (16 entries across 4
requests) was dropped on the floor: `assistantResponseText` walked
the response[] array but only collected entries with a `value`
field and no `kind`, so thinking entries weren't picked up. Two
follow-on changes:
- New `collectThinkingTexts(req)` helper extracts the ordered
  thinking-prose list from `response[*].kind="thinking"`.
  `emitModernTurn` pairs the first thinking entry with the first
  round of tool calls, the second with the second round, etc.
  (sticking at the last entry if rounds outnumber thinking blocks).
  Each tool-call ToolEvent now carries the preceding round's
  reasoning in `PrecedingReasoning` (truncated to 1000 chars,
  matching the cowork sliding-window pattern).
- `assistantResponseText` tightened: any envelope with a `kind`
  field is now skipped (not just those with a `toolId`). Previously
  thinking text could leak into the task_complete row's
  `ToolOutput`; now it lands only in `PrecedingReasoning` on tool
  rows. The visible assistant prose (kind-less entries with a
  `value` string) is the only thing in `ToolOutput`.

New regression tests: `TestParseModern_ThinkingTextStampedOnToolRows`
(asserts thinking text on each tool row + asserts NO thinking text
leaks into task_complete output) and
`TestParseModern_NoThinkingTextWhenAbsent` (graceful empty case).

### Carry-over from the audit (deferred)

The following findings from
`docs/audits/copilot-vscode-audit-2026-05-19.md` are intentionally not in
this patch:

- **F3** — other `response[*].kind` envelopes (`inlineReference`,
  `mcpServersStarting`, `progressTaskSerialized`) ignored.
  Observability-only; no token/cost impact.
- **Population audit** — the live corpus has 4 requests across 3
  substantive sessions, too small for population-level
  reconciliation. A larger-corpus re-audit when a heavy-Copilot
  maintainer corpus exists should follow.
- **Sticky-state model fallback risk** — `state.Model` is sticky
  across turns within a request; in degraded snapshots where
  modelId and resolvedModel are both empty after a populated turn,
  the next turn inherits the prior model. No live impact (every
  observed request has at least `modelId="copilot/auto"`) but
  worth a forward-look fixture if Copilot's schema ever degrades.
- **Copilot's internal cache** — Copilot uses its own caching
  layer between IDE and upstream model; the published shape exposes
  no cache fields. Adapter writes 0 for cache columns. This means
  cost engine cannot reflect cache savings the user is actually
  getting — a structural Copilot gap, not an adapter fix.

### Verification gates (all green)

- `go test -race ./... -count=1` 51/51 packages
- `go vet ./...` clean
- New regression tests: 3 in `internal/adapter/copilot/audit_2026_05_19_test.go`
- One pre-existing test updated (`TestParseModern_Kind2_AppendsNewTurn`)
  to reflect the new capi-* fallback behavior
- No migrations (parser-level changes only)

## [1.6.15] — 2026-05-19

### fix(cowork): action-taxonomy + system-event + image-message audit follow-through

Acts on the deep cowork audit at
[`docs/audits/cowork-audit-2026-05-19.md`](docs/audits/cowork-audit-2026-05-19.md)
against the 13-instance live Windows-side corpus
(2,569 events across 9 substantive sessions, 4 stubs). The audit's
token-math reconciliation was clean — all 18 (session × model)
buckets sum zero-delta against `result.modelUsage` ground truth, so
no cost-engine work is in this patch. The fixes below close the
action-taxonomy and system-event coverage gaps that account for
~11% of meaningful events the platform emits.

**B1 — 9 unmapped tool names land as `ActionUnknown`.** Live DB
showed **115 of 1091 cowork action rows (10.5%) tagged `unknown`**.
The biggest hit was `mcp__workspace__bash` at **83 rows** (the
MCP-routed shell tool — semantically identical to the built-in
`Bash`, ~half the bash-shaped activity in the corpus). Other
unmapped names: `mcp__workspace__web_fetch`, `Skill`, `ToolSearch`,
`mcp__cowork__{request_cowork_directory, present_files,
allow_cowork_file_delete}`, `mcp__visualize__{show_widget, read_me}`.
Fix: extend `actionMap` so MCP-routed shell/web tools land on
`ActionRunCommand` / `ActionWebFetch`, and the remaining MCP /
Skill / ToolSearch entries land on `ActionMCPCall`. `extractTarget`
gains `mcp__workspace__bash` → `command` and
`mcp__workspace__web_fetch` → `url`. New regression test:
`TestActionMap_CoworkNewToolNamesMappedCorrectly` covers all 9
names against the live-roster vocabulary.

**B2 — image-only user messages silently dropped.** `userPromptText()`
only emits when at least one `b.Type=="text"` block carries
non-empty text. A user message with only `b.Type=="image"` content
falls through — no row in `actions`. **5 image-only messages
missing** from the live DB for this corpus. Fix: when no text is
extractable but image blocks are present, emit a marker user_prompt
row with `Target = "[user sent N image attachment(s)]"`. No cost
impact (image input tokens land on the next `result.modelUsage`
bucket); observability-only. New regression test:
`TestParseSessionFile_ImageOnlyUserMessageEmitsMarkerRow` covers
single-image, multi-image, and the plain-text control case.

**G1 — system permission events captured.** The `case "system":`
branch in `ParseSessionFile` was a no-op. The corpus carries **38**
permission-flow events that fall in three subtypes:
- `permission_request` (18) → emitted as `ActionPermissionRequest`
  with `Target = tool_name` and `RawToolInput =` scrubbed
  `tool_input`. A `pendingPermissions` map keyed on `rec.UUID`
  records the row index.
- `permission_response` (18) → does NOT emit a new row; instead
  patches the queued request (response shares its UUID with the
  request per the audit). Sets `Success = granted` and stamps
  `Metadata.PermissionApprovalKind = decision`. When the request
  landed in a prior batch (resumed parse), the response drops
  silently — the adapter doesn't retro-update DB rows.
- `permission_denied` (2) → emitted as `ActionPermissionDenied`
  with `Target = tool_name`, `ErrorMessage =` scrubbed `message`,
  `RawToolName = decision_reason_type` (e.g. `"mode"`). The
  top-level `message` string on this subtype is decoded from
  `rawRecord.Message` opportunistically — for user/assistant
  records that field is a JSON object, not a string, so the
  type-mismatched decode just returns "" and falls through.

Mirrors the Copilot CLI v1.6.13 audit (B2) shape — reuses the
existing `ActionMetadata.PermissionApprovalKind` field, no new
metadata columns. New regression test:
`TestParseSessionFile_PermissionEventsCaptured` covers all three
subtypes including the request-then-response patch path.

**G2 — `system.compact_boundary` captured.** 3 compaction
boundaries in the corpus were ignored. Each carries
`compact_metadata.{trigger, pre_tokens, post_tokens, duration_ms}` —
exactly the shape the claudecode adapter already handles via its
`CompactMetadata` struct. Fix: emit `ActionContextCompacted`
mirroring the claudecode shape — `Target =
"<trigger>: ~<preTokens> tokens reclaimed"`, `RawToolInput =`
full metadata JSON, `RawToolName = "compact_boundary"`,
`DurationMs = compact_metadata.duration_ms`,
`SourceEventID = "compact:" + rec.UUID`. New regression test:
`TestParseSessionFile_CompactBoundaryEmitsContextCompacted`.

### Carry-over from the audit (deferred)

The following findings from `docs/audits/cowork-audit-2026-05-19.md` are
intentionally not in this patch — they're either future-proofing
gaps with zero current impact or richer features that need their
own scope discussion:

- **G3** — `system.init.model` + `mcp_servers[]` + `tools[]` roster
  not lifted. Would unblock model attribution for the 4 stub
  sessions (≤4 lines each, no `result` event); the Models Used
  panel currently shows "no model attribution captured" for them.
- **G4** — `result.usage.server_tool_use.web_fetch_requests`
  decoded but not billed. Zero current cost impact (cost engine
  has no `WebFetchPerRequest`); forward-looking gap.
- **G5** — 4 `rate_limit_info` fields (`isUsingOverage`,
  `overageResetsAt`, `surpassedThreshold`, `utilization`)
  un-captured. Governance signal, not cost.
- **G6** — `modelUsage.<model>.{contextWindow, maxOutputTokens}`
  decoded but never propagated to TokenEvent metadata.

### Verification gates (all green)

- `go test -race ./... -count=1` 51/51 packages
- `go vet ./...` clean
- New regression tests: 4 in `internal/adapter/cowork/audit_2026_05_19_test.go`
  (1 actionMap mapping case × 9 names, 1 image-only-user-message
  case, 1 permission-events case, 1 compact-boundary case)
- No migrations (all changes are parser-level)

## [1.6.14] — 2026-05-19

### fix(codex,opencode,openclaw): follow through audit findings

Three adapter audits ran on a Windows-host live corpus during the
v1.6.13 ship; their findings are landed in this patch. Audit
documents:
[`docs/audits/codex-audit-2026-05-18.md`](docs/audits/codex-audit-2026-05-18.md),
[`docs/audits/opencode-audit-2026-05-19.md`](docs/audits/opencode-audit-2026-05-19.md),
and [`docs/audits/openclaw-audit-2026-05-19.md`](docs/audits/openclaw-audit-2026-05-19.md).
A separate implementation tracker
([`docs/plans/codex-audit-followthrough-plan-2026-05-19.md`](docs/plans/codex-audit-followthrough-plan-2026-05-19.md))
captures which findings are closed here versus left as historical
DB / dashboard repair work.

#### fix(codex): forked-rollout session ownership + Observer MCP taxonomy

- **C1 — session-meta ownership bug in forked rollouts.** When a
  Codex rollout carried a second `session_meta` envelope replaying
  the parent session id (real specimen:
  `rollout-2026-05-06T02-38-04-019df9f8-…`), `applyContext()`
  blindly overwrote the file's owning `SessionID`. The static
  two-file reproducer landed **1,783 of 1,784** child-file actions
  + all **460** child-file token rows onto the parent session id;
  the parent file then dropped to **0** token rows by source-file
  because tuple-dedup collapsed them against the replayed copy.
  Fix: session ownership is now file-local — the first real
  `SessionID` seen in a file wins, and later replayed
  `session_meta` records can still refresh prompt / cwd / model
  / branch context but no longer move the owning id. The watcher
  resume path (`prefetchSessionContext` → `mergeSessionContext`)
  mirrors the same rule, so a resumed parse can't reintroduce the
  split. New regression test:
  `TestParseForkedRolloutSessionMetaOwnership`.
- **C3 residual — Observer MCP helper taxonomy.** Eight remaining
  Observer-MCP function-call names were still landing as
  `ActionUnknown`: `search_past_outputs`, `get_session_summary`,
  `get_project_patterns`, `get_last_test_result`,
  `get_session_recovery_context`, `get_cost_summary`,
  `check_command_freshness`, `get_failure_context`, plus
  `load_workspace_dependencies`. All now map to `ActionMCPCall`.
  New regression test: `TestActionMap_ObserverMCPHelpers`.

Codex findings C2 (live DB / dashboard residue from historical
parser repairs) and C4 (FTS5 corruption in the live maintainer DB)
remain operational repair work — not part of this adapter patch.

#### fix(opencode): apply_patch underscore variant

- **O1.** The live OpenCode corpus emits `tool="apply_patch"` with
  an underscore, but `mapTool()` only handled the no-underscore
  spelling `applypatch`. **5/5** real edit-file actions in the live
  corpus were landing as `ActionUnknown`. Added `apply_patch` to
  the `ActionEditFile` branch. `internal/adapter/opencode/doc.go`
  expanded so the field-map decisions the audit had to
  reverse-engineer (authoritative token source =
  `message.data.tokens`; `step-finish` intentionally ignored as
  duplicate) are documented at the package boundary.

OpenCode findings O2 (six historical assistant-text rows missing
from the live DB), O3 (twelve obsolete `prompt-history` /
`turn-complete` rows still in live DB from the retired
desktop-global ingest path), and O4 (`sessions.started_at` stuck
22m late on one session because store policy treats it as
immutable on conflict) are live-data drift that a normal `scan
--force --adapter opencode` only partially repairs; they remain
historical-cleanup follow-up.

#### fix(openclaw): session identity + cross-mount project root + tool taxonomy

- **B2 — session identity.** `parseSessionsIndex()` was using
  `sess.SessionID` (the raw provider id) while the JSONL and
  `task_runs` paths used the alias / session-key form via
  `lookupSessionAlias()` / `sessionID(tr)`. Live consequence on
  the maintainer corpus: **5 OpenClaw sessions** in the live DB
  for only **3 logical** OpenClaw sessions, with the prompt + API
  error rows split away from the completion row on
  `observer-ollama-smoke`. New `canonicalSessionID()` helper
  prefers `systemPromptReport.sessionKey`, then the index key,
  then the raw provider id — matching the JSONL / `task_runs`
  ordering. New regression test:
  `TestParseSessionFile_SessionsIndexUsesCanonicalSessionKey`.
- **B3 — cross-mount project-root translation missing.**
  `resolveProjectRoot()` was calling `git.Resolve(cwd)` directly,
  with no `crossmount.TranslateForeignPath()` translation and no
  stat gate first. Live consequence: **all 5** OpenClaw sessions
  attributed to the placeholder project root `[openclaw]` even
  though their source metadata pointed at a real Windows-side git
  repo `C:\Users\marmu\.openclaw\workspace`. Fix mirrors the
  Claude Code / Codex / Cowork cross-mount pattern: translate
  first, stat-gate the translated path, fall through to
  `git.Resolve()` only when the path is locally reachable. New
  regression test: `TestResolveProjectRoot_PreservesUnreachableForeignPath`.
- **B5 — tool-name coverage gap.** The live Gemma4 session's
  `systemPromptReport.tools.entries` roster declared 23 tool
  names; `mapToolName()` covered only 13. The remaining 10
  (`canvas`, `cron`, `memory_get`, `message`, `nodes`, `process`,
  `session_status`, `sessions_yield`, `subagents`, `tts`) were
  guaranteed to land as `ActionUnknown` whenever they hit the
  JSONL. `process` is a shell-execution tool — mapped to
  `ActionRunCommand`. The other nine map to `ActionMCPCall`.

**Two new historical-repair backfill flags** for openclaw rows
already in the live DB:

- `--openclaw-session-id` — collapses split sessions where
  `sessions.json` historically emitted the raw provider id. Walks
  the user's `<home>/.openclaw/agents/**/sessions.json` files,
  computes the canonical id for each entry, and merges rows on
  `actions`, `token_usage`, and `sessions` onto the alias form.
  Returns per-pass counts: alias files scanned, session rows
  merged, action rows updated, token-usage rows updated, orphan
  session rows deleted.
- `--openclaw-project-root` — re-attributes historical action /
  session rows whose project previously collapsed to `[openclaw]`
  or to a foreign-OS literal. Uses the same translate-first /
  stat-gate / git.Resolve path as the live parser, so a re-run is
  idempotent.

`--openclaw-action-types` extended to also cover the new mappings
(`process → run_command`; `canvas` / `cron` / `memory_get` /
`message` / `nodes` / `session_status` / `sessions_yield` /
`subagents` / `tts` → `mcp_call`).

Both new flags participate in `--all`. Test coverage added in
`cmd/observer/backfill_test.go` for the two new passes and the
extended action-types SQL.

OpenClaw findings B1 (mutable-snapshot `sessions.json` / `task_runs`
ghost rows whose source counterpart no longer exists), B4
(aggregate token fields on `sessions.json` not used as a recovery
fallback when JSONL is missing), and X1 (historical
`openclaw.assistant_text` rows that need a rescan to land) remain
deferred — B1 needs a reconcile design, not a one-line parser fix.

### Verification gates (all green)

- `go test -race ./... -count=1` 51/51 packages
- `go vet ./...` clean
- New regression tests: `TestParseForkedRolloutSessionMetaOwnership`,
  `TestActionMap_ObserverMCPHelpers`,
  `TestResumePreservesSessionContext`,
  `TestParseSessionFile_SessionsIndexUsesCanonicalSessionKey`,
  `TestResolveProjectRoot_PreservesUnreachableForeignPath`,
  expanded `TestMapToolName_*` coverage, plus the two new backfill
  test functions for `--openclaw-session-id` and
  `--openclaw-project-root`
- No migrations (all changes are parser-level or SQL-only repair
  in the backfill command)

## [1.6.13] — 2026-05-19

### fix(copilotcli) + feat(dashboard): events.jsonl schema-audit follow-through + session-detail Models Used panel

Two coherent things land together in this patch. The Copilot CLI
parser bugs and the new dashboard panel are independent — the panel
reads a field the API has been emitting since v1.5.0 — but they
share a release because both are short and ship-ready.

#### feat(dashboard): Models Used panel on session detail

The session detail slide-over already gets `per_model` on every
`/api/session/<id>` response (one bucket per model with token
breakdown + 3-way cost split + turn count), but the React rewrite
never rendered it — so a session that used both haiku and opus
showed per-message model attribution in the Messages table but no
session-level rollup. Operator-flagged.

Fix: new `ModelsUsedPanel` component sits as the third tile in the
`[Action breakdown] [Token buckets]` band. Style:

- One horizontal stacked bar per model with **bar LENGTH encoding
  magnitude** (not normalized to 100%) — the most-expensive model
  takes the full track; everyone else is proportional. A 99%-vs-1%
  cost split is immediately visible.
- **Segments colored by token bucket** (input / cache read / cache
  write / output) using the exact same colors as the adjacent
  `TokenBucketsPanel` — same hue means the same thing across the
  slide-over.
- **`$ / tokens` `SegmentedControl` toggle** flips the encoded
  metric. Cost mode shows per-bucket dollars (dominated by output);
  tokens mode shows raw counts (typically dominated by cache reads).
  Same colors, same rows, re-proportioned bars.
- Per-row sub-line: turn count + the inverse metric (so cost mode
  shows token totals below, tokens mode shows the dollar total) +
  optional tool-cost.
- Shared 4-bucket legend below the panel.
- Top 6 models visible, "+N more" footer when truncated. Empty
  state names the missing dependency: "no model attribution
  captured for this session yet."

Layout: grid widened from `xl:grid-cols-2` → `lg:grid-cols-2
xl:grid-cols-3` so on wide viewports all three panels sit side by
side; below xl, the third tile wraps under the first two.

**Cost-engine extension to feed the panel:**
`cost.CostBreakdown` now carries four per-bucket components —
`InputCost`, `OutputCost`, `CacheReadCost`, `CacheCreationCost` —
populated by `ComputeBreakdown`. Their sum equals `AICost` on every
reachable shape (pinned by
`TestComputeBreakdown_PerBucketComponentsSumToAICost` across 5
bundle variants). Reasoning tokens (billed at output rate) fold
into `OutputCost` so the four buckets always cover the full AI
bill. `/api/session/<id>`'s `per_model` rows expose them as
`input_cost_usd`, `output_cost_usd`, `cache_read_cost_usd`,
`cache_creation_cost_usd`. Adapters that emit recorded costs
(OpenCode/Pi) leave the buckets zero — the `$`-mode bar collapses
to nothing in that case, which is accurate to the data we have.

#### fix(copilotcli): events.jsonl schema-audit follow-through

Acts on the operator-authored deep schema review at
[`docs/audits/copilot-cli-events-schema-audit-2026-05-19.md`](docs/audits/copilot-cli-events-schema-audit-2026-05-19.md)
against a 25,320-line / 28-event-type Copilot CLI specimen. The
v1.6.6–v1.6.8 fixes already covered the load-bearing token
payloads; this audit surfaced two real parser bugs plus three
high-value schema gaps under the reliability / permission-
auditability / project-attribution dimensions. All five land in
this patch.

**B1 — Failed-tool error message extraction.** Failed
`tool.execution_complete` events carry the actual error text at
top-level `data.error.message`, NOT at `result.content`. Empirically
**158/158** failures in the specimen follow the new shape. The pre-fix
parser read `result.content` only, so every failed tool row emitted an
empty `error_message` column — weakening both dashboard review and
observer-side failure search. Fix: add `Error` field to
`toolExecutionCompleteData`; on failure prefer `data.error.message`,
fall back to `result.detailedContent` then `result.content`
(defensive against future shape drift).

**B2 — Permission events are shell-command shaped.** All **3**
permission requests in the specimen carry `kind="shell"` with
`fullCommandText`, `commands[]`, `possiblePaths[]`,
`hasWriteFileRedirection`, `canOfferSessionApproval` — none carry
the legacy `fileName`/`diff` fields. Pre-fix parser sourced
`RawToolInput` from `FileName` only, so the actual command being
approved was lost. Also: `permission.completed.result.kind` has a
new `"approved-for-location"` value that the pre-fix `Success ==
"approved"` check marked as a denial. Fix: extend `permissionRequest`
with the full shell-shape field set (file-shaped fields stay for
backward compat); `RawToolInput` priority is now FullCommandText >
FileName > Intention; `Success` is now `strings.HasPrefix(kind,
"approved")`; granularity (`approved-for-location` / -session) plus
the `locationKey` scope land in new `ActionMetadata` fields
(`PermissionApprovalKind`, `PermissionLocationKey`).

**G1 — `session.resume` state is now consumed.** All **9** resume
events in the specimen carry `selectedModel` + `reasoningEffort` +
`context.{cwd, gitRoot?, branch?, repository?}`. Pre-fix
`dispatchState` ignored them entirely — a long-lived session where
the user re-opened on a different model (without a later
`session.model_change`) silently mis-attributed every subsequent
`assistant.message`. Fix: new `sessionResumeData` struct + case in
`dispatchState`, mirroring `session.start`'s field-by-field updates
(non-empty wins, empty preserves prior context).

**G2 — Workspace.yaml-wins-if-present for project-root resolution.**
The specimen's `session.start.context.cwd` is `"E:\\"` (drive root)
while actual file edits target `"E:\\opencell\\..."`. Action rows
derived from `events.jsonl` would normalize to the drive root.
Fix: before falling back to `resolveProjectRoot(st)` (which reads
the event stream), `parseEventsJSONL` now consults the sibling
`workspace.yaml` at `<copilot-root>/session-state/<sessionID>/
workspace.yaml` — when present and carrying a usable `git_root` or
`cwd`, it wins over the event stream. Extracted the existing
`resolveProjectFromSibling` helper into a reusable
`resolveProjectFromWorkspaceYAML(yamlPath)` so both `parseProcessLog`
and `parseEventsJSONL` share one yaml-reading path.

**MCP enrichment — explicit server attribution.** **84/4,443**
`tool.execution_start` events in the specimen carry `mcpServerName`
+ `mcpToolName`. Some MCP servers don't follow the
`github-mcp-server-*` toolName convention (e.g. `ide-get_selection`
via `mcpServerName="ide"`) and would classify as `ActionUnknown`.
Even when the bare toolName already matches a built-in classifier
(e.g. `web_search` via `github-mcp-server`), dashboards benefit from
explicit server-name preservation. Fix: add `MCPServerName` +
`MCPToolName` to `toolExecutionStartData`; new `classifyToolName`
helper promotes `ActionUnknown` to `ActionMCPCall` when an MCP server
is named; new `composeRawToolName` helper emits `<server>:<tool>`
(stripping the legacy `<server>-` prefix when present, so we never
double-tag).

**ActionMetadata schema additions** (Invariant #50 covered by the
existing reflection test):

- `permission_approval_kind` — captures non-default approval
  granularity (`approved-for-location`, `approved-for-session`).
  Empty for plain `"approved"` so the column doesn't churn.
- `permission_location_key` — the filesystem scope bound to an
  `approved-for-location` grant (e.g. `"D:\\OneDrive - Microsoft"`).

**Files changed:**

| File | Lines | What |
|---|---|---|
| `internal/adapter/copilotcli/events.go` | +224 / −20 | B1 + B2 + G1 + MCP struct/handler/helpers |
| `internal/adapter/copilotcli/log.go` | +18 / −2 | Extract `resolveProjectFromWorkspaceYAML` from `resolveProjectFromSibling` |
| `internal/adapter/copilotcli/adapter_test.go` | +471 / 0 | 13 new tests across B1+B2+G1+G2+MCP |
| `internal/models/models.go` | +15 / −1 | Two `ActionMetadata` fields + `IsZero` extension |
| `internal/intelligence/cost/engine.go` | +30 / −10 | Per-bucket components on `CostBreakdown` (input/output/cache_read/cache_creation); `ComputeBreakdown` restructured to populate them while preserving the AICost / ToolCost / Total invariants |
| `internal/intelligence/cost/engine_test.go` | +90 / 0 | Two new tests pinning the sum-to-AICost invariant across 5 bundle shapes + reasoning-folds-into-output-cost |
| `internal/intelligence/dashboard/dashboard.go` | +21 / 0 | Four `*_cost_usd` fields on `modelBucket` + per-row accumulation from `ComputeBreakdown`'s new components |
| `web/src/components/SessionDetailPanel.tsx` | +242 / −2 | New `ModelsUsedPanel` (stacked horizontal bars per model, bar length = magnitude, segments colored by token bucket, `$ / tokens` SegmentedControl) + grid extension (`xl:grid-cols-2` → `lg:grid-cols-2 xl:grid-cols-3`) |
| `web/src/lib/types.ts` | +9 / 0 | Four `*_cost_usd` fields on `SessionModelBucket` matching the new backend payload |
| `internal/intelligence/dashboard/webapp/dist/**` | regenerated | `make web-build` output |

**Verification:** `go test -race ./... -count=1` 51/51 packages green.
13 new tests added to `internal/adapter/copilotcli/adapter_test.go`,
all passing. `gofmt -l` clean. The `ActionMetadata` reflection
invariant test (`TestActionMetadata_IsZeroCoversEveryField`)
automatically covers both new fields.

**No migrations.** All changes are parser-level + struct-level —
the existing `actions.metadata` JSON column already serializes any
`ActionMetadata` shape.

**Deferred to a follow-up release** (audit §3 G3/G4/G5):
session-level product telemetry (`totalPremiumRequests`,
`totalApiDurationMs`, `codeChanges.*`, per-model `requests.*`),
compaction summary content / checkpoint metadata, and new event
lanes (`session.task_complete`, `session.error`). These need a
larger schema/UX decision and don't gate the bug fixes here.

## [1.6.12] — 2026-05-19

### fix(test): CI regressions surfaced by v1.6.11 release pipeline

Two test failures hit the v1.6.11 GitHub Actions release workflow
(`go test -race ./...`). Patch release fixes both. No production
code changes — only test fixes — so the v1.6.11 binaries +
migrations are unaffected.

**T1 — Data race in `TestBackfillJobsList_ReturnsRunningAndCompleted`**
(introduced in v1.6.11, Issue #1). The test mutated `server.execBackfill`
between two `handleBackfillRun` calls so the second job would finish
fast while the first was still sleeping. But the first job's
goroutine (spawned by `handleBackfillRun` → `runBackfillJob`) reads
`server.execBackfill` concurrently — `-race` flagged the write-vs-read
unsynchronized field access. The race only matters in CI where the
race detector is enabled; local `go test` (no -race) passed.

Fix: restructure to ONE mode-aware fake installed at construction.
The fake inspects its `args` for `--all` and sleeps 200ms in that
branch; everything else returns immediately. Both jobs use the
same fake — no field mutation, no race.

**T2 — `TestAnalysisCacheSavingsTrend_DailySavingsAttribution` straddles
midnight UTC** (pre-existing latent test bug, fired on 2026-05-19
because CI happened to run between 23:00 and 00:00 UTC). The test
anchors `dayA := time.Now().UTC().Add(-3 * 24 * time.Hour)`, then
inserts a second Sonnet turn at `dayA.Add(1 * time.Hour)`. When
the wall clock is within an hour of UTC midnight, `dayA.Add(1h)`
lands on the next calendar day → one of the two day-A turns gets
attributed to day B's bucket. Symptom: day A savings = $0.27
(half of expected $0.54), day B savings = $0.495 (= $0.27 + $0.225
instead of $0.225), day B cache_read_tokens = 150K (= 100K + 50K
instead of 50K).

The bug is in the test, not the cost engine — totals reconcile
($0.27 + $0.495 = $0.54 + $0.225 = $0.765). The day-attribution
shift is the symptom of timestamp drift across the midnight
boundary.

Fix: anchor `dayA` / `dayB` at noon UTC via
`.Truncate(24 * time.Hour).Add(12 * time.Hour)`. Adding ±1–2 hours
to a noon timestamp can never cross a calendar-day boundary, so
the test is now time-of-day-independent. Verified at 23:14 UTC
(the failing time) where the unpatched test fails reliably and
the patched test passes.

Other `time.Now().UTC().Add(-N * 24 * time.Hour)` sites in
`analysis_test.go` were audited (lines 484, 532, 628, 809, 904,
961, 978, 1018, 1662): none combine a same-day anchor with an
intra-day `.Add(hours)` follow-up that could straddle midnight.
Line 628 uses hour-bucket aggregation (not day-bucket) so its
`.Truncate(time.Hour)` is sufficient. No further fixes needed.

**Files changed:**

| File | Lines | What |
|---|---|---|
| `internal/intelligence/dashboard/backfill_run_test.go` | +24 / −13 | T1 — mode-aware fake, no field swap |
| `internal/intelligence/dashboard/analysis_test.go` | +10 / −2 | T2 — noon-UTC anchor, comment explaining why |

**Build state:** `go test -race ./... -count=1` 51/51 packages green
(verified locally at 23:14 UTC, the same wall-clock condition that
broke CI). No production code changes — v1.6.11's binaries,
migrations, and live-DB state are all unchanged.

## [1.6.11] — 2026-05-19

### fix(observer): handover §1 punch list + deferred follow-throughs + e371fdb1 root cause

Operator-flagged 6 issues from a `observer backfill --all` run on
2026-05-19 (handover doc:
[`docs/handovers/next-session-handover-2026-05-19.md`](docs/handovers/next-session-handover-2026-05-19.md)).
Tackled all 6 in handover §4 order, then closed out 5 explicitly-
deferred follow-throughs from those passes, then root-caused the
"e371fdb1 antigravity session not at all being picked up"
regression that surfaced during operator-side post-deploy
verification. 13 distinct fixes total; 3 new migrations; ~35 new
tests across 8 packages.

**#2 — SQLITE_BUSY contention between watcher + backfill** *(operator-
blocking).* `observer backfill --all` against the live watcher
process produced `store.InsertActions: upsert dup: database is
locked (5) (SQLITE_BUSY)` on claudecode-user-prompts and other
multi-thousand-row passes. Two layers of fix in
`internal/db/db.go`: (1) default `BusyTimeout` raised 5s → 30s
(matches the migration runner's own dedicated busy_timeout); (2)
DSN now includes `_txlock=immediate` so every BeginTx acquires
the SQLite write lock upfront. The previous BEGIN DEFERRED took a
read lock at BeginTx then upgraded on first write — when two
writers raced that upgrade, one got SQLITE_BUSY immediately
(busy_timeout doesn't kick in on upgrade-deadlocks). IMMEDIATE
serializes writers through the file lock so busy_timeout's
exponential backoff handles contention properly. All four BeginTx
callers in the codebase (`store.InsertActions`,
`store.InsertTokenEvents`, `retention.deleteActionsOlder`,
`indexing.EmbedBatch`) are write-only so the IMMEDIATE upgrade is
always correct. New `TestConcurrentWritersSurviveContention`
(4 writers × 25 txs × 20 rows hammered against the same on-disk
DB) pins it.

**#1 — Dashboard backfill running-status disappears on navigation.**
Settings > Backfill's running indicator was destroyed on component
unmount because the jobs state lived only in local React state.
New `GET /api/backfill/jobs` endpoint returns every in-flight + recent
job from the in-memory registry, newest first. `BackfillSection`'s
new mount-time `useEffect` re-fetches the list and reduces it to
one-job-per-mode (matching the UI's single-job-per-mode model).
The 3-second polling loop picks up running entries automatically.
3 backend tests (`TestBackfillJobsList_Empty`, `_ReturnsRunningAndCompleted`,
`_RejectsNonGet`).

**#6 — PowerShell + codex `exec_command` normalized.** Bash-family
shell commands across all tools got `action_type='run_command'`
via the `Bash` tool name mapping, but PowerShell / pwsh / cmd.exe
(Windows-side claude-code, copilot-cli powershell tool) fell through
to ActionUnknown — silently dropping out of the dashboard's
`run_command`-filtered views. **Codex's modern `exec_command` tool
name (260 historical maintainer-corpus rows!) was also never
mapped.** Cross-adapter sweep: added shell-interpreter variants
(`PowerShell`, `powershell`, `pwsh`, `cmd`, `cmd.exe`, `sh`) to
the `actionMap` / `mapToolName` of all 9 adapters that handle
shell tools (claudecode, codex, copilotcli, cowork, cline, cursor,
gemini, antigravity, openclaw, copilot, pi, opencode). Migration
`023_powershell_action_type_backfill.sql` re-derives historical
unknown rows (262 maintainer rows: 260 codex exec_command, 1
claudecode PowerShell, 1 copilot-cli powershell). 3 tests pin
the new mappings + the cross-adapter scope guard.

**#4 — Antigravity backfill perf (persistent unrecoverable cache).**
`observer backfill --antigravity-rescan` re-attempted the ~30s
decrypt+gRPC dance on the same handful of structurally-unrecoverable
.pb files on every invocation, since the parse cursor at fi.Size()
makes the watcher skip them but Rescan() ignores cursors. Two-stage
implementation: v1.6.11 first pass added an in-memory cache on the
Adapter struct (helps the `observer start` daemon's dashboard-
triggered Rescans but not one-shot CLI). v1.6.11 final pass replaces
that with a persistent table (migration `025_adapter_unrecoverable_files.sql`):
composite PK `(adapter, source_file)` + size + mtime + reason +
last_attempted_at. New `store.Lookup/Mark/ClearUnrecoverable`
methods. Antigravity adapter now consults the tracker via the
`UnrecoverableTracker` interface (keeps the adapter store-free per
CLAUDE.md), wired in `cmd/observer/main.go` via
`antigravityTrackerShim`. **Now helps `observer backfill --all`
CLI** (the operator's primary case). 7 tests across adapter
(fakeTracker-backed) and store (size+mtime drift, adapter-scoping).

**#5 — Antigravity session `e371fdb1` missing tokens/model** *(this
is the bug the operator hit after deploying v1.6.11-first-pass).*
The probe (one-off test guarded by `PROBE_E371=1`) captured the
gRPC wire bytes from both broken (pid=1339) and correct (pid=1340)
language_servers. **The bug was NOT in `ParseStructuredTrajectory`**
(verified: parser correctly extracts model=`claude-sonnet-4-6` +
17 token rows + 25 tools from the real wire bytes). The bug was
in `recoverViaLocalGRPC`'s empty-stub guard: `numEvents(merged_result) == 0`
checked the MERGED (markdown + structured) event count. A wrong-
workspace language_server returns a 244-byte stub markdown that
parses as 1 fake `user_prompt` event → numEvents = 1 → guard
never fired → wrong server accepted before the correct server
(pid=1340) was tried. **New `isWrongWorkspaceStub(enrichment)`
predicate** checks the structured payload directly
(`Model == "" && len(TokenEvents) == 0 && len(ToolEvents) == 0`) —
a server that hosts the conversation always populates at least
the model name (verified across 122 working sessions in the
maintainer corpus). Applied in both iteration loops (linux-native
+ native non-WSL) so the fix is systemic, not specific to
e371fdb1. Live verify on the maintainer DB: e371fdb1 went from
**1 action / 0 tokens / model="" / wrong project** to **31 actions
/ 17 token rows (17,595 input + 5,074 output + 541,170 cache_read)
/ model="claude-sonnet-4-6" / project "/home/marmutapp/superbased-observer"**.
Also added a debug `dump_shape_mismatches_dir` config option in
`[observer.antigravity]` that writes raw gRPC bytes to disk on
`structured_shape_mismatch` (≥10 KiB payload + 0 tokens + empty
model) — operator-runnable wire-byte capture for future proto-
path investigations. 3 tests (`TestIsWrongWorkspaceStub` 6-case
truth table, `TestParseStructuredTrajectory_E371fdb1WireBytes`
fixture-backed regression, `TestDumpShapeMismatchPayload_WritesWhenConfigured`).

**Session.project_id stickiness** *(surfaced via e371fdb1 fix
verification).* After the routing fix correctly re-ingested
e371fdb1 with project 307 (`/home/marmutapp/superbased-observer`),
the session row's `project_id` stayed pinned at 109
(`/home/marmutapp/superbased` — from the earlier buggy ingest).
Root cause: `store.UpsertSession`'s `ON CONFLICT DO UPDATE SET`
clause omitted `project_id`, so once a session was created with a
wrong project_id (from ANY adapter, ANY buggy ingest) it stayed
stuck. Fix: always overwrite project_id on conflict. Cross-project
session resumes aren't supported; adapters derive project_root
from per-file metadata so the latest value is always the most
accurate. New `TestUpsertSession_ProjectIDChangesOnReingest` pins
the contract including COALESCE preservation for other fields.

**Claude Code historical-row backfill** *(Issue #6 extension).* Live
DB had thousands of `action_type='unknown'` rows for Claude Code
tools that are MAPPED in the adapter's actionMap today but were
ingested before the mapping landed. Added `TodoWrite` +
`EnterPlanMode` + `ExitPlanMode` to the actionMap, then migration
`024_claudecode_action_type_backfill.sql` re-derives historical
unknowns scoped to `tool='claude-code'`. Live verify: **5,909 rows
re-tagged** (TaskUpdate: 3499, TaskCreate: 1844, Agent: 276,
AskUserQuestion: 128, TaskOutput: 84, ExitPlanMode: 22, TaskList:
20, TodoWrite: 16, TaskStop: 11, EnterPlanMode: 9). 16-case
migration test including the cross-tool scope guard.

**#3 — Backfill flag surface audit + `--dry-run`.** Full audit at
[`docs/audits/backfill-flag-audit-2026-05-19.md`](docs/audits/backfill-flag-audit-2026-05-19.md):
27 flags categorized into 4 buckets (schema-migration, cross-mount
reattribution, per-adapter rescans, historical adapter-parity).
Recommendation: no flag removals in this release — annotate help
text instead. Help-text rewrite in `cmd/observer/backfill.go` groups
flags under 4 visual headers per the audit. **`--dry-run` flag**
implemented via the simpler DB-copy approach from the audit:
snapshots the live DB via SQLite's atomic `VACUUM INTO`, overrides
`OBSERVER_OBSERVER_DB_PATH` env so downstream `config.Load` calls
route to the snapshot, runs backfills normally, cleans up snapshot
+ WAL/SHM siblings on exit. Live DB untouched; the row counts in
the final summary reflect what WOULD have updated. 2 tests
(snapshot+redirect+cleanup contract; overwrite-guard).

**Migrations:**

- `023_powershell_action_type_backfill.sql` — shell-variant tool
  names re-tagged across adapters. Codex exec_command rule scoped
  to `tool='codex'` only (defensive against future adapters
  reusing the name).
- `024_claudecode_action_type_backfill.sql` — historical Claude
  Code unknowns re-derived per current actionMap. Tool-scoped to
  `claude-code`.
- `025_adapter_unrecoverable_files.sql` — new table backing the
  persistent unrecoverable-file tracker. Composite PK
  `(adapter, source_file)`; size+mtime pin file identity at failure.

**Files changed:**

| File | Lines | What |
|---|---|---|
| `internal/db/db.go` | +28 / −3 | SQLITE_BUSY fix (busy_timeout 30s + _txlock=immediate) |
| `internal/db/db_test.go` | +316 / 0 | Migration 023+024 tests + concurrent-writer regression |
| `internal/intelligence/dashboard/backfill_run.go` | +35 / +1 | New /api/backfill/jobs endpoint |
| `internal/intelligence/dashboard/dashboard.go` | +1 | Route registration |
| `internal/intelligence/dashboard/backfill_run_test.go` | +120 / 0 | 3 list-endpoint tests |
| `web/src/lib/types.ts` | +4 | `BackfillJobsListResponse` type |
| `web/src/pages/Settings.tsx` | +30 | Mount-time refetch + state restore |
| `internal/adapter/{12 adapters}` | varied | PowerShell + exec_command + TodoWrite + EnterPlanMode + ExitPlanMode added to mappings |
| `internal/adapter/antigravity/adapter.go` | +245 / −20 | UnrecoverableTracker + isWrongWorkspaceStub + dumpShapeMismatchPayload |
| `internal/adapter/antigravity/adapter_test.go` | +360 / 0 | fakeTracker + wire-bytes fixture + stub-classifier truth table |
| `internal/adapter/antigravity/probe_e371fdb1_test.go` | NEW | Diagnostic probe (PROBE_E371-gated) |
| `internal/store/store.go` | +94 / −2 | UpsertSession project_id update + Unrecoverable methods |
| `internal/store/store_test.go` | +213 / 0 | UpsertSession project_id test + Unrecoverable tests |
| `internal/config/config.go` | +20 | DumpShapeMismatchesDir field |
| `cmd/observer/main.go` | +41 | antigravityTrackerShim + WithUnrecoverableTracker/WithShapeMismatchDumpDir wiring |
| `cmd/observer/backfill.go` | +246 / −1 | --dry-run flag + setupBackfillDryRun + snapshotSQLiteDB + restructured help |
| `cmd/observer/backfill_test.go` | +157 / 0 | dry-run tests |
| `internal/db/migrations/023_powershell_action_type_backfill.sql` | NEW | Codex exec_command + PowerShell backfill |
| `internal/db/migrations/024_claudecode_action_type_backfill.sql` | NEW | Claude Code unknowns backfill |
| `internal/db/migrations/025_adapter_unrecoverable_files.sql` | NEW | Unrecoverable-file tracker table |
| `docs/audits/backfill-flag-audit-2026-05-19.md` | NEW | 27-flag categorization + dry-run spec |

**Build state:** `go vet ./...` clean; `go test ./...` 51/51 packages
green; `make web-build` clean (embedded dist regenerated). Live-DB
verification gates after restart on the maintainer DB: 5,909+
historical Claude Code unknowns re-tagged via 024; 260 codex
exec_command rows re-tagged via 023; e371fdb1 reattributed
correctly (31 actions / 17 token rows / claude-sonnet-4-6 model /
superbased-observer project). The wrong-workspace-stub fix is
systemic — any future conversation hosted by a non-first
language_server is routed correctly automatically.

## [1.6.10] — 2026-05-19

### fix(claudecode)+fix(store): five-bug claude-code audit follow-through

Operator-requested deep audit of the claude-code adapter
(`internal/adapter/claudecode/`) against the live maintainer corpus
(42,179 token_usage rows / 305 sessions, 2026-02-08 → 2026-05-18,
spanning 215 WSL-native and 90 Windows-side captures). Five bugs
surfaced + a stale doc-comment. All six fixed in this release. Audit
report: [`docs/audits/claude-code-audit-2026-05-18.md`](docs/audits/claude-code-audit-2026-05-18.md);
empirical scope: [`docs/audits/claude-code-audit-2026-05-18-scope.md`](docs/audits/claude-code-audit-2026-05-18-scope.md);
methodology follows
[`docs/adapter-audit-playbook.md`](docs/adapter-audit-playbook.md)
(v1.6.8).

**The billing-accuracy regroup gate ([CC4]) passed 36/36 sessions
bit-for-bit** across `input_tokens` / `output_tokens` /
`cache_read_tokens` / `cache_creation_tokens` / `cache_creation_1h_tokens`
on every parent-absent acompact-only session. No regroup needed —
the v1.6.5 tuple dedup is doing the right thing on the canonical
billing case.

**B1 — Windows-capture `project_root` misattribution.**
`resolveProjectRoot` at `adapter.go:686-700` passed raw `cwd` to
`git.Resolve` without first translating Windows-style paths
(`C:\programsx\superbased`) via `crossmount.TranslateForeignPath`.
`git.Resolve` calls `filepath.Abs`, which on Linux prepends the
observer's own CWD and walks parents for `.git` — landing on the
observer's own repo. Result: **100% of Windows claude-code captures
(90 sessions / 3,536 token_usage rows / 7,219 actions across 4
distinct Windows projects) misfiled** under `/home/marmutapp/superbased-observer`
in the dashboard's project view. Session_id and per-row token counts
were correct; only the project grouping was wrong. Fix is a one-line
port from the codex adapter (`internal/adapter/codex/adapter.go:2494`,
mirrors `#54` / memory `[[feedback-foreign-path-git-resolve]]`):
call `cwd = crossmount.TranslateForeignPath(cwd)` BEFORE `git.Resolve`.
Backfill via new `observer backfill --claudecode-project-root` flag
(see V7a-bf below) reattributed **84 of the 90** Windows sessions
(7,219 actions updated). 15 sessions are unrecoverable — their
source JSONLs have rotated off disk, so no `cwd` is available to
re-resolve.

**B2 — Cross-source-file `message_id` double-count (snapshot drift).**
When the same `message_id` appeared in both a parent JSONL and an
`agent-acompact-*.jsonl` snapshot with **different** cumulative
token counts, both rows survived the store-layer v1.6.5 tuple dedup
(which only collapses byte-identical tuples). Pattern: the acompact
subagent file captures an in-flight API turn at a LATER cumulative
state than the parent file's earliest matching row — output_tokens
differs, byte-identical dedup misses, cost engine sums both. Pattern
verified: 100% of duplicate-msgid rows were exactly one parent-file
row + one acompact-subagent row (no three-way splits). **Corpus
impact: 96 msgids across 2 sessions (`853e0bc0`, `c242775f`), +2,401
output tokens / +122 input tokens** (~$0.06 at Opus rates). Small
in dollars, but per operator's absolute-accuracy bar this fails the
gate. Fix: new post-batch sweep in `store.InsertTokenEvents` at
`store.go:679-705` that deletes per-(tool, session_id, message_id,
source) all but the row with the highest output_tokens (ties broken
by higher id for determinism). **Scoped to `tool='claude-code'`
only** — codex emits LEGITIMATE per-turn delta `token_count` rows
that must NOT be collapsed (pinned by
`TestInsertTokenEvents_TupleDedupPreservesDistinctRows`), and
source-scoping preserves the legitimate proxy+jsonl complementary
coverage (pinned by `TestInsertTokenEvents_ClaudecodeCrossSourceProxyJsonlSurvive`).
Backfill via migration 021 cleaned the 96 historical rows; idempotent
on re-run.

**B3 — `server_tool_use.web_search_requests` never decoded
(forward-looking).** The adapter's `rawUsage` struct had no
`ServerToolUse` field. The cost engine's `TokenEvent.WebSearchRequests`
was populated correctly by other adapters (cowork at
`adapter.go:235,847`) but remained zero for claude-code's JSONL
path. **Current corpus impact: zero** — disk-wide scan across all
305 sessions found zero `web_search_requests > 0`. **Forward-looking
impact:** every future claude-code WebSearch call would silently
drop the $0.01/call flat fee (memory
`[[feedback-web-search-rate-flat-0p01]]`). Fix: add the
`ServerToolUse` struct to `rawUsage`; route `WebSearchRequests` +
`WebFetchRequests` into the TokenEvent at construction.

**B4 — Four metadata line types silently dropped.** Live captures
emit at least 10 top-level `type` values (per scope doc §2a); the
adapter's early-`continue` at `adapter.go:388-389` on
`len(line.Message) == 0` was dropping four that carry actionable
metadata. Operator confirmed 2026-05-18 these are oversights, not
deliberate skips:

| Type | What it carries | Why it matters |
|---|---|---|
| `agent-name` | `agentName` (subagent persona) | Closest analog to Copilot CLI's `agentId` attribution — surfaces "which subagent did what" for Task tool calls. |
| `system.compact_boundary` | `compactMetadata.preTokens`, `preCompactDiscoveredTools` | Enables compaction-count + reclaimed-tokens timeline; dashboard was blind to compactions. |
| `system.turn_duration` | `durationMs`, `messageCount` | Per-turn wall-clock authority. **Unblocks the B5 fix.** |
| `permission-mode` | `acceptEdits` / `plan` mode entry/exit | Plan-mode timeline analog to codex's `collaboration_mode.mode` (memory `[[project-codex-v0-130-schema]]`). |

Fix: four new handlers in `ParseSessionFile`, each emitting a
`ToolEvent` deduped by name/mode (new `ActionPermissionMode` action
type added to `internal/models/models.go`). No billing impact — none
of these are token-bearing — but unblocks subagent attribution,
compaction surfacing, accurate per-turn wall-clock, and the
plan-mode timeline.

**B5 — Bash duration inflation (consumes B4's `turn_duration`).**
Documented in the prior audit `docs/audits/claudecode-bash-duration-audit-2026-05-15.md`:
62 historical rows with `duration_ms > 3,600,000` claimed **246.4
false hours** of Bash wallclock; top session (`d7657cad`) alone had
73.3 false hours. Root cause: the adapter infers per-tool wallclock
from the gap between `tool_use` assistant-message and `tool_result`
user-message timestamps; auto-compact stitching + session-idle resume
measure the IDLE GAP, not the tool's actual exec time. Fix: hard cap
of **30 minutes** (Claude Code's documented Bash hard ceiling, per
audit doc §B5) on the inferred duration at `adapter.go:744-756`. The
cap chose 30min over the prior audit's 1-hour option per the
documented ceiling. Backfill via migration 022 zeroed **135 inflated
bash rows** (308.8 false hours wiped — more than the 246 the prior
audit projected because the 30-minute cap is stricter than the
audit's 1-hour reference threshold). Idempotent on re-run.

**DH1 — Stale subagent doc-comment.** `adapter.go:114-117` claimed
subagent activity is logged "inline in the same JSONL session with
`isSidechain: true` markers per line — NOT as a separate session_id".
Empirically false on every Claude Code 2.1.x session captured:
subagents live in separate
`<session-uuid>/subagents/agent-(acompact-)?XXX.jsonl` files,
sharing the parent's `sessionId` but flagged `isSidechain: true` per
line. Comment rewritten to describe the actual file layout.

**`observer backfill --claudecode-project-root` flag (V7a-bf).** New
backfill mode that walks `sessions` joined with one
`token_usage.source_file` per session, re-resolves the project root
through `crossmount.TranslateForeignPath + git.Resolve` from the
JSONL's `cwd` field, and updates `sessions.project_id` (creating
new `projects` rows as needed). Live verify on maintainer DB: 84/90
Windows sessions reattributed, 7,219 actions updated, 15 unrecoverable
(JSONLs rotated). Idempotent — already-correct sessions are no-ops.

**Migrations:**

- `021_claudecode_snapshot_drift_dedup.sql` — DELETE pass scoped to
  `tool='claude-code'` that keeps only the highest-output_tokens row
  per `(session_id, message_id, source)`. Mirrors the runtime pass
  at `store.go:679-705` exactly. Idempotent. Live verify on
  maintainer DB: **96 dup-msgid rows deleted, leftover = 0**.
- `022_claudecode_bash_duration_cap.sql` — UPDATE zeroing
  `duration_ms` on any `tool='claude-code'` actions row whose
  computed duration exceeds 30 minutes (1,800,000 ms). UPDATE not
  DELETE because the action row itself is legitimate (the tool call
  did happen); only the DurationMs attribution was wrong. Idempotent.
  Live verify: **135 inflated bash rows zeroed, leftover above 30min
  cap = 0**.

**Files changed (+969 / −6 lines + 2 new migrations):**

| File | Lines | What |
|---|---|---|
| `internal/adapter/claudecode/adapter.go` | +256 / −2 | B1 crossmount call; B3 rawUsage.ServerToolUse + emit; B4 four metadata handlers (agent-name / compact_boundary / turn_duration / permission-mode); B5 30-min bash duration cap; DH1 doc-comment rewrite |
| `internal/adapter/claudecode/adapter_test.go` | +329 / −0 | 9 new regression tests pinning all five bug fixes |
| `internal/store/store.go` | +73 / −0 | B2 snapshot-drift dedup post-batch sweep (claude-code-scoped, source-scoped) |
| `internal/store/store_test.go` | +127 / −0 | 2 new regression tests (B2 + cross-source-survival) |
| `internal/models/models.go` | +10 / −0 | New `ActionPermissionMode` action-type constant |
| `cmd/observer/backfill.go` | +178 / −0 | `--claudecode-project-root` flag + helpers |
| `internal/db/migrations/021_claudecode_snapshot_drift_dedup.sql` | NEW | B2 backfill |
| `internal/db/migrations/022_claudecode_bash_duration_cap.sql` | NEW | B5 backfill |
| `docs/adapters.md` | +2 / −2 | Claude Code row rewritten to match post-audit reality |

**Tests added (11 new):**

- `TestWindowsCwdResolvedViaCrossmount` — B1: Windows `C:\` cwd
  resolves through crossmount to mounted-WSL path, not observer's CWD.
- `TestServerToolUseWebSearchRequestsCaptured` — B3: non-zero
  `server_tool_use.web_search_requests` populates `WebSearchRequests`.
- `TestServerToolUseAbsentImpliesZero` — B3: missing field defaults
  to 0, doesn't crash on decode.
- `TestCompactBoundaryCaptured` — B4: `system.compact_boundary`
  emits the compaction event with `preTokens`.
- `TestTurnDurationCaptured` — B4: `system.turn_duration` emits the
  per-turn wallclock event.
- `TestAgentNameCapturedDedupedByName` — B4: `agent-name` lines
  emit subagent persona events deduped by name.
- `TestPermissionModeCapturedDedupedByMode` — B4: `permission-mode`
  entry/exit emits `ActionPermissionMode` deduped by mode.
- `TestBashDurationCappedAt30Min` — B5: inferred duration above
  1,800,000 ms is clamped to 0.
- `TestBashDurationUnderCapPreserved` — B5: inferred duration ≤
  cap passes through unchanged.
- `TestInsertTokenEvents_ClaudecodeSnapshotDriftDedup` — B2:
  parent-row (early snapshot) + acompact-row (later snapshot) same
  message_id → only the higher-output_tokens row survives.
- `TestInsertTokenEvents_ClaudecodeCrossSourceProxyJsonlSurvive` —
  B2 scope guard: source-scoping preserves legitimate
  proxy+jsonl complementary coverage.

**Build state:** `go vet ./...` clean; `go build` clean; full repo
test sweep **51/51 packages, 0 failures**. Live-DB verification gates
all green: 90 Windows sessions reattributed (84 successful + 15
unrecoverable due to rotated JSONLs), 96 dup-msgids deleted (leftover
= 0), 135 bash rows zeroed (leftover above 30min cap = 0).

## [1.6.9] — 2026-05-18

### chore(release): include docs/assets/ in public orphan so README images render

Operator-flagged: every image link in the public-repo README and on
the npm package page (`@superbased/observer` on npmjs.com) showed a
broken-image placeholder. Latent bug since the two-repo private/
public split.

**Root cause.** `scripts/release.sh:78-85` strips the entire `docs/`
directory from the public orphan tree as part of the PRIVATE_ONLY_PATHS
sweep. Both READMEs reference images under `docs/assets/`:

- `README.md` (lines 14, 52, 145, 157, 169, 180, 193, 208, 219, 231,
  244, 259) — 12 relative-path image refs (`docs/assets/...`).
- `npm/observer/README.md` (lines 14, 168, 250, 268, 290, 308, 322,
  352, 364, 382, 405) — 11 absolute-URL refs
  (`https://github.com/superbasedapp/observer/raw/main/docs/assets/...`).

Both 404 on the public repo because `docs/` doesn't exist there.
Empirically confirmed:

```
$ curl -s -o /dev/null -w "%{http_code}\n" \
  https://github.com/superbasedapp/observer/raw/main/docs/assets/screenshots/01-overview.png
404
```

**Fix.** Surgical re-inclusion of `docs/assets/` in the public orphan
tree, keeping the rest of `docs/` private:

1. After `git rm --cached -r docs` in `cmd_public()`, re-add the
   assets subtree with `git add --force docs/assets`. Files are
   still on disk after the rm-cached, so the re-add is a no-op
   in working-tree terms — just brings them back into the staging
   index.
2. Change the public-side `.gitignore` append from `/docs/` to the
   negation pattern `/docs/*` + `!/docs/assets/`. Gitignore's
   re-include syntax requires `/docs/*` (not `/docs/`) because a
   directory-level exclusion can't be undone for children otherwise.
3. Update the leak sanity-check in `cmd_public()` to split the regex
   across `docs/` vs `docs/assets/` so a future stray `docs/...`
   path still errors but `docs/assets/...` passes.

No README edits required — the references in both README.md and
npm/observer/README.md are unchanged. Future-proof: any new image
added under `docs/assets/` automatically ships in the public orphan.

**Limitations** (npm has no same-version re-upload):

- The public-repo README on GitHub renders correctly **immediately**
  after this release force-pushes the corrected orphan.
- The npm package pages for **v1.6.5 through v1.6.8 stay broken** —
  npm doesn't allow republishing the same version with a corrected
  README. The v1.6.9 npm page (this release) and all future versions
  render correctly.

**Risk:** the screenshots show real session UUIDs, project paths
(`/home/marmutapp/...`), and cost figures from the maintainer's
machine. These were always intended for the public-facing README
(they're the dashboard's marketing assets) and have been referenced
from the README since v1.5.0 — they just never rendered. Publishing
them was the intent all along; this release makes it actually work.

**Files changed:**

| File | What |
|---|---|
| `scripts/release.sh` | Surgical re-inclusion + gitignore negation + leak-check split |

No source-code, test, or runtime changes. Pure release-mechanics fix.

**Build state:** test sweep unchanged (no code touched). `bash -n
scripts/release.sh` syntax-check clean. The fix takes effect at this
release's `scripts/release.sh public` step.

## [1.6.8] — 2026-05-18

### fix(copilot-cli)+fix(store): four-bug Copilot CLI audit follow-through

Operator-requested deep audit of the Copilot CLI integration against
the operator-supplied sample log
`tmp/session-files-examples/events.jsonl` (~25k events, 4-week sticky
session, 9 shutdowns, 39 compactions, 17 model-resolved subagents +
20 model-unresolved subagents). Four bugs found + a fifth attribution
gap that surfaced during fix verification. All five fixed in this
release. Audit report:
[`docs/audits/copilot-cli-audit-2026-05-18.md`](docs/audits/copilot-cli-audit-2026-05-18.md);
reusable methodology:
[`docs/adapter-audit-playbook.md`](docs/adapter-audit-playbook.md).

**B1 — tuple-dedup false-drops legitimate per-block Tier-3 rows on
copilot-cli.** The v1.6.5 tuple-dedup was authored tool-agnostically.
Copilot CLI emits one `assistant.message` event per content block,
each carrying its own per-block `outputTokens` delta (NOT a cumulative
snapshot like Claude Code's emission model). Multiple blocks share
one `MessageID = requestId`. Two distinct blocks under one request
with byte-identical small output counts (e.g. two empty tool_use
blocks both 119 tokens) were wrongly collapsed by the dedup.
Quantified on the sample: 3,303 → 3,297 Tier-3 rows; 1,440 output
tokens lost (~$0.04 at opus-4.7 list). Fix scopes the dedup via SQL
to `tool IN ('claude-code', 'codex')` allowlist — both verified to
have "same MessageID implies same logical content" emission. Future
adapters must NOT join this allowlist until their emit contract is
audited (see playbook §3 Check 5).

**B2 — Tier 1 ≺ Tier 0 session-summary dedup was session-wide.** When
ANY `source='otel'` row existed for a copilot-cli session, EVERY
`source='session_summary'` row for that session was deleted — losing
modelMetrics-derived input/cache for any shutdown window NOT covered
by Tier 1. Real-world trigger: user enables `--log-level debug`
mid-session; pre-debug shutdowns have populated modelMetrics with no
otel coverage; the sweep wipes them anyway. Fix scopes the drop to
per-shutdown timestamp window — only delete the session_summary row
if otel exists in the `(prior_session_summary_ts, this_ts]` interval
for the same session. Empty lower-bound (first shutdown) defaults to
`''` lexicographically less than any RFC3339 timestamp.

**B3 — Tier-1 Request-ID regex rejected 92% of production
requestIds.** The v1.6.6 regex `[0-9a-f-]+` only matched lowercase
hex + hyphen. Sample analysis revealed Copilot CLI emits TWO
distinct Request-ID formats interleaved in production:

- `00000-<uuid>` (lowercase-hex-uuid) — 8.1% of asst.message rids
- `<HEX>:<HEX>:<HEX>:<HEX>:<HEX>` (uppercase hex with colons) — 91.9%

The smoke-test capture used only the UUID format, so the regex
silently dropped Tier-1 coverage for 92% of debug-mode requests on
real sessions. Fix: `[^\s)]+` — permissive up to whitespace or close
paren.

**B4 + V6k — Subagent-context model attribution.** Copilot CLI's
`st.model` tracks only the parent session's selected model
(`selectedModel` / `session.model_change.newModel`). When the
parent spawns a subagent via the `task` tool, asst.message events
under the subagent's `agentId` were attributed to `st.model`
(always opus on the sample) instead of the subagent's actual model.
Net misattribution: **251K output tokens** routed to opus instead of
haiku/gpt-5.4/gpt-5.2; per-model dashboard slice showed
output=0 for the subagent models despite real activity; ~$3 over-
charge in dollars.

Two-step fix in `internal/adapter/copilotcli/events.go`:

- **B4 (primary):** record `subagentModels[agentId] = data.model`
  from `subagent.completed` events. Defer asst.message Model
  resolution until end-of-parse via `pendingSubagentTokenEmits` —
  subagent.completed fires AFTER all its asst.messages in the file,
  so the post-loop patch is mandatory. Resolves 17 of 37 subagents.

- **V6k (fallback):** when `subagent.completed.data.model` is empty
  (20 of 37 events on the sample — cancelled / short-lived
  subagents that never resolved), fall back to
  `tool.execution_complete.data.model` for events sharing the
  subagent's agentId. First-write-wins (don't churn across the
  subagent's many tool calls); subagent.completed still
  authoritatively overwrites if it lands later. Resolves an
  additional 15 of the remaining 20 subagents.

Net post-fix: **32 of 37 subagents (86%)** correctly attributed;
235K of the 251K mis-attributed tokens recovered. Residual 15K
tokens still on parent st.model — the 5 pure-text subagents that
emit zero tool calls and zero model-bearing events anywhere in
their context. Documented in audit doc §B4 + §V6k.

Empirical post-fix on the operator sample (re-ran via the §6
reproducer):

| source | model | rows | output |
|---|---|---|---|
| jsonl | claude-opus-4.7 | 2,540 | 2,651,458 |
| jsonl | claude-opus-4.6 | 492 | 373,526 |
| jsonl | **gpt-5.4** | **262** | **186,778** *(was 0 pre-fix)* |
| jsonl | **claude-haiku-4.5** | **47** | **45,256** *(was 0)* |
| jsonl | **gpt-5.2** | **1** | **3,507** *(was 0)* |
| session_summary | (per-model Tier 0 untouched) | 9 | 0 |

Total Tier-3 output reconciles exactly: 3,260,525 =
3,004,941 (asst.message Tier 3) + 255,584 (compaction Tier 3).

**Audit doc (`docs/audits/copilot-cli-audit-2026-05-18.md`, 30 KB):** full
methodology, severity-ordered bugs, sum-reconciliation tables,
ground-truth recompute correcting the v1.6.7 handover's "$1,806 ≈
$1,800 API-list ceiling" claim (right number, wrong reasoning —
coincidence driven by opus-4.5+ pricing at $5/$25 ≈ 1 Copilot
premium credit per dollar; not a structural equivalence). Reproducer
in §6 is operator-runnable.

**Audit playbook (`docs/adapter-audit-playbook.md`, 31 KB):**
reusable methodology distilled from the audit. Codifies the six
checks every adapter must pass (field-map completeness, handler
coverage, MessageID stability, cross-tier sum reconciliation,
dedup safety, model attribution), four robustness sweeps (regex
variance, state-machine ordering, idempotent re-parse, cross-OS
paths), a red-flag table of 11 anti-patterns to grep for, a 10-gate
PR checklist for new adapters, and an investigative workflow for
"cost looks off" reports. Applies to every adapter we ship; meant
to surface the bug classes that copilot-cli's audit uncovered before
they recur on cowork / claudecode / codex / antigravity / etc.

**Tests added (10 new):**

- `TestInsertTokenEvents_TupleDedupSkipsCopilotCLIMultiBlock` —
  6-block multi-row fixture mimicking the sample's collision pattern
- `TestInsertTokenEvents_TupleDedupAllowlistRejectsUnknownTool` —
  cline-as-future-tool: byte-identical rows survive (not on allowlist)
- `TestInsertTokenEvents_SessionSummaryMidDebugToggle` — pre-debug
  session_summary kept; post-debug dropped
- `TestInsertTokenEvents_SessionSummaryMultiShutdownAllDebug` —
  always-debug path preserved unchanged from v1.6.6
- `TestParseEventsJSONL_SubagentModelAttribution` — 2 distinct
  subagent models + parent-context control
- `TestParseEventsJSONL_SubagentNeverCompleted` — orphan subagent
  falls back to st.model
- `TestParseEventsJSONL_SubagentCompletedWithoutModelField` —
  empty data.model doesn't clobber Model to ""
- `TestParseEventsJSONL_SubagentResolvedFromToolExecution` — V6k
  fallback via tool.execution_complete
- `TestParseEventsJSONL_SubagentCompletedModelWinsOverToolExecution`
  — precedence: subagent.completed authoritative
- `TestParseEventsJSONL_SubagentExplicitModelWins` — data.model on
  asst.message beats both lookups
- `TestParseProcessLog_HexOpaqueRequestID` — Tier-1 regex captures
  both UUID and hex:colon formats

**Build state:** `go vet ./...` clean; `go build` clean; full repo
test sweep **51/51 packages, 0 failures**. Empirical reproducer
verified against the operator sample.

**Files changed (+985 / −15 lines + 2 new docs):**

| File | Lines | What |
|---|---|---|
| `internal/store/store.go` | +70 / −15 | B1 dedup allowlist; B2 per-shutdown window scope |
| `internal/store/store_test.go` | +312 / −0 | B1 + B2 regression tests |
| `internal/adapter/copilotcli/events.go` | +164 / −15 | B4 + V6k subagent attribution; eventEnvelope.AgentID; subagentCompletedData type; post-loop patch |
| `internal/adapter/copilotcli/log.go` | +14 / −0 | B3 regex broadening |
| `internal/adapter/copilotcli/adapter_test.go` | +300 / −0 | 6 subagent tests + 1 hex:colon regex test |
| `docs/audits/copilot-cli-audit-2026-05-18.md` | +662 NEW | audit report + V6k addendum |
| `docs/adapter-audit-playbook.md` | +770 NEW | reusable methodology |

## [1.6.7] — 2026-05-18

### feat(copilot-cli): capture session.compaction_complete.compactionTokensUsed

Follow-on to v1.6.6's Tier 0 fix. While reconciling the operator's
"$1,806 is too low" intuition against the sample events.jsonl, found
that `session.shutdown.data.modelMetrics` does NOT include compaction
tokens — the proof is the modelMetrics outputs sum (2,999,106) matching
Tier 3 assistant.message outputs (3,004,941) within 0.2% (streaming
noise), while `compactionTokensUsed.output` across 39 compactions
contributes another 255,584 outputs that are **separately billable**.
Compaction is its own API call (the assistant summarises prior
context); without capture, every compaction's input / output /
cache_read silently disappears.

For the sampled file: ~$8 (if Copilot uses Haiku for compaction) to
~$38 (if Opus) of dollar cost was being dropped per session. For
summarization-heavy long sessions this could be a meaningful share of
total spend; on this file specifically: 5.99M input + 256K output +
5.7M cached input across 39 compactions.

**Adapter:** new `case "session.compaction_complete":` handler in
`internal/adapter/copilotcli/events.go`. Emits one TokenEvent per
compaction call with the payload's tokens. `source='jsonl'`,
reliability='approximate'.

**Schema variants handled.** Two observed shapes in the wild:

- Older (38/39 events in the sampled log):
  `{input, output, cachedInput, duration}` — no `Tokens` suffix, no
  model field.
- Newer (1/39): `{inputTokens, outputTokens, cacheReadTokens,
  cacheWriteTokens, model}`.

`compactionTokensUsed.resolveTokens()` collapses both by
field-fallback: `InputTokens || Input`, `OutputTokens || Output`,
`CacheReadTokens || CachedInput`. Model from payload when present
(newer schema), else `st.model` fallback (older schema —
empirically Copilot compacts with whatever model is active when the
threshold trips, so `st.model` is the right approximation).

**MessageID.** When `data.requestId` is present (every observed
event), use it — joins to Tier 1 (otel) rows from process.log for the
same compaction call via the v1.6.3 T1 dedup. When absent, fall back
to `"compaction:<env.ID>"` so the row is uniquely keyable.

**Coexistence.** Compaction rows share `source='jsonl'` with Tier 3
per-message rows, but their MessageIDs come from different request
IDs so no collision under the v1.6.5 tuple dedup. When Tier 1 (otel)
captures the same compaction call (debug logging on), v1.6.3 T1 drops
the jsonl compaction row in favour of the more granular otel row —
correct precedence.

**Four new tests in `internal/adapter/copilotcli/adapter_test.go`:**

- `TestParseEventsJSONL_CompactionTokensOldSchema` — `{input, output,
  cachedInput}` → resolves correctly, falls back to `st.model`
- `TestParseEventsJSONL_CompactionTokensNewSchema` — `{inputTokens,
  outputTokens, cacheReadTokens, cacheWriteTokens, model}` → model
  from payload overrides `st.model`
- `TestParseEventsJSONL_CompactionTokensEmptyOrZero` — absent or
  all-zero compactionTokensUsed → 0 TokenEvents
- `TestParseEventsJSONL_CompactionTokensMissingRequestID` → MessageID
  falls back to `compaction:<env.ID>`

**Live verify (no change observable on the maintainer DB —
intentionally).** The 5 active copilot-cli sessions on the
maintainer's machine are short-test sessions, none long enough to
trigger Copilot's compaction threshold (0 compaction_complete events
in any of them). So a rescan emits 0 new rows. The fix is pinned by
the unit tests, which cover both schema variants + edge cases. For
a real long-conversation user (like the operator's sample file with
39 compactions) the impact would be the $8–$38 quantified above.

**Build state:** typecheck + go vet + go build all clean. Full repo
test sweep: 51/51 packages, 0 failures.

## [1.6.6] — 2026-05-18

### feat(copilot-cli): Tier 0 capture from session.shutdown.modelMetrics — closes the input/cache/reasoning gap for non-debug users

Operator-flagged: copilot-cli cost figures on the dashboard were
"very misleading" — only outputTokens were captured for users who
didn't run `copilot --log-level debug`. Investigation of a sample
events.jsonl (~25k events, 9 shutdowns) found `data.modelMetrics`
inside `session.shutdown` carries per-model cumulative usage delta
(inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens,
reasoningTokens, plus a Copilot-premium-credit `cost` field) and the
adapter was discarding it. For that one file alone: **320M input
tokens, 295M cache_read, 115K reasoning, and ~$1,806 of model
activity** were silently dropped — only Tier 3 (per-message
outputTokens, 3M total) survived.

**Empirical findings driving the design.**

- Each `session.shutdown.modelMetrics` is a *delta block* covering
  the work span between the most recent `session.resume` and this
  shutdown, NOT a cumulative all-time snapshot. Verified: summing
  all 9 shutdowns on the sample file gives 2,999,106 output tokens,
  matching the Tier 3 sum (3,004,941) within streaming-chunk noise.
  The latest shutdown alone has all-zero usage (idle pause) — so
  "take last" would have given $0.
- `modelMetrics.requests.cost` is a "Copilot premium request credit"
  count, not dollar cost. gpt-5.4 reports `cost=$0` despite 200+
  requests and 14M input tokens. We compute cost via our standard
  pricing engine on the captured token columns instead.
- `session.compaction_complete.data.compactionTokensUsed` *is already
  aggregated into* modelMetrics — verified by the matching sum check.
  Separately capturing it would double-count. Skipped.

**Tier 0 capture (new `source='session_summary'`).** The
`session.shutdown` handler at
`internal/adapter/copilotcli/events.go:553` now parses
`data.modelMetrics` and emits one `TokenEvent` per model with
non-zero usage:

- `Source = TokenSourceSessionSummary` (new constant)
- `Reliability = ReliabilityApproximate`
- `SourceEventID = env.ID + ":" + model` (per-shutdown-per-model
  unique; idempotent re-parse via `UNIQUE(source_file, source_event_id)`)
- `MessageID = "session-shutdown:" + env.ID` (per-shutdown grouping)
- `InputTokens / CacheReadTokens / CacheCreationTokens
  (= cacheWriteTokens) / ReasoningTokens` from `modelMetrics[model].usage`
- `OutputTokens = 0` — Tier 3 per-message rows already cover output;
  including here would double-count by ~2x
- Models with all-zero usage (idle-pause shutdowns) are skipped so
  the table doesn't accumulate noise rows

**Store-layer Tier 0 ≺ Tier 1 dedup.** When `--log-level debug` IS
on, Tier 1 (`source='otel'`) captures the same model-call data with
per-request granularity. The session-level Tier 0 aggregate would
duplicate Tier 1's input/cache/reasoning columns. New dedup pass in
`store.InsertTokenEvents` (after the v1.6.3 T1 block, gated on
`hasCopilotCLI`): when any `source='otel'` row exists for a
`(tool='copilot-cli', session_id)`, drop every `source='session_summary'`
row for that session. Scoped per-session not per-message because
Tier 0's MessageID groups per-shutdown, not per-request. Arrival-order
independent; idempotent across re-parses.

**Tier coexistence after this change** (cost engine SUMs all rows):

| User mode | Tiers active | Capture quality |
|---|---|---|
| No debug | Tier 0 + Tier 3 | input/cache/reasoning from session-aggregate, output per-message |
| Debug | Tier 1 (drops 0 + 3) | full per-request breakdown |
| Pre-v1.6.6 no-debug | Tier 3 only | **output_tokens only — input/cache/reasoning = 0** |

**Live verify on the maintainer DB** (`observer scan --force --adapter copilot-cli`):
- copilot-cli total cost: **$0.0622 → $0.1810** (+191%, ~3×) for the 7 small sessions on disk
- 4 new `source='session_summary'` rows landed (1 claude-haiku-4.5, 3 gpt-5-mini across distinct shutdowns)
- claude-haiku-4.5 input went 0 → 79,940; cache_read 0 → 70,445
- gpt-5-mini input went 171,579 → 282,908 (+65%); cache_read 20,992 → 84,224 (+301%)
- 0 sessions have both `otel` and `session_summary` rows → Tier 0 ≺ Tier 1 dedup confirmed clean
- For the operator's sample file ($1,806 of model activity in a single session), the projected capture jump on rescan is **~30,000× larger** than the 3× we see on the maintainer's micro-sessions

**Pricing engine coverage** — verified the dot-variant model names that
Copilot CLI emits (`claude-opus-4.6`, `claude-opus-4.7`,
`claude-haiku-4.5`, `gpt-5.2`, `gpt-5.4`) all resolve to non-zero
rates. `claude-haiku-4.5` already had an exact entry; opus dot-variants
fall back to `claude-opus-4` family rates (identical to the hyphen
variants). Dashboard will surface a `~` badge on the opus rows
indicating non-exact lookup — operator can add explicit dot-variant
entries to the pricing table later if desired.

**Four new adapter tests in `internal/adapter/copilotcli/adapter_test.go`:**
- `TestParseEventsJSONL_SessionShutdownModelMetrics` — 3-model shutdown
  emits 3 TokenEvents with correct token mappings, OutputTokens=0,
  session-end marker preserved, stable SourceEventID + MessageID
- `TestParseEventsJSONL_SessionShutdownEmptyModelMetrics` — absent and
  explicit-empty modelMetrics both emit 0 TokenEvents; marker still
  fires
- `TestParseEventsJSONL_SessionShutdownSkipsZeroUsage` — model with all
  zero usage columns (idle-pause) is suppressed; non-zero peers
  survive
- `TestParseEventsJSONL_SessionShutdownPartialFields` — missing
  reasoningTokens / cacheWriteTokens in older Copilot CLI versions
  zero-fill cleanly

**Five new store tests in `internal/store/store_test.go`:**
- `TestInsertTokenEvents_SessionSummaryDroppedWhenOtelPresent` — Tier
  1 wins; Tier 0 is dropped
- `TestInsertTokenEvents_SessionSummaryPreservedAloneNoOtel` — Tier 0
  survives when Tier 1 is absent (the common non-debug case)
- `TestInsertTokenEvents_SessionSummaryAndTier3Coexist` — Tier 0 +
  Tier 3 sum to complete capture
- `TestInsertTokenEvents_SessionSummaryIdempotentReparse` — 3
  re-parses of same shutdown event → 1 row
- `TestInsertTokenEvents_SessionSummaryMultiModelsAllSurvive` — multi-
  model rows in one shutdown share MessageID but distinct token
  tuples; v1.6.5 tuple dedup must not collapse them

**Build state:** typecheck + go vet + make web-build + go build all
clean. **Full repo test sweep: 51/51 packages, 0 failures.**

## [1.6.5] — 2026-05-18

### fix(store): generalized tuple-level token_usage dedup + migration 020

Operator-flagged: cost numbers on the maintainer dashboard looked
roughly right per-session but absolute totals were higher than
plausible. Probe across the live DB (74,227 token_usage rows) found
**41,019 byte-identical re-emission rows in 18,316 (session_id,
message_id) groups for claude-code alone** — pre-cb16006 (2026-04-25)
residue that escaped the `UNIQUE(source_file, source_event_id)`
constraint and inflated per-model cost by ~30% on every dashboard
surface.

**Root cause.** Claude Code's JSONL emits N content-block lines per
assistant message (one per text/tool_use/thinking block), and every
line carries the **same cumulative `message.usage` snapshot** of the
parent API call. The cb16006 fix (2026-04-25) keyed
`SourceEventID = msg.ID` so re-parses correctly hit ON CONFLICT —
forward data is clean. But the pre-fix code used per-line UUID as
`SourceEventID`, leaving N rows per logical message and ~22.6k of
those rows lingering on any DB that ran observer before 2026-04-25.
Verified on a Windows-mounted JSONL too: same N-lines-per-msg-id
emit pattern, but zero DB residue (those rows were ingested post-fix).

A smaller residue (~22 rows, 111 groups) exists for codex from
runtime re-emissions of identical `total_token_usage`. copilot-cli
has 3 groups outside the v1.6.3 T1 otel/jsonl mixed-source scope.

**Tool-agnostic tuple-level fix.** `internal/store/store.go::InsertTokenEvents`
now appends a post-batch DELETE inside the same transaction: per
`(tool, session_id, message_id)`, drop rows whose
`(input_tokens, output_tokens, cache_read_tokens, cache_creation_tokens,
cache_creation_1h_tokens, reasoning_tokens)` tuple is byte-identical
to a higher-id sibling. Gated on the batch containing at least one
msgid-bearing event so empty-msgid-only inserts skip the EXISTS scan.
Rows with distinct token values (real progressing snapshots, real
per-emission deltas) are preserved — only byte-identical re-emissions
collapse. Tool-agnostic so future adapters inherit the dedup without
bespoke per-tool scoping. The existing `idx_token_usage_session_message`
index keeps the EXISTS cheap.

`internal/db/migrations/020_token_usage_tuple_dedup.sql` runs the
same DELETE once over historical data. Idempotent on clean DBs;
schema version 19 → 20.

**Live verify on the maintainer DB:**
- pre-migration token_usage rows: 74,227
- post-migration: **51,671** (`−22,556 rows deleted`)
- claude-code all-history total: **$10,090.55 → $6,768.41** (`−$3,322 / −33%`)
- codex all-history total: $300.40 → $298.21 (essentially unchanged,
  confirms codex per-turn deltas are real cost, not duplicates)
- copilot-cli / antigravity / cowork totals: unchanged (no false
  positives — non-byte-identical dups preserved)
- 30-day sessions vs models reconciliation Δ: $14.14 → **$7.07**
  (tighter — cleaner data reconciles better)
- residual dup groups (all non-byte-identical, preserved by design):
  96 claude-code + 111 codex + 3 copilot-cli

**Why MAX-collapse would have been wrong for codex** — investigation
found codex `token_count` events carry `last_token_usage` (per-turn
delta) not `total_token_usage` (cumulative), so multiple rows
sharing TurnID represent real separate billable cost. Naive
`MAX(output_tokens)` collapse per `(session_id, message_id)` would
have under-counted codex by 80%+. Tuple-equality is the only
semantically safe key.

Six new tests in `internal/store/store_test.go`:
- `TestInsertTokenEvents_TupleDedupIdenticalRows` — claudecode-style
  5-line group with identical tuples collapses to 1 row.
- `TestInsertTokenEvents_TupleDedupPreservesDistinctRows` — codex-style
  3 distinct delta emissions all survive.
- `TestInsertTokenEvents_TupleDedupPreservesEmptyMessageID` —
  msg-less rows never collapse even if tuples match.
- `TestInsertTokenEvents_TupleDedupAcrossTools` — cross-tool rows
  with identical (session_id, message_id, tuple) survive
  independently.
- `TestInsertTokenEvents_TupleDedupArrivalOrder` — final state
  identical across single-batch / sequential / reversed insert
  orders.
- `TestInsertTokenEvents_TupleDedupCoexistsWithCopilotCLI` — single
  batch with copilot-cli tier1+tier3 AND claude-code identical-tuple
  group resolves correctly: T1 mixed-source dedup drops tier3, tuple
  dedup collapses claude-code dups.

`dashboard_test.go::TestAPISessionMessages_LongContextPerTurn` test
fixture updated to use distinct token tuples (149,999 + 150,001
instead of 150,000 + 150,000) — the original seed double-counted by
shape and the v1.6.5 dedup correctly collapses byte-identical
inputs. Production-realistic.

**Build state:** typecheck + go vet + make web-build + go build all
clean. **Full repo test sweep: 51/51 packages, 0 failures.**

## [1.6.4] — 2026-05-18

### fix(dashboard): cost reconciliation + tool-filter coverage on three orphaned endpoints

Operator-flagged: per-session cost on /api/sessions didn't reconcile
with /api/models' total on the Cost page. Investigation surfaced
three related gaps left from the v1.6.3 ship.

**1. /api/sessions cost rollup window aligned to `days` param.**
handleSessions previously hardcoded `cost.Options.Days=365` even when
the caller passed `days=30` — over-counted sessions whose token_usage
spanned beyond the visible window. After the fix, the cost engine
respects the same window as the rest of the page.

Live verify on the maintainer DB (days=30):
- pre-fix: sum-of-sessions=$6,204.21 vs /api/models=$6,168.90
  (**Δ=$35.31 / 0.57%**)
- post-fix: sum-of-sessions=$6,159.97 vs /api/models=$6,174.11
  (**Δ=$14.14 / 0.23%**)

Residual ~$14 is a different smaller phenomenon — sessions started
>30d ago that have token_usage rows in the window. /api/sessions
filters by `started_at`; /api/models filters by `tu.timestamp`. That's
a sessions-list semantic question (whether to include long-resumed
sessions in the windowed list), not a cost engine bug. Deferred.

`days=0` callers (CLI without window) keep the full-history rollup —
`costDays` falls back to 36500 in that case.

New test `TestAPISessions_CostReconcilesWithModels` seeds a session
with a recent + a 60-day-old api_turn, asserts sum-of-/api/sessions
≈ /api/models?days=7 total within 0.01%.

**2. /api/cost honors `tool` query param.** handleCost only read
`project` and `source` — the v1.6.2 ship's "Cost engine + handlers"
sweep wired Tool through `cost.Options` but missed this handler.
Dashboard-orphaned (Cost.tsx calls /api/models, not /api/cost) but
`observer cost --tool=X` CLI consumers expected it. Two-line fix.
New test `TestAPICost_HonorsToolFilter` covers unfiltered vs
per-tool vs nonexistent-tool, asserting tool=A + tool=B sums to
unfiltered.

**3. /api/compression/rolling-cost honors tool + project filters.**
Backend: handleCompressionRollingCost joins `summary_calls` through
sessions → projects and `compression_events` through api_turns →
sessions → projects when filters are set. Frontend Compression.tsx
passes tool + project to the rolling-cost useApi call with proper
deps array. The handler still returns identical shape; only the
underlying scan narrows.

**Build state:** typecheck + go vet + make web-build + go build all
clean. All 51 packages green; two new dashboard tests pin both
behaviors.

## [1.6.3] — 2026-05-18

### feat: copilot-cli cost-accuracy completes — Tier 1+3 dedup + Tier 2 utilization fallback + migration

The v1.6.2 ship landed copilot-cli's three-tier capture and flagged
two known gaps for v1.6.3: (a) Tier 1 + Tier 3 double-count output
tokens when debug logging is enabled, and (b) Tier 2 was documented
but not implemented, leaving the "no debug log = no input tokens"
case fully un-billed. v1.6.3 closes both.

**Tier 1 + Tier 3 dedup (store-layer).** When `--log-level debug` is
on, the same Request-ID produces a Tier-1 row (`source='otel'`, full
usage breakdown from `[DEBUG] response` block) AND a Tier-3 row
(`source='jsonl'`, OutputTokens-only from `assistant.message.outputTokens`).
They land under different `(source_file, source_event_id)` keys, so
the existing ON CONFLICT clause can't dedup them — `output_tokens`
was double-counted in every rollup for those sessions.

`internal/store/store.go::InsertTokenEvents` now appends a post-batch
sweep DELETE inside the same transaction: when a copilot-cli batch
arrives, drop any `source='jsonl'` row where a `source='otel'` row
exists for the same `(session_id, message_id)`. Scoped to
`tool='copilot-cli'` only — other adapters with similar overlap
patterns (Anthropic proxy + claudecode JSONL) are left alone for
future work. Arrival-order independent, idempotent across re-parses;
index `idx_token_usage_session_message` keeps the EXISTS subquery
cheap. 9 new dedup tests (`TestInsertTokenEvents_CopilotCLITierDedup`
covers 7 arrival-order scenarios — tier3-then-tier1, tier1-then-tier3,
both-in-same-batch, tier1-only, tier3-only, double-tier1 re-parse,
double-tier3 re-parse — plus `TestInsertTokenEvents_DedupScopedToCopilotCLI`
pins the cross-adapter non-interference contract).

**Migration `019_copilotcli_dedup.sql`** backfills the same DELETE
once at next observer startup — runtime dedup only catches new
inserts, so without the migration the over-counted rows from the
pre-v1.6.3 era would persist forever. Migration is conservative
(Tier-3-only sessions keep their rows, no OutputTokens loss);
idempotent against clean DBs.

**Tier 2 (utilization fallback).** When `--log-level` is NOT debug
(INFO is the Copilot CLI default), `[DEBUG] response (Request-ID …)`
lines never fire — so Tier 1 has nothing to parse, and input tokens
are completely invisible. Tier 2 fills the gap: the `[INFO]
CompactionProcessor: Utilization X% (CTX/128000 tokens)` line fires
once per outgoing request (verified empirically — every Utilization
sample is followed directly by `--- Start of group: Sending request
to the AI model ---`). Each sample's raw CTX value IS the gross
prompt size for the upcoming request, NOT a delta vs the prior
sample — the v1.6.2 handover's "subtract successive Utilization
values" framing was incorrect; using deltas would under-count input
by ~80%.

`internal/adapter/copilotcli/log.go` now buffers a TokenEvent per
Utilization snapshot during the log-parse pass, then flushes the
buffer at end-of-file ONLY IF the new
`logParserState.seenDebugResponseHeader` flag is false (i.e. no
`[DEBUG] response` line fired anywhere in the file → Tier 1 isn't
covering anything → buffered Tier 2 emits land). When debug logging
IS on, Tier 1 covers every request and the buffered Tier 2 rows are
dropped — avoids double-counting input. Mutual exclusion is
per-file because `--log-level` is a process-level flag (so any one
log file is either all-debug or all-INFO; mid-session toggling is
impossible). New `models.TokenSourceLogDelta = "log_delta"`
distinguishes Tier 2 rows from Tier 1 (`otel`) and Tier 3 (`jsonl`).
Tier 2 has no MessageID (Request-IDs aren't surfaced at INFO level);
the matching Tier 3 row carries OutputTokens with its own MessageID
and the two compose at the rollup layer rather than at the
TokenEvent level. Reliability = `approximate`. 2 new tests pin the
mutual-exclusion contract (`TestParseProcessLog_Tier2_InfoOnlyLogging`
+ `TestParseProcessLog_Tier2_SuppressedByDebugLogging`).

**Live verification on the maintainer DB** (run after
`observer scan --force --adapter copilot-cli`):

- Session `72bbb346` (debug-on): had 6 dupe rows pre-v1.6.3 (3 otel +
  3 jsonl); migration cleaned to 3 otel-only; output_tokens dropped
  from over-counted 2,758 → correct 1,379.
- Session `9da4aa10` (debug-off): had 4 jsonl rows pre-v1.6.3
  (output_tokens=3,807, input_tokens=0 — fully invisible input);
  scan emitted 5 new `log_delta` rows totaling InputTokens=123,348.
  Now has the full per-request gross-prompt billing.
- `/api/analysis/headline?tool=copilot-cli` period_cost shifted
  $0.031 → $0.062 — Tier 2 effectively doubles the captured cost on
  this maintainer's corpus because INFO-only sessions outweigh
  debug-on ones.

**Known limitation:** Tier 2's per-turn count overstates the actual
turn count because Tier 2 (log_delta, no MessageID) + Tier 3 (jsonl,
MessageID set) rows for the same request don't share a join key —
they appear as two distinct "turns" in `per_turn.count`. The
aggregated `period_cost_usd` is correct; only the per-turn
denominator is inflated. Future work: join via timestamp-window or
session-boundary heuristic so per_turn count reflects API turns
rather than token-row count.

### feat(dashboard): filter-wiring follow-up — patterns + compression-retrieval + compaction-events

The v1.6.2 ship hardened most surfaces but explicitly deferred
several smaller ones to v1.6.3. Operator audit (Lane R) of the live
v1.6.2 dashboard with `tool=copilot-cli` + project filters surfaced
three concrete gaps + one hygiene issue.

**`/api/patterns` + `/api/patterns/timeseries` honor the Tool
filter.** `project_patterns` rows are project-scoped at the DB
level, but the semantic "patterns mined from sessions that used
tool=X within project=Y" is the user's expectation when the global
Tool dropdown is set. Backend: both handlers now read `tool` query
param and restrict via `IN (SELECT DISTINCT project_id FROM actions
WHERE tool = ?)`. The IN-subquery with a single scan + hash-join
avoids the EXISTS-per-pattern quadratic risk the v1.6.2 ship hit on
`crossToolFiles` (handover §4d). Frontend: `Patterns.tsx` pulls
`tool` from `useFilters()` and passes it to both `useApi` calls. New
table-driven test `TestAPIPatterns_ToolFilter` covers 7 filter
combinations (no-filter, two tool variants, missing tool,
project-only, project+tool agreeing, project+tool disagreeing).

**`/api/compression/retrieval` honors tool + project.** The K43
retrieval-rate report (`learn.PatternMiner.Report`) was windowed by
days only. New `learn.ReportOptions{Days, Tool, Project}` struct
extends the signature; queries on `retrieval_signals` join through
`action_id → actions → projects` for tool/project filtering (live
DB sanity-check confirmed `action_id` is populated on 179/180
signals — `session_id` is structurally NULL in the historic
corpus, so the action-based path is load-bearing). `compression_events`
queries join through `api_turn_id → api_turns → sessions →
projects`. Two helper functions `signalsFilter` /
`compressionEventsFilter` build the optional JOIN + WHERE clauses
so the empty-filter case stays an unjoined scan. Existing legacy
caller (`signals_test.go` × 5 sites) updated to the new struct.

**`/api/compaction/events` honors tool + project.** Direct WHERE
clauses on `tool = ?` + `project_id = (SELECT id FROM projects
WHERE root_path = ?)` — `compaction_events` already has both columns
indexed via the `001_initial.sql` schema, so no JOIN is needed.

**Frontend `Compression.tsx`**: both `retrieval` and `compaction`
`useApi` calls now pull `tool` + `project` from `useFilters()` and
include them in the deps array.

Verified live: `/api/patterns?tool=copilot-cli` → 0 (no patterns
mined yet for the new adapter — sample threshold not met) vs
`tool=claude-code` → 108. `/api/compression/retrieval?tool=claude-code`
→ 165 search_hits (was 179 unfiltered). `/api/compaction/events?tool=codex`
→ 0 events (no codex compaction events in the corpus). All filter
narrowing is monotone-decreasing vs the unfiltered baseline.

### fix(discover): `cross_tool_files` nil-slice JSON hygiene

Lane R audit caught `/api/discover` returning
`"cross_tool_files": null` (instead of `[]`) when no tool filter
was set — a stale Go nil slice from
`internal/intelligence/discover/discover.go::crossToolFiles()`
that escaped the v1.6.2 ship's source-level slice-init sweep.
Frontend guards with `?.length` so the v1.6.2 routing-suggestions
crash class doesn't repeat, but the type contract (`CrossToolFile[]`
on the wire) is now honest. One-line fix: `var out []CrossToolFile`
→ `out := []CrossToolFile{}`.

### fix(test): newTestServer relative-to-now timestamp (closes time-bomb test failures)

`TestAPITimeseriesActions` + `TestAPITools` were carried over from
v1.6.0 as known-failing per the v1.6.1 + v1.6.2 handovers. Root
cause was a hardcoded `time.Date(2026, 4, 16, 10, 0, 0, 0, time.UTC)`
in `newTestServer` (the dashboard test seed helper) — once today's
date crossed 2026-05-16 (April 16 + 30 days), every test that
queried with `days=30` saw zero rows from the seed and asserted
empty-result-is-failure. Fix at the source:
`base := time.Now().UTC().Add(-time.Hour)`, with a comment
explaining the trap. Other tests that build on the seeded `sA`
session reference it by ID (not by timestamp) so they're unaffected.
Both tests now pass; the full dashboard suite + every package across
the repo (51 packages) is green.

**Build state at tag:** typecheck + go vet + make web-build + make
build + the full test sweep all clean. No pre-existing failures
remain on `main`.

## [1.6.2] — 2026-05-17

### feat(adapter): GitHub Copilot CLI — new `copilot-cli` adapter with three-tier token capture

v1.6.2 adds Observer support for the GitHub Copilot CLI agent
(`@github/copilot` npm package, binary `copilot`) as a NEW adapter
distinct from the existing `copilot` adapter (which covers the VS
Code Copilot Chat extension). Both products share branding but have
wholly different on-disk layouts and event schemas; conflating them
would corrupt per-tool dashboard slicing.

The adapter watches two file shapes under one home-rooted set of
roots (`<home>/.copilot/`), cross-mount-aware for WSL2:

- `<home>/.copilot/session-state/<uuid>/events.jsonl` — per-session
  event stream (13 event types; envelope `{type, data, id, timestamp,
  parentId}`; always written even at INFO log level)
- `<home>/.copilot/logs/process-<ts>-<pid>.log` — global per-process
  log file

**Token capture — three-tier graceful degradation.** GitHub does NOT
expose input / cache / reasoning tokens in `events.jsonl` (only
`outputTokens` on each `assistant.message`). Investigation of the
binary surfaced the full upstream-API `usage` object in the
per-process log at `--log-level debug`. Adopted strategy:

- **Tier 1 (accurate, reliability=approximate)** — log file at
  `--log-level debug` captures `[DEBUG] response (Request-ID …):`
  blocks with full `usage` JSON: `prompt_tokens`,
  `completion_tokens`, `prompt_tokens_details.cached_tokens`,
  `completion_tokens_details.reasoning_tokens`. Joined to
  events.jsonl `assistant.message.requestId` via Request-ID; one
  Request-ID may cover N response blocks within a turn (WebSocket
  serves multiple `response.create` calls), so the parser increments
  a per-Request-ID sequence counter to produce N distinct
  `SourceEventID = "log:<requestId>:<seq>"` rows.
- **Tier 2 (approximate, ~5%)** — even at default INFO level the log
  captures `CompactionProcessor: Utilization X% (CTX/128000 tokens)`
  snapshots before every API call; successive-call deltas give an
  approximate input-token count per turn. Not yet implemented — Tier 1
  + Tier 3 ship first; Tier 2 lands in a follow-up.
- **Tier 3 (output-only, reliability=unreliable)** — events.jsonl
  `assistant.message.outputTokens` is captured unconditionally.
  Input / cache / reasoning land as 0 when neither log tier is
  available.

Strategies rejected during investigation (documented in
`docs/plans/copilot-cli-adapter-plan.md` §11.3): WebSocket MITM proxy
(Copilot uses `wss://api.individual.githubcopilot.com/responses` —
TLS-encrypted WS, ~1 week of work for a problem already solved by the
debug log), local `o200k_base` tokenizer (no good pure-Go port; lossy
on cache splits), env-var endpoint hijack (no `COPILOT_DEBUG_GITHUB_API_URL`
override exists for the model endpoint).

**Verified live on both WSL native and Windows-via-`/mnt/c` capture**
(2026-05-17 smoke). Math reconciles to the Copilot CLI's terminal
footer to the token: a 3-call session displayed
`↑ 48.2k • ↓ 1.4k • 21.0k (cached) • 1.1k (reasoning)`; observer DB
sum: input 48,231 / output 1,379 / cache 20,992 / reasoning 1,088 — all four match.

**Tool-name mapping** (Copilot's built-in tool surface — initial set,
expand as needed): `view`/`read` → read_file; `create` → write_file;
`edit`/`str_replace_editor` → edit_file; `glob` → search_files; `grep`
→ search_text; `bash` → run_command; `web_fetch` → web_fetch;
`web_search` → web_search; `task` → spawn_subagent; `report_intent`
→ unknown (Copilot's mid-turn intent announcement);
`github-mcp-server-*` and `*-mcp-server-*` → mcp_call.

**New artifacts:**

- `internal/models/models.go` — new `ToolCopilotCLI = "copilot-cli"`
  constant
- `internal/adapter/copilotcli/{adapter,events,log,paths,doc,adapter_test}.go`
  — adapter package + 7-test table-driven test suite
- `internal/adapter/defaults/defaults.go` + `_test.go` —
  registration + IsSessionFile fixture
- `internal/config/config.go` — `"copilot-cli"` added to
  `Default().EnabledAdapters` (13 → 14 adapters)
- `internal/intelligence/cost/pricing.go` — `claude-haiku-4.5` alias
  (with a dot, the exact string Copilot CLI emits — pricing already
  had `claude-haiku-4-5` with dashes; gpt-5-mini was already covered)
- `cmd/observer/backfill.go` — new `--copilot-cli-rescan` flag,
  also fires from `--all`. Re-walks both `session-state/` and `logs/`
  trees so a debug-log enabling mid-flight retrofits Tier-1 tokens.
- `internal/intelligence/dashboard/{backfill_run,settings}.go` —
  `copilot-cli` → `--copilot-cli-rescan` allowlist entry + status
  description
- `web/src/lib/tools.ts` + `web/src/styles/tokens.css` — dashboard
  tool registry entry (label "Copilot CLI", provider "github",
  color `--tool-copilot-cli` = `#0969da` light / `#0550ae` dark for
  GitHub-blue distinction from Copilot's slate-gray)

**Docs:**

- `docs/plans/copilot-cli-adapter-plan.md` (new, ~600 lines) — full
  implementation plan with the three-tier strategy deep dive in §11
- `docs/copilot-cli-smoke-test.md` (new) — operator-facing
  enable-debug-logging recipe + cross-mount story + backfill workflow
- `docs/cross-adapter-schema-mapping.md` — new §3.7d row for
  `copilot-cli` (disambiguation from `copilot`; field mapping;
  three-tier token table; joiner cardinality note)
- `docs/adapters.md` — new row in implemented-adapters table

**Known issue (v1.6.2 ship — fix planned for v1.6.3):** when both
Tier 1 and Tier 3 fire for the same session, `output_tokens` is
duplicated (both tiers carry the output side). Cost rollups
over-count output by ~2× for sessions where debug-log capture is
enabled. Workaround for accurate cost analysis: filter
`source_event_id LIKE 'log:%'` to see Tier-1-only totals (which match
the Copilot CLI's terminal footer exactly). Fix: store-layer dedup by
`(session_id, message_id, source)`.

Build state at tag: typecheck + go vet + make web-build + make build
all clean; new adapter tests (7) + defaults invariants pass; the 2
pre-existing dashboard test failures (`TestAPITimeseriesActions`,
`TestAPITools`) carried over from v1.6.0/v1.6.1 still fail on
baseline — not introduced here.

### fix(dashboard): null-slice JSON crash + comprehensive global-filter wiring

Operator-flagged crash on `/analysis`:
`TypeError: Cannot read properties of null (reading 'length') at Analysis.tsx:263`.
Root cause was the dashboard backend marshaling empty `[]T` slices as
JSON `null` (Go's zero-value for an uninitialized slice header) which
then crashed `routing.data.suggestions.length` since the `?.` operator
only guards the parent. Fixed at the source — initialized to non-nil
empty slices in `internal/intelligence/dashboard/analysis.go`
(`allMovers`, `newEntrants`, `increases`/`decreases`, routing `out`,
top-sessions `badges`) and `internal/intelligence/dashboard/health.go`
(`out []fileHealth`). Belt-and-suspenders frontend `?.length` chains
added across Analysis, Cost, Tools, Settings.

Then a comprehensive sweep of every page's filter wiring: the global
Tool dropdown was effectively decorative on most pages (page didn't
read it, or backend didn't honor it), and Project worked piecemeal.
Audit produced an explicit matrix; fix applied in two passes:

- **Cost engine + handlers**: added `Tool string` to `cost.Options`,
  applied via `sessions.tool = ?` in both `loadProxyRows` and
  `loadJSONLRows`. A new analysis-only helper
  `analysisScopeClause(table, alias, tool, project)` builds the
  qualifying JOINs + WHERE for the 6 custom-SQL analysis handlers
  that scan `api_turns ∪ token_usage` via the `proxy_turn_ids` /
  `combined` CTE pattern (headline, top-sessions, routing-suggestions,
  cost-by-hour, cost-by-dow-hour, cache-savings-trend). The remaining
  cost-engine handlers (movers, trend, models, tokens-by-model,
  timeseries-cost, timeseries-actions, tools, tools-breakdown,
  patterns, patterns-timeseries, compression-events,
  compression-by-model, compression-timeseries) now also accept
  `tool` + `project` query params.

- **Frontend pages**: Cost, Analysis, Overview, Compression, Tools,
  Patterns, Discovery now destructure all relevant filters from
  `useFilters()`, pass them to every `useApi` call, and include them
  in deps arrays so changes refetch.

Verified live: `/api/models?tool=claude-code` → 6 models / $10,001 (vs
23 / $10,633 unfiltered); `/api/timeseries/cost?project=…` → $3,731
vs $10,634; `/api/analysis/routing-suggestions` → `suggestions: []`
(not `null`); all 15 probed routes return 200.

### fix(dashboard): scoped KPI counts via `/api/status/scoped`

Operator-flagged inconsistency: Overview's Sessions / API Turns /
Token Rows tiles and Analysis's Total Sessions tile showed identical
all-time numbers regardless of window/tool/project filters, despite a
"window 30d" chip suggesting filter dependence. Root cause — those
tiles sourced from `diag.Snapshot`'s lifetime `SELECT COUNT(*)` block.

- **New endpoint**: `/api/status/scoped?days=&tool=&project=` returns
  `{days, sessions, api_turns, token_usage, actions}` scoped to the
  filter set. Walks the right joins per table (`sessions.tool` +
  `sessions.project_id` direct; `api_turns.project_id` direct + tool
  via session; `token_usage.session_id` → sessions for both project
  and tool; `actions.tool` + `actions.project_id` direct). Original
  `/api/status` stays as the global snapshot — still drives the CLI
  + Settings audit.

- **Frontend re-source**: Overview's three broken tiles and Analysis's
  Total Sessions tile now consume the scoped endpoint. Analysis label
  changed to `Sessions ({win})` to keep the chip honest.

- **discover engine**: `discover.Options` gained `Tool string`,
  threaded into `totalActions`, `staleReads`, `repeatedCommands`,
  `nativeVsBash`. `crossToolFiles` short-circuits to `[]` when a tool
  filter is active (single-tool can't be "cross-tool"; the alternative
  EXISTS approach timed out on the live action table). The Analysis
  Waste tile (`/api/analysis/headline`) now passes `Tool` +
  `ProjectRoot` to `discover.WastedTokens`; `/api/discover` honors a
  new `tool` query param; Discovery + Overview frontends pass it.

Verified live: `/api/status/scoped?days=30` → 304 sessions; `&days=7`
→ 47; `&tool=copilot-cli` → 5; `&project=…/superbased-observer`
→ 199. Analysis Waste: claude-code = $5.27 / 1.27M tokens;
copilot-cli = $0 / 0.

**Known gaps deferred to v1.6.3**: Compression Retrieval +
Compaction sub-panels still honor `days` only (not tool/project);
`cross_tool_files` returns `[]` when a tool filter is set rather
than redefining the panel's semantics; the v1.6.2-candidate Tier 1
+ Tier 3 output-tokens duplication noted above also still applies.

## [1.6.1] — 2026-05-17

### Dashboard polish + backfill 3-modes restored + Settings audit + full CI/CD pipeline overhaul

v1.6.1 follows v1.6.0 (shipped same day) with five workstreams: a
help-icon scroll-into-view fix, three previously-failing Backfill
modes brought back online with a new tracker dialog, a Settings
audit fixing six bugs (one critical — compression save was zeroing
config), Vite preload-error auto-recovery, and a full build/release
pipeline overhaul that adds triple-layer gating (local preflight →
ci.yml on push → npm-release.yml on tag). Build state at tag:
`npm run typecheck` + `make web-build` + `go vet ./...` + `make
build` all clean; all 10 dashboard routes return 200; the three
previously-failing backfill modes return `status: running`;
Compression + Proxy round-trip via `/api/config` preserving full
bodies.

**Dashboard polish:**

- **Help-icon scroll-into-view** (`web/src/components/HelpDrawer.tsx`).
  Clicking any `?` indicator now opens the drawer AND navigates to
  the matching entry via `itemRefs` + a two-frame
  `requestAnimationFrame` then
  `el.scrollIntoView({ block: "center", behavior: "smooth" })`. Prior
  behavior opened the drawer but left the entry off-screen.
- **Vite preload-error auto-recovery** (`web/src/main.tsx`). New
  `window.addEventListener("vite:preloadError", …)` handler reloads
  once per session on stale-chunk fetch failure, with a
  `sessionStorage` guard to break out if the chunk is genuinely
  missing. Catches the "tab cached old `index.html`; new `dist` has
  different hashes" class hit after every `make web-build`.

**Backfill — 3 previously-failing modes restored + tracker dialog:**

- **`antigravity` / `antigravity-project-root` / `gemini-cli`** brought
  back online (`cmd/observer/backfill.go`,
  `internal/intelligence/dashboard/backfill_run.go`,
  `internal/intelligence/dashboard/settings.go`). Added
  `--antigravity-rescan`, `--antigravity-project-root`, and
  `--gemini-cli-rescan` rescan paths mirroring the existing
  `--codex-rescan` / `--cowork-rescan` shape; `allowlistedBackfillModes`
  gains the three entries; `--all` now also fires the new rescans;
  `handleBackfillStatus` now advertises the real CLI flag names
  (previously surfaced descriptive labels like
  `--all (rescan + recover)` that weren't real args).
- **`BackfillTrackerDialog`** (`web/src/pages/Settings.tsx`). 720-px
  SlideOver with live-streaming output and auto-scroll-to-bottom
  while running. Closed-dialog banner above the list shows live-job
  count when jobs are in flight.

**Settings audit — 6 bugs (A–F):**

- **B (critical)**: compression spec used `path: []`, so the draft
  was the entire root config and the PUT body decoded as
  `CompressionConfig` — every save zeroed `cfg.Compression`. Fixed by
  setting `path: ["Compression"]` and making the group paths
  relative (`["Shell"]`, `["Conversation", "Stash"]`, etc.).
- **A**: proxy upstreams (`AnthropicUpstream` / `OpenAIUpstream` /
  `ChatGPTUpstream`) were not editable — a fake `Upstreams: list`
  field shadowed the three real string fields. Replaced with three
  explicit text fields matching `ProxyConfig`.
- **C**: removed the dead `code_graph` compression group
  (`cfg.Compression.CodeGraph` has zero Go consumers, verified via
  grep); the section description now points users to Settings →
  Intelligence → Code graph.
- **D**: header sub-copy claimed "restart-on-save plumbing arrives
  next PR", but every section was already editable. Rewritten to
  state pricing hot-reloads while every other section saves the file
  and surfaces the restart banner.
- **E**: Indexing.Embeddings carried upbeat copy despite no Go
  consumer. Now labeled "Embeddings (experimental — not yet wired)"
  with honest help text per `[[feedback-honest-disable-copy]]`.
- **F**: pricing `about.behavior` had a duplicated stutter
  ("restart-on-save plumbing arrives next PR; restart-on-save
  plumbing arrives next PR") + stale next-PR claim. Trimmed both.

PUT round-trip smoke verified: Compression + Proxy bodies survive
the save unchanged.

**CI/CD pipeline overhaul (triple-layer gate):**

- **`.github/workflows/npm-release.yml`** refactored into 4 jobs:
  `frontend` (build once, upload `web/dist` artifact) → `build`
  matrix × 5 (download artifact, sync into embed dir, cross-compile
  observer; linux variants ALSO cross-compile
  `antigravity-bridge.exe`; upload whole `bin/` folder) → `publish`
  (download `bin/` artifacts, `cp -R` into npm dirs) → `release`
  (create GitHub Release on private repo, body extracted from
  `CHANGELOG.md` via `awk`). Workflow now requires
  `permissions: contents: write` for the Release step.
- **`.github/workflows/ci.yml`** NEW. Triggers on `pull_request` +
  push to `main`. Two parallel jobs: `frontend` (`npm ci` +
  `typecheck` + `build` + dist-consistency check — fails if the
  committed `webapp/dist` drifted from a fresh build) and `go`
  (`vet` + `test -race` + build observer + cross-compile bridge).
- **`scripts/release.sh`** new `preflight_checks()` runs inside
  `cmd_tag` before tagging: `npm run typecheck` + `npm run build` +
  dist-consistency check + `go vet` + `go build` smoke +
  `GOOS=windows` bridge cross-compile smoke + `CHANGELOG.md
  ## [<version>] —` section assertion. Any failure exits BEFORE the
  tag is created, so the npm-release workflow never fires on a known-
  broken state.

Same dist-consistency check at all three layers
(release.sh preflight → ci.yml on push → npm-release.yml on tag).

**WSL2 / Antigravity adapter:** `@superbased/observer-linux-x64`
and `@superbased/observer-linux-arm64` npm packages now bundle
`antigravity-bridge.exe` alongside the observer binary —
`locateBridgeBinary` finds it via `filepath.Dir(exe)` lookup. No
clone, no `make build` needed for the Antigravity adapter on WSL2.

**Docs:**

- **`docs/release-runbook.md`** new "Build pipeline at a glance"
  section with full ASCII diagram of the 4-stage flow. "Releasing a
  new version" updated to walk through the preflight gate. Three
  new troubleshooting entries for the new failure modes (drifted
  dist / typecheck fail / missing CHANGELOG section).
- **`docs/developer.md`** NEW (248 lines). Developer guide covering
  the two-tier stack, prerequisites, Go-only vs React-contributor
  dev loops, every `make` target, running tests, coding standards,
  project layout, both CI workflows, releasing TL;DR, memory entries
  that influence dev workflow.
- **`README.md`** "Build from source" rewritten for the React/TS/
  Vite dual-stack (mentions `web/`, `make web-build`, Node 22 LTS);
  new "CI gates" subsection summarizing both workflows.
  Self-contained — no internal `docs/*` links that would 404 on the
  public repo.

**Surviving from v1.6.0:** two pre-existing dashboard test failures
(`TestAPITimeseriesActions`, `TestAPITools`) — fail on baseline too,
not introduced by this work. Worth investigating eventually.

## [1.6.0] — 2026-05-17

### Dashboard — Lane A + 6 rounds of Lane B operator feedback + DB-API perf sweep + Sessions Calendar fix

v1.6.0 builds on the v1.5.0 React dashboard cutover with four feature
items (Lane A), six rounds of operator feedback (Lane B / Rounds L–Q),
four DB-API performance fixes covering the longest-running endpoints,
and one Sessions Calendar day-click bug fix. Build state at tag:
`npm run typecheck` + `make web-build` + `make build` + `go vet ./...`
all clean; all 10 dashboard routes return 200; new endpoints smoke-
tested green.

**Lane A — finish prior-handover §2a + §2c (4 items):**

- **Sessions Filters drawer** (`web/src/pages/sessions/FiltersDrawer.tsx`).
  Slide-over with model multi-select + cost-range + actions-range +
  duration buckets + sidechain toggle + reliability filter. Versioned
  localStorage persistence (`sb:sessions:filters:v1`). Active-chip
  strip above the table + count badge on the toolbar button.
- **Antigravity bridge download link** — `make build` now ships
  `bin/antigravity-bridge.exe` (8.5 MB). The `AntigravityHelperCard`
  HEAD-probes `/api/admin/antigravity-bridge.exe` on mount and renders
  a green "Download .exe" CTA when present, warn copy ("rebuild
  observer with `make build`") when missing.
- **FilterBar `ComboChip` popover** (`web/src/components/primitives/ComboChip.tsx`).
  Filter-chip + portal-positioned combobox replaces native `<select>`
  for Tool + Project filters. Type-to-filter input, ↑↓+Enter+Esc
  keyboard navigation, click-outside dismiss.
- **⌘K command palette** (`web/src/components/CommandPalette.tsx`).
  Portal modal with 3 sections (Jump-to / Recent sessions / Recent
  actions), shared keyboard cursor, ⌘K-toggles-from-anywhere
  (handler at the App level).

**Lane B — 6 rounds of operator feedback on top of v1.5.0:**

- **Round L (initial fresh-feedback sweep)** — 11 items: Sessions
  Calendar honors the global Window (sourced from
  `/api/sessions/calendar`); Models cell uses provider-tinted
  `ModelDot` swatch + bare " + N" mono text (replacing the bordered
  pill); per-tool distinctive `ToolGlyph` glyphs (nested arcs for
  claude-code, `>_` for codex, 4-point sparkle for gemini, two linked
  circles for cowork, arrow for cursor, etc., ported from
  `design/provider-icons.jsx`) wrapped in a `ToolGlyphFrame` (18% bg /
  35% border); `DataTable` accepts a `loading` prop that drives an
  indeterminate top stripe + "Loading…" empty-state swap; Actions
  Target / Content column widths tightened to eliminate horizontal
  scroll; new `HeroStat` primitive (wide hero KPI tile, 1.4fr in xl
  grid, accent / danger / warn variants) swap-in on Compression
  ("Total compression savings", accent) + Discovery ("Estimated
  waste — last 30 days", danger); new `DensityBar` primitive (multi-
  segment bar with capacity rail) in Discovery's Reads Density column;
  Settings parity — icon + EDIT/READ-ONLY group polish on the section
  nav.
- **Round M (Calendar 7-day cap + Timeline single-dot fixes)** — new
  backend endpoints `/api/sessions/calendar` and `/api/actions/day-counts`
  so per-day rollups span the full configured Window (not the
  paginated page-50 slice). `/api/actions` accepts `from_date` /
  `to_date` (YYYY-MM-DD prefix against `substr(a.timestamp, 1, 10)`)
  so the Timeline day strip can scope per-day fetches. `HEAD` method
  added to `/api/admin/antigravity-bridge.exe` for the helper card's
  liveness probe.
- **Round N (Timeline rebuild attempt 1)** — horizontal day strip on
  top, entry cards below. Superseded in Round O.
- **Round O (Timeline final — vertical rail)** — Actions Timeline view
  redesigned around the design's Event-Log shape: `TimelineDayAxis`
  (horizontal day-chip strip, density-bar height per day, "All" reset
  chip) over `VerticalTimeline` rendered as a 3-column flex per row:
  timestamp (HH:MM:SS / Mon DD) | continuous 16-px rail with per-row
  colored dot marker (action-type color, danger ring on failure;
  first/last row line capped at the dot) | `EventLogCard`
  (ToolBadge + raw_tool_name + ActionTypeBadge + #id, target on the
  right, body FTS5 excerpt OR target fallback, footer status pill +
  effort + permission + source filename + session deep-link).
- **Round P (pagination + loading-on-day-switch)** — `<Pagination />`
  rendered below the vertical Event Log; busy days like Apr 23
  (2,275 actions) and May 15 (4,173 actions) walk through
  `TIMELINE_LIMIT=500` chunks. Stale-data fix:
  `rows={loading ? [] : data?.rows ?? []}` swaps the body to the
  loading skeleton during the in-flight refetch when `pickedDay`
  changes. Page resets to 1 on day pick.
- **Round Q (default-to-today + live-tail scoped)** — Timeline picks
  today on first entry, guarded by a `useRef` so a follow-up "All"
  click isn't clobbered by the same effect re-firing. "Loading
  forever" root-cause fix: live-tail interval ticks `tailNonce` every
  5 s, which sits in the actions useApi dep array; each tick aborted
  the in-flight Timeline fetch faster than the network round-trip
  could resolve. Live-tail now suppressed when `view === "timeline"`.

**DB-API performance sweep (operator complaint: messages table slow):**

- **`/api/session/<id>/messages` 136.2 s → 0.13 s (1048× on the largest
  1772-action session)**. Root cause: `LEFT JOIN action_excerpts ae ON
  ae.action_id = a.id` against the FTS5 virtual table, whose
  `action_id` column is declared `UNINDEXED`. SQLite has no b-tree on
  it, so each outer row triggered a full virtual-table SCAN. Fix: drop
  the LEFT JOIN; add a single batch `SELECT … FROM action_excerpts
  WHERE action_id IN (?, ?, …)` after the main row query via new
  `loadActionExcerpts(ctx, db, ids, maxBytes)` helper. One ~50 ms scan
  per request regardless of |ids|.
- **`/api/actions?limit=500` 38.1 s → 0.09 s (423×)**. Same FTS5
  UNINDEXED root cause via the correlated subquery inside the SELECT
  list. Same batch-load fix using the shared helper.
- **`/api/discover` 15.1 s → 0.52 s (30×)**. `discover.repeatedCommands`
  was an N+1+M anti-pattern: for each of up to 500 outer rows it ran a
  query to fetch run timestamps then **another** `SELECT COUNT(*) FROM
  actions WHERE action_type IN ('edit_file','write_file') AND …` per
  consecutive run pair. Replaced with one
  `LAG() OVER (PARTITION BY session_id, target, project_id ORDER BY
  timestamp) + NOT EXISTS` CTE in new `noChangeRerunCounts`. The dead
  `countNoChangeReruns` is removed.
- **`/api/sessions?limit=20` 0.63 s → 0.02 s (30× default page; 14× at
  limit=50; 3× at limit=200)**. `handleSessions` called
  `CostEngine.Summary` with `Days: 365`, no session filter, and
  `Limit: 100_000` — loading every row from `api_turns` + `token_usage`
  (~71 k rows here) into Go and rolling them up just to attach token
  totals to the ≤500 sessions visible on the current page. New
  `cost.Options.SessionIDs` field is plumbed through all three loaders
  (`loadProxyRows` / `loadJSONLRows` / `loadSummaryCallRows`) as
  `AND session_id IN (?, ?, …)`. `handleSessions` passes the page's
  session IDs so the engine only scans the relevant subset.

### Fixed

- **Sessions Calendar day-click filters server-side**. Click on
  2026-04-16 in the Calendar previously did `setLocalQuery("2026-04-16")`
  and switched to Table view; the local substring filter then ran
  against the most-recent page-50 of sessions (none of which were
  from April 16) and produced a misleading "No sessions match" empty
  state for any picked day older than the loaded slice. `handleSessions`
  now accepts `from_date` / `to_date` (mirroring `/api/actions`'s
  Round-M shape). `Sessions.tsx` swaps the calendar click from a
  local-query mutation to a `pickedDay` state that the
  `/api/sessions` fetch URL consumes; the active-chip strip shows a
  clearable `day: <date>` chip; empty-state copy distinguishes
  picked-day-with-no-results from search-query-with-no-results.

### Build, release, docs

- Build state at tag: `npm run typecheck` + `make web-build` +
  `make build` + `go vet ./...` all clean. All 10 dashboard routes
  return 200 on the embedded webapp. New endpoints (`/api/sessions/calendar`,
  `/api/actions/day-counts`, `HEAD /api/admin/antigravity-bridge.exe`,
  `/api/actions?from_date=&to_date=`, `/api/sessions?from_date=&to_date=`)
  return green data on a 81 k-action / 499-session real DB.

## [1.5.0] — 2026-05-16

### Dashboard — React/TS/Vite rewrite + design-parity + operator-feedback sweep

The dashboard is now a React + TypeScript + Vite + Tailwind app served
at `/` (the legacy vanilla SPA was retired in Phase 8). v1.5.0 marks
the major version bump for the cutover, alongside two rounds of
design-parity work and three rounds of operator-feedback systemic
fixes. Build state at tag: `npm run typecheck` + `make web-build` +
`make build` + `go vet ./...` all clean; all 10 dashboard routes
return 200.

**Backend additions (Go) — new endpoints + per-row enrichments:**

- `GET /api/analysis/cost-by-dow-hour` — 168-cell (7×24) aggregator
  for the "When you spend" 2D heatmap on the Analysis tab.
- `GET /api/patterns/timeseries` — per-day pattern reinforcements,
  segmented by `pattern_type`. Drives the Patterns "discovery over
  time" stacked bars.
- `GET /api/compression/by-model` — per-model × mechanism rollup of
  compression savings ($, bytes, events, est-tokens). Drives the
  Compression "Per-model breakdown" table.
- `POST /api/suggest` (preview) + `POST /api/suggest/write` — wrap the
  existing `internal/intelligence/suggest` package so the Patterns
  tab can render + persist `CLAUDE.md` / `AGENTS.md` / `.cursorrules`
  from the dashboard.
- `GET /api/sessions` — adds a `models` field per row (api_turns ∪
  token_usage GROUP BY session_id, model, ordered by turn count desc)
  so the Sessions Models col can render a primary chip + `+N`.
- `GET /api/actions` — adds `source_file`, `source_event_id`, and a
  280-char excerpt from the FTS5 `action_excerpts` table per row.
- `PUT /api/config/section/<id>` already existed; now wired
  end-to-end with a fully editable form on the frontend.

**Dashboard — design-parity passes (A–G) + operator-feedback (H–K):**

- New primitives: `PageHeader`, `IdLink`, `Toggle`, `CopyOnClick` (portal
  toast); `StatCard` extended with `icon`, `loading`, `cornerPill`,
  `linkTo`, `deltaPrior`, default + accent + warn gradient overlays,
  sparkline absolutely-positioned bottom-right. Sparkline now centers
  flat data instead of pinning the line to the bottom edge.
- Charts: gradient fills on CostArea / ActionsArea / CacheSavings /
  TokensByDay (Recharts linearGradient defs). New `DowHourHeatmap`
  component with log-scaled accent saturation + scale legend +
  fixed-height hover readout (no height jump on hover).
- Sessions: complete rewrite with cols matching design (no API$/Tool$
  cols; split surfaces in the Total$ tooltip), Models col live,
  Calendar view restyled with gradient cells + header summary + scale
  legend, Calendar day-click filters Table view to that day.
- SessionDetailPanel: 1400px wide (96vw cap), 4-tile KPI band with
  CostStat splitting API + Tool below the headline total, vibrant
  donut for action breakdown, Token Buckets with per-bucket help +
  share %, 14-col messages table with message IDs / per-message
  cache reads/writes/output/tools/API$/Tool$/Total$, expanded tool
  calls fully copyable (no truncation), pagination on the messages
  table (25/page).
- Settings: structured form per section (legacy `SECTION_FIELDS`
  parity restored), Compression rendered as 7 sub-groups (CodeGraph /
  Shell / Indexing / Conversation / Stash / Rolling / Compaction).
  Save POSTs the section, surfaces success / error / restart-required
  banner. Antigravity Windows-bridge helper card preserved.
- Patterns: real-data per-day distribution chart, `edit_test_pair`
  flow card layout, Generate / Preview / Write live against the
  `/api/suggest` family (respects the global Project filter).
- Analysis: 12 KPI tiles with icons + sparklines (Spend → daily cost,
  MTD → cumulative, Cache Savings → savings_usd from
  cache-savings-trend). "When you spend" is now the 2D dow×hour
  heatmap from the design.
- Actions: Effort col, live-tail indicator + pause button, active
  filter chip strip, Source + Content cols.
- Tools: % / count mix-mode toggle on ActionMixPanel; shared legend.
- Compression: SetupBanner with expandable Claude + Codex detail
  toggles + "Configure now" link; CompressionByModelTable mount.
- Discovery: single-tone density + frequency bars (was 2-tone
  overlay); CopyOnClick on file paths + commands.
- Global CSS: themed scrollbars (both axes) via
  `::-webkit-scrollbar*` + Firefox `scrollbar-color`; themed `<select>`
  + `<option>` so dropdown panels inherit dashboard tokens
  (eliminates white-on-white in dark mode).
- StatCard `loading` state propagated to every KPI tile across
  Overview / Cost / Analysis / Compression / Discovery / Tools so
  refetches visibly pulse the affected cards.

**v1.4.51 → v1.4.53 backend batch (included in this bump):**

- v1.4.51: per-session token + cost split (Input / Cache R / Cache W
  / Output + 3-way API$/Tool$/Total$ cost) on `/api/sessions`.
- v1.4.52: codex audit batch (web_search billing, reasoning tokens,
  rate limits, reasoning rows, `--codex-rescan` umbrella).
- v1.4.53: Claude Cowork adapter (capture, parser, normalization,
  cost-reconciliation endpoint), claudecode JSONL CRLF + empty-line
  cursor parity (#52/#53), foreign-OS path translation through
  `git.Resolve` (#54), `enabled_adapters` drift warning (#51),
  reasoning-tokens billing fix (output rate, LC-tier-aware).

**Compatibility:**

- The `/v2/` bookmark path is preserved via SPA index fallback —
  legacy bookmarks resolve to the same React route.
- All public API shapes either extended (new optional fields) or
  unchanged. The `/api/analysis/cost-by-hour` legacy endpoint is
  still served alongside the new `/api/analysis/cost-by-dow-hour`
  in case external consumers depend on it.

## [1.4.53] — 2026-05-15

### Added — Claude Cowork adapter (M0–M3)

User-driven workstream: capture Claude Cowork session data into
Observer's normalized schema. Cowork is Anthropic's "knowledge-work"
desktop product layered on top of Claude Code's CLI session model; on
Windows MSIX installs it stores per-local-instance audit logs at
`%LOCALAPPDATA%\Packages\Claude_*\LocalCache\Roaming\Claude\local-agent-mode-sessions\<cowork-uuid>\<device-uuid>\local_<instance>\audit.jsonl`
(macOS: `~/Library/Application Support/Claude/...`). Each local-
instance is one Observer session; `audit.jsonl` carries the canonical
user / assistant / system / tool_use_summary / rate_limit_event /
result records, plus the inner Claude Code session's rich usage
envelope (5m/1h cache-creation split, service_tier, inference_geo).

Full schema reference, design rationale, and per-task checklist in
`docs/plans/cowork-adapter-plan.md`.

**M0 — Capture-only adapter:**

- New tool constant `models.ToolCowork = "cowork"`.
- 8 new `omitempty` fields on `ActionMetadata`:
  `CoworkProcessName`, `CoworkTitle`, `HostLoopMode` (sidecar-derived),
  `ServiceTier`, `InferenceGeo`, `CacheCreate5mTok`, `CacheCreate1hTok`
  (per-usage), `TotalCostUSD` (per-result, Cowork-authoritative).
- New `internal/adapter/cowork/` package: streaming audit.jsonl parser
  with `pending` map for tool_use ↔ tool_result pairing and
  msg.id-based dedup for streaming usage.
- Sidecar (`<device-uuid>/local_<id>.json`) loaded once per parse;
  fields lifted onto every event's `Metadata`. Project root resolves
  from `userSelectedFolders[0]` → `cwd` → "".
- 19-name `actionMap` covering Cowork's Claude-Code-derived tool
  surface. `Skill` + `mcp__*` fall through to `ActionUnknown` with raw
  name preserved.
- Identity: one Observer session per `local_<instance-uuid>/` dir.
  Pinned by `TestParseSessionFile_SessionIDIsLocalInstance` — the
  audit-internal `session_id` is observed varying within one file
  (sub-agent dispatch resets it); local-instance UUID is the stable
  anchor.
- Registered in `internal/adapter/defaults/defaults.go` + added to
  `EnabledAdapters` default in `internal/config/config.go::Default()`.
  v1.4.51 invariant tests
  (`TestAllAdapters_IsSessionFile_RequiresUnderWatchRoots` +
  `TestRegistryRootsNonOverlapping`) extend automatically; both pass.
- Reflection invariant `TestActionMetadata_IsZeroCoversEveryField`
  added (closes Invariant #50 follow-up — guarantees every new
  `ActionMetadata` field is covered by `IsZero` or the column
  marshals to non-NULL `{}` on sparse rows).

**M1 — Cross-platform paths + auto-detect:**

- `WatchPaths` uses `crossmount.AllHomes()` for WSL2 ↔ Windows
  bridging (same model as the codex adapter). Per-OS expansion in
  `candidateRoots`:
  - Windows MSIX: glob `<home>/AppData/Local/Packages/Claude_*/LocalCache/Roaming/Claude/local-agent-mode-sessions`
    (handles MSIX-hash rotation).
  - Windows non-MSIX: `<home>/AppData/Roaming/Claude/local-agent-mode-sessions`
  - macOS: `<home>/Library/Application Support/Claude/local-agent-mode-sessions`
  - Linux: skip — no known Cowork install path.
- `cowork.IsNativeTool` wired into the watcher's `NativePredicate`
  map in `buildWatcherWithOverride`, so `actions.is_native_tool` is
  set on cowork rows.
- Auto-registration is inherited from inclusion in the default set
  + `EnabledAdapters` — no manual `observer init` step needed.

**M2 — Rich metadata + sub-agent IsSidechain:**

- `tool_use_summary` records join to their matching `tool_use` action
  via `preceding_tool_use_ids[0]`; summary text lands on
  `Metadata.CoworkToolSummary`. Live data: 297 attachments.
- `rate_limit_event` records emit `ActionRateLimit` rows (new action
  constant) with 4 new typed metadata fields:
  `RateLimitStatus`, `RateLimitType`, `RateLimitResetsAt`,
  `RateLimitOverageStatus`. Generic naming so the codex 0.130+
  rate_limits workstream can reuse the schema. Live data: 53 rows
  including out-of-credits cases.
- Sub-agent `IsSidechain` cross-reference: `collectSidechainUUIDs`
  walks `<instance>/.claude/projects/**/subagents/agent-*.jsonl`
  once per parse, builds a set of assistant uuids, and the
  audit.jsonl handlers flag `IsSidechain=true` when `rec.UUID`
  matches. Resolves the §6 verification open question (audit.jsonl
  covers sub-agent rows but lacks the `isSidechain` flag — we
  back-fill from the inner transcripts). Live data: 64 of 898
  actions flagged sidechain.

**M3 — Cost reconciliation:**

- New `GET /api/cowork/reconcile` dashboard endpoint surfaces
  per-session Cowork-authoritative cost (`result.total_cost_usd`)
  vs Observer-derived cost (from `token_usage` × pricing-table)
  with absolute and percentage drift. Rows over 5% threshold are
  flagged. Unknown models surface as `unknown_model=true`.
- Live smoke against maintainer's install: 8 cowork sessions
  reconciled, all 8 over 5% threshold. Observer under-counts
  Cowork's claimed cost by ~21% systemically ($44.17 Cowork vs
  $34.70 derived). Real pricing-drift signal — the tile does its
  job; whether the gap is pricing-table stale vs Cowork-includes-
  overhead is for the operator to investigate.

**Tests added (32 new, all pass):**

- `internal/models/models_test.go`: 1 (reflection invariant; 22 sub-cases)
- `internal/adapter/cowork/adapter_test.go`: 10
- `internal/adapter/cowork/m2_test.go`: 4
- `internal/adapter/cowork/paths_test.go`: 5
- `internal/intelligence/dashboard/cowork_reconcile_test.go`: 5
- `internal/adapter/defaults/defaults_test.go`: cowork sub-cases pin
  the v1.4.51 dispatch-contract invariants automatically.

**Live smoke** (`/tmp/cowork-smoke-*/`) against maintainer's real
Cowork install (12 audit.jsonl files): 845–898 actions + 12 sessions
+ 3 models (opus-4-6 heavy, sonnet-4-6, haiku-4-5) ingested cleanly.
0 parse errors.

**Files touched (v1.4.53):**

- `internal/models/models.go` — `ToolCowork`, `ActionRateLimit`, 13 new `ActionMetadata` fields, `IsZero` extended
- `internal/models/models_test.go` (new) — `IsZeroCoversEveryField`
- `internal/adapter/cowork/{doc,adapter,adapter_test,m2_test,paths_test}.go` (new package)
- `testdata/cowork/cowork-aaaa/dev-bbbb/...` (new fixtures incl. subagent)
- `internal/adapter/defaults/defaults.go` + `defaults_test.go` — register cowork + fixture entry
- `internal/config/config.go` — add `"cowork"` to `EnabledAdapters`
- `cmd/observer/main.go` — import cowork + `NativePredicate` entry
- `internal/intelligence/dashboard/cowork_reconcile.go` (new) — endpoint + math
- `internal/intelligence/dashboard/cowork_reconcile_test.go` (new)
- `internal/intelligence/dashboard/dashboard.go` — route registration
- `docs/plans/cowork-adapter-plan.md` (new) — comprehensive plan + checklists
- `docs/cowork-adapter.md` (new) — operator-facing reference
- `CHANGELOG.md` + `PROGRESS.md`

### Fixed — Post-ship bug classes surfaced against live data (collectively v1.4.54)

The M0–M3 implementation landed cleanly but the operator's iteration
against the live install surfaced four bug classes plus a cost-drift
investigation that produced a fifth fix. All folded into the v1.4.53
release.

**Cowork reconciliation tile not wired into the dashboard.** M3 added
the `/api/cowork/reconcile` endpoint but didn't surface it in the UI.
Added a "Cowork — cost reconciliation" panel inside the Cost tab in
`internal/intelligence/dashboard/static/index.html`. Renders only when
`sessions_total > 0`; hides on fresh installs.

**`enabled_adapters` existing-config drift (Invariant #51).** Adding
`"cowork"` to `config.Default()` is a no-op for users with an explicit
`enabled_adapters` list set by an earlier release — Default() only
applies when the key is absent. Documented one-liner in
`docs/cowork-adapter.md`'s Recovery section. Long-term fix candidate
(startup warning on missing-from-allow-list defaults) deferred to a
future release.

**CRLF byte accounting + empty-line cursor stall (Invariants #52, #53).**
Cowork's Windows-side audit.jsonl writer uses CRLF line endings.
`bufio.Scanner` strips `\r\n` from the returned token; pairing it with
`lineBytes = len(raw) + 1` undercounted CRLF lines by 1 byte each.
Plus: an empty trailing line (`\n` byte read when resuming from
`cursor = file_size - 1`) hit `if len(raw) == 0 { continue }` BEFORE
updating `res.NewOffset`. Combined effect: cursor stalled at
`file_size - 1`, watcher poll fired forever on every cowork audit
file. Fix: switched from `bufio.Scanner` to `bufio.Reader.ReadString('\n')`
(preserves the full terminator) AND moved `res.NewOffset = bytesRead`
to fire on every complete line (only partial trailing lines hold back).
Three regression tests in `internal/adapter/cowork/crlf_test.go`.

**Foreign-path → `git.Resolve` CWD-leak (Invariant #54, mirrors codex
v1.4.28 fix exactly).** Sidecars carrying `userSelectedFolders =
["C:\\..."]` passed Windows paths directly to `git.Resolve`. On Linux,
`filepath.Abs` treats Windows paths as relative, prepends observer's
CWD, and `findGitRoot` walks up to find observer's own `.git` — 6 of
12 cowork sessions misattributed to `/home/marmutapp/superbased-observer`.
Fix: delegate to `crossmount.TranslateForeignPath` (translates
`C:\foo` → `/mnt/c/foo` on WSL2) AND `os.Stat`-gate the result before
calling `git.Resolve`. New `cowork.ProjectAttribution` exported helper.
Project-less sessions whose `cwd` points inside Cowork's own storage
tree now synthesize `/sessions/<processName>` matching Cowork's
non-host-loop convention (Invariant #55). Two new regression tests.

**Backfill ergonomics.** Two new flags so the operator can fix
existing rows without a full `--all` rescan:

- `--cowork-rescan` — fast cowork-only rescan (12 audit.jsonl files,
  seconds). Equivalent to `observer scan --force --adapter cowork`
  but discoverable via the dashboard Backfill UI.
- `--cowork-project-root` — re-attribute existing rows by re-running
  `cowork.ProjectAttribution` on each local_*/audit.jsonl and
  UPDATEing sessions + actions on mismatch. Modeled on
  `backfillCodexProjectRoot`. Bundled into `--all`.

### Fixed — Token ingest from result.modelUsage (closes 21% cost drift)

**Cost-drift investigation findings (drops live reconciliation drift
from 21.4% → 2.5%).** The maintainer's live install showed Cowork
reporting $44.17 across 8 sessions vs Observer-derived $34.70 (21.4%
drift). Read-only investigation
(`docs/cowork-cost-drift-investigation-2026-05-15.md`) decomposed the
drift into three causes:

1. **Streaming-snapshot stale `output_tokens`** in audit.jsonl
   assistant rows — most records carry `stop_reason: null` and
   `output_tokens=0`. For f70e7c7a (sonnet-only): Observer's
   audit-derived sum = 4,339 output tokens; Cowork's
   `result.modelUsage` says 102,371 (23.6× under-count). Inner
   Claude-Code transcript agrees with audit — Cowork bills from the
   SDK's ApiTracker which sees `message_stop`, not the audit log.
2. **Haiku shadow cost** — 6 of 8 sessions have
   `claude-haiku-4-5-20251001` token consumption in
   `result.modelUsage` with **zero corresponding assistant rows** in
   audit.jsonl. Cowork dispatches background haiku work outside the
   transcript stream (7b03e00c: 517,928 input tokens of haiku
   invisible to assistant-row ingest).
3. **Sonnet-4-6 pricing-rate delta** — Cowork's per-token cost for
   `claude-sonnet-4-6` is a consistent 1.67× Observer's pricing-table
   rates. Opus-4-6 matches exactly (1.00×). Hypothesis: Cowork
   mis-routes sonnet-4-6 to the opus-4-6 rate card (since 5/3 =
   1.667). Cannot be verified without Anthropic billing dashboard
   ground truth — left as Phase 2.

**Fix (Phase 1):** Switched cowork adapter token ingest from
per-assistant-row `message.usage` to per-result `result.modelUsage`.
Closes causes #1 and #2 in one move:

- `internal/adapter/cowork/adapter.go::handleAssistant` no longer
  emits TokenEvents (kept content parsing for assistant_text /
  tool_use / sidechain attribution).
- `internal/adapter/cowork/adapter.go::handleResult` now emits one
  `TokenEvent` per `(result.uuid, model)` from `rec.ModelUsage`.
  `SourceEventID = result.uuid + ":" + model` for stable resume;
  `MessageID = "result:" + result.uuid + ":" + model`. Reliability
  bumped from `ReliabilityUnreliable` to `ReliabilityAccurate` since
  modelUsage is Cowork's authoritative source.
- 5m/1h cache-creation tier split derived per-result from the
  top-level `result.usage.cache_creation` ratio, applied uniformly to
  each model's `cacheCreationInputTokens`. Approximate (the tier
  split is per-final-turn, not per-batch) but matches Cowork's own
  accounting for opus-4-6 within rounding.
- New struct `rawResultModelUsage` decodes the per-model breakdown.
  `rawRecord` extended with `TopUsage *rawUsage` and
  `ModelUsage map[string]rawResultModelUsage` (populated only on
  result records).

**Live verification:** After re-backfill via
`bin/observer backfill --cowork-rescan`, the reconciliation tile drift
drops from 21.4% to 2.5% across the maintainer's 8 cost-claiming
sessions. Action count unchanged (898 — UNIQUE index kept idempotent);
token_usage rows replaced (508 stale per-assistant rows → 56
modelUsage-derived rows across 8 sessions × 3 models, with
previously-invisible haiku now properly accounted).

**Tests:** Two new tests in `internal/adapter/cowork/adapter_test.go`:
- `TestParseSessionFile_ModelUsageEmitsTokenEventPerModel` — pins
  one TokenEvent per (result.uuid, model), including a haiku entry
  with zero corresponding assistant rows (the shadow-cost case).
- `TestParseSessionFile_AssistantRowsDoNotEmitTokenEvents` — pins
  that an assistant-only audit.jsonl (no result record) emits zero
  TokenEvents but ToolEvents are unaffected.

`TestParseSessionFile_CacheCreationSplit` updated to assert against
the opus TokenEvent (looked up by Model name, since sort-by-name
puts haiku first now). Fixture `audit.jsonl` extended: result record
now carries `usage` (with cache_creation tier split) and `modelUsage`
(opus + haiku entries summing to the existing total_cost_usd=0.0125).

### Fixed — Phase 2: web_search billing in cost engine (closes haiku 1.4-1.5× residual)

**Phase 2 outcome** (cross-checked against Anthropic's authoritative
2026-05-15 pricing supplied by the operator): Observer's pricing
table is verified correct per Anthropic. The residual 2.5% drift
after Phase 1 decomposes into THREE Cowork-side billing
inaccuracies reproducible to penny precision:

1. Cowork bills `claude-sonnet-4-6` token traffic at `claude-opus-4-6`
   rates (5/3 = 1.667× the correct sonnet rate). Verified penny-perfect
   on every sonnet result record: f70e7c7a result#1 $0.527 = opus-rates
   $0.5274; result#4 $4.7001 = opus-rates $4.7001 exact.
2. Cowork bills opus `cache_creation` at the $6.25/M (5m) rate
   regardless of stored ephemeral tier — even for the 100%-1h-tier
   sessions where Anthropic's invoice should apply $10/M. 7b03e00c
   has 628,137 1h-tier opus cw tokens; Cowork's $14.68 = `cw × 6.25`,
   real Anthropic bill = $17.03.
3. Server-side web_search ($10/1000 calls) was not modeled in
   Observer's cost engine at all — captured as Phase 2 work.

**Phase 2 fix scope (foundational cost-engine update, benefits all
adapters):**

- Migration `018_web_search_requests.sql` — new INTEGER column
  `web_search_requests` on `token_usage` and `api_turns`.
- `models.TokenEvent.WebSearchRequests` and `models.APITurn.WebSearchRequests`
  fields added.
- `cost.Pricing.WebSearchPerRequest float64` — flat per-request fee
  ($/call, NOT $/1M-tokens) separate from the existing per-token
  rate fields. No LC tier (LC repricing applies only to token
  rates).
- `cost.TokenBundle.WebSearchRequests int64` + accumulator support.
- `cost.Compute()` adds `b.WebSearchRequests × p.WebSearchPerRequest`
  to the total.
- Default pricing entries for Anthropic 4.x models
  (`claude-opus-4-{5,6,7}`, `claude-sonnet-4-{5,6}`, `claude-haiku-4-{4,5}`)
  populated with `WebSearchPerRequest: 0.01`.
- `store.InsertTokenEvents` + `store.InsertAPITurn` write the new
  column.
- Cowork adapter `handleResult` emits `WebSearchRequests` from
  `rec.ModelUsage[model].WebSearchRequests`.
- `cowork_reconcile.go` updated to SUM `web_search_requests` into
  the TokenBundle so the engine's per-request fee applies in the
  reconciliation tile's derived cost.

**Tests:**

- New `TestCompute_WebSearchPerRequest` in `internal/intelligence/cost/`
  pins the flat per-request math (no /1M scaling), the combined
  tokens+web-search calculation, and the zero-rate fallback for
  non-Anthropic entries.
- New `TestParseSessionFile_ModelUsageEmitsWebSearchRequests` in
  `internal/adapter/cowork/` pins haiku's WebSearchRequests=3
  emission from modelUsage (with the opus entry's
  WebSearchRequests=0 confirming no cross-model bleed).
- `TestParseSessionFile_ResultCarriesTotalCost` updated for the
  fixture's new total_cost_usd=0.0425 (was 0.0125; bumped by +$0.03
  for 3 web searches × $0.01 to keep the fixture internally
  consistent).

**Live verification:** After Phase 2 backfill, 42 web_search_requests
captured across 2 sessions (5afdac1e: 11; 7b03e00c: 31) — exactly
matching what Cowork's `modelUsage.webSearchRequests` reports. 3bb5ea14
(28 WebSearch action rows) and ee3ab099 (16 action rows) report
`modelUsage.webSearchRequests=0` despite the tool calls — these are
SDK-internal / cached web searches that didn't hit Anthropic's
billed endpoint, so they correctly don't appear in cost.

**Final reconciliation tile state:** 21.4% (pre-fix) → 2.53% (after
Phase 1, token ingest from modelUsage) → 3.48% (after Phase 2,
web_search added). The slight Phase-2 drift INCREASE is intentional:
Observer now correctly applies Anthropic's $10/1000 web_search fee,
which Cowork's modelUsage already includes — the net change is the
proper attribution of that fee in Observer's derived cost. The
remaining +3.48% drift is now cleanly partitioned into two
diagnostic signals (Cowork's two billing bugs), per-session
direction varying based on opus-vs-sonnet token mix.

**What Phase 2 explicitly does NOT do:**

- No patch to `claude-sonnet-4-6` or `claude-opus-4-6` base rates
  in `pricing.go`. Observer's table is verified correct against
  Anthropic's authoritative pricing. The residual drift IS the
  Cowork bug, surfaced exactly as the reconciliation tile is
  designed to do.
- No `inference_geo` 1.1× data-residency multiplier (worth adding
  for codex/antigravity traffic that DOES set `inference_geo: "us"`,
  but irrelevant for current cowork dataset which has
  `inference_geo: ""`).
- No fast-mode 6× detection (Opus 4.6/4.7 beta), no Managed Agents
  $0.08/hour metering — deferred until use cases land.

See `docs/cowork-cost-drift-investigation-2026-05-15.md` for the
full verified-against-truth analysis and the per-result penny-perfect
reverse-engineering.

### Fixed — claudecode adapter CRLF + empty-line cursor stall (Invariants #52/#53 preempt)

Mirrors the cowork v1.4.54 fix shape proactively onto the claudecode
adapter before it bites on a Windows-side / cross-mount claudecode
transcript. Same bug class as the cowork case:

- `bufio.NewScanner(f)` + `lineBytes := int64(len(raw) + 1)`
  undercounted CRLF lines by 1 byte each, stranding the cursor
  short of EOF and causing the watcher to repoll the same range
  forever.
- `if len(raw) == 0 { continue }` skipped the
  `res.NewOffset = bytesRead` commit on empty trailing lines, same
  stall mode.

Fix: switched the parsing loop in
`internal/adapter/claudecode/adapter.go::ParseSessionFile` from
`bufio.NewScanner` to `bufio.Reader.ReadString('\n')` (preserves the
exact terminator length) and moved the `res.NewOffset = bytesRead`
commit so it fires on every complete line, including empty,
malformed, and unknown-type lines. Partial trailing lines (no `\n`,
EOF) are deferred to the next poll so the watcher doesn't read a
half-written record.

The 16 MiB `maxLine` cap is gone — `bufio.Reader.ReadString` grows
dynamically across buffer boundaries, so the previous cap is no
longer needed; trades a fixed buffer for transient allocation on
the rare giant tool-output line.

Removes the now-unused `errors` import. Existing claudecode tests
that built JSONL fixtures via `strings.Join(records, "\n")` (no
trailing newline) were updated to append `"\n"` — matches real
Claude Code transcripts on disk and pins the deferred-partial-line
contract.

Three new regression tests in
`internal/adapter/claudecode/crlf_test.go`:

- `TestParseSessionFile_CRLF_CursorReachesEOF` — CRLF body, asserts
  NewOffset == file size.
- `TestParseSessionFile_TrailingPartialLine_DoesNotAdvance` —
  pins the partial-line deferral.
- `TestParseSessionFile_TrailingEmptyLine_AdvancesPastIt` — pins
  the empty-trailing-line cursor advance.

Also updated `cmd/observer/backfill_test.go::TestBackfillClaudeCodeAPIErrors`
fixture to add the trailing newline so the api_error record on the
last line is processed by the v1.4.20 recovery pass under the new
parser contract.

### Fixed — Codex web_search billing + rate_limits + reasoning capture (provider-normalization parity with cowork)

Operator-driven audit of live session
`019e2bb0-6042-7571-962b-f03b9303653a` (gpt-5.5, 1 user turn, 9
web_search_end events, 10 reasoning items, 2 token_count events
carrying rate_limits) surfaced three coverage gaps in the codex
adapter that the cowork Phase 2 work had already addressed for
Anthropic. All three are closed in this batch — codex now sits at
the same provider-normalization level as cowork for web_search
billing, rate-limit snapshots, and reasoning visibility.

**1. Web search billing wired through the cost engine.**
`internal/adapter/codex/adapter.go` gains a session-scoped
`runningWebSearchCount int64` that increments on every
`event_msg/web_search_end` and flushes onto the next non-dedup
`event_msg/token_count`'s `TokenEvent.WebSearchRequests`, where the
cost engine then applies `Pricing.WebSearchPerRequest` as a flat
per-call fee (Invariant #57 mechanics, mirroring cowork). Counter
resets after each flush so adjacent turns attribute their searches
independently. Live verification on the maintainer's install: 9
web searches on the target session now flow through to
`token_usage.web_search_requests=9`, lifting derived cost from
$0.445 → $0.670 (Δ = 9 × $0.025 = $0.225 of previously-invisible
search billing). 13 web_search billable calls captured across 2
sessions globally.

`internal/intelligence/cost/pricing.go` adds
`WebSearchPerRequest: 0.01` to every gpt-5 family entry,
matching Anthropic's flat rate. Operator-confirmed against
OpenAI's published 2026-05-15 rate card: **$10 per 1k calls**
($0.01/call). "Search content tokens are free" per the same
card — no separate token billing layer; the flat per-call fee
is the entire web-search charge. Initial commit used $0.025
(speculation against a tiered-by-search_context_size pricing
model that turned out not to apply); corrected based on the
authoritative rate.

**2. token_count.rate_limits emitted as ActionRateLimit rows.**
Codex 0.130+ embeds a `rate_limits.{primary,secondary,plan_type,rate_limit_reached_type}`
envelope on every `event_msg/token_count`, INCLUDING the startup
one where `info: null` (so the snapshot fires before any usage
exists). New `buildCodexRateLimitEvent` maps the envelope into the
generic schema cowork introduced (`RateLimitStatus` from
`rate_limit_reached_type` or "ok"; `RateLimitType` from
`limit_id`; `RateLimitResetsAt` from `primary.resets_at`;
`RateLimitOverageStatus` from `plan_type`) and stores the full
envelope verbatim in `RawToolInput` so the dashboard can render
both windows without losing the secondary one. Stable
`source_event_id` (`ratelimit:<file>:L<linenum>`) keeps re-parses
idempotent. Live: 843 codex rate_limit rows materialized across
the live install (2 on the target session).

**3. response_item.reasoning rows visible in the action stream.**
Codex Desktop emits one `response_item.reasoning` per turn
component carrying `encrypted_content` (opaque) plus a `summary[]`
array that's empty in every 2026-05 build inspected. Pre-fix the
adapter folded these into the per-turn `agentMessages` cache for
`PrecedingReasoning` propagation but never surfaced them in
actions — operators saw "10 reasoning items happened" only via
the rollout file, not the dashboard timeline. v1.4.53 keeps the
agentMessages threading AND emits one `codex.reasoning` ToolEvent
per reasoning block (ActionTaskComplete + `RawToolName=codex.reasoning`).
Summary text lands in `Target`/`ToolOutput` when present;
empty-summary items show `"(encrypted reasoning, N bytes)"` so
the reasoning's existence is visible even when content is
unrecoverable. Live: 746 codex.reasoning rows materialized
globally (10 on the target session).

**4. `observer backfill --codex-rescan` umbrella flag.** Models on
`--cowork-rescan`: fast codex-only `Rescan` that re-walks every
codex rollout from offset 0, picking up all three additions on
historical rows. Bundled into `--all`. Surfaces in the dashboard
Backfill settings table.

**5. `token_usage` ON CONFLICT extended to backfill
`web_search_requests`.** The existing `ON CONFLICT(source_file,
source_event_id) DO UPDATE` clause only refreshed `model`. A
rescan that re-emitted the same `tk:<file>:L<linenum>`
source_event_id with a newly-populated `WebSearchRequests`
therefore got dropped silently. Extended the clause to set
`web_search_requests` from the excluded row when (a) the excluded
value is non-zero AND (b) the existing value is zero/NULL. Other
token columns stay untouched (they don't change across rescans
under stable source_event_ids). Without this fix `--codex-rescan`
would correctly insert new rate_limit / reasoning rows but leave
the existing token_usage row's web_search_requests at 0 — caught
by live-verification on the target session.

**6. Cost engine SQL pulls the new column on both paths.**
`internal/intelligence/cost/summary.go::loadJSONLRows` and
`loadProxyRows` now SELECT and Scan `web_search_requests` into
`TokenBundle.WebSearchRequests` so per-session/per-model/per-day
cost rollups see the billing. Without this `bin/observer cost` /
the dashboard Cost tab would render the same $0.445 as before
the fix even with the DB column populated. `isNoiseRow` also
updated so a token row carrying only web_search_requests (no
input/output/cache tokens) is no longer dropped as zero-token
noise.

**Tests added:**

- `TestParseRolloutWebSearchCountAttribution` — pins 3 web searches
  in one turn flow through to `TokenEvent.WebSearchRequests=3`.
- `TestParseRolloutWebSearchCountResetsAcrossTokenCounts` — pins
  counter reset between adjacent turn flushes.
- `TestParseRolloutRateLimitsCapturedFromTokenCount` — pins
  startup (`info: null`) + end-of-turn rate_limits both emit
  ActionRateLimit rows, with the full envelope in
  `RawToolInput`.
- `TestParseRolloutReasoningEmptySummaryEmitsPlaceholderRow` —
  pins the encrypted-only reasoning case (the 100% shape today)
  emits a row with the byte-count proxy in `Target`.
- `TestParseRolloutResponseItemReasoning` updated for the new
  dual-row shape (codex.reasoning + the downstream
  exec_command_end that inherits PrecedingReasoning).

**Files (this batch):**

- `internal/adapter/codex/adapter.go` — runningWebSearchCount +
  TokenEvent flush on both token_count paths;
  `rate_limits` struct + `parseModernRateLimits` +
  `buildCodexRateLimitEvent`; response_item.reasoning emits row
  via new `buildCodexReasoningEvent`; new `webSearchRawInput`
  helper serializes `action.queries[]` fan-out as JSON into
  RawToolInput (3-4 sub-queries per top-level call, previously
  collapsed to just the top-level Query string).
- `internal/intelligence/cost/pricing.go` — WebSearchPerRequest
  $0.025 on all gpt-5 family entries.
- `internal/intelligence/cost/summary.go` — SELECT + Scan
  web_search_requests on JSONL + proxy paths; isNoiseRow update.
- `internal/intelligence/dashboard/dashboard.go` +
  `analysis.go` — 5 CTE/SELECT/Scan sites updated to pull
  `web_search_requests` into `TokenBundle.WebSearchRequests`
  (`handleSessionDetail`, `handleCostHC`, `handleCacheSavings`,
  `handleAnalysisSessions`, `handleAnalysisCacheSavingsTrend`).
  Without this, per-session/per-day cost rollups would still
  render the pre-fix $0.4452 even with the DB column populated.
- `internal/store/store.go` — token_usage ON CONFLICT backfills
  `web_search_requests`; actions ON CONFLICT refreshes
  `raw_tool_input` when (a) existing is empty or (b) excluded
  payload is strictly longer (length heuristic; rescan-richer
  payloads win, accidental-truncation regressions don't).
- `cmd/observer/backfill.go` — `--codex-rescan` flag, bundled into
  `--all`.
- `internal/intelligence/dashboard/backfill_run.go` +
  `settings.go` — dashboard wiring for the new mode.

### Fixed — Reasoning tokens are now billed (closes a systemic under-charge across every reasoning-capable model)

Operator-driven follow-up audit surfaced a foundational cost-engine
gap that the v1.4.53 web_search work didn't touch: **`TokenBundle`
had no `Reasoning` field** and **`Compute()` never multiplied
reasoning_tokens by the output rate**. Both OpenAI (o1/o3/o4/gpt-5
`reasoning_output_tokens`) and Anthropic (extended-thinking output
portion) bill reasoning at the standard output rate, but Observer
was systematically dropping that line from every per-session,
per-model, and per-day cost rollup. For the target session
`019e2bb0` that's $0.045 missing (1496 tokens × $30/1M); across the
maintainer's 24 reasoning-bearing codex sessions it's **$6.53 of
previously-uncharged spend (217,618 reasoning tokens)**.

**Cost engine:**
- `cost.TokenBundle.Reasoning int64` field added (with `Add()` accumulator).
- `Compute()` now adds `b.Reasoning × rates.Output / 1e6` to the
  total, AFTER LC-tier dispatch — reasoning is part of the model's
  output stream, so the LC-tier output rate applies when prompt
  size crosses the threshold.
- New `TestCompute_ReasoningTokensBilledAtOutputRate` pins the
  reasoning-only, combined-with-tokens, and LC-tier-dispatch
  shapes. Default rate is "billed at p.Output" — no per-model
  pricing-table change needed (reasoning ≡ output across providers).

**SQL paths plumbed end-to-end:**
- `cost/summary.go::loadJSONLRows` SELECTs `reasoning_tokens` from
  `token_usage` into `TokenBundle.Reasoning`; `isNoiseRow` updated
  so a reasoning-only row isn't dropped as zero-token noise.
- `cost/summary.go::loadProxyRows`: no change — `api_turns` has no
  `reasoning_tokens` column (the proxy already folds reasoning into
  `output_tokens` at capture, so the existing math is correct).
- `dashboard/dashboard.go::handleSessionDetail` +
  `handleSessionMessages` CTEs add `0 AS reasoning_tokens` for the
  api_turns arm and `reasoning_tokens` for the token_usage arm of
  the UNION ALL, with matching Scan slots.
- `dashboard/analysis.go` (5 CTE sites: headline, cost-hc,
  cache-savings, analysis-sessions×2, cache-savings-trend) all
  updated symmetrically.
- `dashboard/cowork_reconcile.go::SUM(reasoning_tokens)` so the
  reconciliation tile's derived-cost includes reasoning where
  cowork modelUsage reports it.

**Dashboard rendering:**
- New `Reasoning` column on the Cost-tab model breakdown table —
  always visible, blank cell for non-reasoning models.
- Session-detail token-bucket table conditionally appends a
  `Reasoning` row when the session total is non-zero (keeps
  non-reasoning sessions uncluttered).
- Session-detail per-model breakdown gains a `Reasoning` column
  (em-dash for models that didn't emit any).
- Per-message timeline row table gains a `Reasoning` column —
  this is the row the operator's screenshot showed missing the
  data. Tooltip explains OpenAI vs Anthropic billing semantics.

**Backend JSON:**
- `modelBucket` struct: `Reasoning int64 \`json:"reasoning,omitempty"\``.
- Session-detail `tokens` map: `"reasoning": totalReasoning`.
- `messageRow` struct (`/api/session/<id>/messages`):
  `Reasoning int64 \`json:"reasoning,omitempty"\``.

**Live verification on session 019e2bb0:**

| | input | output | cache_read | reasoning | web_search | cost |
|---|---|---|---|---|---|---|
| Pre-v1.4.53 | 71135 | 2738 | 14720 | 1496 (ignored) | 9 (ignored) | $0.4452 |
| Post web_search + reasoning fix | 71135 | 2738 | 14720 | 1496 ($0.0449) | 9 ($0.09 at $0.01/call) | **$0.5801** |

Per-row codex.reasoning rows continue to render as
`(encrypted reasoning, N bytes)` — per-row token attribution
would require buffering reasoning items until each token_count
flush and proportionally splitting by encrypted_content size, an
approximation whose accuracy isn't worth the complexity. Session
total is the authoritative number; visible in both the
per-message timeline row and the Reasoning column.

### Fixed — observer start warns when registered defaults are missing from `enabled_adapters` (Invariant #51 long-term fix)

Closes the v1.4.53 carryover for Invariant #51: `config.Default()`
only seeds `enabled_adapters` when the key is absent, so adding a
new adapter to the registered defaults is silently a no-op for any
user whose `config.toml` pins an explicit allow-list from a prior
release. (The cowork rollout surfaced this — the new adapter
registered, watched paths existed, but the allow-list filter
dropped every event.)

`buildWatcherWithOverride` in `cmd/observer/main.go` now compares
the registered defaults against the user's explicit
`enabled_adapters` list and emits a single WARN per startup naming
each missing tool, plus the exact append-this-string remediation
the user can paste into their `config.toml`'s
`[observer.watch] enabled_adapters`. Silent when the allow-list is
empty (fresh installs let `Default()` populate the full set) or
when every registered default is already present. Skipped on the
`--adapter <name>` override path (where filtering is the user's
intent).

New helper `warnMissingDefaultsFromAllowList` is independently
tested via `cmd/observer/missing_adapter_warning_test.go` with 5
cases pinning the empty-allow-list silence, full-match silence,
single-missing emission, multi-missing emission, and extra-unknown-
tool silence shapes.

### Fixed — Antigravity reasoning_output_tokens captured (1.3.1.17.2.9, Gemini-only)

Operator-driven path-inventory dig surfaced a coverage gap in the
antigravity adapter parallel to the codex/cost-engine reasoning
fix above: `ParseStructuredTrajectory` was mapping
**`1.3.1.17.2.3 → OutputTokens`** but that field is the **total
output (response + reasoning) on Gemini sessions**, not response-
only. Reasoning was being absorbed into OutputTokens with no
separate attribution, so the new Reasoning column on the dashboard
read `0` for every antigravity row (8,787 rows total) even on
Gemini Pro / Flash sessions that emit thinking tokens.

**Empirical evidence** (`TestTokenRowDump` against 5 live sessions
covering Gemini Pro low/high, Gemini Flash, and Claude Sonnet 4.6
via the language_server gRPC bridge, 33 turns total):

| Path | Wire | Semantics | Verified |
|---|---|---|---|
| `1.3.1.17.2.1` | varint | input_tokens | already mapped |
| `1.3.1.17.2.2` | varint | cache_creation_input_tokens | already mapped |
| `1.3.1.17.2.3` | varint | **total** output = .9 + .10 | re-interpreted |
| `1.3.1.17.2.5` | varint | cache_read_input_tokens | already mapped |
| `1.3.1.17.2.6` | varint | constant per session (24 Gemini, 26 Claude) — header overhead, NOT a count | n/a |
| `1.3.1.17.2.9` | varint | **reasoning_output_tokens** (Gemini-only; field absent on Claude) | **NEW MAPPING** |
| `1.3.1.17.2.10` | varint | response_output_tokens (text-only); mirror of .3 on Claude | **NEW MAPPING** |

Universal invariant `.3 == .9 + .10` holds on every observed turn
across all 5 sessions / 33 turns. On Claude `.9` is absent → .10
== .3.

**Adapter change** (`internal/adapter/antigravity/structured.go`):

- `turnTokens` struct gains `reasoning uint64`.
- Walker's path-switch now reads `.10 → r.output` (was `.3`) and
  `.9 → r.reasoning`. `.3` is no longer mapped (it's the sum we
  reconstruct from .9 + .10).
- Empty-turn guard updated to consider `reasoning == 0` alongside
  the existing fields.
- TokenEvent emission gains `ReasoningTokens: int64(r.reasoning)`.
- Path-mapping comment block at the top of `ParseStructuredTrajectory`
  rewritten to document the empirical relationship.

**Cost preservation:** under the codex/cost-engine convention
(Invariant #58 — reasoning + output additive, both at output_rate),
cost = `OutputTokens × rate + ReasoningTokens × rate` =
`(.10 + .9) × rate` = `.3 × rate`. Total identical to the pre-fix
math; the breakdown is now visible.

**Tests:** existing synthetic test (`TestParseStructuredTrajectory_Synthetic`)
extended with reasoning assertions (turn 0 carries 12 reasoning,
turn 1 mirrors Claude with `.9` absent). `buildTurn` helper takes
a new `reasoning` arg; all 6 call sites updated. Live-bridge
acceptance test `TestStructuredReasoningTokenCapture` (gated on
`OBSERVER_AG_REASONING_TOKEN_CHECK=1`) asserts Gemini sessions
emit non-zero reasoning and Claude sessions zero.

**Live verification** (gRPC bridge, 5 sessions, all PASS):

| sid | model | turns | output | reasoning |
|---|---|---|---|---|
| 162c4ab9 | gemini-3.1-pro-low | 5 | 1728 | 2111 |
| ae703782 | gemini-3-flash-agent | 9 | 1632 | 2396 |
| 462469ee | claude-sonnet-4-6 | 4 | 1394 | 0 ✓ |
| da973a42 | gemini-pro-agent | 6 | 2063 | 3698 |
| fc8d44e5 | claude-sonnet-4-6 | 9 | 5431 | 0 ✓ |

**Backfill:** existing 8,787 antigravity rows have OutputTokens=.3
(includes reasoning) + ReasoningTokens=0. Total cost is unchanged
(`.3 × rate` either way), so no operator action is required for
billing correctness. To re-decompose for visibility:
`observer scan --force --adapter antigravity`. Idempotent via
`(source_file, source_event_id)` UNIQUE; refreshes both fields
under stable IDs.

**Invariant #63 (Antigravity output_tokens decomposition).**
`1.3.1.17.2.3` is the TOTAL output emission (response + reasoning);
`1.3.1.17.2.9` is the reasoning portion (Gemini-only); `1.3.1.17.2.10`
is the response-only portion. Adapter maps `.10 → OutputTokens`
and `.9 → ReasoningTokens` so cost = (output + reasoning) × output_rate
matches the pre-decomposition `.3 × output_rate` — codex convention
of reasoning+output additive, never subset.

**Cross-adapter reasoning-coverage sweep** (alongside the antigravity
fix): audited all 11 default adapters for reasoning_tokens capture.
Verdict — coverage is now complete:

| Adapter | Provider class | Reasoning capture |
|---|---|---|
| codex | OpenAI | ✓ (this batch — `reasoning_output_tokens`) |
| copilot | OpenAI | ✓ (pre-existing — `metadata.toolCallRounds[].thinking.tokens`) |
| opencode | provider-agnostic | ✓ (pre-existing — `msg.Tokens.Reasoning`) |
| gemini-cli | Gemini | ✓ (pre-existing — `thoughtsTokenCount`) |
| antigravity | Gemini + Claude | ✓ (this session — `1.3.1.17.2.9`) |
| claudecode | Anthropic | implicit — API folds thinking into `output_tokens` |
| cowork | Anthropic | implicit — `result.modelUsage.outputTokens` folded |
| cline | Anthropic | implicit — `usage.output_tokens` folded |
| openclaw | Anthropic | implicit — `tokenUsage.output` folded |
| pi | Anthropic | implicit — `tokenUsage.output` folded |
| cursor | hook-only | n/a — no token-row emission from adapter |

The five Anthropic-direct adapters have no `reasoning_tokens` field
in their on-disk usage envelopes because Anthropic's `/v1/messages`
API folds extended-thinking output into `output_tokens` (per
docs.anthropic.com as of 2026-05-15). Cost is correct without
separate capture: `output_tokens × output_rate` already prices
thinking. If Anthropic later splits the field (operator-confirmed
via API release notes), each adapter's `rawUsage` struct gains the
new field and the existing TokenEvent emission path lights up.

## [1.4.52] — 2026-05-14

### Added — Codex 0.130+ turn_context schema capture

User-driven audit of live session `019e22b1-84a6-7ea3-ad2c-3672aaf9268f`
(Codex Desktop 0.130.0-alpha.5 running on Windows, observer in WSL2,
post-v1.4.51 dispatch fix) verified ingestion was clean but surfaced
several new `turn_context` payload fields that observer was not
capturing. v1.4.52 wires four sticky-metadata fields plus a latency
metric onto `actions.metadata`:

| Field source | New `ActionMetadata` field | Type | Semantics |
|---|---|---|---|
| `turn_context.payload.collaboration_mode.mode` | `CollaborationMode` | string | `"default"` vs `"plan"` — Plan mode is read-only-thinking, materially different signal from edit-capable sessions |
| `turn_context.payload.personality` | `Personality` | string | Codex Desktop persona (e.g. `"friendly"`) — informs the base-instructions tone |
| `turn_context.payload.realtime_active` | `RealtimeActive` | bool | True while real-time/voice surface is active (rare today, future signal) |
| `turn_context.payload.truncation_policy.{mode,limit}` | `TruncationMode` + `TruncationLimit` | string + int | Per-turn truncation strategy + token budget — forensics for "why was this turn cut short?" |
| `event_msg.task_complete.time_to_first_token_ms` | `TimeToFirstTokenMS` | int | Gap between `task_started` and first streamed assistant token — separates model warmup + queue latency from total `duration_ms` |

Capture pattern matches the existing `EffortLevel` mechanism: per-turn
sticky values lifted onto `ctxState` from each `turn_context` line,
then stamped onto every action emitted in that turn via the
`withEffort` helper (now stamps the full metadata struct, not just
effort). All fields are `omitempty` — `ActionMetadata.IsZero` returns
true when every field is zero, so the store layer writes NULL instead
of `{}`, keeping the column dense.

**Pinned by:**

- `TestParseSessionFile_Codex0_130TurnContextMetadata` — full set
  appears on actions when present in turn_context.
- `TestParseSessionFile_Codex0_130StickyMetadataAcrossTurns` — turn_context
  with most fields omitted does NOT wipe sticky values from the prior
  turn (matches the `EffortLevel` sticky-then-overwrite contract).
- `TestParseSessionFile_Codex0_130TimeToFirstToken` — `task_complete`
  carries the new latency on `Metadata.TimeToFirstTokenMS`; existing
  `DurationMs` column unchanged.

### Deferred — `speed` toggle NOT in the rollout (Codex-side gap)

User asked whether Codex Desktop's new `speed` toggle (`standard` |
`fast`) could be captured. Empirically verified by flipping the
toggle mid-session on `019e22b1-…` and re-grepping the post-flip
turn (rollout grew from 44 → 53 lines): **no `speed`,
`priority`, `tier`, `latency`, or equivalent field appears anywhere
in the resulting JSONL** — not in `turn_context`, `session_meta`,
`task_started`, `task_complete`, `token_count.rate_limits`,
`agent_message`, or `event_msg`. The post-flip `turn_context` payload
has the exact same key set as pre-flip (only `turn_id` differs).
Conclusion: Codex 0.130.0-alpha.5 does not persist the speed setting
into the on-disk rollout. The toggle is presumably UI-side, resolving
to a server-side routing/queue-priority knob that never gets baked
into the client artifact. Tracked as deferred until Codex starts
emitting it; revisit when newer CLIs ship.

### Further-deferred surface (visible in 0.130+ but not yet captured)

Other new fields observed in `019e22b1-…` that are good capture
candidates for follow-on work but not in this release:

- `event_msg.token_count.rate_limits.{primary,secondary,credits,plan_type}`
  — primary/secondary rate-limit windows with `used_percent` +
  `resets_at`, plus credit balance and plan type. High-signal for
  quota-tracking; would naturally live on `token_usage.metadata` but
  needs schema work + dashboard surface.
- `event_msg.task_started.{started_at,model_context_window,collaboration_mode_kind}`
  — duplicates info already on other rows; `collaboration_mode_kind`
  cross-confirms our `turn_context.collaboration_mode.mode` capture.
- `event_msg.user_message.{images,local_images,text_elements}` —
  vision-input support landing in 0.130+. Currently the adapter
  captures only the text `message` field.
- `event_msg.agent_message.memory_citation` — memory references the
  model produced. Schema unverified; needs a session that actually
  uses memory.
- `response_item.reasoning` — reasoning blocks now appear as their
  own response_item type. Already partially captured for cost via
  `reasoning_output_tokens` on token_count; the body itself isn't
  ingested as an `assistant_text`-shaped action.

**Backfill note for existing codex rows:** the actions UPSERT
(`store.go:225-229`, same invariant the v1.4.50 antigravity tool_time
fix hit) only writes `metadata` when the prior value was NULL.
Sessions ingested before v1.4.52 froze with `{"effort_level":"…"}`
metadata and won't pick up the new fields just by re-running
`observer scan --force`. Verified on the maintainer's
`019e22b1-…` session: 18 pre-v1.4.52-rescan rows stayed at
`effort_only`, 3 fresh rows from the post-speed-flip turn got the
full new metadata.

To backfill existing codex rows, NULL the metadata first then rescan:

```bash
sqlite3 ~/.observer/observer.db \
  "UPDATE actions SET metadata = NULL WHERE tool = 'codex';"
observer scan --force --adapter codex
```

Sessions ingested after v1.4.52 install pick up rich metadata
automatically on first scan — no backfill needed.

**Files touched (v1.4.52):**

- `internal/models/models.go::ActionMetadata` — 5 new omitempty fields
- `internal/adapter/codex/adapter.go` — `sessionContext` + `turnContextPayload` + `taskComplete` struct extensions, `applyContext` sticky merge for new fields, `withEffort` extended to stamp full metadata, `buildTaskCompleteEvent` carries `TimeToFirstTokenMS`
- `internal/adapter/codex/adapter_test.go` — 3 new tests
- `CHANGELOG.md` + `PROGRESS.md`

## [1.4.51] — 2026-05-13

### Fixed — Watcher adapter misrouting silently strands Codex token rows under WSL2

User-reported and externally diagnosed: live Codex session
`019e222a-097b-7642-83a9-fb24c23419b3` ingested its leading
`session_meta` + early hook rows but the assistant turn's
`token_count` / `response_item` rows never landed in `token_usage` or
`api_turns`. The watcher log surfaced the smoking gun:

```
watcher.poll: caught up dropped writes adapter=claude-code
  path=C:\Users\marmu\.codex\sessions\...\rollout-...jsonl
```

— a Codex rollout file dispatched to **claude-code** by the poll
fallback.

**Root cause (architectural):** the watcher's poll fallback at
`internal/watcher/watcher.go::adapterFor` iterated
`registry.Detected(allow)` (alphabetical by `Adapter.Name()`) and
returned the first adapter whose `IsSessionFile` accepted the path.
Combined with three "broad" predicates that matched any `.jsonl`
regardless of location (claude-code, openclaw, pi), Codex's
`rollout-*.jsonl` matched **claude-code first** by sort order. The
claude-code parser walked every JSON line cleanly (Codex JSONL
unmarshals as valid JSON) so the cursor advanced to EOF, but none of
the Codex schema fields (`response_item`, `event_msg/token_count`,
`turn_context`) matched claude-code's record types, so **zero events
were emitted**. Subsequent polls saw `file_size == byte_offset` and
did nothing. Token + turn rows stranded until `observer scan --force`
re-walked from offset 0.

**Failure footprint:** any cursor row whose path matched a broad
predicate could misroute under the poll fallback. JSONL-only matches:
claude-code, openclaw, pi — all three would steal each other's
.jsonl files and any other adapter's .jsonl-shaped files. Codex was
the most exposed because its sessions live under WSL2/NTFS where
fsnotify drops are routine, so the poller fires constantly. Other
adapters share the same architectural risk on lossy filesystems.

**Fix — two layers, both load-bearing:**

1. **Dispatch layer (`internal/watcher/watcher.go::adapterFor`):**
   rewritten to use longest-watched-root prefix — the same
   `adapterForPath` rule fsnotify event dispatch has always used.
   Registry is still queried per call so dynamically-added adapters
   are picked up next tick. A defensive `IsSessionFile` sanity check
   was added to `pollCursors`: after root-prefix dispatch picks an
   adapter, the adapter's own predicate must also accept the file
   before processFile fires — catches the future case where a stray
   file is placed inside a watch root that the adapter shouldn't
   ingest.
2. **Predicate layer (every adapter's `IsSessionFile`):** all ten
   adapters (antigravity, claude-code, cline, codex, copilot, cursor,
   gemini-cli, opencode, openclaw, pi) now AND their shape filter
   with `adapter.UnderAnyWatchRoot(a.WatchPaths())`. Predicates
   self-limit to paths the adapter could actually own. Two new
   invariant tests in `internal/adapter/defaults/` enforce this:
   `TestAllAdapters_IsSessionFile_RequiresUnderWatchRoots` (rejects
   shape-correct paths outside watch roots) and
   `TestRegistryRootsNonOverlapping` (asserts no two adapters' watch
   roots prefix each other).

Either layer alone would fix the bug; both together make the
bug-class regression-proof. The regression test
`internal/watcher/multiadapter_test.go::TestPollerDispatchesByRoot_NotByShape`
registers both claude-code + codex adapters into one registry, drops
a Codex rollout file under the Codex root, and asserts the poller
dispatches to Codex. Fails on every pre-fix version.

**Operator-facing additions:**

- New CLI flag `observer scan --force --adapter <name>` scopes a
  recovery scan to one adapter without editing config. Recommended
  one-liner for users who installed any pre-v1.4.51 build:
  `observer scan --force --adapter codex` re-walks Codex sessions
  from offset 0, recovering any token rows the pre-fix poller routed
  to the wrong adapter.
- `/api/health/watcher` now surfaces a `suspected_misrouted` signal
  per `parse_cursors` row: cursor at EOF on a non-trivial file
  (>1 KB) AND zero rows in `actions` for that source_file. That's the
  pre-fix fingerprint claude-code produced when it silently "parsed"
  Codex JSONL — surface so operators can run the recovery one-liner
  before the recovery flow is forgotten.

**Future-proofing deferred (Option B in the audit):** persisting an
`adapter` column on `parse_cursors` so dispatch never depends on
WatchPaths at lookup time was considered. Deferred because today no
two adapters share an overlapping watch root — the
`TestRegistryRootsNonOverlapping` invariant guards future regressions.
If that invariant ever fails (e.g. a future adapter intentionally
shares a tree with another), the upgrade path is Option B: add the
column, write it from `processFile`, dispatch via
`registry.Get(c.Adapter)`. See `docs/dispatch-contract.md`.

**Affected paths:**

- `internal/adapter/match.go` (new) — `HasPathPrefix` + `UnderAnyWatchRoot` helpers
- `internal/adapter/defaults/defaults.go` (new) — production adapter set factored out of `cmd/observer/main.go`
- `internal/adapter/defaults/defaults_test.go` (new) — invariant tests
- `internal/adapter/{antigravity,claudecode,cline,codex,copilot,cursor,gemini,opencode,openclaw,pi}/adapter.go` (or `scan.go`) — IsSessionFile predicates tightened
- `internal/watcher/watcher.go::adapterFor` + `pollCursors` — root-prefix dispatch + defensive predicate check
- `internal/watcher/multiadapter_test.go` (new) — regression test
- `cmd/observer/main.go::newScanCmd` + `buildWatcherWithOverride` — `--adapter` flag
- `internal/intelligence/dashboard/health.go` — `suspected_misrouted` heuristic
- `docs/dispatch-contract.md` (new) — architectural rule and Option B upgrade path

## [1.4.50] — 2026-05-13

### Fixed — Antigravity tool_time inflation (32h on a single turn)

User-reported: Messages view on session `162c4ab9-…` showed a single
turn with `Tool time = 32h 18m` despite the session being only ~50s
long. Root cause: Antigravity's protobuf records snapshots of all
currently-active terminals on each AI turn. When one of those terminals
is a long-running background process (e.g. `codex` or `claude --resume`
left running across days), the adapter naively computed
`duration_ms = endSec − startSec` from the terminal's process lifetime
and attributed it as the AI's tool-call duration. For the user's
session, a `codex` terminal alive 32h before the session started turned
into `115,776,000 ms` of fake tool time.

Same shape applied to the step-to-next-step duration computation at
`structured.go:401-404`: when there's an idle gap between turns
(or when the parser sees stale pre-session steps), the gap inflated
every step's reported duration.

DB audit found **3,746h total** of bogus tool time across 157
antigravity rows >1h, plus an additional **9.8h** in pre-session rows
under the 1h threshold (157 + 1,917 = **2,074 rows** affected
overall).

Two-part fix:

- **Adapter** (`internal/adapter/antigravity/structured.go`): both
  duration computation sites now cap at 1h. Additionally, terminal
  durations are only emitted when `startSec >= session_start` (the
  terminal was spawned during the session, not before it).
- **One-shot SQL backfill** zeroes `duration_ms` on every antigravity
  action row that is either (a) `> 1h` or (b) timestamped before its
  parent session's `started_at`. Required because the action UPSERT
  path (`store.go:225-229`) only overrides `duration_ms` when the
  prior value was zero — re-scans alone wouldn't clean up the
  historical pollution.

Live verify: user's session 162c4ab9 now shows `tool_time = 11.0s` on
the previously-32h turn; all 7 messages sum to ~50s total, matching
the actual session wall-clock.

### Fixed — Antigravity: reasoning capture + final-summary capture restored across all models

User-reported gap: Antigravity IDE chat UI renders per-step reasoning
blocks ("**Prioritizing Tool Specificity**\n\nI'm focusing now on…")
between tool calls, but observer's DB captured none of them. The
`structured.plan_step` (1.2.93.x) and `structured.final_summary`
(1.2.94.x) emission cases in `internal/adapter/antigravity/structured.go`
were derived against a single Claude-Sonnet fixture (`FB48`) and fire
**zero hits on every current Antigravity session** — verified
empirically against four user sessions on 2026-05-12:

| Session | Model | reasoning rows (was) | reasoning rows (now) |
|---|---|---|---|
| `da973a42…` | gemini-pro-agent (Pro, high effort) | 0 | **5** |
| `fc8d44e5…` | claude-sonnet-4-6 | 0 | **1** |
| `162c4ab9…` | gemini-3.1-pro-low | 0 | **5** |
| `ae703782…` | gemini-3-flash-agent | 0 | **4** |

All four now also produce 1 `structured.final_summary` row each.

**Root cause:** Antigravity's protobuf schema moved between the
fixture and now. Reasoning bodies now live at **`1.2.20.3`** (sibling
of `1.2.20.1` assistant text on the same `PLANNER_RESPONSE` step) and
the final-summary envelope moved to **`1.2.30.{4,5,15}`** (title /
body / URI). The old paths return zero across 2.5MB of plaintext
across all four sessions.

**Discovery method:** new `path_inventory_test.go` walks every
protobuf wire path the language-server's `GetCascadeTrajectory`
endpoint returns and produces a `(path, wire_type, count, sample)`
catalog. Diffing across the four sessions identified the new path
layout. The probe is permanently in-tree but gated on
`OBSERVER_AG_PATH_INVENTORY=1` so it doesn't fire in CI.

**Code change:**

- `internal/adapter/antigravity/structured.go`: added `case pathEq(f.Path, 1, 2, 20, 3)`,
  `1, 2, 30, {4,5,15}` clauses; new `reasoningText` and
  `finalSummaryTitle` fields on `stepData`; new emission for
  `structured.reasoning` ToolEvent + revised `structured.final_summary`
  to prefer the explicit `1.2.30.4` title when present.
- Legacy `1.2.93.x` / `1.2.94.x` cases retained as fallback for any
  pre-rewrite session files that might still exist; commented as
  DEPRECATED.

**Not addressed in this change** (deferred):

- `reasoning_tokens` is still 0 across all sessions. The
  `digestTokenRow` (`classify.go:373`) read at `1.3[].17.2 sorted[3]`
  doesn't fire; likely the field renumbered or the gRPC trajectory
  strips it. Separate investigation.

### Fixed — Antigravity-internal model SKU pricing (3 bugs)

Antigravity encodes the model + effort selector into a single
identifier string. Two naming conventions co-exist:

- `<family>-agent` for default/high effort
- `<version>-<family>-<effort>` for explicit effort selection

Verified empirically across four sessions on 2026-05-12:

| Antigravity selection | Stored model string |
|---|---|
| Gemini 3.1 Pro — high | `gemini-pro-agent` |
| Gemini 3.1 Pro — low | `gemini-3.1-pro-low` |
| Gemini 3 Flash | `gemini-3-flash-agent` |
| Claude Sonnet 4 | `claude-sonnet-4-6` (clean) |

Pre-2026-05-13 pricing-table coverage:

| Model in DB | Lookup result | Effective behavior |
|---|---|---|
| `gemini-pro-agent` | `PricingSourceMiss` → $0 | ❌ silent zero |
| `gemini-3.1-pro-low` | `gemini-3.1` family → Pro rates | ✅ correct by accident |
| `gemini-3-flash-agent` | `gemini-3` family → **Pro rates** | ❌ ~4× overcharge (Pro $2/$12 vs Flash $0.50/$3) |
| `claude-sonnet-4-6` | `PricingSourceExact` | ✅ correct |

Added 8 explicit entries pinning each variant to `PricingSourceExact`:
`gemini-pro-agent`, `gemini-3.1-pro-{low,medium,high}` → Gemini 3.1 Pro
rates incl. 200K LC tier; `gemini-3-flash-{agent,low,medium,high}` →
Gemini 3 Flash rates (no LC tier). Pinned by
`TestTable_AntigravityInternalSKUs` so future table churn can't
silently re-break the alignment.

### Changed — Sessions table: per-bucket tokens + elapsed time

The Sessions tab's single "Tokens" column is replaced with the four
billable buckets shown separately — **Input · Cache R · Cache W ·
Output** — plus a new **Elapsed** column. The single-number column
collapsed the cache-reuse story; the split lets users see at a glance
which sessions are cache-anchored (Cache R ≫ Input) vs cache-burning
(Cache W ≫ Cache R) without opening the detail modal.

**Backend (`/api/sessions`):**

- New fields per row: `input_tokens`, `output_tokens`,
  `cache_read_tokens`, `cache_creation_tokens` (sourced from the cost
  engine's per-session rollup — same dedup as `/api/cost`).
- New fields: `last_seen_at` = `COALESCE(s.ended_at, MAX(actions.timestamp))`
  + `duration_seconds` = `last_seen_at − started_at`. Open sessions
  (no `ended_at`) still show in-flight elapsed time using the latest
  action.
- `total_tokens` is kept in the JSON for backwards compatibility with
  CLI / external callers; the Sessions table no longer renders it.

**Frontend:**

- Columns reordered: `ID · Tool · Project · Started · Elapsed ·
  Actions · Sub-agent · Input · Cache R · Cache W · Output · Cost`
  (+ Quality / Errors / Redundancy when `observer score` has run).
- New `fmtDuration(secs)` helper renders the two largest non-zero
  units ("19h 7m", "1d 4h", "35m 12s"). Zero / unknown renders as the
  muted em-dash to stay visually quiet.
- Each per-bucket cell falls back to the muted em-dash when that
  bucket is zero (e.g. Codex sessions emit no cache_creation tokens).

**Tests:** `TestAPISessions_AttachesTokensAndCost` extended to assert
the per-bucket fields and the zero-fallback for unused buckets. New
`TestAPISessions_DurationSecondsFromActions` pins the open-session
elapsed math (no `ended_at`, falls back to MAX(actions.timestamp)).

**Help-text:** 5 new column entries in `help.js` (Elapsed + the 4
token buckets); the old `col.sessions.tokens` entry marked deprecated
but retained for any callers still wiring `data-help="col.sessions.tokens"`.

### Changed — Analysis tab metric overhaul (audit-driven)

User-reported audit found that the v1.4.49-and-earlier "Effective rate"
tile was structurally misleading: dividing period cost by
(output + cache_write) treated paid-for setup overhead (cache writes)
as if they were value tokens, deflating the displayed rate when cache
churn was high. On the maintainer's live install the displayed rate was
$36.75/M against $211.55/M output-only — same data, very different
signal. A second finding: the "LC tier surcharge" tile silently
reported $0 for users on Anthropic Opus (which has no LC pricing tier),
hiding 18k+ heavy-context turns. A third: LC surcharge attribution
silently dropped to zero for any row with `recorded > 0` (proxy-priced
cost), with no user-facing disclosure.

This release retires the misleading tiles and adds cost-sensitive
replacements.

**Tiles retired:**

- `effective.rate_per_million` (output + cache_write denominator)
- `long_context.turns / surcharge_usd` (no high-context signal when
  models lack LC tier)

**Tiles added (all in `/api/analysis/headline`):**

- **`$/M output`** (`output_rate.rate_per_million`) — clean per-token-
  of-value rate. Period cost ÷ output tokens × 1M. Unambiguous; matches
  industry convention.
- **`Cache savings $`** (`cache_savings.usd`) — counterfactual: per-
  turn `Compute(p, {Input += CacheRead, CacheRead = 0}) − Compute(p, b)`,
  summed. The dollar value of cache_read traffic vs uncached input
  pricing. Pairs with the existing efficacy % tile.
- **`High-context turns`** (`high_context.turns_over_100k / 200k /
  cost_over_*_usd / lc_eligible_turns / lc_surcharge_usd`) — model-
  agnostic turn counts at 100K and 200K prompt-window thresholds + the
  $ attributable to those turns. LC surcharge becomes a sub-line that
  fires only when LC-eligible models (Sonnet 4 / 4.5 / Gemini Pro /
  GPT-5.4/5.5) actually crossed their threshold.
- **`$ per turn (p95)`** (`per_turn.count / mean_usd / p95_usd`) —
  variance signal across all costed turns. p95 is the headline; mean
  is the sub-line.
- **`Burn rate $/hr`** (`burn_rate.active_hours / cost_per_hour_usd`)
  — period cost ÷ distinct (date, hour) buckets with traffic. The
  user's hourly AI bill while engaged.
- **`Top model`** (`top_model.key / cost_usd / concentration_pct`) —
  single model with the most $ + concentration as a % of period total.
  One-glance attribution.

**Tile changed:**

- **`Month-to-date`** gains `prior_month_same_day_usd` +
  `vs_prior_month_pct` as the primary sub-line. Linear projection
  drops to a secondary reference. Prior-month-same-day is a more honest
  comparison than extrapolation: on day 12 of May, it compares MTD
  against April 1–12, not against an assumption that today's daily
  rate continues.
- **`Period`** gains `recorded_cost_share_pct` disclosure (B3 fix) —
  the share of period cost that came from upstream-recorded values.
  When >5%, the dashboard renders a small note below the tile grid
  explaining that LC surcharge / cache savings may under-report on
  those rows. Quiet when share is low.

**New endpoints:**

- **`/api/analysis/cost-by-hour?days=N`** — 24 fixed buckets (0..23
  UTC) with cost + turn count per hour-of-day. Powers the "When you
  spend" bar chart in the new Analysis-tab panel.
- **`/api/analysis/cache-savings-trend?days=N`** — daily cache savings
  $ across the window. Same counterfactual as the headline tile but
  per-day. Recorded-cost rows are excluded since they can't be
  decomposed. Powers the "Cache savings trend" line chart.

**Frontend:**

- Analysis tab card grid expanded from 6 → 10 tiles.
- Two new chart panels added under the daily-trend chart: cost-by-hour
  (bar) + cache-savings-trend (line).
- Full set of `help.js` registry entries added for every new + revised
  tile and chart — pre-v1.4.50 the tile help-keys were `data-help`-
  attributed but had no registry entries, so hover popovers were empty.

**Performance:**

- Headline endpoint no longer calls `discover.New().Run()` (which
  walked stale-reads + repeated-commands + cross-tool-files + native-
  vs-bash). New `discover.WastedTokens(ctx, opts)` helper runs only
  the stale-reads pass — the only one the headline needed. Other passes
  weren't expensive but were wasted work on every tab load.

**Audit summary** (full detail in
`docs/handover-v1.4.50-analysis-metrics-2026-05-12.md`):

| Finding | Resolution |
|---|---|
| B1 — "Effective rate" denominator includes cache_write overhead | Tile retired; replaced with $/M output + Cache savings $ |
| B2 — LC surcharge always $0 for Opus-only users despite 18k+ heavy turns | Tile retired; replaced with model-agnostic High-context turns + LC sub-line for LC-eligible models |
| B3 — LC surcharge silently $0 when recorded cost present | Disclosed via `period.recorded_cost_share_pct` |
| B4 — `tile.analysis.*` help-keys had no registry entries | All entries added to help.js |
| B5 — Discovery walked actions table on every headline hit | Lighter `discover.WastedTokens` helper added |

**Tests:** 11 new tests in `analysis_test.go` covering output_rate,
cache_savings, high_context turns + LC surcharge, opus model-agnostic
high-context, per_turn distribution, burn_rate hour buckets, top_model
concentration, prior_month_same_day, recorded_cost_share, plus 4 tests
for the two new endpoints. Pre-existing `TestAnalysisHeadline_LCSurchargeAttribution`
rewritten as `TestAnalysisHeadline_HighContextAndLCSurcharge` —
asserts both the new high_context counts AND that LC surcharge still
fires for LC-eligible models (regression coverage for the half that
survived the refactor).

## [1.4.49] — 2026-05-12

### Fixed — Dashboard backfill subprocess timeout raised to 2h

The dashboard's "Run all" backfill kicker (`/api/backfill/run` with
`mode=all`) wraps the spawned `observer backfill --all` subprocess in
a `context.WithTimeout` that hard-kills the child at the cap. The
original 30-min cap got blown on the maintainer's 67k-action /
51k-action_excerpts DB during v1.4.49 dogfood: `--all` does a full
Rescan from offset 0 + 15 surgical backfills in sequence, which
exceeded 30 min before completing the rescan phase.

Raised to **2h** and extracted into the named constant
`backfillJobTimeout` in `internal/intelligence/dashboard/backfill_run.go`.
Surgical individual modes (`message-id`, `cursor-subagents`, etc.)
finish in single-digit minutes, so the new cap only bites on `--all`
against heavy installs.

The new v1.4.49 assistant-text emission adds ~25s of indexer work for
~4k new rows — negligible by itself, but it nudged the prior just-
under-30m run past the boundary, surfacing the inadequate cap.

Diagnosis-by-elimination: pre-checking
`store.go::InsertActions::InsertActions` line 304-328 confirmed that
the FTS5 indexer only fires on NEWLY-inserted rows (UPSERT no-op rows
leave `a.ID == 0`, and `indexOutputs` skips ID==0 rows). So the per-
row indexer cost is bounded by NEW rows per backfill, not by re-
processed rows. The real wall-clock dominator on `--all` is the
rescan's per-file UPSERT loop across years of session JSONL.

### Added — Cross-adapter assistant-text capture batch (8 adapters)

The "what did the AI say to the user?" question now has a first-class
answer across every adapter that has the data. Before this batch only
Antigravity (the precedent) and Pi emitted standalone assistant-text
rows; the rest captured assistant text only as PrecedingReasoning on
sibling tool events. This batch wires per-emission assistant-text rows
in seven additional places + adds a dashboard filter to surface them.

**Convention decisions (binding for future adapters):**

- **`ActionType = ActionTaskComplete`** for all new assistant-text rows.
  Mirrors the Antigravity precedent and Pi's existing pattern. A single
  turn can legitimately produce multiple ActionTaskComplete rows (one
  per assistant message); the RawToolName discriminates intent.
- **`RawToolName = "<source>.assistant_text"`** for new wirings.
  Legacy precedents (Pi's `message.assistant.<stopReason>`, Copilot's
  `agent_response`, Antigravity's `structured.assistant_text`,
  OpenClaw's `message.assistant.stop`) are **kept as-is** to avoid
  SourceEventID dedup churn on existing rows. The dashboard surface
  uses a multi-pattern OR-chain.
- **No token/cost fields on assistant-text ToolEvents.** Token usage
  flows through the dedicated `TokenEvent` path. Tests pin this
  invariant for every wiring (the `ToolEvent` struct doesn't expose
  token fields, so the type system enforces it).
- **Per-emission granularity.** Codex emits one row per
  `event_msg.agent_message` line. Cline/Roo emit one per text content
  block on a role=assistant message. Claudecode JSONL same. Cursor
  same (from the transcript-walking path). Gemini same. OpenCode emits
  one per text part in the `part` table where parent is
  role=assistant. OpenClaw emits one per `type:"text"` content
  alongside the existing `message.assistant.stop` marker.
- **MessageID strategy:** prefer the native upstream id (msg_xxx,
  turn_id, generation_id, message-row-id) where available; fall back
  to a content hash so re-parses dedupe via the (source_file,
  source_event_id) UPSERT path.

**Adapter wiring (with file:line):**

- **Codex JSONL** — `internal/adapter/codex/adapter.go::buildAgentMessageEvent`
  + new emission inside `case "agent_message"` (adapter.go:823-840).
  Wrapped in `withEffort` so per-turn `effort_level` rides the row.
  4 new tests covering field shape, no-TokenEvent, L-num stability,
  multi-message turn IDs.
- **Cline / Roo Code** — `internal/adapter/cline/adapter.go::assistantTextEvent`
  + new `case "text"` in the content-block switch. `RawToolName`
  uses `toolID + ".assistant_text"` so cline → `cline.assistant_text`
  and roo-code → `roo-code.assistant_text`. 2 new tests + existing
  fixture-driven test bumped 3→4.
- **Claude Code JSONL** — `internal/adapter/claudecode/adapter.go::assistantTextEvent`
  + emission in the existing `case "text"` for role=assistant. Synthetic-
  model (`<synthetic>`) compaction placeholder rows correctly continue
  to be filtered out by the existing pre-emit gate at adapter.go:367.
  1 new test + 3 existing fixture tests rebalanced to account for
  the new emissions.
- **Claude Code Stop hook** — pre-v1.4.49 the dispatch fell through
  to the generic approve-reply path so the assistant's final-message
  text was lost. Added `case "stop"` to `cmd/observer/hook.go::run`
  + new `buildClaudeStopEvent` (cmd/observer/hook.go) mirroring
  SubagentStop's pattern. Empty-message suppression returns
  (zero, false). 3 new tests + existing `TestBuildClaudeAllRejectMissingSessionID`
  extended.
- **OpenCode** — new `loadAssistantTextEvents` + `assistantTextEvent`
  in `internal/adapter/opencode/adapter.go` query the `part` table
  for type=text parts whose parent `message` is role=assistant.
  Complements the existing `assistant.stop` lifecycle marker.
  1 new test seeding an opencode SQLite DB with multiple assistant
  text parts.
- **Gemini CLI** — new emission inside `internal/adapter/gemini/parser.go::emitMessage`
  + `assistantTextEvent` builder. Both the legacy JSON format and the
  JSONL spec proposed in issue #15292 benefit since both share the
  `emitMessage` orchestrator. 1 new test.
- **Cursor (transcript walker)** — new emission inside
  `internal/adapter/cursor/adapter.go::buildTranscriptToolEvents`
  covering both the live Stop hook's transcript replay AND the
  historical `backfillCursorSubagents` path (sidechain rows inherit
  `IsSidechain=true` via the existing wrapping at
  cmd/observer/backfill.go:3592). 5 existing tests rebalanced for
  the new emissions and content-block ordering.
- **OpenClaw** — per-text-part emission inside
  `internal/adapter/openclaw/adapter.go::parseMessageLine`'s
  `case "assistant":` block, not gated on `stopReason`. The existing
  `message.assistant.stop` row stays as the lifecycle marker. 2
  existing tests rebalanced; new emission covers mid-turn text parts
  on tool_use-stopping turns that previously produced no observability
  row.

### Added — Dashboard "AI messages only" filter

`/api/actions` accepts `assistant_text=1` to filter on a multi-pattern
RawToolName OR-chain covering the 8 new `<source>.assistant_text`
conventions + the 4 legacy precedents (`structured.assistant_text`,
`message.assistant.*`, `agent_response`). The Actions tab toolbar
gains an "AI messages only" checkbox wired to this filter. Backend +
frontend test coverage in `dashboard_test.go::TestAPIActions_AssistantTextFilter`
(8 seeded rows × 4 filter combos).

### Audit-subagent verdicts revised

Three Tier 3 tasks the initial audit flagged as "blocked on upstream
schema" or "scope unclear" turned out to be unblocked under live code
inspection. Each shipped code, not doc-only:

- **Gemini** — subagent claimed adapter was "skeletal, no message
  parsing." Verified false: `emitMessage` handles user / gemini /
  model / assistant / tool roles end-to-end. Wired per-text-part
  emission.
- **Cursor** — subagent claimed "no hook event carries the model's
  final response." Verified false: `BuildStopTranscriptEvents`
  already walks the transcript JSONL on the `stop` hook (crossmount-
  translated WSL paths). Wired per-text-part emission in the
  transcript walker.
- **OpenClaw** — subagent claimed "schema doesn't store assistant
  responses." Verified false: openclaw's JSONL has assistant-role
  messages with text/thinking/toolCall content. The existing
  `message.assistant.stop` emission only fired on `stopReason=stop`;
  added per-text-part emission for the other stop reasons.

Lesson reaffirmed (invariant 36-ish): "Trust empirical capture >
local docs > inherited claims." Subagent code reads excerpts; full
file reads catch what the excerpts missed.

### Fixed — Codex JSONL SourceEventID stable across re-parses (L-num bug)

Surfaced by the 2026-05-11 backfill: `observer scan --force`
created 17 duplicate codex rows in the maintainer's DB instead of
upserting via the (source_file, source_event_id) UNIQUE key.
Affected `user_prompt`, `task_complete`, `system_prompt`, and any
event using the `:L<lineNum>:` SourceEventID format (15 builders
in the codex JSONL adapter).

**Root cause:** `ParseSessionFile` initialized `lineNum := 0` at the
start of every invocation. On incremental watcher resume
(`fromOffset > 0`), the scanner read from the seek position and
counted from 1 starting at the RESUME line — making lineNum
*chunk-relative* on resume but *absolute* on rescan. Same file →
different lineNum → different SourceEventID → ON CONFLICT didn't
match → INSERT created a duplicate.

Concrete observation: a "what files are in /tmp?" prompt at
file-line 7 was tagged `L2` by the watcher (chunk-relative, the
prompt was 2nd line of the resumed chunk) and `L7` by the rescan
(absolute). Two rows for one prompt.

**Fix:** `prefetchSessionContext` already scanned every line from
offset 0 to fromOffset to recover SessionID/Cwd/Model/EffortLevel.
It now ALSO counts those lines and returns the count. `ParseSessionFile`
seeds `lineNum` from that count, so resumed parses continue from
the same absolute line number a full-file rescan would compute.

The signature of `prefetchSessionContext` changed from
`(sessionContext, bool)` to `(sessionContext, int, bool)` (added
lineNum count). Single caller updated.

Pinned by new `TestParseSessionFile_SourceEventIDStableAcrossResume`
which writes a header section + a user_prompt at file-line 6, parses
once from offset 0 and once from offset-past-header, and asserts
the SourceEventID matches.

**Affected event types** (15 SourceEventID builders that embed
`:L<lineNum>:`): `user_prompt`, `task_complete`, `system_prompt`,
`compacted`, `mcp`, `error`, `web`, `view_image`, `patch`, plus
the call_id-fallback paths in exec_command_end, function_call_end,
function_call_output, etc. All now produce stable IDs across
re-parses.

### Fixed — Codex JSONL effort_level survives watcher cycles

The v1.4.47 sticky-effort invariant (#33) held within a single
`ParseSessionFile` invocation but silently broke whenever the
watcher's incremental ingest split a session across multiple parse
cycles. Surfaced on 2026-05-11 when 3 codex sessions on the
maintainer's host showed `reasoning_effort: "medium"` in the
JSONL but observer captured `effort_level=NULL` on every emitted
ToolEvent.

**Two-part root cause:**
1. `mergeSessionContext` copied SessionID/TurnID/Model/Cwd/GitBranch
   but NOT EffortLevel. Even when `prefetchSessionContext` correctly
   read the leading `turn_context` line on resume, EffortLevel was
   silently dropped during merge.
2. `prefetchSessionContext` unmarshaled `turnContextPayload` and
   passed `meta.sessionContext` to mergeSessionContext directly —
   but EffortLevel is `json:"-"` so it's NEVER populated by
   unmarshal. The live-parse path lifts effort via
   `meta.EffortFromPayload()` before applyContext; the prefetch
   path didn't mirror this.

Either bug in isolation produced the same symptom; both needed
fixing.

**Fix:** `mergeSessionContext` now copies EffortLevel following the
same sticky rule as applyContext (non-empty overwrite).
`prefetchSessionContext` now calls `EffortFromPayload()` to lift
effort from the nested envelope before merge. Pinned by new
`TestParseSessionFile_EffortLevelSurvivesWatcherCycle` which
exercises fromOffset > 0 past a `reasoning_effort: "medium"`
turn_context AND verifies the live-parse path as a control.

**Field audit:** every other context field maintained by
`applyContext` (SessionID/TurnID/Model/Cwd/GitBranch) was already
correctly preserved. EffortLevel was the only gap. Other per-parse
state (pending tool_use map, turnModels, seenSystemPrompts,
seenModernTotal) doesn't survive cycles either, but those losses
are self-healing at the store layer (system prompts dedup via
content-hash source_event_id) or theoretical / never reported.

**Revises v1.4.47 invariant 33:** sticky effort propagation now
survives watcher cycles via prefetch, not just a single
ParseSessionFile call.

**Backfill:** `observer scan --force` populates effort_level on
the historical empty-effort rows via the v1.4.47 ON CONFLICT
UPDATE metadata-backfill rule (invariant 30 — only updates when
existing is NULL).

### Refactored — Codex hook envelope cleanup

Completes the v1.4.48 task #2 capture-first procedure with the
2026-05-11 maintainer dogfood findings.

- **`Effort.Level` and `CollaborationMode` struct fields removed**
  from `rawHookPayload`. Both were speculative defensive paths
  introduced in v1.4.47; live capture of codex 0.129.0
  SessionStart + UserPromptSubmit fires confirmed neither field
  is ever in codex hook payloads. Effort capture for codex
  remains JSONL-only via the adapter's `withEffort` wrapper.
- **`hookEnvelopeMetadata` simplified** to just `PermissionMode`
  (the one envelope field codex DOES carry — undocumented, but
  empirically present).
- **`ensureCodexHooksFeatureFlag` doc-comment corrected.** The
  feature-flag name `[features].hooks = true` IS canonical (codex
  0.129.0 prints a deprecation warning on the longer
  `codex_hooks = true`). The local docs file at
  `tmp/codex-hooks.md` is stale on this point.
- **`docs/codex-hook-capture.md` rewritten** as a verified-facts
  reference (was a speculative procedure). Documents the real
  envelope shape, flag-name history, and the codex `unified_exec`
  coverage gap (tool-context hooks only intercept simple Bash,
  apply_patch edits, and MCP tools — not modern streaming shell
  calls).
- **`hook_test.go::TestBuildHookEvent_PopulatesMetadata`**
  rewritten (6 → 5 cases): dropped the both-shapes and
  collaboration_mode-shape cases (testing removed code paths),
  added a stray_effort_level_ignored case pinning that observer
  no longer extracts effort from the hook even when payload
  contains it.

### Added — Claude Code Worktree hooks (carried-over menu #4)

Wires the Claude Code `WorktreeCreate` and `WorktreeRemove` hooks
that fire on Agent spawns with `isolation: "worktree"`. The v1.4.47
handover labeled this "Cursor Tier 4" but the actual hook surface
is Claude Code's (Cursor doesn't have a WorktreeCreate event). The
two hooks have asymmetric risk profiles, so the wiring is asymmetric:

| Hook | Blocking? | Default-registered? | Why |
|---|---|---|---|
| `WorktreeRemove` | No (logging-only per docs matrix) | Yes | Zero behavioral risk — incorrect handler can't break spawns |
| `WorktreeCreate` | Yes (any non-zero exit fails spawn) | **No** | Path-echo contract unverified on live bytes; opt-in only |

- **New ActionType constants** in `internal/models/models.go`:
  `ActionWorktreeCreate = "worktree_create"`,
  `ActionWorktreeRemove = "worktree_remove"`.
- **WorktreeRemove**: added to `claudeCodeEvents` (now 22 events).
  Standard `buildClaudeWorktreeRemoveEvent` follows the existing
  Tier 1 pattern. Target carries `worktree_path`. SourceEventID:
  `{session_id}:worktree_remove:{worktree_path}`.
- **WorktreeCreate**: NOT in `claudeCodeEvents`. The dispatch case
  in `handleClaudeCodeHook` and the handler
  `handleClaudeCodeWorktreeCreate` exist, but the registration
  helper won't write the entry to `~/.claude/settings.json` on
  `observer init --claude`. Users opt in per
  `docs/claude-worktree-hook.md`. The handler:
  - Reads stdin, parses payload
  - Computes worktreePath: `$OBSERVER_CLAUDE_WORKTREE_ROOT/<name>`
    if set, else `~/.claude/worktrees/<name>` (docs default), else
    `/tmp/.claude/worktrees/<name>` (last-ditch when `os.UserHomeDir`
    fails)
  - Synthesizes a `worktree-<base36-nanos>` name when payload.name
    is empty
  - Writes `{"hookSpecificOutput":{"worktreePath":"<path>"}}` on
    stdout FIRST (so Claude Code never blocks on the DB write)
  - Inserts the action row best-effort (logs to stderr on failure)
- **Hook event arg mappings** in `internal/hook/register.go::hookEventArg`:
  `WorktreeCreate → worktree-create`, `WorktreeRemove → worktree-remove`.

**Tests:** 6 new tests in `cmd/observer/hook_test.go`:
- `TestBuildClaudeWorktreeRemoveEvent` — standard builder coverage.
- `TestBuildClaudeWorktreeCreateReply_DocumentedPayload` — path
  resolution with HOME-stubbed env.
- `TestBuildClaudeWorktreeCreateReply_EmptyNameSynthesizes` — empty
  payload synthesizes a `worktree-<base36>` name.
- `TestBuildClaudeWorktreeCreateReply_EnvRootOverride` —
  `$OBSERVER_CLAUDE_WORKTREE_ROOT` takes priority.
- `TestBuildClaudeWorktreeCreateReply_NoSessionIDStillEchosPath` —
  missing session_id skips DB write but STILL echoes the path
  (preventing spawn failures on malformed payloads).
- `TestHandleClaudeCodeWorktreeCreate_AlwaysReplies` — end-to-end:
  invalid config path → handler still writes a valid reply.

Plus extended `TestBuildClaudeAllRejectMissingSessionID` to cover
`WorktreeRemove`.

**Behavior delta:**
- `observer init --claude` now writes a `WorktreeRemove` entry to
  the user's `~/.claude/settings.json`. Future fires emit
  `action_type='worktree_remove'` rows in the actions table.
- `WorktreeCreate` is undisturbed by default — no regression for
  existing Agent spawns. Users who want to capture it follow the
  opt-in walkthrough at `docs/claude-worktree-hook.md`.

**Schema:** no migrations.

**Honest framing:**
- WorktreeCreate's reply shape (`hookSpecificOutput.worktreePath`)
  is documented but unverified on live bytes. The capture-first
  procedure in `docs/claude-worktree-hook.md` walks through dry-run
  validation before relying on it for real Agent spawns.
- The default path `~/.claude/worktrees/<name>` is a docs best-guess.
  Users on non-standard layouts (shared `/workspace/` mounts,
  alternate filesystem roots) should set
  `$OBSERVER_CLAUDE_WORKTREE_ROOT` before opting in.

### Added — Dashboard metadata filters (carried-over menu #3)

Lands the actionable-analysis surface for the v1.4.47 metadata
badges. The Actions tab already showed effort_level / permission_mode
/ is_interrupt as pills next to each action_type; this PR adds three
filters so users can drill into "show me only high-effort runs" or
"only plan-mode actions" without manual SQL.

| Filter | Query param | Frontend control |
|---|---|---|
| effort_level | `?effort_level=minimal\|low\|medium\|high\|xhigh\|max` | `<select id="effort-filter">` dropdown |
| permission_mode | `?permission_mode=default\|plan\|acceptEdits\|auto\|dontAsk\|bypassPermissions` | `<select id="permission-filter">` dropdown |
| is_interrupt | `?is_interrupt=1` (only `1` triggers the filter) | checkbox `<input id="interrupt-filter">` |

- **Backend** (`internal/intelligence/dashboard/dashboard.go::handleActions`):
  parses the three new query params and adds them to the WHERE
  clause via `json_extract(a.metadata, '$.<field>') = ?` (no
  JSON1 dependency added — `modernc.org/sqlite` ships it). Empty
  / missing params skip the filter entirely so legacy callers'
  results are unchanged. `is_interrupt=1` matches the JSON
  boolean's numeric representation (SQLite returns 1/0 for true/
  false on `json_extract`); rows with NULL metadata correctly
  fail the equality check rather than matching as 0.
- **Frontend** (`internal/intelligence/dashboard/static/index.html`):
  three new controls in the Actions tab toolbar adjacent to the
  existing `action_type` dropdown. Action-type dropdown also
  expanded with the v1.4.48 Tier 2/3 types
  (`user_prompt_expansion`, `tool_failure`, `permission_request`,
  `permission_denied`, `post_tool_batch`, `setup`,
  `instructions_loaded`, `config_change`, `subagent_start`,
  `subagent_stop`, `notification`, `cwd_change`, `api_error`,
  `session_start`, `session_end`) so the filter options match the
  rows the table actually surfaces.
- **State** (3 new fields on the `state` object): `actionsEffortFilter`,
  `actionsPermissionFilter`, `actionsInterruptFilter`. All reset
  the page to 1 on change.

**Tests:** new `TestAPIActions_MetadataFilters` in
`dashboard_test.go` seeds 5 rows covering the filter matrix (plan/
high/interrupt, plan/medium/no-interrupt, default/high, acceptEdits/
xhigh/interrupt, no-metadata) and exercises 11 filter combinations
including combined effort+permission+interrupt and the empty-param
fall-through. NULL metadata correctly fails the equality check.

**Schema:** no migrations. Filters operate on the existing
`actions.metadata` JSON column from migration 017.

**Behavior delta:** before this PR, the Actions tab badges from
v1.4.47 were view-only — users could see that a row had
`effort=xhigh` or `permission=plan` but not select for those rows
without manual SQL. After this PR, three new controls turn the
badges into actionable filters. Mixed-and chains supported (e.g.
`?action_type=run_command&effort_level=high&permission_mode=plan&is_interrupt=1`
finds high-effort plan-mode run-command rows that were interrupted).

### Added — Codex hook capture infrastructure (carried-over menu #2)

Ships the capture-first procedure for settling the
`effort.level` vs `collaboration_mode.settings.reasoning_effort`
envelope-shape question on real Codex hook fires (the open item from
v1.4.47 handover pending #2).

- `scripts/codex-hook-tee.sh` — versioned tee-shim. Captures the
  raw JSON stdin of each codex hook fire to
  `$OBSERVER_CODEX_CAPTURE_DIR/<Event>-<timestamp>.json` (default
  `/tmp/codex-hook-captures/`) then pipes the unchanged bytes
  through to `$OBSERVER_BIN`. Matches the precedent of
  `/tmp/cursor-tee-shim.sh` from the v1.4.45 cursor work.
- `docs/codex-hook-capture.md` — walkthrough doc. Covers the 7-step
  procedure: back up hooks.json → swap commands to the shim →
  re-trust in codex /hooks → run codex for ~30s → inspect captures
  → decide which of the two `effort` shapes to drop → restore the
  original hooks.json. Documents the three possible outcomes and
  the exact `internal/adapter/codex/hook.go` lines to edit for each.
- `internal/adapter/codex/hook.go:39-58` (and counterpart on
  `CollaborationMode`): doc-comment now points at the capture doc
  as the cleanup path, so future readers know HOW to verify, not
  just THAT verification is pending.

**No behavior change.** The defensive first-non-empty parsing
introduced in v1.4.47 stays. Once the user captures real fires and
the doc's Step 6 decision is made, a follow-up PR removes the dead
path and tightens the doc-comments to "verified".

### Added — Tier 2/3 Claude Code hook events (carried-over menu #1)

Wires 7 of the 8 Tier 2/3 events from the v1.4.45 menu / v1.4.47
handover's highest-impact carryover slot. Each event now emits its
own row in the `actions` table via a per-event builder following the
established Tier 1 pattern (`handleClaudeCodeActionEvent` +
`baseToolEvent` + `envelopeMetadata`). FileChanged is deferred — its
matcher takes literal filenames split on `|` (NOT regex / `*`) so it
needs a per-project config surface before registration.

**Verified shapes.** Every field extraction was matched against the
canonical Claude Code hooks reference fetched from
`code.claude.com/docs/en/hooks` (full table at
`tmp/claude-code-hooks-payload-reference.md`). No speculative fields
— each builder's struct unmarshals exactly the documented keys and
nothing else. Unknown payload keys fall through into the universal
envelope's catch-all behavior (no panic, no row drop).

| Event | ActionType | Target | RawToolName | Extracted fields | Success |
|---|---|---|---|---|---|
| `Setup` | `setup` | `trigger` | — | `trigger` | true |
| `UserPromptExpansion` | `user_prompt_expansion` | `command_name` | `expansion_type` | `prompt`, `command_args`, `command_source` (in PrecedingReasoning JSON) | true |
| `PostToolBatch` | `post_tool_batch` | `N tool call(s)` | first call's `tool_name` | `tool_calls[]` JSON in RawToolInput | true |
| `PermissionRequest` | `permission_request` | `tool_name` | `tool_name` | `tool_input` in RawToolInput, `permission_suggestions` in PrecedingReasoning | true |
| `PermissionDenied` | `permission_denied` | `tool_name` | `tool_name` | `tool_input`, `reason` → ErrorMessage; SourceEventID from `tool_use_id` | **false** |
| `InstructionsLoaded` | `instructions_loaded` | `file_path` | `memory_type` | `load_reason` + optional `globs` / `trigger_file_path` / `parent_file_path` (JSON in RawToolInput) | true |
| `ConfigChange` | `config_change` | `file_path` or `source` | `source` | — | true |

**SourceEventID uniqueness.** Three events fire multiple times per
session without a payload-carried unique key (UserPromptExpansion,
PostToolBatch, PermissionRequest). For those, SourceEventID is
`{session_id}:{event}:{fnv32a(body)}` so distinct fires don't collide
under `ON CONFLICT DO UPDATE`. PermissionDenied uses
`{tool_use_id}:permission_denied` (mirrors PostToolUseFailure).
InstructionsLoaded uses `{session_id}:instructions_loaded:{file_path}`
(natural per-session discriminator). ConfigChange uses
`{session_id}:config_change:{source}:{file_path}`. Setup uses
`{session_id}:setup:{trigger}`.

**Coverage.**
- `internal/models/models.go`: 7 new ActionType constants with
  full doc comments explaining field choices.
- `internal/hook/register.go`: 7 new entries in `claudeCodeEvents`
  (now 21 events) + 7 new cases in `hookEventArg` mapping.
- `cmd/observer/hook.go`: 7 new dispatch cases in
  `handleClaudeCodeHook` + 7 new `buildClaude*Event` builders + new
  `claudeContentHash` helper (`hash/fnv` import added).
- `cmd/observer/hook_test.go`: 11 new tests (one per builder + 3
  extra: PostToolBatch empty-batch suppression, InstructionsLoaded
  optional-fields, ConfigChange skills-source fallback) + new
  builders added to the missing-session-ID rejection sweep.
- `internal/hook/unregister_test.go`: switched the
  user-hook-preserved seed event from `Setup` (now managed) to
  `TeammateIdle` (still unmanaged).

**Schema:** no migrations. All event rows land in the existing
`actions` table with the `metadata` column inherited from migration
017 (PermissionMode + EffortLevel auto-populated from the envelope
via `baseToolEvent`).

**Behavior delta:** before this PR, 7 Claude Code lifecycle / flow
events fired into `hook.HandleApprove` (acknowledge-only, no DB
write). After this PR, each emits one row. Dashboard's Actions tab
now shows `permission_request` / `permission_denied` / `setup` /
`user_prompt_expansion` / `post_tool_batch` / `instructions_loaded`
/ `config_change` types alongside existing Tier 1 rows. New
`config_change` source values (`user_settings` / `project_settings`
/ `local_settings` / `policy_settings` / `skills`) appear as
RawToolName values — filterable via the existing Actions tab.

**Honest framing:**
- All 7 builders' field shapes are docs-verified — see the
  reference doc at `tmp/claude-code-hooks-payload-reference.md` for
  the source-of-truth grid. Live captures of real fires haven't
  landed yet; if Claude Code emits unexpected keys, they fall
  through silently (the docs-verified extraction is conservative
  about what it reads).
- PermissionRequest's `permission_suggestions` array shape is rich
  (addRules / setMode / addDirectories variants). We stash the
  array verbatim in PrecedingReasoning rather than parsing per-
  variant — dashboards can `json_extract` if they want to
  visualize specific suggestion types.
- FileChanged deferred. Wiring it cleanly needs either (a) Claude
  Code-default matcher behavior verified, or (b) a project-config
  surface that lets users opt files / globs in. Either deserves
  its own design discussion.

## [1.4.47] — 2026-05-10

### Added — Action metadata schema (migration 017)

New `actions.metadata` TEXT column carries per-event JSON for fields
both Claude Code and Codex hook payloads emit on every fire that
previously had no place to land: `permission_mode`, `effort_level`,
`is_interrupt`. App-layer JSON marshal/unmarshal — no SQLite JSON1
dependency added (matches the existing `sessions.metadata`
treat-as-string precedent). New `models.ActionMetadata` struct with
`omitempty` tags + `IsZero()` predicate so a zero-valued struct
persists as NULL and the column stays dense rather than filling with
empty `{}` placeholders.

`Store.InsertActions` extended:
- `insertActionSQL` 25 → 26 columns; new `marshalActionMetadata`
  helper.
- `ON CONFLICT DO UPDATE` extended with a metadata backfill rule
  (parallel to the duration_ms rule from v1.4.28): backfill from
  NULL only, never clobber a populated value.
- `ToolEvent → Action` conversion in `Store.Ingest` threads
  `e.Metadata → act.Metadata`.

Hook adapters populate metadata:
- **Claude Code** (`cmd/observer/hook.go`): `claudeBaseEnvelope`
  extended with `permission_mode` + `effort.level` parsing; new
  `envelopeMetadata` helper; `baseToolEvent` populates Metadata for
  every Tier 1 builder automatically.
- **Codex** (`internal/adapter/codex/hook.go`): `rawHookPayload`
  extended with the same fields plus `collaboration_mode.settings.
  reasoning_effort` (the JSONL-verified shape) as a defensive
  fallback. `BuildHookEvent` sets `base.Metadata` on every event
  branch; first-non-empty-wins between the two effort shapes.
- The pre-fix lossy `[interrupt] ` prefix on
  `buildClaudePostToolFailureEvent`'s ErrorMessage is replaced
  with a typed `Metadata.IsInterrupt = true` flag. ErrorMessage
  now carries only the actual error text.

Verified live: 6 Claude Code rows on the maintainer's DB landed with
`{"permission_mode":"default","effort_level":"xhigh"}` after restart.

### Added — Codex JSONL reasoning_effort capture

Extends the migration 017 metadata column to capture from the Codex
JSONL adapter (every tool call, every session) — not just hook events
(lifecycle markers only).

**Verified field path** on a real Codex 0.129.0 rollout:
`payload.collaboration_mode.settings.reasoning_effort` on
`type: "turn_context"` lines. Values per Codex CLI:
`minimal | low | medium | high` (or `null` = use model default).
The maintainer's local rollouts all had null, so non-null parsing
is implemented but not fixtured against real bytes.

- `internal/adapter/codex/adapter.go::sessionContext` extended with
  `EffortLevel string` (hand-populated from the nested envelope, not
  directly JSON-parsed since it doesn't ride on the flat envelope).
- `turnContextPayload` extended with the `CollaborationMode.Settings.
  ReasoningEffort *string` envelope; `*string` distinguishes
  field-absent from explicit-null (both collapse to empty downstream).
- `applyContext` extended with sticky propagation: a later
  `turn_context` that omits `collaboration_mode` (or sends explicit
  null) does NOT wipe a previously-set effort. Same precedence
  rule as Cwd/Model.
- New `withEffort(ev) ToolEvent` helper inside `ParseSessionFile`
  stamps `ctxState.EffortLevel` onto every emitted ToolEvent's
  `Metadata.EffortLevel` (when non-empty AND the event doesn't
  already carry one). Wraps all 17 `res.ToolEvents = append(...)`
  call sites — single mechanical seam.

Tests pin the propagation, sticky semantics across null /
omitted-collaboration_mode turns, and overwrite on explicit
change.

### Added — Cursor after-event update-in-place via Store.UpdateActionOutcome

Lands the symmetric "after-event enriches the matching before-event
row" path the v1.4.45 Tier 3 work registered as no-row pending. Pre-
fix `afterShellExecution`, `afterMCPExecution`, and `postToolUse` all
returned `(zero, false, nil)` from `cursor.BuildEvent`, deferring
the richer behavior to a follow-up. Post-fix the dispatcher routes
them through a new code path that updates the matching before-event
row's outcome fields in place.

- New `Store.UpdateActionOutcome(ctx, sourceFile, sourceEventID,
  success, errorMessage, durationMs) (int64, error)`. Conservative
  backfill: success always overwritten (after-event is
  authoritative); error_message only overwritten when newValue is
  non-empty (don't wipe a structured error from a sibling
  postToolUseFailure row); duration_ms only when newValue is
  non-zero AND existing is zero (mirrors InsertActions rule —
  never lower a populated duration).
- New `cursor.OutcomeUpdate` struct + `cursor.BuildAfterOutcome`
  function. SourceEventID is computed using the BEFORE-event's
  slug + identical hash inputs to `cursorEventID` so the update
  lands on the matching before-row.
- New `beforeEventNameFor(after, raw)` mapper handles routing:
  `afterShellExecution → beforeShellExecution`, `afterMCPExecution
  → beforeMCPExecution`, `postToolUse` → routed by tool_name (per-
  tool slug for covered tools; `preToolUse` for long-tail; no-
  pair for FileEdit/Subagent).
- New `deriveAfterSuccess(raw)` collapses the three-way success
  signal: explicit `success` bool > `exit_code == 0` >
  error-string emptiness fallback.
- `rawHookPayload` extended with `Success *bool`, `ExitCode *int`,
  `Output string` for after-event outcome parsing.
- `internal/hook/cursor.go::HandleCursorEvent` now calls
  `cursor.BuildAfterOutcome` BEFORE `cursor.BuildEvent` for
  after-events. CursorSink interface extended with
  `UpdateActionOutcome` method.

**Behavior delta:** before this PR a Cursor `afterShellExecution`
event was a no-op in the actions table (the before-row stayed at
the placeholder `Success=true` forever). After this PR the matching
beforeShellExecution row is updated with the real outcome. The
structured `postToolUseFailure` row is unchanged — both surfaces
coexist (failure row carries the typed failure_type; before-row
carries the typed-payload outcome).

### Decided — Cursor pre/postToolUse dedup model (kept current)

After review, kept the per-tool + universal-long-tail-fill model
rather than going universal-only. Per-tool hooks deliver typed
payloads (`command`, `server_name`+`tool_name`, `file_path`) that
beat re-extracting the same fields from `tool_input json.RawMessage`,
the dedup logic (`coveredByPerToolHook`) is small (5 cases), and
the after-event update-in-place wired in this same release makes
the before/after pair enrich a single row rather than emit
duplicates. Decision pin in `internal/adapter/cursor/adapter.go`
comment block.

### Fixed — Claude Code SubagentStop emits empty rows on most fires

Pre-fix every Claude Code `SubagentStop` hook fire wrote a row to
the actions table — but on the maintainer's live DB, 11 of 12
historical SubagentStop rows had empty `agent_type`, empty
`last_assistant_message`, and rendered as blank rows in the
dashboard. Claude Code apparently fires SubagentStop with only
the universal envelope + `agent_id` for many lifecycle cases
(not just real Agent-tool subagents).

Two coordinated fixes in `cmd/observer/hook.go::buildClaudeSubagentStopEvent`:

1. **Empty-shell suppression.** When `agent_type`,
   `last_assistant_message`, AND `agent_transcript_path` are ALL
   empty, return `(zero, false, nil)` so the row is never inserted.
   The loss is just a content-less lifecycle marker; the JSONL
   watcher's sidechain capture already covers real subagent
   activity via `agent-<id>.jsonl` transcript files.
2. **`last_assistant_message` lands where the dashboard renders.**
   Pre-fix the message went to `ToolOutput` (which feeds the
   FTS5 index but is NOT rendered in the actions list — the
   dashboard reads `target` and `raw_tool_input`). Post-fix the
   message lands in BOTH `RawToolInput` (rendered) and
   `ToolOutput` (indexed). `Target` falls back through three
   tiers: `agent_type` first (e.g. `Explore`), then a 120-char
   preview of `last_assistant_message`, then the
   `agent_transcript_path` basename — so the row never renders
   blank when there's any useful payload.

Tests pin all three paths plus the suppression case.

**Migration note:** existing empty rows in the DB from prior
fires remain (no in-place delete). A user can run
`DELETE FROM actions WHERE action_type='subagent_stop' AND
COALESCE(target,'')='' AND COALESCE(raw_tool_input,'')='';` to
clear them; future fires no longer create them.

### Added — Dashboard surface for action metadata + session-modal loading state

Three UI affordances to make the new metadata column visible and
the session detail modal feel responsive:

1. **Actions tab** — `permission_mode` / `effort_level` /
   `is_interrupt` extracted via `json_extract(metadata, '$....')`
   in the `/api/actions` SQL and surfaced as inline pills next
   to the action_type pill in the table:
   - `⚙ <level>` — reasoning effort (xhigh / high / medium / low / minimal)
   - `🔒 <mode>` — permission mode (only shown when non-default)
   - `⏸ interrupt` — user pressed esc on a tool failure

2. **Session detail modal** — same three badges added to the
   per-message tool_calls expand-row in the messages timeline.
   `handleSessionMessages` extends `toolCallRow` with the three
   metadata fields; SQL extracts via `json_extract`.

3. **Session modal loading + stale-data guard** — clicking a
   session now shows a centered spinner with "Loading session…"
   while `/api/session/<id>` and `/api/session/<id>/messages`
   resolve in parallel; the body stays hidden until both
   complete. New `state.sessionDetail.fetchToken` counter
   guards against switching sessions mid-fetch: if the user
   opens session B before A's fetch resolves, A's response is
   dropped and only B paints. Eliminates the prior "wrong
   session's data renders briefly" race.

### Schema

Migration `017_action_metadata.sql`: `ALTER TABLE actions ADD
COLUMN metadata TEXT`. Pre-migration rows leave the column NULL
and surface in queries as "we never had this metadata" — the
right interpretation since the adapters didn't capture it before
this release.

### Honest framing

- Codex JSONL effort path: field name verified from a real local
  rollout; non-null *values* not fixtured (all local sessions had
  `reasoning_effort: null` = use model default).
- Codex hook envelope: defensively accepts both the speculative
  `effort.level` shape (from the v1.4.45 handover docs) AND the
  JSONL-verified `collaboration_mode.settings.reasoning_effort`
  shape; first non-empty wins. Real hook captures will eventually
  settle which (or both) Codex actually emits.
- Claude Code envelope: live DB confirms `permission_mode` +
  `effort.level` ARE present in real hook payloads — 6 rows
  post-restart landed with `{"permission_mode":"default",
  "effort_level":"xhigh"}` (Claude uses `xhigh`, not the
  Codex/OpenAI `minimal/low/medium/high` ladder).
- Cursor after-event payload: field shapes assumed from the
  cursor-telemetry-observation-reference.md docs; real captures
  will validate. The dispatcher logs `outcome update touched 0
  rows` to stderr when pairing fails so dogfood can spot any
  mismatch.

## [1.4.46] — 2026-05-10

### Fixed — Antigravity endpoint cache + INSERT-vs-UPDATE distinction (FK 787 root cause)

Two follow-on improvements after the project-folder fix landed:

**1. Cache the working endpoint per language_server.** `Endpoints()`
iteration tries up to 6 URLs per call (PreferredEndpoint first, then
http for every owned port, then https). The heuristic-derived
PreferredEndpoint is often wrong (verified case: pid 694's
ports[1]=37933 was actually TLS, not HTTP as the heuristic guessed),
costing a full ~5s timeout on the first failed attempt for every
single conversation. New `endpointCache` on the Adapter keyed by
`PID:CSRFToken` (CSRF rotates each language_server start, so stale
cache entries naturally expire when a server is restarted) stores
the URL that succeeded most recently. Cache-hit path tries the
cached URL first; on success, returns immediately. On cache-hit
failure (server restarted, port changed), invalidates and falls
through to full Endpoints() iteration. Saves ~5s per conversation
on hosts where the heuristic gets the protocol wrong.

**2. FK 787 root cause fix.** The recurring
`store.recordCommandOutcome: insert: constraint failed: FOREIGN KEY
constraint failed (787)` errors traced to a real bug, not the
modernc.org/sqlite quirk we'd guessed:

- `insertActionSQL` is `INSERT ... ON CONFLICT DO UPDATE` (an
  UPSERT), but observer treated it like `INSERT OR IGNORE`. When the
  DO UPDATE branch fires for a duplicate (source_file,
  source_event_id), SQLite reports `RowsAffected() = 1` (a row was
  modified) and `LastInsertId()` returns the connection's PREVIOUS
  successful true-INSERT rowid — not the row we just upserted.
- Combined with retention pruning old rows, that stale rowid often
  points at a long-gone action. Observer set `a.ID = stale_id`,
  which `recordCommandOutcome` then used as the `action_id` FK in
  `failure_context.INSERT` → row doesn't exist → FK violation.
- Verified directly: the action_ids reported in the user's logs
  (1266813, 52321, 52322, 52323, 1266832) did NOT exist in the
  actions table; current MAX(id) was 1832013 with only 62814 rows
  (most older rows pruned by retention).

Fix: pre-check existence with a SELECT against the
`(source_file, source_event_id) UNIQUE` index BEFORE the upsert.
On hit, run the upsert (so duration_ms backfill still fires for
legitimately-improved values) but leave `a.ID = 0` so the caller's
`if a.ID == 0` skip for failure_context / file_state side effects
keeps working. On miss, run the upsert as before and trust
LastInsertId — it's reliable for the true-INSERT path.

Tests in `internal/store/store_test.go::TestInsertActions_DupLeaves
IDZero` pin the duplicate-leaves-ID-zero invariant directly. The
existing TestInsertActionsIdempotent + TestInsertActions_Duration
RefreshOnConflict tests still pass — duration_ms backfill behavior
preserved.

Tests in `internal/adapter/antigravity/process_test.go` add
`TestEndpointCacheKey` (PID+CSRF identity) and
`TestAdapterEndpointCacheRoundtrip` (hit/miss/invalidate flow).
All green; vet/fmt clean.

### Fixed — Antigravity project folder resolution + non-fatal failure_context insert

Two follow-on fixes for Antigravity-on-WSL after the language_server
selection fix landed: project folder kept showing as `[antigravity]`
even when capture was working, and a `FOREIGN KEY constraint failed`
error in `failure_context` was tearing down the watcher between
otherwise-successful ingests.

**Project folder fix.** Two compounding gaps:

1. `stateDBPathFor` only checked Linux-side candidates for the
   state.vscdb. With Antigravity-server on WSL + IDE running on
   Windows, conversations sit Linux-side under `/home/<u>/.gemini/`
   but the IDE's `state.vscdb` lives Windows-side at
   `/mnt/c/Users/<u>/AppData/Roaming/Antigravity/User/globalStorage/
   state.vscdb`. None of the same-home candidates existed, so
   `idxEntry == nil`, so `wantWS == ""`, so the workspace-match check
   always said `false`, so `projectRoot` stayed at the placeholder.
2. Even after fixing path resolution, live in-progress conversations
   weren't yet in `trajectorySummaries` — Antigravity flushes the
   index on session save / checkpoint, not real-time. Verified
   directly: a 657 KB blob held 101 indexed conversation UUIDs but
   not the active live one.

Two coordinated fixes:

- **`stateDBPathFor` cross-mount candidates.** New layer iterates
  `crossmount.AllHomes()` and adds OS-appropriate state.vscdb
  candidates for each detected mount: `<windows_home>/AppData/
  Roaming/Antigravity/...` for Windows homes, `<mac_home>/Library/
  Application Support/Antigravity/...` for macOS, `<linux_home>/
  .config/Antigravity/...` for non-native Linux. Same-home
  candidates still tried first; cross-mount candidates fall through
  cleanly when not present.
- **Workspace_id reverse-resolution for live conversations.** New
  `resolveWorkspaceIDToPath(wsID, roots, maxDepth)` helper inverts
  the lossy `file_` + replace-non-alphanumerics-with-underscore
  encoding by BFS-walking each home root up to depth 4, encoding
  every visited directory's path back to the workspace_id form, and
  matching. Caches hits AND misses on `Adapter.wsResolveCache`
  (depth-4 walk is cheap once but not per-conversation; both
  outcomes saved). When the gRPC recovery succeeds and the
  language_server has a `--workspace_id` but `idxEntry` is still
  nil, the resolver runs and `applyResolvedProjectRoot` overwrites
  `[antigravity]` placeholders on every emitted ToolEvent /
  TokenEvent. Pruning skips dotfiles and known-noisy roots
  (`node_modules`, `vendor`, `target`) so the walk stays bounded on
  real filesystems.

**Non-fatal `recordCommandOutcome`.** The `failure_context` table is
a supplementary index for the dashboard's "this command kept
failing" view. A per-row insert error there shouldn't fail the
whole batch and rip down the watcher. Two changes in
`internal/store/store.go`:

- The Ingest loop now logs the error to stderr and continues to the
  next action instead of returning it. Actions and tokens that did
  land stay landed.
- `recordCommandOutcome` adds a defensive guard: if `action_id`,
  `session_id`, or `project_id` are zero/empty, return early
  (silent skip) rather than provoking the FK violation.

The underlying root cause of the FK violation is still under
investigation (likely a modernc.org/sqlite quirk with `INSERT OR
IGNORE` + `LastInsertId` returning a stale id, or a session that's
elided by an upsert race) — but treating this index as best-effort
rather than load-bearing is the right framing regardless.

Tests in `internal/adapter/antigravity/process_test.go` add
`TestResolveWorkspaceIDToPath` (5 cases incl. exact match for
hyphenated and non-hyphenated paths, no-match on wrong wsID, depth
exhaustion, missing `file_` prefix) and
`TestResolveWorkspaceIDToPath_SkipsDotfilesAndNoise` (BFS skips
hidden dirs and `node_modules` subtrees). All green; `vet`/`fmt`
clean; full suite shows only the two pre-existing flakies.

### Fixed — Antigravity WSL recovery picks the right language_server

Fixes a silent zero-events-captured bug for Antigravity-on-WSL: tool
calls, token usage, and project-folder attribution were missing from
the dashboard despite observer logging "OK" responses for each
language_server gRPC call. Two compounding root causes:

1. **Port-protocol heuristic was wrong.** `discoverNativeLinux`
   assumed `ports[0]=HTTPS, ports[1]=HTTP` (sorted ascending), but on
   the host this fix was diagnosed against (`pid 694 --workspace_id
   file_home_marmutapp_superbased_observer`) the actual mapping was
   `ports[0]=HTTP (35989), ports[1]=TLS (37933)` — flipped from the
   heuristic. Observer sent HTTP/2 plaintext (h2c) to a TLS port,
   which the language_server killed mid-stream → `write: broken pipe`.
2. **Wrong-server fall-through.** When the heuristic mismatch caused
   the correct workspace's server to fail, observer iterated to the
   *next* discovered language_server — but each language_server only
   hosts conversations from ITS `--workspace_id`. Talking to a non-
   matching server returned a stub response (190-byte markdown wrapper
   + a 12K stale structured payload from a different workspace). The
   parser extracted ~0 events, which observer accepted as success.

Three coordinated fixes:

- **`workspaceIDFromURI(uri)` + workspace-aware server ordering.** New
  helper in `internal/adapter/antigravity/process.go` encodes a
  `file://` URI to the language_server's `--workspace_id` format
  (`file_` + path with non-alphanumerics replaced by `_`, leading
  slashes stripped). `recoverViaLocalGRPC` decodes the conversation's
  index `workspaceURI`, derives the wanted workspace_id, and sorts
  discovered servers so matchers come first via new
  `sortServersByWorkspaceMatch`. Non-matching servers still get tried
  as last resort (no info loss when the index is missing) but no
  longer outrank the right one.
- **`LanguageServer.Endpoints()` + try-both-protocols.** New method
  returns every plausible URL for a server (`PreferredEndpoint()`
  first, then `http://port` for every owned port, then `https://port`
  for every owned port — deduped). New `tryConvertTrajectoryAcross
  Endpoints` helper iterates the list until one returns a non-error
  response, then threads the working endpoint through to the
  structured-trajectory call via the new `fetchStructuredEnrichment
  NativeAt` method (so the second gRPC doesn't re-iterate failing
  protocols). The old `HTTPPort`/`HTTPSPort` fields stay populated by
  the heuristic for backwards-compat (they feed `PreferredEndpoint()`,
  the first candidate in the list) — but the heuristic is no longer
  load-bearing.
- **Empty-stub guard.** New `numEvents(res)` helper. After parse, if
  `len(ToolEvents) + len(TokenEvents) == 0`, observer treats the
  response as a wrong-server stub and continues to the next server
  instead of returning success. Closes the failure mode that masked
  the bug — the next-server iteration that previously short-circuited
  on the first responsive but-empty server now correctly walks all
  candidates until one extracts real events.

Diagnostic logging extended so the same symptom is easier to debug
next time: `tracef` after each server call now reports the workspace
match flag, and after parse reports extracted tool/token counts +
model name. Lines like `linux-native pid=846 ... OK (190 bytes,
ws="file_home_marmutapp_superbased" match=false)` and `pid=846
returned empty stub (0 events extracted); trying next server` make
the filtering decisions visible.

Tests in `internal/adapter/antigravity/process_test.go` pin
`workspaceIDFromURI` (8 cases incl. URL-encoded, vscode-remote URIs,
trailing slash), `LanguageServer.Endpoints()` (iteration order,
dedup, fallback to HTTPPort/HTTPSPort when Ports is empty),
`sortServersByWorkspaceMatch` (matches first, empty wantWS preserves
order), `numEvents` (count helper for the empty-stub guard), and the
existing `parseTCPListeners` inode-filtering invariant.

## [1.4.45] — 2026-05-10

### Added — Cursor hook expansion (Tier 3)

Builds on the Tier 2 expansion below by adding the universal preToolUse
event and three paired-after observers, taking Cursor live-hook
coverage from 12 to 16 of the 18 documented agent-loop events. The
remaining two (afterAgentResponse, afterAgentThought) fire on every
streaming text/thought delta — registering them would mean a process
spawn per fragment and is deferred until streaming-aware ingest lands.
Tab events (beforeTabFileRead, afterTabFileEdit) remain out of scope:
tab uses a different session model from agent chat with no shared
correlation keys.

- **`preToolUse` — long-tail fill.** Cursor's universal pre-tool hook
  fires for every tool call, but the actions table already gets rich
  per-tool rows from `beforeShellExecution` / `beforeMCPExecution` /
  `afterFileEdit` / `beforeReadFile` / `subagentStart`. To avoid
  double-counting, the `preToolUse` builder calls a new
  `coveredByPerToolHook(tool_name)` predicate (matches `Shell`/`Bash`/
  `command`, `call_mcp_tool`/`MCP`, `ApplyPatch`/`EditFile`/
  `StrReplace`/`Edit`, `Read`/`ReadFile`/`cat`/`ReadLints`,
  `Subagent`/`Agent`) and returns `(zero, false)` for those — the
  per-tool hook stays canonical. For the long-tail tools the per-tool
  hooks miss (`Glob`/`FindFiles` → `ActionSearchFiles`,
  `Grep`/`Search`/`SearchFiles`/`semanticsearch` → `ActionSearchText`,
  `WriteFile`/`CreateFile` → `ActionWriteFile`, plus any future tools)
  the builder emits a row using `cursorTranscriptActionType` +
  `cursorTranscriptTarget` (the same helpers the transcript walker
  uses, so the mapping stays in one place). Truly-unknown tools
  surface as `ActionUnknown` rows preserving `RawToolName`. Trade-off
  consciously accepted: pre-edit visibility for `EditFile`/`StrReplace`
  is dropped (afterFileEdit fires only on success); revisit if
  pre-edit gating becomes a real use case.
- **`postToolUse` / `afterShellExecution` / `afterMCPExecution` —
  registered no-row.** Parity with codex's `PreToolUse`/`PostToolUse`
  precedent. The richer thing to do — update the `before*` row's
  `Success` / `ErrorMessage` / `DurationMs` from the after-event —
  needs a new `Store.UpdateActionOutcome(sourceFile, sourceEventID,
  ...)` method, deferred to a separate batch. Failures are still
  captured live via `postToolUseFailure` (Tier 2) so the most
  load-bearing signal isn't blocked by the deferral.
- **`afterAgentResponse` / `afterAgentThought` — explicitly NOT
  registered.** Per the docs reference these fire on every text
  delta during streaming (`Final assistant text in a single payload
  (only deltas via afterAgentResponse)`), so registering means a
  process spawn per fragment. High overhead, low marginal value —
  the JSONL transcript walker delivers the same content on stop with
  no per-fragment cost. Defer until streaming-aware ingest lands.
- **`internal/adapter/cursor/adapter.go`** adds 4 new constants
  (`EventPreToolUse`, `EventPostToolUse`, `EventAfterShellExecution`,
  `EventAfterMCPExecution`), one new `rawHookPayload` field
  (`ToolInput json.RawMessage` for `tool_input` — distinct from the
  existing `Input` field which beforeMCPExecution uses for `input`),
  the `coveredByPerToolHook` predicate, and the new switch cases.
  `cursorEventID` extended for `EventPreToolUse` to disambiguate
  multiple preToolUse fires within one turn (uses `tool_use_id` when
  present, falls back to `(tool_name, tool_input)` hash).
- **`internal/hook/register.go::cursorEvents`** grows from 12 to 16
  entries.
- **Tests.** `internal/adapter/cursor/adapter_test.go` adds 4 new
  tests: `TestBuildEvent_PreToolUse_CoveredToolsSuppressed` (table-
  driven across all 11 covered names), `TestBuildEvent_PreToolUse_
  LongTailToolsRecorded` (table across Glob/Grep/semanticsearch/
  WriteFile/unknown-future-tool), `TestBuildEvent_PreToolUse_
  DistinctIDsForDistinctTools` (within-turn dedup), and
  `TestBuildEvent_PostToolUseAndAfterEventsNoRow` (the three paired-
  after events all return `(zero, false, nil)`).

### Added — Cursor hook expansion (Tier 2)

Broadens Cursor live-hook coverage from the original 5 events to 12 by
adding `beforeReadFile`, `postToolUseFailure`, `sessionStart`,
`sessionEnd`, `subagentStart`, `subagentStop`, and `preCompact`.
Implemented from the Cursor Hooks docs (`https://cursor.com/docs/hooks`)
against the field-level reference at
`tmp/cursor-telemetry-observation-reference.md` — no live capture
pre-implementation (capture is blocked on Cursor Pro, free tier disables
chat model selection even with BYOK). Honest framing: payload shapes
follow documented + sibling-tool conventions; tolerant decoders accept
plausible field-name variants (`agent_id` / `subagent_id` for sub-agent
identity; `error` field on tool failure). Discrepancies discovered post-
hoc when a Pro user drives the integration will surface as `unknown`-
typed rows rather than silent drops, and tests will pin the corrected
shape.

- **`beforeReadFile` → `ActionReadFile`.** Closes audit C2: Cursor's
  pre-v1.4.45 hook surface had no live file-read signal, so freshness/
  redundancy detection systematically undercounted Cursor activity vs
  claudecode. Live capture now happens at the same point in the agent
  loop as `beforeShellExecution` — before the tool runs — and shares
  `generation_id` with sibling rows for correlation.
- **`postToolUseFailure` → `ActionToolFailure`.** Pairs with the
  Claude Code Tier 1 expansion below: same ActionType, same field
  shape (`tool_name`, `failure_type` → `RawToolName`, `error` →
  `ErrorMessage`, `duration_ms`, scrubbed `input`). `Success=false`
  always. `tool_use_id` discriminates duplicates within a turn when
  present; falls back to `(tool_name, error)` hash otherwise.
- **`sessionStart` / `sessionEnd` → `ActionSessionStart` /
  `ActionSessionEnd`.** Lifecycle markers — composer-session boundary
  events that fire before any generation, so `generation_id` may be
  empty. Event ID falls back to `conversation_id` to keep the insert
  idempotent. `Target` carries `source` (start: `"startup"|"resume"|
  "clear"`) or `reason` (end: `"clear"|"resume"|"logout"|...`).
- **`subagentStart` / `subagentStop` → `ActionSubagentStart` /
  `ActionSubagentStop`.** Brackets a Cursor sub-agent's runtime,
  parallel to the Claude Code SubagentStart/Stop pair. `IsSidechain=
  true` so existing sidechain-aware queries pick them up. `MessageID`
  is the sub-agent identity (accepts both `agent_id` and the docs-
  shape alternate `subagent_id`); `Target` is `agent_type` for fan-out
  attribution.
- **`preCompact` → `ActionContextCompacted`.** Records context-window
  compaction trigger (`auto`/`manual`) so the dashboard can surface
  compaction frequency without polluting the file-edit timeline.
  Parallel to codex's top-level `compacted` event.

- **Out of scope for this batch (deferred):** `preToolUse` and
  `postToolUse` are universal events that overlap with the per-tool
  `before*` hooks already registered — emitting both would duplicate
  every shell/MCP/file row. Deferred until we make a dedup decision
  (probably: register universal events as no-row, drop the per-tool
  ones — but that's a behavioral change worth doing in isolation).
  `afterShellExecution` and `afterMCPExecution` are paired with their
  `before*` siblings; cleanest semantics is to update the existing
  before-row's `Success` / `ErrorMessage` / `DurationMs` rather than
  emit a new row, but update-in-place is more design than a 1-batch
  job. `afterAgentResponse` and `afterAgentThought` would duplicate
  assistant text + thinking already in the JSONL transcript walker.
  Tab events (`beforeTabFileRead`, `afterTabFileEdit`) use a different
  session model from agent chat — separate work.

- **`internal/adapter/cursor/adapter.go::BuildEvent`** extended with
  7 new switch cases. New constants `EventBeforeReadFile`,
  `EventPostToolUseFailure`, `EventSessionStart`, `EventSessionEnd`,
  `EventSubagentStart`, `EventSubagentStop`, `EventPreCompact`.
  `rawHookPayload` extended with the Tier 2 union of fields
  (`tool_use_id`, `error`, `failure_type`, `duration_ms`, `source`,
  `reason`, `agent_id`, `agent_type`, `subagent_id`, `trigger`).
  `cursorEventID` updated to derive a stable ID from `conversation_id`
  when `generation_id` is empty (session-lifecycle events) and to
  hash event-specific discriminators (file_path / tool_use_id /
  agent_id) so within-turn duplicates of the same event class never
  collide.
- **`internal/hook/register.go::cursorEvents`** grows from 5 to 12
  entries. Both `registerCursor` (writes `~/.cursor/hooks.json` for
  native installs) and `registerCursorWindows` (writes to
  `/mnt/c/Users/<u>/.cursor/hooks.json` with `wsl.exe -d <distro> --`
  prefix for Cursor-on-Windows + WSL-observer setups) iterate the
  same slice, so the expansion lights up both surfaces. Existing
  conflict-guard / staleness-detect logic carries through unchanged
  (cross-binary-path refreshes; foreign-entry rejection without
  `--force`).
- **Tests.** `internal/adapter/cursor/adapter_test.go` adds one new
  test per Tier 2 event (`TestBuildEvent_BeforeReadFile`,
  `TestBuildEvent_PostToolUseFailure`,
  `TestBuildEvent_SessionStart`, `TestBuildEvent_SessionEnd`,
  `TestBuildEvent_SubagentStartStop`, `TestBuildEvent_PreCompact`)
  pinning the ActionType mapping, target extraction, error-field
  capture, idempotency-key derivation, and the
  `agent_id`/`subagent_id` fallback. The existing
  `TestBuildEvent_DeterministicEventID` continues to cover the
  shared-payload-stable-ID invariant for the original 5 events.

### Added — Codex hook coverage (full) + Claude Code hook expansion (Tier 1)

Captures the previously-zero Codex hook surface and broadens Claude Code
from 6 of ~23 events to 14, ingesting tool failures, sub-agent
lifecycle, host notifications, working-dir changes, and clean
session-end markers as actions table rows. Schemas were captured live
from real Codex (codex 0.129.0) and Claude Code sessions and
implemented against the resulting payloads — both surfaces had
doc-vs-reality gaps the captures surfaced (codex `hooks.json` requires
`{matcher, hooks: [{type, command}]}` not the flat shape the
developer docs example implied; Claude's `WorktreeCreate` payload
sends `{name}` not `{base_path}`; Claude's `CwdChanged` sends
`old_cwd`/`new_cwd` not `previous_cwd`).

- **Codex hooks — new package.** `internal/adapter/codex/hook.go` adds
  `BuildHookEvent` covering all six documented events
  (`SessionStart`, `UserPromptSubmit`, `PreToolUse`,
  `PermissionRequest`, `PostToolUse`, `Stop`). `SessionStart` and
  `UserPromptSubmit` emit action rows (`session_start`, `user_prompt`);
  `PermissionRequest` emits an `unknown`-typed row carrying the tool
  name + scrubbed input so dashboards can correlate slow turns to
  permission prompts. `PreToolUse` / `PostToolUse` / `Stop` are
  registered for parity but emit no rows — codex's session JSONL and
  the proxy stream already capture that data with richer detail.
  Unknown future events surface as `ActionUnknown` rather than
  silently dropping.
- **Codex hook handler.** New `internal/hook/codex.go::HandleCodexEvent`
  mirrors the existing Cursor handler shape (read stdin → reply
  immediately with `{}` so codex doesn't wait → ingest into the
  configured DB with a 250ms deadline). `cmd/observer/hook.go` adds
  `case "codex":` dispatching to it.
- **Codex registration.** `internal/hook/register.go::registerCodex`
  writes `~/.codex/hooks.json` with the `{hooks: {<event>: [{matcher,
  hooks: [{type, command}]}]}}` schema codex 0.129.0 requires. Also
  patches `[features].hooks = true` into `~/.codex/config.toml` via
  `ensureCodexHooksFeatureFlag` — codex gates its hook dispatcher
  behind that flag and silently ignores hooks.json without it. The
  legacy `[features].codex_hooks` flag was deprecated in a recent
  codex release; we set the new flag and leave any legacy key alone
  (codex prints its own deprecation warning, the right signal for
  the user). Idempotent re-registration; conflict-guard refuses to
  clobber user-authored hook entries unless `--force`.
  `Registry.Installed()` already detected `~/.codex` so
  auto-register-on-start picks codex up automatically.
  `cmd/observer/init.go::hookSupported` extended to accept `codex`;
  the `--codex` flag description updated to reflect hooks-now-supported.
- **Codex trust-flow guidance — surfaced on three independent paths.**
  Codex requires per-hook user trust approval the first time each
  entry is seen (security feature; trust state lives in
  `~/.codex/config.toml [hooks.state]` keyed by an opaque sha256 hash
  that no `codex` subcommand exposes). Because observer can't
  pre-trust on the user's behalf, the gap is surfaced wherever the
  user is most likely to look:
  1. **CLI hint after `observer init --codex`** — one-time guidance
     block walking the user through `codex` → `/hooks` → mark all 6
     trusted.
  2. **`observer doctor` check** — new `codex.hook_trust` check reads
     `~/.codex/hooks.json` for observer-owned entries and
     cross-references `[hooks.state]` in `config.toml`. Reports
     `StatusWarn` listing the specific event names that need trust;
     flips to `StatusOK` once the user completes the `/hooks` walk.
  3. **Dashboard banner** — Compression tab renders a
     `codex-hook-trust-card` warning whenever there's actionable
     friction (`needs_trust` / `config_missing` / `feature_disabled`
     statuses). The card lists exact event names, includes the
     specific `/hooks` instruction, and offers a *Re-check after I've
     trusted* button so users can verify their walk worked without
     reloading the page. Auto-hides on `all_trusted` / `no_hooks` /
     `no_codex`. Backed by the new `GET /api/setup/codex-hooks`
     endpoint.

  We don't reverse-engineer the hash because codex can change the
  algorithm in any release; capture-driven probes against codex
  0.129.0 confirmed 7 plausible inputs (command-only, JSON-canonical
  with/without matcher, etc.) all miss the actual hash. If OpenAI
  ever ships `codex hooks trust <event>` (or equivalent), observer
  adopts it transparently — the trust check just looks at config.toml
  state. Full rationale + walkthrough in `docs/codex-hook-trust.md`.
- **Claude Code Tier 1 events.** `claudeCodeEvents` now registers 14
  events (was 6): added `SessionEnd`, `UserPromptSubmit`,
  `PostToolUseFailure`, `StopFailure`, `SubagentStart`, `SubagentStop`,
  `Notification`, `CwdChanged`. Each maps to an actions row via a
  per-event builder in `cmd/observer/hook.go`:
  - `PostToolUseFailure` → new `ActionToolFailure`. Carries the failing
    tool name, scrubbed input, host-side error message, and duration.
    `is_interrupt: true` payloads get `[interrupt]` prepended to
    `ErrorMessage` so dashboards can distinguish user-cancelled tools
    from genuine failures without a new column.
  - `StopFailure` → existing `ActionAPIError`. Captures typed error
    classes (`rate_limit | authentication_failed | oauth_org_not_allowed |
    billing_error | invalid_request | server_error | max_output_tokens
    | unknown`) the inline JSONL `system / api_error` records don't
    carry as cleanly.
  - `SubagentStart` / `SubagentStop` → new `ActionSubagentStart` /
    `ActionSubagentStop`. Distinct from the parent's
    `ActionSpawnSubagent` (which fires when the parent invokes
    `Agent`) — the new pair brackets the sub-agent's own runtime,
    carrying `agent_id` + `agent_type` for fan-out attribution and
    `IsSidechain=true` so the existing sidechain-aware queries
    pick them up.
  - `Notification` → new `ActionNotification`. Surfaces typed dispatches
    (`permission_prompt | idle_prompt | auth_success | elicitation_*`)
    that aren't in the JSONL transcript at all.
  - `SessionEnd` → new `ActionSessionEnd`. Clean lifecycle close marker.
  - `CwdChanged` → new `ActionCwdChange`. `Target` carries the new cwd,
    `PrecedingReasoning` the previous cwd. Builder accepts both
    `old_cwd` (observed) and `previous_cwd` (docs) for forward-compat.
  - `UserPromptSubmit` → existing `ActionUserPrompt`. Live capture
    parallel to the JSONL watcher's eventual ingest (one-turn lag
    closed for hook-enabled installs).
- **Tests.** `internal/adapter/codex/hook_test.go` covers every event
  shape including the `Pre/PostToolUse no-row` decision and the
  `unknown future event` capture path. `internal/hook/register_test.go`
  adds 5 codex registration cases (fresh install, idempotency,
  config.toml preservation, conflict guard, unregister).
  `cmd/observer/hook_test.go` adds 11 builder-level tests covering
  each Claude Tier 1 event, including the `is_interrupt` marker prefix
  and the `old_cwd` vs `previous_cwd` field-shape forward-compat.

**Honest framing — what this does NOT cover:**
- **Codex hook trust automation.** Per-hook trust still requires a
  one-time manual `/hooks` walk inside codex. We surface the hint
  but cannot bypass codex's security model without reverse-engineering
  the (undocumented, change-prone) trust hash algorithm.
- **`permission_mode` and `effort.level` capture on Claude Code tool
  events.** Both surface in the live payload but ingesting them
  requires a schema migration on the actions table (no free-form
  metadata column today). Deferred to a follow-up — the row writes
  succeed today; the new fields are dropped on the floor.
- **Tier 2/3/4 Claude Code events.** `Setup`, `UserPromptExpansion`,
  `PostToolBatch`, `PermissionRequest`, `PermissionDenied`,
  `InstructionsLoaded`, `ConfigChange`, `FileChanged`,
  `WorktreeCreate` / `WorktreeRemove`, `TaskCreated` / `TaskCompleted`,
  `TeammateIdle`, `Elicitation` / `ElicitationResult` — captured as
  payloads during the dev probe; not yet wired through registration
  or handlers. Some (e.g. `WorktreeCreate`) require non-trivial reply
  shapes: `WorktreeCreate` is blocking and demands the worktree path
  on stdout — implemented naively it would fail every Claude Code
  subagent spawn with `isolation: "worktree"`.
- **Cursor hook expansion.** Tracked separately; capture shim is in
  place at `/mnt/c/Users/<u>/.cursor/hooks.json` awaiting a Cursor
  drive — implementation pending.

### Added — Cursor on Windows + observer on WSL bridge

- **Cursor transcript watcher.** New `internal/adapter/cursor/scan.go`
  implements the `adapter.Adapter` interface against Cursor's on-disk
  agent transcripts under
  `<home>/.cursor/projects/<slug>/agent-transcripts/<conv>/<conv>.jsonl`.
  Until now Cursor was hook-only; the watcher path lights up cross-mount
  capture (Cursor on Windows + observer in WSL via `crossmount.AllHomes()`)
  and provides a fallback when hooks aren't registered. Reuses the
  existing `parseTranscriptTurns` + `BuildTranscriptToolEvents` +
  `BuildTranscriptUserPromptEvent` machinery; emits synthetic
  `MessageID = transcript:<convID>:turn<N>` so watcher rows coexist with
  hook rows (different MessageIDs, same SessionID = conversation_id;
  SourceFile distinguishes them — `cursor:hook` vs the real transcript
  path). `cmd/observer/main.go::defaultAdapters` now registers
  `cursor.New()` alongside the existing JSONL adapters.
- **Project slug decoder.** `DecodeProjectSlug("c-programsx-marmutmain")`
  → `C:\programsx\marmutmain`. Reverse-engineered from real on-disk data:
  Cursor encodes the workspace path's drive letter (lowercase) + each
  component joined by `-`. Heuristic: 1-char first segment = Windows
  drive letter; 2+ char first segment = POSIX-style path with a leading
  `/`. Lossy only if a path component itself contains `-` (no observed
  cases). Captures the workspace_root field for transcript-derived rows.
- **Tool-name aliases for v1.4-era transcripts.** Cursor's current
  transcripts use `Read` and `SemanticSearch` as tool names; the action-
  type switch only knew `readfile` / `cat` / `readlints` (and didn't
  handle SemanticSearch at all). `cursorTranscriptActionType` and
  `cursorTranscriptTarget` extended.
- **Windows-host hook registration (`cursor-windows` target).** New
  `internal/hook/register.go::registerCursorWindows` writes hooks at
  `/mnt/c/Users/<u>/.cursor/hooks.json` with each command wrapped in
  `wsl.exe -d <distro> -- <linux-bin> hook cursor <event> [--config ...]`,
  so a Windows-Cursor process can invoke the WSL-side observer binary
  for stop-event token telemetry the watcher path can't recover. Distro
  read from `Options.WSLDistro` or `$WSL_DISTRO_NAME`; auto-detection
  via `crossmount.AllHomes()` + `OS=windows` filter. New options:
  `WSLDistro`, `WindowsCursorHome` (test seam). Registry.Installed()
  surfaces `cursor-windows` when applicable. `observer init` picks it
  up automatically via the existing union-of-installed dispatch.
- **Stop-hook transcript replay now works on WSL+Windows-Cursor.**
  `BuildStopTranscriptEvents` was silently failing to ingest tool_use
  rows when Cursor on Windows sent `transcript_path` as a Windows-style
  path (`C:\Users\<u>\.cursor\projects\…`) — `os.Open` from the WSL
  observer can't resolve that. Now wrapped via
  `crossmount.TranslateForeignPath` so the path becomes `/mnt/c/…`
  before the file read. SourceFile on the emitted events also uses the
  translated path, which makes hook-replay rows and watcher rows agree
  on file identity (the SourceEventID still differs intentionally; see
  the dual-source design note).
- **Watcher no longer emits user_prompt rows.** The live
  `beforeSubmitPrompt` hook captures every user prompt with the real
  `generation_id` synchronously when the user submits; the watcher's
  transcript-derived user_prompt was a pure duplicate (different
  MessageID, same content, same SessionID). On a normal install
  (auto-register on `observer start` guarantees hooks are wired) the
  user-prompt row appears once. Trade-off: pre-install historical
  transcripts lose user_prompt rows, but the assistant tool_use rows
  that follow still convey what the model did. Watcher continues to
  emit tool_use rows because Cursor's hook layer has no
  `beforeFileRead` / `beforeGrep` event (audit C2 coverage gap), so
  reads and searches would otherwise be invisible.
- **Watcher defers to live hook when session is already covered.**
  `cursor.Adapter.WithSessionHookChecker` lets callers inject a
  predicate that reports whether a session_id has any
  `source_file='cursor:hook'` rows in the DB. When the predicate
  returns true, `ParseSessionFile` skips emission entirely — the
  live hook layer (beforeSubmitPrompt + stop's BuildStopTranscriptEvents
  with the path-translation fix above) covers everything for that
  session. Wired in `cmd/observer/main.go` against
  `Store.SessionHasSourceFileRows`. Net effect: live sessions
  produce one row per event class (no watcher/hook duplication);
  pre-install historical sessions still get full watcher coverage
  because they have zero hook rows. New tests:
  `TestParseSessionFile_DefersWhenHookActive` (skip path) and
  `TestParseSessionFile_EmitsWhenNoHookRows` (cold-start fallback).
- **Auto-register hooks on `observer start`.** The daemon now runs an
  idempotent registration pass on every launch, installing hooks for
  every tool `Registry.Installed()` detects. Already-registered
  entries are silent no-ops; freshly installed entries print
  `auto-register <tool>: installed N hook(s) at <path>` to stdout;
  conflicts with non-observer entries log a warning and skip
  (`Force=false` — never silently overwrites user-authored
  configuration). Closes the discoverability gap where a user with
  Cursor on Windows had to manually run `observer init` AFTER the
  daemon was already up, which most users wouldn't think to do.
  Gated by new `[observer.hooks] auto_register` config key
  (defaults to `true`); set to `false` to opt out and manage hooks
  via `observer init` exclusively.
- **Tests.** `internal/adapter/cursor/scan_test.go` covers slug decode
  (Windows + POSIX shapes, edge cases), `IsSessionFile` matcher
  (back-slash + forward-slash inputs, dir/file-basename mismatch
  rejection), path-component extractors, end-to-end `ParseSessionFile`
  against a synthesised real-shape transcript, and the offset-based
  no-op shortcut. `internal/hook/register_test.go` adds three new
  cases (fresh install, missing-distro error, idempotent re-run).
- **Docs.** `docs/provider-mapping.md` Cursor column file-telemetry rows
  filled in (rollout location, format, tool-call shape, adapter-package
  description) and the hook-registration row gained a `cursor-windows`
  paragraph. CHANGELOG entry follows the c20a116 honest-framing
  pattern.

**Honest framing — what's NOT covered by the watcher path:**
- **Token usage / model.** Cursor's transcript JSONL has neither field;
  cost columns for transcript-only sessions stay zero. Token rows still
  require the live `stop` hook (or the new `cursor-windows` wsl.exe
  variant on Windows installs).
- **Real-time.** Cursor flushes the transcript file after each
  assistant turn completes; the watcher reacts on file growth, so
  there's a one-turn lag vs in-process hooks.
- **No `beforeFileRead` event.** Audit C2's coverage gap on the live
  hook layer doesn't apply to the watcher path — `tool_use{name:"Read"}`
  blocks are present in the transcript so reads ARE captured. (Hook
  + watcher together over-count; the new MessageID prefix makes the
  rows distinct so the dashboard's tools tab can render both without
  collision.)
- **Latency on cold WSL.** The `wsl.exe`-launched cursor-windows hook
  inherits WSL's cold-start latency (~100-300ms after distro idle).
  Within the 500ms hook budget but not generous; if cursor users
  observe drops, the next iteration is a native `cursor-hook-bridge.exe`
  that POSTs to a localhost endpoint on the WSL daemon (option 3 from
  the design discussion). Not measured against a real workload yet.

**Smoke-tested live** against `/mnt/c/Users/auzy_/.cursor/projects/
c-programsx-marmutmain/agent-transcripts/93eb822a-…/93eb822a-….jsonl`
on a real WSL host: 16 actions ingested cleanly, project_root
decoded as `C:\programsx\marmutmain`, action types split as 7
`read_file` + 1 `user_prompt` + 6 `search_files` + 2 `run_command`.

## [1.4.44] — 2026-05-08

### Added — codex CLI compression parity (this session)

- **Codex CLI now gets the same compression treatment as Claude Code.**
  Verified against codex 0.129.0 via live capture. Phase summary:

  - **Tier 0/1 wire-side parity for the OpenAI Responses API.** New
    functions in `internal/compression/conversation/openai.go`:
    `resolveOpenAIResponsesToolCalls` (back-fills toolName + filename
    onto `function_call_output` items via `call_id` lookup),
    `collectOpenAIMCPToolNames` (walks `tools[]` for `namespace`-typed
    entries with `mcp__` prefix), `isOpenAIMCPCall` (union predicate:
    set membership OR HasPrefix `mcp__` fallback),
    `compressOpenAIResponsesToolResults` (per-block per-type
    compression mirroring the Anthropic `compressToolResults`),
    `stashOpenAIResponsesLargeBodies` (G31 stash for codex outputs),
    `compressOpenAIResponsesToolDefinitions` with namespace recursion
    via `compressOpenAIResponsesToolEntry` (description-tail trim +
    `examples` strip from `parameters`; forbidden list — `parameters` /
    `properties` / `required` / `enum` / numeric bounds — universal),
    `extractFilePathFromArgs` + `parseReadCmdForPath` (heuristic
    file-path extraction from `function_call.arguments` shapes; explicit
    `file_path` / `path` / `filename` keys take priority; falls back to
    parsing `cmd` / `command` for `cat` / `head` / `tail` / `less` /
    `more` / `nl` verbs with `bash -lc` wrapper unwrap),
    `substituteOpenAIRedundantReads` (C16 read-cache substitution per
    session; (filename, content-hash) tuple deduplication; mirrors the
    Anthropic-side path with the same MCP-skip invariant). `runOpenAI`
    in `pipeline.go` extended to invoke the full pre-pass chain
    (read-cache → per-type → tool-defs trim → stash) and adds the
    fast-path early-return for `prompt_cache_key`-based prefix-cache
    invariance (without it, even a no-op compression run breaks
    OpenAI's prefix cache on every turn).

  - **Tier 2 session-aware features for codex.**
    `extractOpenAISessionID` (`internal/proxy/provider.go`) reads the
    Responses API body's `prompt_cache_key` field (verified against the
    codex 0.129.0 capture: equals the `session_id` HTTP header in
    observed traffic). Header fallback in `proxy.go` reads the
    `session_id` request header for the rare case where the body lacks
    `prompt_cache_key`. The proxy's session-aware compressor gate +
    auth-cache write are both extended to fire on
    `provider == ProviderOpenAI` (previously Anthropic-only).
    `internal/messagesummary/summarizer_openai.go` ships
    `OpenAISummarizer` (Responses API summary calls, Bearer auth,
    `gpt-5-nano` default — free per OpenAI's 2026-04-29 pricing
    catalog) and `OpenAIFactory` (per-session credential lookup; JWT
    detection — `Bearer eyJ...` ChatGPT-Plus tokens return nil so D20
    no-ops gracefully on those sessions; API-key sessions get a real
    summariser). New `Pipeline.WithSummarizerFactoryFor(provider, …)`
    method + `summarizerFor(provider)` lookup so the pipeline picks
    the right summariser per request.

  - **Codex CLI launcher (`observer codex`).** Mirrors `observer claude`
    in shape: spawns codex with `-c openai_base_url='"<proxy>/v1"'`
    injected into argv so the Responses API request lands at the
    observer proxy. Both auth shapes (sk- API key + ChatGPT-Plus JWT)
    flow through the same override — the proxy's existing
    `isChatGPTAuthRequest` + `translateChatGPTPath` machinery routes
    the JWT form to `chatgpt.com/backend-api/codex/responses`
    automatically. `prepareCodexArgs` respects user-supplied
    `-c openai_base_url=…` / `-c model_provider=…` overrides without
    double-injecting (intent wins). Pinned by `cmd/observer/codex_test.go`.

  - **A/B harness scripts for codex.** New
    `scripts/ab-codex-{setup,start,stop,report}.sh` — mirror the
    Claude-side scripts on ports 8832 (ON) / 8833 (OFF), with
    pre-flight against `api.openai.com` (expects 401 on a fake bearer)
    and per-mechanism breakdown filtered to `provider = 'openai'`.

  - **Provider-mapping reference doc.** New `docs/provider-mapping.md`
    captures the Claude Code ↔ Codex CLI surface mapping (wire endpoint,
    auth shapes, body envelope, tool defs, tool results, session ID
    extraction, cache mechanism, hooks, MCP, file telemetry, feature
    portability matrix) as a reusable template for future provider work.
    **Cursor column now filled** (this session, follow-up): hook-side
    rows from the existing `internal/adapter/cursor/` source-of-truth
    (5 hook events, conversation_id/generation_id session model,
    `~/.cursor/{hooks.json,mcp.json}` config, beforeFileRead coverage
    gap per audit C2); wire-shape rows marked `Opaque (proprietary)`
    since Cursor's backend is hardcoded into the binary with no
    user-controllable upstream URL — capture-driven verification of
    BYOK-mode routing tracked as a follow-up to confirm whether
    `ANTHROPIC_BASE_URL` / `OPENAI_BASE_URL` are honored when the user
    supplies their own keys. Gemini CLI / Cline / Copilot / Antigravity
    columns still TBD.

  - **Bonus production-bug fix in the scrubber.** `sensitiveKeyRE` and
    the JSON env-var-style key pattern were redacting any field with a
    `*_key` suffix — including codex's `prompt_cache_key` (the OpenAI
    prefix-cache lookup field). That would have broken OpenAI's prompt
    cache on every codex turn in production, regardless of the rest of
    the compression work landing. Tightened both regexes to require a
    recognized secret-prefix word (`API_KEY`, `ACCESS_KEY`,
    `PRIVATE_KEY`, `MASTER_KEY`, `ENCRYPTION_KEY`, `SIGNING_KEY`,
    `HMAC_KEY`) before treating `*_KEY` as sensitive. Bare suffixes
    like `prompt_cache_key`, `idempotency_key`, `partition_key`,
    `cache_key` now pass through. Pinned by
    `TestScrubPreservesNonSecretCacheLookupKeys` in
    `internal/scrub/scrub_test.go`. Existing
    `TestScrubString.secret_key_in_json` still covers the
    `SECRET_KEY` redaction path (matches via the SECRET prefix
    alternative).

  - **Config:** `RollingConfig.OpenAISummaryModel` (defaults to
    `gpt-5-nano`). Anthropic and OpenAI summary models are independent.

  - **Chat Completions (`/v1/chat/completions`) parity (this session,
    follow-up).** The Responses-API pre-pass chain now has a Chat
    Completions twin so non-codex OpenAI clients (Cursor / Cline / any
    Chat Completions–wired host) get the same compression treatment.
    New helpers in `internal/compression/conversation/openai.go`:
    `resolveOpenAIChatToolCalls` (back-fills toolName + filename onto
    role:"tool" messages by walking earlier assistant.tool_calls
    entries — the producing function's name + arguments live one
    message back, not on the tool message itself),
    `substituteOpenAIChatRedundantReads` (C16 read-cache via
    (filename, content-hash) tuple dedup; sessionID-gated, MCP-skip
    via HasPrefix `mcp__`), `compressOpenAIChatToolResults` (per-block
    per-type compression with the same MCP-skip and `len(out) >=
    len(body)` short-circuit), `stashOpenAIChatLargeBodies` (G31 with
    the same marker shape), `compressOpenAIChatToolDefinitions` +
    `compressOpenAIChatToolEntry` (description-tail trim + recursive
    `examples` strip — descends through the `function` wrapper since
    Chat Completions nests one level deeper than Responses API:
    `tools[].function.{name, description, parameters}` vs
    `tools[].name/.description/.parameters`). Non-function tool types
    (`web_search`, `mcp`, etc.) pass through unchanged so future tool
    types don't get accidentally mutated. `runOpenAI` rewired so the
    Chat Completions branch invokes the full pre-pass chain (same
    order: read-cache → per-type → tool-defs → stash → score+enforce)
    and the fast-path early-return fires when zero events fire,
    preserving OpenAI's `prompt_cache_key` cache hit on Chat
    Completions traffic the same way it does on Responses API. D20
    rolling summarisation rides through `summarizeIfThreshold` —
    same provider="openai" key as the Responses API path. Pinned by
    11 new tests in `openai_test.go` covering the resolver,
    per-type-fires + MCP-skip, stash + MCP-skip, tool-defs trim +
    non-function-skip, read-cache + sessionID-gate + MCP-skip, and
    the trivial-body fast-path byte-identity invariant.

- **Measured codex compression A/B — 30% cost reduction on a 4-prompt
  expressjs/express exploration workload.** Drove the harness against
  ChatGPT-Plus JWT codex against expressjs/express, single session per
  side, four prompts in sequence. Per `docs/codex-compression-ab-results.md`:

  | Metric | Compression ON | OFF | Delta |
  |---|---:|---:|---:|
  | API turns | 30 | 26 | +4 (+15%) |
  | Input tokens | 584,735 | 853,292 | **−268,557 (−31.5%)** |
  | Output tokens | 9,352 | 9,083 | within variance |
  | Cost USD | **$3.41** | **$4.88** | **−$1.46 (−30.0%)** |
  | Bytes saved (compression telemetry) | 22.9% | 0% | — |
  | Median per-turn latency | 6,691 ms | 7,792 ms | −14% (ON faster) |
  | p95 per-turn latency | 13,796 ms | 12,662 ms | +9% (within variance) |

  Per-mechanism distribution: text=84% / tools=14% / logs=8% / stash=4%
  / drop=0.3% / code=0.0%. All five mechanisms fired on real chatgpt-
  auth codex traffic; stash fired twice (small sample, not enough to
  validate retrieve-rate yet). C16 read-cache substitution did NOT fire
  on this workload — codex's `exec_command` `cat`-style file reads
  apparently didn't duplicate within a single request body. Worth a
  follow-up dig.

  **Honest framing:**
  - **NOT measured this run:** D20 (rolling-summ no-ops on JWT auth —
    routing to chatgpt.com/backend-api for summary calls is deferred);
    long-session retrieve-rate (2 stashes is not enough); cross-run
    variance (n=1 paired run, need 3-5 for noise bounds); MCP tool path
    (no server registered).
  - **Caveat — turn-count regression:** ON used 4 more API turns than
    OFF (+15%). Small in absolute terms; cost still net-positive
    despite the extra turns. Watch across more runs to see if the +15%
    delta is stable.

  Two production bugs surfaced + fixed during this dogfood (next
  bullet).

- **Two production-bug fixes surfaced during the codex A/B dogfood
  (this session, follow-up).**

  - **chatgpt.com Responses API SSE arrives with empty Content-Type
    header.** `isStream` detection in `internal/proxy/proxy.go`
    required a `text/event-stream` Content-Type prefix → SSE bodies
    from chatgpt.com (path-translated from `/v1/responses` to
    `/backend-api/codex/responses`) routed to the JSON-only
    non-streaming branch → `parseOpenAIResponse` failed to
    JSON-unmarshal the SSE body → the proxy returned a turn with
    `Model=""` and silently bailed. Net effect: every chatgpt-auth
    codex turn was silently dropped from cost/token telemetry — the
    compression-events panel showed activity but the cost columns
    stayed zero on the codex side, masking the 30% cost-saving
    measurement entirely. Fix: new `looksLikeSSE` content-sniff helper
    + post-read fallback in `proxy.go::serve` that reroutes to
    `buildStreamTurn` when the body looks like SSE despite a missing
    Content-Type. Pinned by `TestLooksLikeSSE` (10 cases),
    `TestParseSSEStream_ChatGPTFixture` (full-fixture parse), and
    `TestProxy_ChatGPTSSEWithEmptyContentTypeRoutedToStreamParser`
    (end-to-end via fake chatgpt.com upstream returning the captured
    fixture). The fixture lives at
    `internal/proxy/testdata/chatgpt_codex_responses_sse.bin` —
    captured from a real codex 0.129.0 + chatgpt.com session
    2026-05-08, 19 SSE events terminated by `response.completed`
    carrying `usage.{input_tokens, output_tokens,
    input_tokens_details.cached_tokens}`.

  - **Scrubber regex false-positive on Fernet-encrypted reasoning
    blobs.** OpenAI's Responses API ZDR-mode emits `encrypted_content`
    fields containing Fernet tokens (gAAA...== prefix, hundreds of
    base64 chars). The scrubber's existing global patterns —
    `gh[pousr]_[A-Za-z0-9]{20,}` (GitHub PAT),
    `(?i)(?:sk|pk|ak)[_-][A-Za-z0-9_]{16,}` (OpenAI/Stripe-style key),
    `AKIA[0-9A-Z]{16}` (AWS access key) — match SUBSTRINGS inside long
    base64 strings roughly every fourth Fernet token. When matched,
    the redacted substring corrupts the Fernet HMAC and the upstream
    returns `invalid_encrypted_content` on the second-and-later turn
    of any reasoning chain. Net effect: codex sessions errored out
    after ~15-25 turns on the ON side once enough reasoning context
    accumulated; OFF side unaffected because the scrubber only runs
    inside `Pipeline.finalize` which is gated on
    `cfg.Compression.Conversation.Enabled`. Fix:
    `shieldFernetEncryptedContent` in `internal/scrub/scrub.go`
    extracts every `encrypted_content` value to a regex-inert
    placeholder (`OBSERVERSHIELD<padded-N>ENDSHIELD`) before pattern
    application, restores after. Surrounding text (other JSON fields,
    other secrets that happen to appear outside encrypted_content) is
    still redacted normally — the shield is field-name targeted, not
    a global bypass. Pinned by `internal/scrub/encrypted_content_test.go`
    (3 tests: `TestScrubPreservesEncryptedContentValues` covering
    realistic + synthetic shapes, `TestScrubStillRedactsSecretsOutsideShield`
    proving the shield doesn't mask legit secrets, and
    `TestScrubHandlesMultipleEncryptedContentFields` for multi-blob
    bodies — codex sessions accumulate one `encrypted_content` per
    agent loop turn).

- **Codex A/B harness now enables `proxy.force_chatgpt_http` by
  default.** The flag (already shipped as a config knob; pinned by
  `TestProxy_ForceChatGPTHTTPRejectsWebSocketUpgrade`) makes the proxy
  return `426 Upgrade Required` for ChatGPT-backed WebSocket upgrade
  requests. Codex's CLI tries WebSocket first on ChatGPT-Plus JWT
  sessions and only falls back to HTTPS after 7 retries × ~15s ≈ 2
  minutes per session start; this flag short-circuits the cycle so
  codex falls straight to HTTPS (the path observer compresses) on the
  first try. No effect on Anthropic or sk-OpenAI traffic. Wired into
  `scripts/ab-codex-setup.sh` so `[proxy] force_chatgpt_http = true`
  ships in every per-side `observer-config.toml` the harness writes.
  Users running `observer start` outside the harness can opt in
  explicitly in their `~/.observer/config.toml`.

- **Codex parity NOT shipping (intentionally):**
  - **D23 post-compact injection:** codex has no compact event (no
    hook system), so there's no signal to inject around. Documented
    in `docs/provider-mapping.md` as "n/a — not portable".
  - **Cache-aware mode:** codex's Responses API has no block-level
    `cache_control` markers — `prompt_cache_key` is a single-shot
    session-keyed cache. The fast-path early-return preserves the cache
    hit; nothing else applies.

### Added

- **Tier 3.5 / dashboard observability bundle — Compression tab gains
  three new panels surfacing the v1.4.42/43 mechanisms that were
  previously invisible to the user (Tier 3.5; opt-in features remain
  opt-in, the cards just render zero state until enabled).** Pre-fix:
  K43's retrieval signals lived in their own table never queried by
  the UI; D23's post-compact injections mutated request bodies without
  emitting `compression_events` rows; D20 charged Haiku tokens against
  api.anthropic.com directly, bypassing the proxy, so `api_turns`
  couldn't see the spend. New users opening the Compression tab saw
  the same KPI tiles they saw in v1.4.39 even when half a dozen new
  mechanisms were firing. Post-fix: every shipped Tier 2/3 feature has
  a visible surface.

  **Three new panels on the Compression tab:**
  - **Reversibility — CCR retrieve rate** (G31 / K43): 4 KPI tiles
    (stashes, retrieves, retrieve rate, search hits) + side-by-side
    top-shas / top-actions tables. `retrieve_rate = retrieves ÷
    stashes`; > 100% reads naturally as "model returned to the same
    sha multiple times". Backed by `GET /api/compression/retrieval`.
  - **Compaction events** (D23): 4 KPI tiles (compactions, sessions
    affected, injections fired, inject rate) + per-event table with
    ghost-files / file-snapshot / injected pill. Migration 015 adds
    `injected_at` to `compaction_events`; the injector writes it
    idempotently the first time it builds non-empty content. Backed
    by `GET /api/compaction/events`.
  - **Rolling-summarisation net cost** (D20): 4 KPI tiles (summary
    calls, Haiku spend, cache-creation savings, net delta with
    ok/warn colour). Migration 016 adds `summary_calls`; the new
    `messagesummary.CallRecorder` interface + `DBRecorder` production
    impl writes one row per successful Haiku call, parsing Anthropic's
    response usage block for token counts and pricing them at insert
    time via the cost engine. Savings are priced at `cache_creation`
    (not `input`) since rolling-summ replaces bytes that would
    otherwise be re-cached on the next turn. Backed by `GET /api/compression/rolling-cost`.

  **Help drawer extended** with 5 new mechanism entries
  (`mechanism.read_cache`, `mechanism.stash`, `mechanism.tools`,
  `mechanism.rolling_summary`, `mechanism.compaction`) and 3 new
  metric entries (`term.retrieve_rate`, `term.compaction_events`,
  `term.rolling_cost_net`). Existing `mechanism.code` corrected — was
  describing the v1.4.39-and-earlier signature-only-skeleton
  behaviour, replaced with the four content-preserving v1.4.40
  transforms. `mechanism.logs` extended with the eight-pass pipeline
  + G32 level enrichment + E27 anomaly preservation.

  **Doc-drift fixes** — `CLAUDE.md`, `README.md`, `kickstart-prompt.md`
  references to "12 tools" updated to "13 always-on (+ retrieve_stashed
  conditional with stash)". Historical PROGRESS.md mentions left
  intact (accurate as-of-when-written).

  **Verification caveat — zero-state honest framing.** Every new card
  surfaces a metric whose load-bearing value is "is the feature
  actually helping?" Until dogfood data lands, the cards mostly show
  zeros — D20/D23 default-off; K43 always-on but stash itself is
  opt-in. The shipping bar is "the surface exists and renders
  correctly when data flows through", not "the metrics are meaningful
  on a fresh install". Once dogfood populates real values, follow-up
  CHANGELOG entries will report measured retrieve rates / inject
  rates / rolling-summ net deltas.

  **Implementation:**
  - `internal/db/migrations/015_compaction_injected_at.sql` (new),
    `016_summary_calls.sql` (new).
  - `internal/intelligence/compaction/postcompact.go` — `Injector.Get`
    now writes `injected_at` via `UPDATE ... WHERE injected_at IS NULL`
    (idempotent).
  - `internal/messagesummary/recorder.go` (new) — `DBRecorder` +
    `PricingLookup` + `Pricing` shape. `recorder_test.go` for the
    round-trip + nil-safe + unknown-model-zero-cost tests.
  - `internal/messagesummary/summarizer.go` — added `CallRecorder`
    interface, `SummaryCall` shape, `SummarizerOptions.{Recorder,
    SessionID}`, `extractSummaryAndUsage` (parses Anthropic's usage
    block alongside the assistant text), `Factory.For` threads
    sessionID into per-call options.
  - `internal/intelligence/dashboard/dashboard.go` — three new
    handlers (`handleCompressionRetrieval`, `handleCompactionEvents`,
    `handleCompressionRollingCost`).
  - `internal/intelligence/dashboard/static/index.html` — three new
    panels + JS renderers (`renderRetrievalCards`,
    `renderCompactionCards`, `renderRollingCostCards`).
  - `internal/intelligence/dashboard/static/help.js` — 8 new entries
    + 2 corrections.
  - `cmd/observer/proxy.go` — production wire-up:
    `messagesummary.NewDBRecorder` + `costEnginePricingAdapter`
    threaded through `messagesummary.NewFactory`.

  **Tests (all green):** 9 new tests
  (`TestAPICompressionRetrieval_HappyPath` + `..._EmptyWindowNoZeroDiv`;
  `TestAPICompactionEvents_HappyPath` + `..._EmptyWindow`;
  `TestAPICompressionRollingCost_HappyPath`;
  `TestDBRecorder_RecordsRow` + `..._NilSafe` + `..._UnknownModelZeroCost`;
  `TestInjector_SetsInjectedAtOnFirstFire` — the idempotency pin).
  Existing 39+ tests still pass — no regressions.

- **D20 rolling summarisation — live API wire-up (Tier 2;
  opt-in via `compression.conversation.rolling.enabled`).** v1.4.42
  shipped the framework; v1.4.43+ closes the loop with the
  production summariser, the proxy-side auth capture, the cross-
  turn-invariance design, and end-to-end wiring through
  `runAnthropic`. Long sessions that crossed Anthropic's context
  window had no answer pre-D20 — `cache_aware` extends *prefix life*
  but doesn't extend *conversation life*. Rolling summarisation
  replaces older messages with a `[<N> earlier messages summarized:
  <text>]` marker so the conversation can keep going long after the
  raw byte-count would have hit the cap.

  **Cross-turn invariance — sticky boundary (the cache-hit
  predicate).** Naïve summarisation re-summarises a slightly-longer
  prefix every turn → different summary text → different marker bytes
  → Anthropic prefix-cache miss → `cache_creation` charged on every
  turn (the v1.4.38 regression class re-introduced via the rolling
  layer). The fix is a per-session sticky boundary held in
  `Pipeline.rollingState`: once turn N summarises at boundary K, turns
  N+1 onward reuse the same summary + boundary unless the
  unsummarised tail grows past `2 × PreserveLastN`. Turn N+1's prefix
  bytes are then byte-identical to turn N's, hitting the cache. A
  stale-input safety check (hash of `msgs[:K]`) catches the rare path
  where a downstream rewrite changes the summarised content out from
  under us.

  **Production summariser — `internal/messagesummary/`:**
  - `AuthCache` — process-wide session_id → credentials map. The
    proxy's `serve()` writes one entry per Anthropic request before
    invoking the compressor; the rolling-summ summariser reads it
    when threshold fires. Soft cap at `auth_cache_size` (default
    1024) with drop-everything reset.
  - `AnthropicSummarizer` — calls `https://api.anthropic.com/v1/messages`
    with the captured Authorization (Pro/Max OAuth bearer) or
    `x-api-key`. Honours `anthropic-version`. 60s default timeout —
    long enough for a Haiku summary, short enough that a stuck
    request can't hang the parent proxy request indefinitely.
  - `Factory` — implements `conversation.SummarizerFactory` by
    combining the cache + summariser. Returns `nil` when no
    credentials are cached for the session, which makes the pipeline
    no-op the rolling pass for that session.
  - System prompt biases the model toward dense factual recall (file
    paths, decisions, errors, current goal) over narrative — the
    marker sits inline in a long conversation and dense bytes are
    more useful per token.

  **Proxy-side auth capture (`internal/proxy/proxy.go::serve`):** when
  an Anthropic request comes through with a session_id, the proxy
  captures `Authorization` and `x-api-key` headers into the
  `AuthCache` *before* invoking the compressor. Token rotation is
  picked up on the next regular request.

  **Pipeline wire-up:** new `RunInSessionContext(ctx, provider, body,
  sessionID)` threads the proxy request's context all the way down
  into the summariser HTTP call, so a cancelled parent request kills
  the in-flight summary too. Legacy `RunInSession(...)` delegates with
  `context.Background()` for backward compat.

  **Net-positive guard (the `len(out) >= len(body)` analogue):** when
  the marker is longer than the original messages it would replace,
  the summarisation result is discarded and the pipeline returns the
  original messages — so a verbose summariser response can never grow
  the body.

  **Disabled by default.** Honest framing on the cost side: the
  summary call costs Haiku tokens; the savings come from the avoided
  context blow-up + `cache_creation` premium on the regular request.
  Whether the net is positive depends on workload (long-session
  multi-tool exploration favours ON; short Q&A sessions favour OFF).
  Once dogfood lands measured numbers, the default may flip.

  **Implementation:**
  - `internal/compression/conversation/rolling.go` — `rollingState`
    type + sticky-boundary logic in `summarizeIfThreshold`.
  - `internal/compression/conversation/pipeline.go` — `Pipeline.
    rollingState` field, `RunInSessionContext`, runAnthropic
    integration.
  - `internal/messagesummary/{doc.go,auth_cache.go,summarizer.go}` —
    new package (3 files).
  - `internal/proxy/proxy.go` — `Options.AuthCache`, `AuthCache`
    interface, `AuthCredentials` shape, capture in `serve()`.
  - `internal/config/config.go` — `RollingConfig{Enabled,
    ThresholdTokens, SummaryModel, AuthCacheSize}` (defaults:
    enabled=false, threshold=80000, model=`claude-haiku-4-5`,
    auth_cache_size=1024).
  - `cmd/observer/proxy.go` — production wire-up:
    `messagesummary.NewAuthCache` →
    `messagesummary.NewFactory` → `pipeline.WithSummarizerFactory`,
    plus `authCacheAdapter` bridging the two `AuthCredentials` types.

  **Tests (all green):** 1 sticky-boundary cross-turn test
  (`TestSummarizeIfThreshold_StickyBoundaryAcrossTurns` — turn N
  fires, N+1 reuses, N+2 rebuilds when tail outgrows trigger);
  5 messagesummary auth-cache tests
  (round-trip / empty no-op / drop-at-cap / empty-session-Get /
  AuthCredentials.Empty); 6 messagesummary summariser tests
  (httptest.Server happy path with header + body assertions; api-key
  auth path; no-creds error; upstream 429 surfaces body; Factory
  returns nil for missing session, returns working summariser for
  present session, nil-cache no-op); 2 pipeline-level integration
  tests (`TestPipeline_RollingSummary_FiresOnAnthropic_E2E` — 25-msg
  body fires + sticky on second run; `..._NoOpUnderThreshold`).
  Existing 9 framework tests still pass (the sticky-boundary refactor
  is additive — single-turn behaviour is unchanged).

  **Pending follow-ups (not blocking):**
  - Cost-engine surfaces Haiku summary calls separately so the user
    can see "spent $X on summary calls vs $Y avoided on cache_creation".
  - Dogfood ≥1 long session (≥30 turns) measuring tokens-on-the-wire
    stays under context window.
  - Threshold tuning from real-workload data — the 80000-token default
    is a conservative starting point.

- **K43 self-learning feedback loop — `retrieval_signals` table +
  instrumentation on `retrieve_stashed` and `search_past_outputs`
  (Tier 3; always-on once a `SignalRecorder` is wired in `serve()`).**
  Every successful `retrieve_stashed({sha})` MCP call writes a
  `signal_type = 'retrieve_stashed'` row carrying the sha; every non-
  empty `search_past_outputs({query})` writes one `signal_type =
  'search_hit'` row per FTS5 hit carrying the originating query and
  the hit's `action_id`. Both writes are best-effort — losing a single
  signal row never fails an MCP tool call.

  **Why this is the closing move on the moat (per
  `docs/list-of-features-competition.md` cross-cutting observation 3):**
  the K43 aggregate is the input that lets the compression layer
  *learn* which content classes are load-bearing. CCR (G31) lets the
  compressor stash aggressively without losing data; K43 measures
  whether the stashed content is later retrieved — turning compression
  from a static heuristic into a feedback loop. Patterns that surface
  through the report ("tool_result bodies > 8KB containing `panic:` are
  retrieved 87% of the time → consider lowering the stash threshold for
  panic-shaped bodies") feed back into Tier 1 / Tier 2 tuning decisions.

  **`PatternMiner.Report({days})` aggregates over the lookback window:**
  - Per-type counts (`stash_retrievals`, `search_hits`).
  - `top_retrieved_shas` — top 10 shas by retrieve count (good
    candidates for a stash-bypass override: model keeps asking for
    them anyway).
  - `top_searched_actions` — top 10 action_ids by search-hit count
    (load-bearing tool outputs the model returns to repeatedly across
    sessions).

  **Migration `014_retrieval_signals.sql`** — new table, `action_id`
  nullable (stash retrievals don't have one), three indexes
  (`action_id`, `signal_type`, `signal_at`). No `ON DELETE CASCADE` —
  orphan rows after action deletion are harmless and we'd rather
  preserve the long tail for the pattern miner.

  **Implementation:**
  - `internal/intelligence/learn/signals.go` — `SignalRecorder` (write
    side) + `PatternMiner` (read side) + `RetrievalRateReport` /
    `ShaCount` / `ActionCount` shapes.
  - `internal/mcp/server.go` — new `Options.SignalRecorder` field +
    `SignalRecorder` interface (import-cycle-free).
  - `internal/mcp/tools.go::searchPastOutputsTool.Invoke` — logs one
    `search_hit` per returned hit.
  - `internal/mcp/tools_extra.go::retrieveStashedTool.Invoke` — logs
    one `retrieve_stashed` per successful retrieve (sha tracked in
    payload).
  - `cmd/observer/serve.go` — production wire-up:
    `learn.NewSignalRecorder(database)`.

  **Tests (all green):** 5 learn tests
  (`TestSignalRecorder_RecordRetrieveStashed` × 3 rows;
  `..._RecordSearchHit` — action_id round-trip via FK reference;
  `..._NilSafe` — nil receiver no-ops both Record methods;
  `TestPatternMiner_ReportAggregates` — 7 stashes / 4 hits / top sha +
  action ordering on a seeded set;
  `..._OutsideWindowExcluded` — 30-day-old row drops out of a 7-day
  window) plus 1 MCP integration test
  (`TestServer_RetrieveStashed_LogsK43Signal` — successful
  retrieve_stashed lands one signal row with the sha as payload).

- **D23 compaction-survival — proxy-side post-compact context injection
  (Tier 3; opt-in via `compression.conversation.compaction.inject_post_compact`).**
  Claude Code's `/compact` summarises the conversation and starts
  fresh — but the summary throws away tool-state (which files were
  read, which edits were made, which commands failed and why). The
  model effectively has to re-discover the project on the first turn
  after `/compact`. D23 closes that gap: when the proxy sees an
  Anthropic request for a session that has a recent `compaction_event`
  row, it prepends a synthetic system block carrying recovery context:

  ```
  <observer-compaction-recovery>
  Session sess-X underwent context compaction. Below is the most recent
  activity from before the compaction so you can re-orient without
  re-reading every file.

  Recently read files:
    - internal/proxy/proxy.go
    - internal/compression/conversation/pipeline.go
    ...

  Recently edited files:
    - internal/proxy/proxy.go
    ...

  Recent failures (in this session):
    - go test ./... — FAIL TestPipelineCacheAware: ...

  Project-specific learned rules (from prior sessions):
    - cargo build [build_failure] — failed 4 times, recovered 3 times
  </observer-compaction-recovery>
  ```

  **Cross-turn invariance — the cache-hit predicate.** The synthetic
  content is a pure function of (compaction_event timestamp, DB rows
  AT-OR-BEFORE that timestamp). All the underlying queries scope to
  `timestamp <= compactionAt` so post-compaction edits don't churn the
  block on subsequent turns. The proxy-side `Injector` caches per
  compaction event, so every turn of the post-compact conversation
  sees byte-identical injection — Anthropic's prefix cache hits hold.
  A new compaction event invalidates the cache and rebuilds.

  **Forbidden — same shape as the other compressors:** never mutates
  the `messages` array (only `system`), never strips existing system
  content (string `system` is lifted into a two-element array, array
  `system` is prepended-to), and the body is unchanged when content is
  empty (no compaction event, or no recovery data to surface).

  **Sections (limits chosen to fit a few hundred tokens):** last 10
  distinct read targets, last 5 distinct edit targets, last 3 failures
  from `failure_context`, top 5 `learn` rules for the session's
  project (`Days = 30`).

  **Disabled by default.** Once dogfood shows the model uses the
  injected context (vs. ignoring it) and cross-turn invariance holds
  on real long-session workloads, the default may flip.

  **Implementation:**
  - `internal/intelligence/compaction/postcompact.go` — new
    `BuildPostCompactContext(ctx, db, sessionID)` builder + `Injector`
    with per-compaction-event cache.
  - `internal/proxy/postcompact_inject.go` — new
    `injectAnthropicSystemBlock(body, content)` envelope mutator
    handling all three `system` field shapes (missing, string, array)
    + a deterministic-key `marshalEnvelope` helper.
  - `internal/proxy/proxy.go::serve` — runs injection after zstd
    decode but before compression, so the compressor sees the
    injected body. When compression skips (zero events fire) but
    injection happened, forwards the injected bytes upstream rather
    than the pre-injection original (with zstd re-encode where
    needed).
  - `cmd/observer/proxy.go` — wires `compaction.NewInjector(db)` into
    `proxy.Options.PostCompactInjector` when the config flag is set.

  **Tests (all green):** 4 builder tests
  (`TestBuildPostCompactContext_HappyPath` — all four sections
  populated and wrapped in the recovery envelope; `..._NoCompactionEvent`
  — empty for fresh sessions; `..._Determinism` × 5; `TestInjector_*` —
  cache reuse + invalidation on new compaction event + empty-session
  no-op) plus 7 envelope-mutation tests
  (`TestInjectAnthropicSystemBlock_NoSystemField` /
  `_StringSystem` / `_ArraySystem` — three input shapes;
  `_PreservesMessages` — messages array passes through bytewise;
  `_EmptyContentNoOp` — empty content returns body unchanged;
  `_Determinism` × 25; `_BadJSON` — non-JSON surfaces error).

- **G33 three-layer progressive disclosure — new `list_actions_around`
  MCP tool (Tier 3; always-on).** Inserts a chronological middle layer
  between `search_past_outputs` (FTS5 keyword hit on tool output) and
  `get_action_details` (full row + excerpt body). The model's previous
  two-call workflow forced an all-or-nothing choice at the FTS5 hit:
  either pay for the full body of every adjacent action via repeated
  `get_action_details` calls, or guess at session timeline shape from a
  single hit. The new tool returns ±N actions adjacent to a pivot
  `action_id` within the same session, with summary fields only (id,
  timestamp, tool, action_type, target, success, freshness, position).

  **Tool spec:** `list_actions_around({action_id, before?: int,
  after?: int})`. `before`/`after` default to 5, capped at 20 each.
  Output rows carry `position: "before" | "target" | "after"` and are
  ordered chronologically (the target row sits in the middle of the
  array). Same-session-only — neighbour windows do not surface
  unrelated actions from other sessions that happened to overlap.

  **Tie-break by id at identical timestamps** so two actions with
  microsecond-equal timestamps return in deterministic order.

  **Found=false on missing action_id** — no error, just an empty
  `actions` array. The model can distinguish "wrong id" from "first
  action in session" via the empty-but-found-true vs empty-but-
  found-false response.

  Four new tests
  (`TestServer_ListActionsAround_HappyPath` — chronological order
  and position labels on a 11-action seed, target at index 5;
  `..._NotFound` — bogus action_id returns found=false;
  `..._AtSessionBoundary` — first-in-session has empty before window;
  `..._DefaultsAndCaps` — 5/5 default, 20/20 cap on a 50-action seed)
  plus the existing tool-count smoke test bumped from 12 → 13.

- **E27 anomaly preservation — FATAL/ERROR/PANIC lines lift out of the
  elided middle through `LogsCompressor` head+tail truncation (Tier 3;
  always-on once `LogsCompressor` runs).** Pre-fix the head+tail
  truncation pass at the end of `LogsCompressor` could elide a load-
  bearing failure signal — a `FATAL: out of memory` line in the middle
  of a long log would vanish into the `… [N lines elided]` marker even
  though it was the single most useful line in the body. Post-fix
  `headTailWithLevelStats` lifts anomaly-shaped lines out of the
  elided range and inserts them right after the marker, so the model
  sees the failure inline:

  ```
  starting up
  ready
  … [10 lines elided: 5 ERRORs, 3 WARNs, 2 INFO; preserved 3 anomalies]
  FATAL: out of memory at allocator.go:42
  panic: runtime error: index out of range [7] with length 5
  Caused by: storage backend offline
  final-1
  final-2
  ```

  **Anomaly pattern (deterministic regex):** severities `FATAL`, `ERROR`,
  `PANIC` (matched at line start or after `[`/space, mirroring
  `logLevelPattern`); plus line-start anchors `^Caused by:` and
  `^panic:`; plus `exit (?:status|code) [1-9]` for non-zero process
  exits. Stack-frame heuristics (`^\s+at\s+`) deliberately deferred —
  the lift-out is conservative on purpose and pairs with the
  load-bearing severities, not the surrounding context.

  **Cap at 20 preserved anomalies per truncation** — pathological
  middles (e.g. retry-storm `ERROR` floods) can't blow up the post-
  truncation body. The cap is the same shape as the head/tail line
  budgets: bounded lift-out, never larger than the input.

  Marker form (deterministic, depends only on body bytes):
  - `[N lines elided]` — bare form, no levels and no anomalies.
  - `[N lines elided: 3 ERRORs, 12 WARNs]` — G32 level-count form.
  - `[N lines elided: 3 ERRORs; preserved 5 anomalies]` — E27 form when
    anomalies are lifted; the lifted lines themselves follow inline.

  Three new tests pin the behaviour
  (`TestLogsCompressor_AnomalyPreservation_LiftsFatalOutOfElidedMiddle`,
  `..._NoAnomaliesIsBareMarker`,
  `..._CapsAt20`) plus the existing
  `TestLogsCompressor_ElisionMarkerCountsLogLevels` and
  `TestLogsCompressorClampsLargeInput` continue to pass — the marker
  shape change is additive (suffix-only).

- **C16 read-cache auto-substitution — per-call dedup of redundant
  Read tool_results (Tier 2; session-gated, always-on when session_id
  is present).** When the model re-Reads a file with bytewise-
  identical content, the second and subsequent occurrences of the
  Read tool_result are replaced inline with a deterministic marker:

  ```
  [file /repo/main.go unchanged since earlier in this turn; same content already returned]
  ```

  **Per-call dedup design:** Anthropic's request body includes the
  entire conversation history every turn, so when the model re-Reads
  a file in turn N+1, both turn N's and turn N+1's Read tool_results
  appear in the same `Pipeline.Run` call. `substituteRedundantReads`
  hashes (filename, line-strip-normalised body) per Read block and
  collapses second-and-subsequent occurrences. No SQLite, no in-
  memory cross-call cache, no session-state plumbing — the per-call
  scope is exactly the right semantic.

  **Safety properties (pinned by 4 new tests):**
  - **Read-only:** Bash / Grep / Glob with identical command output
    (which is content-unstable across re-runs) does NOT collapse.
    `tool_use.name == "Read"` is the gate.
  - **Hash-aware:** when the same path appears with different content
    (file edited between reads), C16 does NOT collapse — the model
    needs to see both states.
  - **Session-gated:** disabled when `sessionID == ""` so legacy
    `Pipeline.Run()` callers and unit tests preserve the previous
    behaviour.
  - **Cache_control-respecting:** honours `preserveMsg`/`preserveBlock`
    so the SDK's cache marker block stays bit-identical.
  - **Never grows:** net-shrink short-circuit at the per-block scope.

  Wired via the new `Pipeline.RunInSession(provider, body, sessionID)`
  entry point + `proxy.SessionAwareCompressor` interface extension.
  Production `proxy.serve` extracts the Anthropic SDK's `session_id`
  from `metadata.user_id` and threads it through; the legacy
  `Pipeline.Run()` and `proxy.Compressor` interface are kept for
  backward compat.

- **D20 rolling summarisation — framework + cache + tests (Tier 2;
  live API integration deferred to a follow-up).** New `Summarizer`
  interface, `SummarizerFactory` per-session lookup,
  `Pipeline.WithSummarizerFactory(factory, thresholdTokens)` setter,
  `EstimateTokens` heuristic (chars / 4), `summaryCache` (sha256-keyed
  in-memory dedup with drop-everything-at-cap eviction),
  `Pipeline.summarizeIfThreshold` helper that gates on every safety
  condition (no factory / no session / under threshold / no
  summariser for this session / Summarize error / marker doesn't
  shrink the prefix).

  Marker form (deterministic): `[<N> earlier messages summarized: <text>]`.

  9 new tests cover the estimate, cache round-trip + cap eviction +
  determinism, mock-summariser happy path, every no-op gate, error-
  fallback, cache-hit avoid-upstream.

  **Live wire-up pending follow-up commit** — substantial scope:
  - Operate on `extracted` (parsed JSON messages) so the serializer
    can replace K original messages with 1 marker.
  - Cross-turn invariance design: naïve summarisation re-summarises a
    slightly-longer prefix every turn, busting Anthropic's prefix
    cache. Need session-scoped sticky boundary (turn N+1 reuses turn
    N's summary unless tail grew past `2 × PreserveLastN`).
  - Production Anthropic API client wired to the per-session auth
    cache (the proxy captures Authorization headers per session_id;
    the Summarizer factory pulls them out for the actual API call).
  - Cost tracking — Haiku summary calls billed separately; honest
    framing on cost engine net-delta.
  - Config struct.

- **Format-aware shell-output parsing (Tier 1 / B12; cargo_test_json
  shipped, pytest + npm deferred to a follow-up landing).** New rule
  type `format_parse` in `internal/compression/shell/`. The first
  parser handles libtest's NDJSON output from
  `cargo test -- --format json`: parses each JSON line as a libtest
  event, accumulates pass/fail/ignored/filtered counts, and on Flush
  emits a compact summary:

  ```
  cargo test summary: 247 passed, 3 failed, 1 ignored
  
  failures (3):
    - foo::a::handles_empty_input
        thread 'foo::a::handles_empty_input' panicked at src/foo.rs:42:5
        assertion failed: result.is_some()
    - foo::b::respects_timeout
        ...
    - foo::c::reads_metadata
        ...
  ```

  Fall-through contract — **never load-bearing**: when the buffered
  content doesn't parse as the declared format (non-JSON output, the
  `--format json` flag wasn't passed, or the stream was truncated
  mid-run), the rule emits the buffered lines verbatim. The model
  never silently loses content; format-aware parsing is a yield
  optimisation that can degrade safely to no-op.

  `failure_only` flag piped through `RuleSpec` and `FormatParse`
  constructor (B13 piggy-back) — currently a signature placeholder
  for cargo since per-test detail isn't emitted for passes; richer
  formats (pytest, npm) will use it.

  Cargo TOML default split into two specs: the existing generic
  `cargo` filter (drops `Fresh` lines, squashes whitespace) and a new
  subcommand-targeted `cargo test` filter that runs the
  `cargo_test_json` parser. Pinned by 6 unit tests
  (`TestParseCargoTestJSON_*` + `TestFormatParse_*`) covering the
  happy path, non-JSON fall-through, truncated-stream fall-through,
  determinism × 50 with alphabetical failure ordering, fall-back on
  unparseable buffered content, and unknown/missing format errors at
  construction.

  **Deferred:** pytest_json (libtest's `pytest-json-report` plugin
  shape; needs real-fixture sourcing for the assertion-shape
  extraction) and npm_test_json (jest/mocha dialects). Both follow
  the same framework with format-specific summarisers; ~1 hour each,
  not blocking the rest of Tier 1. Tracked in
  `docs/compression-roadmap.md`.

- **`LogsCompressor` truncation marker enriched with log-level counts
  (Tier 1 / G32 — LogsCompressor side).** When the head+tail
  truncation pass elides a range that contains recognisable log
  levels, the marker shape switches from the bare
  `… [N lines elided]` to the enriched form:

  ```
  … [347 lines elided: 12 ERRORs, 47 WARNs, 288 INFO]
  ```

  Lets the model decide whether to retrieve the elided range based
  on what's in it (e.g. an elided range with 12 ERRORs is much more
  likely to be load-bearing than one with 288 INFO lines). New
  helpers `countLogLevels`, `formatLogElisionMarker`, and
  `headTailWithLevelStats` in `internal/compression/conversation/logs.go`
  recognise ERROR/FATAL → ERRORs, WARN/WARNING → WARNs, INFO,
  DEBUG/TRACE → DEBUG. Falls back to the bare form when no levels
  appear — the enrichment is opportunistic, not load-bearing. Two
  new tests (`TestLogsCompressor_ElisionMarkerCountsLogLevels`,
  `TestLogsCompressor_ElisionMarkerBareWhenNoLevels`).

  CCR-side enrichment (stash markers carrying format-shape signal —
  `[output 47KB stashed: cargo test run, 247 passed 3 failed at retrieve_stashed("<sha>")]`)
  is deferred to a follow-up alongside the pytest/npm parsers; needs
  the same per-format detection infrastructure.

- **CCR (Compressed Content Retrieval) — disk-stash + retrieve_stashed
  MCP tool — the strategic moat (Tier 1 / G31; opt-in via
  `compression.conversation.stash.enabled`).** Tool_result bodies whose
  size exceeds the inline-threshold (default 8 KB; configurable) after
  per-type compression are written to a content-addressed on-disk stash
  and replaced inline with a deterministic marker:

  ```
  [output 47KB stashed at observer://stash/<sha>; use retrieve_stashed]
  ```

  The model retrieves originals via the new MCP tool
  `retrieve_stashed({sha, max_bytes?})`, which validates the on-disk
  bytes re-hash to the requested sha (catches partial writes / manual
  tampering) and supports an optional truncation cap so the model can
  pull just the head of a multi-MB blob.

  **Why this is the moat (per
  `docs/list-of-features-competition.md` cross-cutting observation 2):**
  pure-filter tools (RTK, snip) hit a quality ceiling because lossy
  compression eventually drops content the model needs. CCR is
  reversible — nothing is actually thrown away; the marker is a
  compress-then-retrieve indirection. This lets us compress
  aggressively (large bodies always stash, regardless of dedup-friend-
  liness) without ever forcing the model to re-run a tool because we
  truncated mid-content.

  **Implementation:**
  - New package `internal/stash/` — content-addressed flat-layout
    storage at `~/.observer/stash/<sha>`. Atomic write (temp file +
    rename), idempotent on re-write, sha-validated on read,
    LRU-mtime-eviction GC capped at `max_total_mb` (default 256 MB).
    9 unit tests (round-trip, idempotence, missing/invalid/corrupt
    sha, GC eviction, GC no-op when under cap, dir-on-first-write).
    Path-traversal guard via 64-char-lowercase-hex sha validation.
  - `Pipeline.WithStash(s, threshold)` — opt-in attachment that runs
    `stashLargeBodies` after `compressToolResults` and
    `compressToolDefinitions`. Honours the existing
    `preserveMsg`/`preserveBlock` cache_control protection. Emits
    `compression_events.mechanism = "stash"` per stashed block.
  - `mcp.Options.Stash` — opt-in registration of the
    `retrieve_stashed` tool. Without it, tools/list excludes the
    tool (pinned by `TestServer_RetrieveStashed_NotRegisteredWithoutStash`).
  - Production wire-up in `cmd/observer/proxy.go` (proxy daemon) and
    `cmd/observer/serve.go` (MCP server) reads
    `compression.conversation.stash.{enabled,dir,threshold_bytes,max_total_mb}`
    and constructs the stash conditionally. `~/`-expansion is applied
    in `config.Load`.

  **Cross-turn invariance — pinned by
  `TestPipeline_StashCrossTurnInvariance`:** the marker depends only on
  body bytes (sha + size-in-KB), not on call ordering or wall-clock,
  so the same body in turn N and turn N+1 produces byte-identical
  markers. Anthropic's prefix cache hits stay intact across turns
  even when the body is stashed.

  **Verification caveat — yield + retrieve-rate claims.** Five new
  pipeline tests
  (`TestPipeline_StashFires`,
  `TestPipeline_StashSkipsBelowThreshold`,
  `TestPipeline_StashCrossTurnInvariance`,
  `TestPipeline_StashDisabledByDefault`)
  + 5 MCP-side tests pin the structural behaviour. The dogfood-data-
  driven retrieve-rate (`% of stashed bytes ever retrieved`) and the
  threshold-tuning numbers will be reported in a follow-up CHANGELOG
  entry once we have a week of usage. Default-on flip is gated on
  retrieve-rate landing in a healthy range.

- **Tool/function schema compression at the request envelope level
  (sub-feature 2 of the v1.4.40 honest-defaults bundle; cold-cache
  effect only — see verification caveat).** The Anthropic Messages API
  request body carries a `tools` array on every turn (Claude Code SDK
  ships ~45 tools, ~94 KB); on cache-cold turns or after the prompt-
  cache TTL elapses the entire array is paid for in full. New
  `compressToolDefinitions` helper in
  `internal/compression/conversation/anthropic.go` mutates
  `envelope["tools"]` in place with two strict-content-preserving
  transforms applied per tool:
  1. **Top-level description trim** — when `description` has ≥ 3
     paragraphs (split on a blank line), keep only the first 2. The
     first 2 paragraphs reliably carry the "what the tool does" +
     "primary parameters" content; later paragraphs typically repeat
     usage hints already encoded in the input schema.
  2. **Deep `examples` strip from `input_schema`** — `examples` is a
     JSON-Schema informational keyword. Removing it does not change
     validation behaviour, parameter names, types, required-ness,
     enums, or numeric bounds. The model loses sample values but
     retains every other signal the parameter schema carries.

  **Forbidden — pinned by `TestCompressToolDefinitions_NeverTouchesParameterSchemaContract`:**
  tool `name`, `input_schema.type`, `input_schema.properties` keys,
  nested `type`/`description`/`required`/`enum`/`minimum`/`maximum`,
  any field outside `description` and `input_schema`. Touching
  parameter schemas changes the model's tool-use behaviour and re-
  introduces a regression equivalent to v1.4.38's turn-count loss
  for tool calls.

  Wired into `pipeline.go::runAnthropic` alongside
  `compressToolResults`; events join `br.Stats.Events` so the fast-
  path early-return correctly skips when tools-only compression fires.
  Net-shrink short-circuit at the envelope-tools scope mirrors the
  per-body `len(out) >= len(body)` rule: if compressed tools aren't
  smaller than original, the envelope is restored unchanged.

  **Verification caveat — yield claims.** Five new tests
  (`TestCompressToolDefinitions_StripsExamplesAndTrimsDescription`,
  `..._Idempotent`, `..._NoOp`, `..._NeverTouchesParameterSchemaContract`,
  `TestPipeline_ToolSchemaCompressionFires`) pin the structural
  behaviour. The tools array is part of Anthropic's cached prefix once
  warm, so this compression's value is realised only on cache-cold
  turns (first turn of a session, or after the cache TTL elapses).
  Real-workload yield numbers from the v1.4.40 A/B re-run will be
  reported in a follow-up CHANGELOG entry — until then the cost-savings
  claim is structural (fewer bytes go up cold) rather than empirical.

- **`LogsCompressor` extended with five new content-preserving filters
  (sub-feature 1 of the v1.4.40 honest-defaults bundle; live A/B
  re-run pending).** The pre-existing dedup-only behaviour was leaving
  ~70 % of real Bash / npm / cargo / pytest tool_result bytes on the
  table because ANSI escapes, progress-bar updates, padding-only blank
  runs, and tabular-output column gutters all survived intact. The new
  pipeline runs (in order):
  1. **ANSI CSI escape strip** — `\x1b\[[0-9;?]*[a-zA-Z]` covers SGR
     colour codes, cursor moves, and line-erase sequences. Fast-path
     skips the regex entirely when the body contains no `0x1b` byte.
  2. **Carriage-return overwrite collapse** — per line, `prefix\rmid\rfinal`
     → `final`. Progress bars and spinners shrink to their final
     state.
  3. **Trailing-whitespace trim per line.**
  4. **PowerShell wide-padding squash** — runs of ≥ 4 spaces collapse
     to a single space, but only on lines with ≥ 3 such runs. The
     ≥ 3-run threshold is the conservative sweet spot: it catches PS
     `Get-*` cmdlet table output (which has 3 + column gutters per
     data row) without corrupting `ls -l` style output (which has 1
     wide gutter per line). Pinned negatively by
     `TestLogsCompressor_LeavesLsAlone`.
  5. **Progress-bar line drop** — drops lines whose visible content is
     only padding / progress glyphs (`[=\->%#*.[\]<>█▓▒░]`) AND length
     ≥ 6, so Markdown-style short dividers (`---`, `===`) survive.
  6. **Run-length dedup of consecutive identical non-blank lines** —
     refactored from the existing `dedupConsecutive` so blank lines
     now act as run boundaries (avoiding the ugly ` [×N]` marker on
     pure-whitespace runs) and `capBlankRunsAt(2)` runs as a separate
     pass.

  **Forbidden / deferred — same regression-class guards as
  CodeCompressor:** no truncation, no head-tail elision (the existing
  truncate pass at the end is unchanged and still bounded by
  `MaxLines`), no fuzzy line collapse. The originally-planned
  near-identical run-length collapse (`fetched a@1.0.0` / `fetched
  b@1.0.0` → `fetched <pkg>@<ver> ×N (a, b, ..., z)`) is **deferred**
  to a follow-up because the deterministic-marker requirement (every
  cross-turn output must list the same set of differing tokens
  byte-identically) makes the heuristic materially riskier than the
  other five — it will land alongside Tier 1's B12 format-aware test-
  runner parsers (`docs/compression-roadmap.md`).

  **Verification caveat — yield claims.** Eleven new unit tests
  (positive + negative per filter, plus determinism × 50, idempotence,
  no-ANSI fast-path no-op) pin the structural behaviour; the live A/B
  re-run on the `/tmp/ab-claude/{on,off}/` 4-prompt workload has not
  yet been executed. Per-filter yield on synthetic fixtures: 10–30 %
  for ANSI strip on coloured `pytest`/`cargo` output, 20–40 % on PS
  Get-* tables, 5–15 % on install/build progress lines. Real-workload
  `Bytes saved %` on Claude Code Bash tool_results targeting `npm`,
  `cargo`, `pytest`, `kubectl` will be reported in a follow-up
  CHANGELOG entry once the A/B is re-run with the v1.4.40 bundle.

- **Content-preserving `CodeCompressor` rewrite + `code` enters default
  `compress_types` allow-list (yield is structural, post-rewrite live
  A/B not yet run — see verification caveat).** Replaces the previous
  signature-keep / body-elision strategy in
  `internal/compression/conversation/code.go` (which was the regression
  class v1.4.38 + v1.4.39 spent two releases ring-fencing) with four
  strict-content-preserving transforms, applied in order:
  1. Trim trailing whitespace per line.
  2. Elide a leading license/banner block — only at file top, only when
     the contiguous run of comment-only (or blank) lines is ≥ 5 lines
     AND contains ≥ 3 actual comment lines. Trailing blanks are trimmed
     off the elided range so the visual break before the first code
     line is preserved. Replaced by a single
     `// [<N>-line license header elided]` marker. Python `"""`
     docstrings are deliberately NOT recognised — they are string
     literals with module-level semantics (`__doc__`), not comments.
  3. Run-length dedup of consecutive identical non-blank lines into
     `<line> [×N]`, mirroring `LogsCompressor.dedupConsecutive` so the
     marker form is consistent across compressors. Yield is near-zero
     on hand-written source, 30–60 % on generated/templated files.
  4. Cap consecutive blank-line runs at 2.

  **Forbidden — these are the regression class:** body elision, mid-
  file comment stripping, signature-only skeleton. Every non-comment,
  non-blank line of the input now appears bytewise in the output. The
  test `TestCodeCompressor_PreservesEveryNonCommentNonBlankLine` is the
  unit-level guard that would have caught the v1.4.38 turn-count
  regression.

  Defaults flip: `internal/config/config.go::Default()` now ships
  `compress_types = ["json", "logs", "code"]`, up from
  `["json", "logs"]`. The `code` allow-list entry is justified by the
  rewrite's content preservation; reverting it is a product decision
  and is regression-guarded by `TestDefaultCompressTypesIncludesCode`.

  **Verification caveat — yield claims.** The rewrite is structurally
  correct (29 unit tests across determinism, idempotence, license-
  header positive/negative, mid-file negative, generated-code dedup,
  trailing-whitespace trim, blank-run cap, never-grows-body, plus
  pipeline-level integration `TestPipeline_CodeCompressionFiresOnReadToolResult`),
  but the live A/B re-run on the `/tmp/ab-claude/{on,off}/` 4-prompt
  workload has not yet been executed for this change. Per-file yield
  on synthetic fixtures: 5–15 % on header-bearing files, ~1–3 % on
  bare source, 30–60 % on generated code. Real-workload `Bytes saved %`
  on Claude Code Read tool_results targeting `.go` / `.py` / `.js`
  files will be reported in a follow-up CHANGELOG entry once the A/B
  is re-run with the v1.4.40 bundle.

- **Per-type compression detection improved for Claude Code tool
  envelope shapes (effect on real workloads is currently zero — see
  caveat below).** Pre-fix `types.Detect` returned `Unknown` on every
  Claude Code tool envelope because (a) Read tool output is line-
  numbered (cat -n style) so structural sniffing fails, (b) every
  caller passed an empty filename so extension-based routing never
  fired, and (c) Bash output shapes weren't recognised by the log-line
  classifier. Three detection paths now light up correctly in unit
  tests and on synthetic fixtures:
  1. **Line-numbered Read tool output is unwrapped before
     classification.** New exported `IsLineNumbered` + `StripLineNumbers`
     helpers strip the `<digits>\t` prefix from each line; `types.Detect`
     classifies the underlying content. `compressToolResults` also
     strips line numbers before invoking the compressor. Trade-off
     accepted: compressed Read output loses line numbers (model can
     re-Read for line numbers if `Edit` needs them later).
  2. **Producing-tool filename hints flow through to `types.Detect`.**
     `resolveToolUseInputs` pre-walks the request body, builds a
     `tool_use_id → {Name, FilePath}` index from every `tool_use`
     block's `input.file_path`, and back-fills
     `extractedMessage.resultFilenames` + `resultToolNames` parallel
     to `resultBlockIdxs`. The per-block compression loop passes the
     matching filename to `types.Detect`.
  3. **Bash output shapes (ls -la, grep -n, find, wc -l) now classify
     as `Logs`** via a new `shellOutputPattern` regex in
     `types/detect.go`.

  **Real-workload caveat (the honest part).** With the conservative
  default `compress_types = ["json", "logs"]`, the new detection
  paths produce **zero observable byte savings on Read/Bash-heavy
  code-exploration workloads** because:
  * Read tool_results that classify as `Code` (the common case for
    `.go`/`.js` files) are filtered by the allow-list — `code` is
    excluded by default for the same regression-class reason `text`
    is excluded (the existing `CodeCompressor` elides function bodies,
    which would re-introduce the v1.4.38 turn-count regression on
    prompts that need to re-reference function bodies).
  * Bash tool_results that classify as `Logs` are typically too short
    (5-line `ls -la`, 3-line `grep`) for `LogsCompressor`'s dedupe +
    head/tail strategy to shrink them — the `len(out) >= len(body)`
    short-circuit fires.
  * Mixed Bash output (`cat package.json && ls`) doesn't sniff as
    JSON because the leading bytes aren't `{`/`[`.

  Net live A/B on Express repo, post-fix: zero compression events
  recorded, `Bytes saved % = 0%`. The detector improvements are
  wired correctly and have unit-test coverage; they remain latent
  until either (a) a content-preserving `CodeCompressor` ships and
  `code` enters the default allow-list, or (b) workloads shift toward
  longer Bash outputs / structured-data-file Reads.

  Synthetic-fixture verification
  (`TestPipelineCacheAware_RealClaudeCodeShapes`,
  `TestDetect_LineNumberedReadOutput`,
  `TestDetect_BashOutputShapes`,
  `TestDetect_DiffShapes`,
  `TestResolveToolUseInputs_FilenamePlumbing`,
  `TestStripLineNumbers`): JSON compression fires on a synthetic
  line-numbered package.json (163 → 132 bytes, 19% saved on the
  touched block), pipeline remains deterministic across two runs,
  cross-turn invariance still holds on real Claude Code shapes.
  Diff detection covers line-numbered `.diff`/`.patch` Read output
  and bare `git diff` Bash output transparently via the strip-and-
  route at the top of `Detect`.

- **`compression.conversation.mode = "cache_aware"`: new strategy
  for Anthropic Pro/Max sessions where the SDK already places
  `cache_control` markers (cost-savings claim is structural, not
  empirical — see verification caveat below).** Skips the drop pass
  entirely (drop ranking is budget-relative and shifts as the
  conversation grows, which invalidates Anthropic's prefix cache
  turn-over-turn), narrows per-type compression eligibility to
  `Role == RoleTool` (RoleAssistant flips Preserved at the
  PreserveLastN boundary; preserving it bit-stable keeps cache hits
  intact), and skips `cache_control` injection (the SDK already sets
  markers; injecting a 4th is wasteful or rejected). No-ops
  gracefully (effectively ModeToken without drops) when no SDK
  marker is present in the request body. New `findLastCacheBreakpoint`
  helper in `internal/compression/conversation/anthropic.go` walks
  messages-level `cache_control` annotations (system-level markers
  ignored). New `BudgetOptions.CacheAware` + `OriginalBodyBytes`
  fields in `budget.go` propagate the mode into `Enforce`. Determinism
  and cross-turn invariance unit tests
  (`TestPipelineCacheAware_Determinism`,
  `TestPipelineCacheAware_CrossTurnInvariance`) pin the load-bearing
  properties: same input → byte-identical output, and turn N+1's
  output shares a byte-identical prefix with turn N's output (the
  cache-hit predicate). Default `Mode` flipped from `"token"` to
  `"cache_aware"`.

  **Verification caveat — cost claims.** Four live A/B runs on the
  Express repo (identical 4-prompt workload, symmetric on both
  sides) showed cost deltas spanning **-14.7% to +14.8%** ON-vs-OFF.
  Three of the four post-HTML-escape-fix runs favoured ON (+14.8%,
  +6.1%, +6.1% directionally), but the variance is wider than any
  reproducible signal. Critically, **zero compression events fire on
  these workloads** (per the caveat in the detection entry above) and
  the fast-path makes ON forward byte-identical bytes to OFF when
  nothing compresses — which means `cache_aware`'s structural
  behaviour (no drops, no injection) has no observable bytes-on-the-
  wire difference from `compression.enabled = false`. The cost
  variance we measure is dominated by cascade non-determinism (same
  prompts, temperature > 0, different tool decisions, different turn
  counts) rather than anything compression did. **No measurable
  cost-savings claim is supported by current evidence**; the value
  of `cache_aware` mode is *latent* — it makes future compressor
  work safe to ship without re-introducing the v1.4.38 turn-count
  regression class, but until compressors actually fire (see the
  detection-entry caveat for blockers), the mode is functionally
  equivalent to compression-disabled on common code-exploration
  workloads.

- **Per-session `api_turns.session_id` for Claude Code proxy traffic.**
  Pre-fix every proxy row from Pro/Max OAuth Claude Code carried
  `session_id=NULL` because no `SessionStart` hook fires for the
  launcher path. The Claude Code SDK 2.1+ already embeds a stable
  per-session UUID inside `metadata.user_id` (a JSON-encoded blob of
  the form `{"device_id":...,"account_uuid":...,"session_id":"<uuid>"}`)
  on every `/v1/messages` POST. New `extractAnthropicSessionID` helper
  in `internal/proxy/provider.go` parses the blob defensively
  (returning `""` on any malformed JSON or missing field).
  `proxy.go::serve` consults it first for `provider == "anthropic"`,
  falling through to the existing `X-Session-Id` header and
  `SessionResolver` paths so non-Claude-Code Anthropic clients aren't
  affected. 7-case unit test on the helper plus 2 end-to-end proxy
  tests pin the body→DB column flow and the header-fallback path.
  Live verification: a fresh `observer claude --print` turn lands
  `api_turns.session_id` populated with the SDK's own UUID, matching
  across every turn of the same invocation. Replaces the launcher-
  injection plan from the v1.4.38 handover — the value was already on
  the wire.

- **`observer claude` launcher: closes the Pro/Max OAuth bypass.**
  Pro/Max-OAuth Claude Code (2.1+) reads
  `~/.claude/.credentials.json::claudeAiOauth.accessToken` and sends
  Bearer tokens straight to `api.anthropic.com`, bypassing
  `ANTHROPIC_BASE_URL` for the `/v1/messages` chat call — i.e. the
  observer proxy never sees the request, compression doesn't run, and
  no `api_turns` rows land for the OAuth majority. The bypass is
  conditional, not absolute: when the OAuth bearer is exposed via
  `ANTHROPIC_AUTH_TOKEN`, Claude Code falls into its API-key code
  path, which DOES respect `ANTHROPIC_BASE_URL`. Same Bearer header
  on the wire, same Pro/Max billing — observer just gets to see (and
  compress) the body. The launcher (`cmd/observer/claude.go`)
  resolves the proxy URL from `cfg.Proxy.Port` (or `--proxy`), reads
  the credentials file (honoring `CLAUDE_CONFIG_DIR` /
  `ANTHROPIC_CONFIG_DIR`), exports both env vars without overriding
  anything the user already set, and execs `claude` with the original
  argv. Smoke test: `observer claude -- --print "hi"` lands a real
  `claude-opus-4-7` row with compression metadata populated, on a
  Pro/Max account with `hasApiKey: false`. API-key users get
  `ANTHROPIC_BASE_URL` only — the same path that worked pre-2.1.
  7 unit tests in `cmd/observer/claude_test.go` pin the env-prep
  rules, including the "user-already-set" precedence and the
  malformed-credentials surfacing path. Mirrors the v1.4.36 codex
  ChatGPT-auth fix in spirit (close a silent-bypass for the
  subscription-login majority) but not in shape — codex needed
  upstream-host + path translation; Claude Code OAuth needs only an
  env-var injection because the on-wire upstream is unchanged
  (api.anthropic.com either way).

- **Configure Claude Code dashboard card.** New
  `/api/setup/claude` GET endpoint (purely informational — no config
  to write, no POST) backs a Compression-tab card alongside the codex
  one. Probes `~/.claude/.credentials.json` (honoring
  `CLAUDE_CONFIG_DIR` / `ANTHROPIC_CONFIG_DIR`) and `claude` on PATH,
  classifies the install as `oauth_ready` / `api_key_ready` /
  `claude_not_installed`, and surfaces the launcher snippet
  pre-filled with this observer's proxy port. Status pills show the
  detected `claude` binary path. The card explains the OAuth-bypass
  background only on the `oauth_ready` path so API-key users don't
  see noise that doesn't apply to them. 6 new tests in
  `setup_test.go` cover the four status branches plus
  method-not-allowed and the `CLAUDE_CONFIG_DIR` override path.

### Fixed

- **MCP tool outputs no longer pollute the FTS5 search index
  (recursive-search bug, surfaced 2026-05-08 dogfood).** Pre-fix,
  every `search_past_outputs` (or other MCP tool) call's output got
  written to the `action_excerpts` FTS5 table on ingest. The next
  search for the same keyword surfaced the prior search results as
  hits — because the search response's JSON contains the query
  keyword multiple times. Compounded across sessions: every search
  inflated the index with self-referential hits, degrading recall
  quality session-over-session. The model itself flagged the
  behaviour after the JSON-compression fix landed: *"Many of the
  hits are recursive — prior search_past_outputs calls for the
  same/similar query that themselves got indexed."*

  **Fix in `internal/store/store.go::Ingest`** — skip the
  `idx.Index(...)` call for any tool event whose `RawToolName`
  starts with `mcp__`. Same semantic as the JSON-compression skip:
  MCP tool outputs are derived query data, not source content; the
  search index should reflect what the AI agent *did* (Bash, Read,
  Edit), not what it *queried* about prior actions.

  Pinned by `TestIngest_SkipsMCPToolOutputsFromFTSIndex` — seeds two
  events with the same keyword (`app.set`), one from `Bash` and one
  from `mcp__observer__search_past_outputs`; post-ingest, FTS5
  search returns exactly 1 hit (the Bash row), confirming the MCP
  row was excluded.

  **Note on existing indexed rows.** The fix prevents *new* MCP
  outputs from being indexed but doesn't retroactively clear prior
  ones. The pollution accumulated over the 2026-05-07 stress-test
  sessions remains in `/tmp/ab-claude/on/observer.db`. To reset
  cleanly: `rm /tmp/ab-claude/on/observer.db` and re-run the
  harness; the new binary will rebuild the schema without the
  recursive entries. Production main DB users can either accept
  the slow drift-out (hits age out as new content lands) or run a
  one-time clean with: `DELETE FROM action_excerpts WHERE
  rowid IN (SELECT id FROM actions WHERE raw_tool_name LIKE 'mcp__%')`.

- **CRITICAL — MCP tool_results were silently being JSON-compressed,
  corrupting query data (surfaced 2026-05-08 dogfood; broke
  `search_past_outputs` user-visible).** When the user asked the model
  to call `mcp__observer__search_past_outputs` with `query="app.set"`,
  the tool returned 10 hits — but the model reported "values weren't
  surfaced in this response (placeholders only)". Root cause: the
  proxy's per-type JSONCompressor saw the search response as JSON
  content, replaced every scalar value with a type sentinel
  (`"action_id": "<number>"`, `"excerpt": "<string>"`, etc.), and the
  model received the corrupted shape.

  **Severity.** Every MCP observer tool's response is structured
  query data where the **values are the answer**:
  `search_past_outputs` (action_ids, excerpts, ranks),
  `get_action_details` (full row data), `get_cost_summary` (dollars),
  `check_file_freshness` (hashes, mtimes), `retrieve_stashed`
  (catastrophic — would replace the stashed bytes with `<string>`).
  Two places fired:
  1. `compressToolResults` — JSON/code/logs compressors per
     tool_result block.
  2. `Enforce`'s budget-pass `compressMessage` — second compression
     pass on the joined text.

  Suspected this also explains the 0-of-114 retrieve_stashed rate
  observed in the prior two stress tests: the model may have been
  receiving corrupted retrieve_stashed responses on earlier sessions
  and learned not to trust the tool. Or the marker phrasing alone is
  the issue. Subsequent runs will distinguish.

  **Fix.** New `isMCPToolName` helper checks for the standard
  `mcp__<server>__<tool>` prefix. Three guards added:
  - `compressToolResults` skips per-tool_result compression when the
    producing `tool_use.name` starts with `mcp__`.
  - `stashLargeBodies` skips stashing when the producing tool is MCP.
  - New `Message.NoCompress` field on the conversation Message
    abstraction. `toConversationMessages` sets it whenever any of
    the message's tool_results came from an MCP tool. Budget
    enforcer's per-type compression pass respects the flag, so the
    second-pass `compressMessage` can't corrupt the response either.

  **Tests:** `TestCompressToolResults_SkipsMCPToolResults` pins the
  end-to-end fix — a 10-hit `search_past_outputs` response with 60+
  scalar values goes through the full pipeline with `["json", "logs",
  "code"]` allow-list + stash enabled at 1 KB threshold; output must
  contain the actual `action_id` values (1000..1009) and must NOT
  contain `<number>` / `<string>` sentinels; no `json`/`code`/`logs`/
  `stash` events allowed for the MCP block.

- **`search_past_outputs` FTS5 syntax error on dotted queries
  (surfaced in 2026-05-08 dogfood).** Pre-fix, calling
  `mcp__observer__search_past_outputs` with a query like `app.set` —
  the natural shape for "find anywhere we discussed app.set in
  prior sessions" — failed with
  `search: indexing.Search: query: SQL logic error: fts5: syntax
  error near "."`. SQLite FTS5 treats `.` as a syntactic separator
  (column-qualified search) and rejected the unquoted token. The
  model self-corrected by re-issuing the query as `"app.set"`, but
  the wasted tool round-trip was a real cost.

  **Fix in `internal/compression/indexing/indexer.go::Search`** —
  new `sanitizeFTSQuery` helper auto-wraps single-token queries that
  contain FTS5-special chars (`.`, `:`, `(`, `)`, `*`, `-`) in
  double quotes (FTS5's literal-phrase form). Multi-token queries
  pass through untouched (those callers are presumed to be using
  FTS5 boolean / phrase syntax deliberately). Already-quoted queries
  pass through too. Embedded `"` characters are escaped via FTS5's
  standard `""` doubling.

  Pinned by `TestSanitizeFTSQuery_DottedTokensWrapped` × 9 cases
  (dotted / colon / parens / hyphen / plain word / already-quoted /
  multi-token boolean / empty / whitespace) +
  `TestSearch_DottedQueryNoLongerErrors` integration test that
  re-runs the exact `app.set` query against a real seeded FTS5
  index.

- **Stash marker rephrased to be directive (surfaced in 2026-05-08
  dogfood — model never called `retrieve_stashed`).** Pre-fix marker:
  `[output 47KB stashed at observer://stash/<sha>; use retrieve_stashed]`.
  In a stress-test session with 114 stashed bodies, the model called
  `retrieve_stashed` **zero times** — even when an explicit prompt
  asked for the full output of a previously-stashed grep. The phrase
  `use retrieve_stashed` after the semicolon read as a status note
  rather than an actionable instruction; the model's reflex was to
  re-run the original Bash command instead.

  **Fix in `internal/compression/conversation/anthropic.go::formatStashMarker`** —
  new directive form:
  `[output 47KB stashed at observer://stash/<sha> — to view full content, call mcp__observer__retrieve_stashed with sha="<sha>"]`.
  Three changes vs. prior:
  - Explicit MCP tool name (`mcp__observer__retrieve_stashed`) so
    the model recognises it as a tool-call template, not free-form
    advice.
  - Explicit `sha="<sha>"` argument shape so the model can copy-
    paste the call.
  - "to view full content, call ..." phrased as instruction, not as
    afterthought.

  The URL form `observer://stash/<sha>` is preserved as a secondary
  reference so existing greps / tests still locate it. Cross-turn
  invariance preserved: the marker is still a pure function of
  (kb, sha) → byte-identical bytes turn-over-turn.
  `TestPipeline_StashFires` updated to (a) assert the new directive
  substrings (`mcp__observer__retrieve_stashed`, `sha=\"`) are
  present, and (b) parse the URL-form sha with whitespace as
  terminator (was `;`).

  **Verification caveat.** This fix is structural — the new
  phrasing is more directive on its face, but whether the model
  actually changes its behaviour and starts calling
  `retrieve_stashed` instead of re-running producing commands needs
  another dogfood pass to confirm. Follow-up CHANGELOG entry will
  report the 0-of-114 → N-of-M shift once we re-run the stress
  test on the new binary.

- **D20 rolling summarisation tool-pair invariant violation — naive
  boundary could drop a `tool_use` block whose `tool_use_id` was
  still referenced by a `tool_result` block in the preserved tail
  (Tier 2 / D20 follow-up; surfaced in dogfood on the Express-repo
  stress test).** Pre-fix, when D20 fired on a long session
  containing tool calls, `summarizeIfThreshold` computed `boundary =
  len(msgs) - PreserveLastN` and dropped `msgs[:boundary]` wholesale.
  If any of those dropped messages was an assistant message
  containing `tool_use` blocks whose IDs were still referenced by
  `tool_result` blocks in the preserved tail, the outgoing request
  body was invalid: Anthropic's API validator rejected with HTTP
  400 (`messages.0.content.1: unexpected tool_use_id found in
  tool_result blocks: each tool_result block must have a
  corresponding tool_use block in the previous message`).

  **Root cause.** D20 was wired with attention to cross-turn
  invariance (sticky boundary, hash-checked prefix) but no
  preservation contract for tool pairs. The existing budget enforcer
  (`Score`/`Enforce`) has the concept of `Preserved` for tool-pair-
  live messages — D20 sat in a separate code path and didn't consult
  it. The original D20 mock-summariser tests fed in `Message` slices
  with `Raw == nil`, so the regression mode was latent.

  **Fix.** New helpers in `internal/compression/conversation/rolling.go`:
  - `extractToolUseIDs(raw)` parses an Anthropic message envelope's
    `content` blocks and returns the `tool_use_id`s it produces (from
    `tool_use` blocks) and consumes (from `tool_result` blocks).
    Best-effort: nil on parse failure / string-form content / empty
    Raw, falling back to "include this message" (the safe default).
  - `summarizableBoundary(msgs, initialK)` walks backward from
    `initialK`, expanding K to keep any message that produces a
    referenced `tool_use_id`. Chained preservation: when a newly-
    included message itself consumes IDs, those propagate further
    back. Returns 0 when the entire conversation is one tool-pair
    chain — caller then no-ops summarisation (degraded gracefully:
    request goes upstream uncompressed rather than malformed).

  `summarizeIfThreshold` calls `summarizableBoundary` after
  computing the initial boundary on a rebuild. Sticky reuse is
  unchanged — once a boundary was tool-pair-safe, byte-prefix
  invariance keeps it safe forever (subsequent turns can only ADD
  new pairs at the tail, never reach back into the dropped range).

  **Tests (5 new, all green):**
  - `TestExtractToolUseIDs` × 6 cases — parser shape (string
    content / tool_use / tool_result / parallel calls / empty raw /
    malformed JSON).
  - `TestSummarizableBoundary_PreservesToolPair` — tool_use producer
    at index 4, tool_result consumer at index 14, naive boundary 14
    expands to 4.
  - `TestSummarizableBoundary_NoToolPairsIsNoOp` — boundary stays at
    initialK on no-tool conversations.
  - `TestSummarizableBoundary_PairFullyInDroppedRangeIsNoOp` —
    complete pair (both sides) in dropped range: no expansion needed.
  - `TestSummarizeIfThreshold_PreservesToolPairsAcrossBoundary` —
    end-to-end integration: output preserves `msg[4]` (the producer)
    despite naive boundary 14.

- **Compression pipeline silently rewrote HTML escapes in upstream
  request bytes, causing a model-behaviour regression.**
  `serializeAnthropic`'s `json.Marshal([]json.RawMessage)` call
  applied Go's default `HtmlEscape=true` to the raw bytes coming
  through `RawMessage.MarshalJSON`, rewriting `<system-reminder>` →
  `<system-reminder>` on the wire even when zero compression
  events fired. The SDK sends those tags literally to signal tool-use
  guidance to the model; subtle on-wire differences in those tags
  measurably shifted the model's tool-use sampling, taking ~2× turns
  on multi-file exploration prompts (live A/B repro: ON 9-10 turns on
  "summarize architecture" vs OFF 5 turns, reproduced across two
  runs). Same bug affected `rewriteToolResult` and
  `marshalToolResultBlock` via `json.Marshal` on structs/maps. Fix in
  `internal/compression/conversation/pipeline.go::runAnthropic`: when
  no compression events fire, no drops happen, and no `cache_control`
  injection is needed (the typical case for Read/Bash-heavy code-
  exploration workloads where JSON/logs `Detect` doesn't classify
  Read-tool envelopes), forward the original body unchanged after
  scrubbing. Diagnostic test confirmed two real captured Anthropic
  bodies pass through `delta=+0` (byte-identical) with the fast
  path. Live A/B post-fix: regression closed (14 vs 21 turns, ON 33%
  fewer; cost -14.8%).

- **Parallel `tool_result` messages no longer have their compression
  silently discarded by the serializer.** Pre-fix,
  `extractedMessage`'s `resultBlockIdx` field was only set when a
  message had EXACTLY one `tool_result` block; multi-`tool_result`
  messages (Claude Code's parallel-tool-call pattern: `Read + Bash +
  Read` in one assistant turn produces a single user message with N
  `tool_results`) had `resultBlockIdx = -1`, and `serializeAnthropic`
  short-circuited back to the original raw bytes — Enforce's flat-
  text compression was thrown away. Refactor in `anthropic.go`
  replaces three singular fields (`resultBlockIdx`, `resultText`,
  `resultIsStructured`) with parallel slices (`resultBlockIdxs`,
  `resultTexts`, `resultIsStructureds`) and adds `compressedTexts`.
  New `compressToolResults` runs per-type compression on every block
  independently before scoring (so Score/Enforce see post-compression
  byte counts and drop decisions don't trigger spuriously on already-
  shrunk content). `BudgetOptions.OriginalBodyBytes` carries the true
  pre-compression body size into `Enforce` so the budget reference
  stays anchored against the original. Per-block compression also
  respects the cache_aware marker block (preserves it bit-identical).
  New `TestPipelineCompressesParallelToolResults` pins three parallel
  JSON `tool_results`: blocks 0+1 compressed, block 2 (the small
  tail) preserved, all three structurally retained in the output.

- **Proxy: `api_turns.cost_usd` now populated at insert time.** The
  column existed since the table was created but no writer set it —
  the dashboard's `/api/cost` and `/api/timeseries/cost` endpoints
  computed cost on the fly via `cost.Engine.Compute(model, bundle)`,
  but every reader that summed the column directly (`observer cost`
  CLI, `scripts/ab-claude-report.sh`'s headline panel, ad-hoc SQL
  queries) saw NULL/zero and reported `$0.00 saved` even on sessions
  with real multi-thousand-token spend. The proxy now accepts an
  optional `CostComputer` (mirrored on `Compressor`'s pattern, so the
  proxy stays free of an `intelligence/cost` import cycle); when
  set, every insert site (stream success, stream error, non-stream
  success, non-stream error) calls a small `applyCost` helper that
  populates `APITurn.CostUSD` before handing the row to the sink.
  `cmd/observer/proxy.go` wires a `costEngineAdapter` over
  `cost.NewEngine(cfg.Intelligence)` so production gets the same
  pricing table the dashboard uses. Computers are nil-safe and
  unknown-model-safe (cost stays NULL when pricing isn't found, so
  downstream on-the-fly computation still wins). Two new tests in
  `proxy_test.go`: `TestProxy_PopulatesCostUSDOnInsert` pins a known
  rate × known tokens product through the full proxy → sink path;
  `TestProxy_CostUSDUnsetWhenComputerAbsent` confirms the no-op when
  no computer is wired (so older Options callers don't regress).
  Manual verification on the live OAuth A/B: a single `--print`
  turn with 6 input + 11 output + 46,577 cache-creation tokens
  records `cost_usd = 0.291411`, matching the spreadsheet math
  against `claude-opus-4-7`'s rates ($5/$25/$6.25 per 1M).

- **Proxy: usage tokens lost when upstream gzips the response.** Modern
  HTTP clients (claude included) negotiate `Accept-Encoding: gzip, br`
  by default and `api.anthropic.com` honors it — so the proxy's SSE
  parser saw gzip-encoded bytes, found zero `data:` lines or `usage`
  keys, and `api_turns` rows landed with input/output tokens both
  zero. The bug was invisible for API-key clients run via curl/scripts
  (which don't negotiate compression) and only surfaced once the
  `observer claude` launcher started routing live OAuth Pro/Max
  traffic through the proxy: 24 of 24 successful chat rows from the
  first live A/B had `input_tokens=output_tokens=0` despite real
  multi-thousand-token prompts. Fix:
  `internal/proxy/proxy.go::serve` now sets
  `Accept-Encoding: identity` on the upstream request after copying
  client headers. Identity-forced responses are plaintext and the
  parser extracts usage as designed. The proxy runs on loopback so
  the bandwidth cost is effectively free; the gain is accurate
  per-turn input/output/cache token counts (and therefore real
  `cost_usd`, real `bytes saved %`, real Live verification numbers
  in the headline panel). New regression test
  `TestProxy_AnthropicStreamingForcesIdentityEncoding` in
  `proxy_test.go` mocks an upstream that records the negotiated
  encoding; the test fails if the override regresses.

- **`enabled_adapters = []` in config.toml is now respected as
  "no adapters" (was silently treated as "all"). ** `internal/adapter/
  registry.go::Detected` distinguished `len(allow)==0` (empty allow
  list → no filter) from `allow==nil` (no allow list → no filter)
  prior to this fix; both paths yielded the same result. The user-
  facing footgun was the A/B compression test setup: each A/B daemon
  config wrote `enabled_adapters = []` to disable its watcher, but
  the watcher still came up with the full default adapter set and
  ingested 41,698 actions / 218 sessions / 31,327 token rows from
  the user's main `~/.claude/` directory into each A/B observer.db
  (113 MB per DB). Now `nil` (zero-value, callers using
  `watcher.Options{}` without setting `Allow`) means "no filter,
  return all detected"; non-nil empty slice (the explicit-empty TOML
  case) means "filter to zero adapters". BurntSushi/toml correctly
  preserves the nil-vs-empty distinction. Two new tests pin the
  semantics:
  `TestDetectedExplicitEmptyAllowDisablesAllAdapters` in
  `internal/adapter/registry_test.go` and
  `TestEmptyEnabledAdaptersDisablesWatch` in
  `internal/config/config_test.go`. The A/B harness re-tested clean
  after the fix: 0 actions/sessions/token rows in both `/tmp/ab-
  claude/{on,off}/observer.db`, DB sizes dropped from 113 MB to 4 KB.

- **Antigravity Run All wastes ~70s on Linux-side conversations.**
  `internal/adapter/antigravity/adapter.go::recoverViaLocalGRPC` and
  `internal/adapter/antigravity/index_resolve.go::FetchStructuredTrajectory`
  now short-circuit the Windows-side bridge fallback for paths under
  `/home/` (where Linux-side `~/.gemini/antigravity/conversations/`
  `.pb` files live). The bridge can't read files behind WSL's
  filesystem boundary, so the prior fall-through cost ~3s per
  conversation × 24 conversations on a typical Run All — and emitted
  multi-line WARN dumps for each. Now returns a one-line
  "no Linux-native language_server hosts this conversation; reopen
  the originating workspace in Antigravity to recover" hint and moves
  on. Linux-native discovery still runs first (so a running native
  server still recovers any conversation it hosts); only the
  guaranteed-to-fail bridge step is skipped.

- **Proxy test stability sweep.** Three SSE-shaped upstream test
  fixtures were missing the `Cache-Control: no-cache` header and an
  explicit `flusher.Flush()` after writing the body — same pattern
  that bit `TestProxy_OpenAIResponsesStreamingCompletedUsage` and
  `TestProxy_StreamUpstreamError`. Patched proactively to keep
  release runs deterministic:
  `TestProxy_AnthropicStreamingZeroUsageDropped`,
  `TestProxy_OpenAIStreamingNoUsageDropped`,
  `TestProxy_OpenAIStreamingNoUsageKeptWhenCompressed`. Plus
  `TestProxy_StreamUpstreamError` itself: the test client closed
  `resp.Body` without draining, which can race the proxy's
  `teeStream → InsertAPITurn` sequence; now drains via
  `io.Copy(io.Discard, resp.Body)` first. 10× stress-runs all pass.

### Changed

- **Default `compression.conversation.compress_types` is now
  `["json", "logs"]` (was `["json", "logs", "text"]`).** The `text`
  compressor's head-tail truncation strategy keeps the first ~1KB and
  last ~1KB of a body and replaces the middle with a `[truncated]`
  marker — destructive to mid-file content the agent may re-reference.
  Live A/B on a "trace request flow" prompt showed the model re-
  reading `lib/application.js` 8 times in a row trying to recover
  elided content; OFF answered the same prompt in 2 turns. Removing
  `text` from the default closes that regression class. Users who want
  it can opt in explicitly. JSON schema replacement and logs dedup
  remain content-preserving and stay enabled.

- **`crossmount: detected extra home` log demoted INFO → DEBUG.**
  Useful when the cross-mount detector was new (users could see
  exactly which Windows-side homes WSL2 picked up); in steady state
  it re-prints 8+ lines of stable data on every scan. Diagnostics
  that actually change state stay at INFO. (`cmd/observer/main.go`.)

- **CI: `actions/setup-node` Node version bumped 20 → 22.** Node 20
  is in maintenance LTS and the GitHub Actions runtime emits a
  deprecation warning on every workflow run. The publish job only
  invokes `npm publish`, so it's Node-version-insensitive. The
  `actions/checkout`/`setup-go`/`upload-artifact`/`download-artifact`
  versions were already current.

### Added

- **A/B harness pre-flight check.** `scripts/ab-claude-start.sh`
  now hits `/v1/messages` on each daemon's port with a fake
  `x-api-key` after startup; expected response is Anthropic's
  `invalid x-api-key` 401, which proves the proxy *forwards* (not
  just *binds*). If the user has typoed the env-prefix or Claude
  Code ignores `ANTHROPIC_BASE_URL`, the harness now flags it before
  the user burns 4 prompts on a bypassed-proxy run. Pre-flight 401s
  are filtered out of `ab-claude-report.sh`'s aggregates via
  `error_class IS NULL`. Doc tightened with one-liner invocation
  guidance: `cd …` first, then `ANTHROPIC_BASE_URL=… claude` —
  inline env-prefix only attaches to the immediately following
  command, and `… && claude` chains drop the prefix on the second
  step.

- **Claude Code compression A/B harness.** Four shell scripts plus a
  recipe doc give end users a one-command way to measure conversation-
  compression savings on their own Claude Code sessions against a
  real public repo. `scripts/ab-claude-setup.sh` clones a repo
  (default `expressjs/express`) into `/tmp/ab-claude/{on,off}/repo/`
  and writes per-side observer configs (port 8830 vs 8831, separate
  SQLite DBs, `[compression.conversation].enabled` true vs false,
  watch-adapters disabled so the test daemon doesn't ingest the
  user's main `~/.claude/` sessions). `scripts/ab-claude-start.sh`
  brings up both daemons in the background with `--no-dashboard`;
  startup probe uses a connect-only `/dev/tcp` check so it doesn't
  land as a 404 turn in either DB. `scripts/ab-claude-stop.sh`
  tears down without touching the user's main daemon.
  `scripts/ab-claude-report.sh` reads both DBs read-only and prints
  a markdown table covering turns / input / output / cache-read
  tokens / cost USD / compression bytes saved + % / per-mechanism
  breakdown / median + p95 latency. Recipe lives in
  `docs/claude-code-compression-ab.md`. The user drives the actual
  Claude Code sessions (one terminal per port); the scripts handle
  setup, lifecycle, and result extraction.

- **Codex CLI proxy routing from the dashboard.** New `/api/setup/codex`
  GET + POST endpoints back a "Configure Codex CLI" card on the
  Compression tab. The card surfaces only when `~/.codex/config.toml` is
  not already routed through this Observer's proxy and offers a
  one-click write — no terminal, no `observer init --codex`. Reuses
  the `proxyroute.Registrar` code path the CLI uses, so the conflict
  matrix is identical (reserved `[model_providers.openai]` block,
  non-loopback `base_url`, foreign top-level `model_provider` all
  refuse without `force=true`). 409 conflicts surface a "Force
  overwrite" button on the card so users on v1.4.34-broken installs
  recover in one click. ChatGPT-auth installs see an inline note about
  the JSONL-only token capture path. `dashboard.Options.ProxyPort` is
  plumbed from `cfg.Proxy.Port` in `cmd/observer/start.go` so the
  card's desired URL matches the running proxy. 9 new tests in
  `setup_test.go` cover GET (no_config / routed_to_observer /
  reserved_block_present / non_loopback / not_configured) and POST
  (fresh-file / reserved-block-without-force / reserved-block-with-
  force / dry_run) plus method-not-allowed.

- **Compression dashboard: $ savings on charts.** The Compression tab's
  per-day chart and per-mechanism stacked-bar chart previously surfaced
  bytes and tokens only — KPI tile and per-model table already showed
  $, but the time-series visuals didn't. Now:
  - **Per-day chart** replaces the right-hand "Bytes saved" series with
    "$ saved (est.)" — bytes are still totalled in the KPI tile above.
    Y-axis B switches from byte units to USD with a `fmtUSD` tick
    formatter, tooltip routes the $ axis through `fmtUSD` while the
    tokens axis stays on `fmtN`.
  - **Per-mechanism chart** gets a third "$" button on the unit toggle
    (alongside tokens / bytes). Y-axis title and tooltip switch to "$
    saved (tokens × model input rate)" when active.
  - **Footer notes** under both charts spell out the bytes → tokens
    (`÷ 4`) and tokens → $ (× model input rate) math so the derivation
    is on-page rather than buried in the tab blurb.
  - **"Recent compression events" table** gains a `$ saved` column
    between `Saved (tok)` and `Saved %`. Per-row $ uses the joined
    `api_turns.model` priced through `cost.Engine.Lookup`; rows whose
    model has no pricing entry render `—` with a tooltip explaining
    why (bytes/tokens still counted).

  Backend: `handleCompressionTimeseries` now joins `compression_events
  → api_turns` to get per-event model context, looks up each model's
  input rate via `cost.Engine.Lookup`, and emits `saved_usd_est` per
  `(bucket, mechanism)` plus a `total_saved_usd_est` per bucket.
  `handleCompressionEvents` adds `saved_usd_est` to each row in the
  paginated response. Models without a pricing entry contribute 0 to
  $ but still count toward bytes/tokens — matches
  `cost.Engine.Summary`'s `CostSavedUSDEst` semantics. `dashboard_test`
  extended in both endpoints.

Brings the cross-handoff proxy + compression + dashboard + watcher
work together into one shippable bundle. Proves out the A/B
compression test against codex 0.128.0 with ChatGPT-plan auth: short
prompt records 1,402 tokens with compression ON vs 10,106 OFF
(~86% reduction); long prompts record api_turns on both sides with
populated `compressed_bytes` on the ON side.

### Added

- **Proxy: ChatGPT-auth detection + path translation.** Codex
  0.128.0+ rejects overriding the reserved built-in `openai`
  provider, so the recommended workaround is a custom provider name
  — which means codex always sends canonical `/v1/responses` paths
  even on ChatGPT-plan auth, where older codex used native
  `/backend-api/codex/responses`. Path-based detection alone
  therefore mis-routed every request to api.openai.com, where
  ChatGPT JWTs returned 401 ("Missing scopes:
  api.responses.write"). Detection now reads the `Authorization`
  header — `Bearer eyJ...` is a ChatGPT JWT, `Bearer sk-...` is a
  platform API key. When ChatGPT auth is detected on an OpenAI-side
  path, the proxy:
  - routes the upstream request to `chatgpt_upstream` (default
    `https://chatgpt.com`) instead of `openai_upstream`;
  - rewrites `/v1/{responses,models,...}` → `/backend-api/codex/...`;
  - short-circuits `GET /v1/models` with a synthetic 200 carrying
    `{"models":[]}`, since chatgpt.com doesn't expose that endpoint
    and codex's model-list refresher would otherwise spam 401s every
    turn. Codex 0.128.0+ expects the chatgpt-shaped `models` field —
    OpenAI's `{"object":"list","data":[]}` shape trips the decoder
    with "missing field `models`";
  - rejects ChatGPT websocket upgrades when `force_chatgpt_http` is
    set so codex falls back to HTTP POST (Observer can only inspect
    HTTP bodies);
  - decodes/re-encodes zstd request bodies — chatgpt.com sends them
    compressed and the compression layer needs the plain JSON.

  Also: `/v1/models` was historically routed to `ProviderAnthropic`
  by default (no prefix match) — added it to the OpenAI prefix list
  so the short-circuit can match.

- **Compression: Responses-API (`input` array) support.** The
  conversation compressor previously only handled the Anthropic
  `messages` shape. Codex's Responses API uses `input` instead. Adds
  `internal/compression/conversation/openai.go` with input-array
  extraction and structural-aware token compression that preserves
  the user prompt and tool-call structure verbatim.
  budget/scoring/pipeline updated for the new shape; `pipeline_test`
  gets ~360 lines of coverage.

- **Dashboard: ChatGPT-mode awareness + unlinked-turn count.** New
  `internal/intelligence/dashboard/codex_support.go` adds detection
  for the four codex modes (`jsonl_only`, `proxy_unlinked+jsonl`,
  `proxy_linked+jsonl`, `proxy_only`) and three compression modes
  (`none`, `live`, `live_unlinked`). The Codex section's banner now
  shows unlinked proxy turns explicitly so users on the ChatGPT-auth
  path see what's being captured even when the JSONL session can't
  yet be linked. Header, table, and tooltip in `static/index.html`
  updated to surface the new fields. `dashboard_test` gets ~180
  lines of regression coverage for the support-snapshot endpoint.

- **Watcher: settle pass for short ChatGPT-auth Codex sessions.**
  `internal/watcher/watcher.go` runs a delayed second parse after
  each debounced batch so files that grow shortly after the first
  parse get re-ingested even when fsnotify drops the follow-up
  Write event (common on Windows-NTFS for short codex turns). Pairs
  with the v1.4.33 prefetch fix to make live ingestion reliable for
  the ChatGPT-auth A/B path.

### Fixed

- **Proxy: keep ChatGPT-auth turns even when usage is empty.**
  `isEmptyUsage(turn) && !hasCompressionEvidence` previously
  dropped zero-token turns to keep averages clean. That filter
  dropped every non-compressed ChatGPT-auth turn during live
  verification — the chatgpt.com SSE shape can omit the `usage`
  block in places the parser expects, so the OFF-side A/B baseline
  was silently lost on the dashboard. Added a third exemption:
  `&& !chatgptAuth`. Real ChatGPT turns now land regardless of how
  the upstream framed usage.

- **`TestProxy_OpenAIResponsesStreamingCompletedUsage` flake.** The
  new test for `response.completed` usage parsing failed ~80% of
  runs because the upstream test handler wrote the SSE bytes
  without an explicit `flusher.Flush()` call; under contention the
  close-flush race against the proxy's `teeStream` read loop made
  the capture intermittently see zero bytes. Mirrored the
  earlier-passing `TestProxy_OpenAIStreamingWithUsage` pattern
  (`Flush()` + `Cache-Control: no-cache`); 8/8 stable after the
  change. Test-only — the proxy capture path is fully synchronous.

### Documentation

- **npm/observer/README.md.** Per-AI-client setup table now
  separates Codex's two practical capture modes: API-key auth runs
  full proxy + JSONL; ChatGPT-plan login currently behaves as JSONL
  only (live proxy compression depends on the proxy → JSONL session
  link, which isn't yet reliable on the ChatGPT-auth path).

### Added — post-bundle follow-ups

- **Cost engine surfaces D20 summary_calls as a first-class source.**
  New `cost.SourceSummaryCalls` reads the migration-016 ledger
  (`internal/intelligence/cost/summary.go::loadSummaryCallRows`).
  Rows are tagged `source = "summary_calls"` and
  `tool = "observer-rolling-summary"` so per-tool grouping shows the
  observer-initiated Haiku spend separately from natural turns. Wired
  into `SourceAuto` so `observer cost` CLI, `mcp__observer__get_cost_summary`,
  and dashboard cost-by-model views all pick it up automatically without
  per-consumer changes. Defensive against missing migration 016
  (no-such-table → empty rows, never a fatal error). 3 new tests pin
  the shape: `TestSummary_SourceAuto_IncludesSummaryCalls`,
  `TestSummary_SourceAuto_TaggedAsObserverTool`,
  `TestSummary_SourceSummaryCallsOnly`. Pre-fix the dashboard's
  rolling-cost panel was the only place that knew about Haiku spend;
  totals on the cost CLI / MCP tool understated the user's bill by the
  rolling-summ portion. Honest framing: production users won't see
  these rows until they enable D20 (off by default), so totals only
  drift on configs where rolling-summ is actually firing.

- **K43 PatternMiner emits threshold-tuning hints.**
  `learn.PatternMiner.Report` now also reads `compression_events` to
  compute `TotalStashes` and `RetrieveRate`, then runs
  `deriveThresholdHints` to produce banded recommendations:
  * 0 retrieves on ≥ 10 stashes → info: "current threshold catches
    bodies the model never returns to; raising
    `compression.conversation.stash.threshold_bytes` (default 8192)
    would shrink the stash dir without hurting safety."
  * retrieve rate ≥ 5% → consider: "model returns to stashed content
    often; lowering threshold captures smaller bodies the model is
    asking about."
  * retrieve rate in (0, 5%) → info: "within expected baseline;
    no threshold change recommended" (matches the CCR-moat reframe:
    retrieve rate measures safety-net utilisation, not the primary
    cost saving).
  Surfaced in the dashboard's Reversibility panel via a new
  `retrieval-hints` block (rendered only when hints fire — fresh
  installs stay clean). `GET /api/compression/retrieval` now
  delegates to `PatternMiner.Report` instead of inlining duplicate
  SQL — DRY win + Hints surface naturally.
  Tests: `TestPatternMiner_RetrieveRateAndHints` covers all three
  bands + the no-stashes no-op case.

### Changed — post-bundle follow-ups

- **D20 tool-pair safety reads from `Message.ToolUseIDs` /
  `Message.ReferencedIDs` instead of re-parsing Raw bytes.**
  `summarizableBoundary` previously called `extractToolUseIDs(msg.Raw)`
  twice per message in the tool-pair walk — once to collect referenced
  IDs in the tail, once per backward-walk message to check producers.
  The same parsing already happens at extract time
  (`anthropic.go::fillFromBlocks`) and populates `Message.ToolUseIDs` /
  `ReferencedIDs`, so the walk now reads those fields directly. No
  behaviour change — pinned by existing
  `TestSummarizeIfThreshold_PreservesToolPairsAcrossBoundary` +
  `TestSummarizableBoundary_PreservesToolPair`. Removed dead
  `extractToolUseIDs` + `bytesTrimSpace` helpers and the
  `TestExtractToolUseIDs` parser-shape test (the actual parser is
  `fillFromBlocks`, covered by integration tests).

- **A/B harness threshold reverts.**
  `/tmp/ab-claude/on/observer-config.toml`:
  `compression.conversation.stash.threshold_bytes` 1024 → 8192 (production
  default), `compression.conversation.rolling.threshold_tokens` 10000 →
  80000 (production default). Inline comments updated.
  `~/.observer/config.toml`: stash dir repointed from
  `/tmp/ab-claude/on/stash` → `~/.observer/stash`, threshold 1024 →
  8192. The earlier dir mirroring was a workaround for the MCP/proxy
  config split; the new `--config` propagation (see Fixed below)
  removes the need for it. Numbers from the v1.4.43+ stress runs are
  unsafe for headline claims now that thresholds are aggressive — a
  fresh A/B re-run with these production thresholds is the next
  measurement to take.

### Fixed — post-bundle follow-ups

- **`observer init --config` now propagates to MCP + hook
  registrations.** Surfaced 2026-05-08 dogfood. Without this, the
  registered MCP launch (`observer serve`) and hook commands
  (`observer hook claude-code <event>`) always read
  `~/.observer/config.toml`, regardless of which proxy daemon they
  paired with. Three concrete breakages: (1) MCP server's
  `retrieve_stashed` registration could not align with whichever
  proxy was actually stashing (had to mirror stash config in the
  main file); (2) `/compact` rows landed on the main DB even when
  the harness proxy fired the hook → D23's `Injector` queried the
  proxy's DB and found nothing; (3) K43 retrieve_stashed signals
  landed on the main DB rather than the harness DB.
  Fix: `RegisterOptions.ConfigPath` on both `internal/mcp/register.go`
  and `internal/hook/register.go`. When set, the registered argv
  becomes `serve --config <path>` (MCP, JSON args array) or
  `hook claude-code <event> --config '<shell-quoted path>'` (hook,
  bash -c command string with POSIX single-quote escaping for paths
  with spaces / quotes). `cmd/observer/init.go` gains a `--config`
  flag that validates + absolutises before threading into both
  registrars. `cmd/observer/hook.go` gains a `--config` flag that
  threads through every `config.Load()` call. Same-binary args
  drift silently refreshes the registration; non-observer entries
  still require `--force`. New tests:
  `TestRegistrar_ConfigPathThreadedIntoArgs`,
  `TestRegistrar_ConfigPathChangeIsNotAlreadySet`,
  `TestRegisterClaudeCodeWithConfigPath`,
  `TestRegisterClaudeCodeRefreshesOnConfigPathChange`,
  `TestShellQuoteEscapesSingleQuotes`.

## [1.4.35] — 2026-05-06

Hot-fix on top of v1.4.34. Live verification surfaced that codex
0.128.0+ rejects any attempt to override the built-in `openai`
provider in `config.toml` with a hard config-load error
("model_providers contains reserved built-in provider IDs:
`openai`. Built-in providers cannot be overridden."). The
`[model_providers.openai]` block v1.4.34's `observer init --codex`
wrote is therefore unloadable on current codex — any user who ran
v1.4.34's init now has a config that prevents codex from starting at
all. Recovery requires re-running init with the new release.

### Fixed

- **Codex proxy auto-registration uses a sibling provider, not an
  override of the reserved `openai` ID.** `observer init --codex` now
  writes a custom provider under the non-reserved name
  `openai-observer` and switches `model_provider` to it, instead of
  trying to override the built-in `openai` provider:

  ```toml
  model_provider = "openai-observer"

  [model_providers.openai-observer]
  name = "OpenAI (via Observer)"
  base_url = "http://127.0.0.1:8820/v1"
  wire_api = "responses"
  requires_openai_auth = true
  ```

  ChatGPT-auth survives via `requires_openai_auth = true` on the
  custom provider — that field exists on `ModelProviderInfo`
  specifically to let custom providers reuse the OpenAI auth flow.

  **Migration path for v1.4.34-broken installs.** When init runs
  against a config that already contains the old reserved
  `[model_providers.openai]` block, it errors with a clear explanation
  and points at `--force`. With `--force`, the reserved block is
  deleted and replaced with the custom-provider shape. A single
  `observer init --codex --force` recovers a v1.4.34-broken install.

  Other refused conflicts (existing v1.4.34 conflict matrix, now
  applied to the new key): a non-loopback `base_url` on the custom
  provider (third-party routing — only `--force` overwrites), and a
  top-level `model_provider` that points at a different provider
  (e.g. `anthropic` — again only `--force` flips it). A `127.0.0.1`
  base_url on a different port is treated as the user's own observer
  install and reports `AlreadySet` without changes.

  `--skip-proxy-route` hint output is also updated so users following
  the manual path get the new shape (with an explanatory note about
  the reserved-ID constraint), not the broken v1.4.34 shape.

  Coverage: `internal/proxyroute/codex_test.go` restructured to 11
  cases — fresh-file, preserves-unrelated, reserved-block-rejected,
  reserved-block-force, idempotent-same-port, loopback-collision,
  non-loopback-refused-with-force, third-party-model-provider-refused,
  half-state (provider written but model_provider not flipped),
  dry-run, `IsObserverBaseURL`, and `CodexHint` key contents.

## [1.4.34] — 2026-05-06

Two follow-ups from v1.4.33's live verification: codex now wires its
proxy automatically (it was silently bypassing the proxy because the
`OPENAI_BASE_URL` env var path codex 0.128.0 ignores was the only one
documented), and `observer doctor` now surfaces the dual-daemon failure
mode that turned the v1.4.32 codex-prefetch bug into a recurring
"phantom partial session" symptom.

### Added

- **Codex proxy auto-registration via `internal/proxyroute`.**
  `observer init --codex` now writes the proxy routing config into
  `~/.codex/config.toml` (e.g. `OPENAI_BASE_URL =
  "http://127.0.0.1:8820/v1"`) so codex actually transits the observer
  proxy. Pre-fix init only touched MCP and printed a hint; users had
  to hand-edit TOML or remember the `-c` flag, and codex 0.128.0
  silently ignores the `OPENAI_BASE_URL` env var that the docs
  examples leaned on. The new package owns per-tool routing as a
  concern parallel to `internal/mcp`. `RegisterCodex` round-trips
  through TOML's generic `map[string]any` so unrelated sections —
  including the `[mcp_servers.observer]` table written by the MCP
  registrar — survive intact. Same idempotent + dry-run + force
  pattern as MCP/hook registration: re-running with the same port
  reports `AlreadySet`, a different loopback URL is treated as the
  user's own observer (warn but don't clobber), a non-loopback URL
  refuses without `--force`. New CLI flags on `observer init`:
  `--proxy-port` (default 8820) and `--skip-proxy-route` (print the
  manual hint instead of writing the file). The existing claude-code
  routing hint is now parameterized on the same `--proxy-port` value
  so it stops hardcoding `8820` in its example output. Coverage: 8
  unit tests in `internal/proxyroute/codex_test.go` for the
  fresh-file / preserves-unrelated / idempotent / loopback-collision
  / non-loopback-refused-with-force / dry-run / `IsObserverBaseURL` /
  hint paths.
- **Doctor check: multiple observer daemons sharing a DB.** Two
  `observer.exe` processes watching `~/.codex/sessions/` against the
  same `~/.observer/observer.db` race on the `parse_cursors` table —
  one advances past resumed-context lines and the other never sees
  them, silently corrupting backfill state. This was the root cause
  of the v1.4.32-era "phantom partial session" symptoms during live
  verification of the codex prefetch fix; killing the stale
  npm-installed observer was the only way to recover. `observer
  start` now writes a per-PID lockfile under the DB directory
  (`observer-<pid>.lock` — JSON with `pid` / `started_at` / `db_path`
  / `binary_path`) and removes it on clean shutdown. Stale lockfiles
  from crashed processes are swept on the next `observer start`. The
  new doctor check `daemon.unique` enumerates live lockfiles and
  warns when more than one is alive on the same DB, with each PID +
  binary path printed for forensics. 0 daemons (just running doctor)
  is OK; 1 daemon is OK; 2+ is a warn nudge to kill the strays.
  Cross-platform liveness: `os.FindProcess` on Windows verifies the
  handle; `Signal(0)` on Unix. False negatives bounded — at worst a
  stale lockfile sticks around until the next `observer start`
  sweep. Coverage: 8 unit tests in `internal/diag/lockfile_test.go`
  for `WriteLock` / `RemoveLock` round-trip, stale-PID filtering,
  sort order, empty dir, garbage files, plus the three
  `checkConcurrentDaemons` cases (none / one / multiple).

## [1.4.33] — 2026-05-06

### Fixed

- **Codex incremental parse now preserves session context across
  resume.** When the watcher's first parse advanced the cursor past
  `session_meta` and the file then grew with `token_count` /
  `function_call` / `task_complete` events, the resumed parse started
  with empty `Cwd` (no `session_meta` in the new chunk) and the
  date-prefixed filename as `SessionID`. Every emitted event therefore
  had `ProjectRoot=""`, and `store.Ingest` silently dropped the lot
  because empty `ProjectRoot` is a hard skip — short ChatGPT-auth
  Codex sessions surfaced on the dashboard with only the leading 4
  prompt rows and 0 tokens unless the user ran `observer scan
  --force`. The parser now prefetches the file's leading
  context-bearing lines (`session_meta`, `session_configured`,
  `turn_context`) on every resume so the resumed events inherit the
  canonical UUID `SessionID` and the recorded `cwd`. Regression
  tests: `TestResumePreservesSessionContext` (codex unit) replays the
  failure-mode rollout shape and asserts every resumed event carries
  a non-empty `ProjectRoot` and the UUID `SessionID`;
  `TestCodexShortSessionMultiPassIngest` (watcher integration) drives
  the same shape end-to-end through a real SQLite store and asserts
  the `run_command` row lands; `TestCodexConcurrentProcessFileRace`
  fires two `processFile` calls concurrently for one path to confirm
  INSERT OR IGNORE + MAX cursor semantics keep the result deterministic
  even when the watcher's debounce + settle timers race. Already-broken
  sessions can be backfilled once with `observer scan --force`.

## [1.4.32] — 2026-05-05

Surface the full underlying text on the per-message timeline expand
view. Three coordinated additions:

### Fixed

- **Per-tool-call `full_text` on `/api/session/<id>/messages`.** The
  adapter truncates `target` to 200 chars for the table-row preview;
  prompt-style actions (`user_prompt`, `system_prompt`, `ask_user`,
  `run_command`) now also surface their pre-truncation `raw_tool_input`
  via a new `full_text` field. Prompts that ran past the 200-char
  cap are no longer cut off when the row is expanded.
- **`run_command` argv decode for display.** Codex / Claude shells
  serialize commands as JSON arrays (e.g.
  `["powershell.exe","-Command","Get-ChildItem ..."]`). The new
  `decodeCommandInput()` helper detects a leading `[`, JSON-unmarshals
  into `[]string`, and joins with spaces for human-readable display.
  Defensively tolerant — falls back to the raw string on any decode
  error or empty input.
- **`excerpt` field surfaced inline.** `action_excerpts` rows
  (FTS5-indexed tool-output excerpts) are now LEFT JOIN'd into the
  `/api/session/<id>/messages` response and rendered as a
  `**Output:** …` sub-line under each tool call on the expand view.
  Previously only visible via the search tab.

## [1.4.31] — 2026-05-05

Fix the session modal's per-message cost rollup for long-context models.
The dashboard was summing all token rows under one `message_id` and then
pricing that aggregate as a single synthetic turn, which falsely tripped
LC pricing for GPT-5.4/5.5 and could do the same for Claude Sonnet 4/4.5
and Gemini Pro families whenever multiple sub-threshold turns shared one
message row.

### Fixed

- **Per-message timeline cost is now priced per underlying deduped turn,
  then summed back into the message row.** This keeps LC threshold checks
  on the real turn boundary instead of the UI aggregation boundary, so the
  message modal no longer doubles displayed cost for sessions like the
  user's local Codex audit.
- **Regression coverage for multi-turn single-message rows under
  `gpt-5.5`.** New dashboard test proves two 150K-input turns grouped
  under one message still bill at standard tier (`$1.50` total), not the
  false aggregate LC tier (`$3.00`).

## [1.4.30] — 2026-05-05

Docs-only follow-up to v1.4.29. Both READMEs (top-level + npm
package) had drifted behind the adapter set: Google Antigravity and
Gemini CLI shipped in v1.4.29 but neither was listed in the supported
clients prose, the per-client setup table, the JSONL-adapters
architecture section, the per-AI-client breakdown lists on the
Sessions / Tools tabs, the reliability-tagging paragraph, the
Discovery glossary "Tool" definition, or the architecture diagram's
adapter count.

### Documentation

- **`README.md`**: opening sentence + Tools-tab description list +
  architecture diagram's adapter count (9 → 10) + the
  `observer backfill` granular-flags list (added
  `--codex-project-root` and `--antigravity-project-root`).
- **`npm/observer/README.md`**: opening "across X, Y, Z" sentence +
  per-AI-client setup table (two new rows describing Antigravity's
  encrypted-protobuf + oscrypt-key-fetcher + gRPC-bridge fallback
  pipeline and Gemini CLI's dual-format JSON/JSONL dispatch with the
  three-step project-root fallback) + reliability-tagging paragraph
  + Sessions-tab tool list + Discovery glossary "Tool" definition +
  architecture-section "JSONL adapters (passive ingest)" prose
  (added the Antigravity-specific decryption + gRPC-fallback
  paragraph).

## [1.4.29] — 2026-05-05

Antigravity coverage round 2 — close the orphan-token-row gap on the
dashboard for agentic sessions, plus a JSONL recovery pass for Claude
Code's own log corruption and two WSL2-side cleanups around the
language-server bridge.

### Added

- **Tier 4 — `structured.run_command` extraction** from
  `1.2.19.4.8.x` terminal-session snapshots embedded in every
  `1.2.19` user-message envelope. Each `1.2.19` carries a snapshot of
  every live IDE terminal; we walk the snapshot, dedup commands by
  `(terminal_uuid, start_unix_sec)` (the same command repeats in
  every later snapshot until the session is closed), and emit one
  `structured.run_command` ToolEvent per unique command with
  scrubbed `cwd`, stdout/stderr, real start timestamp, duration, and
  exit-code-derived success flag. **184 commands extracted DB-wide**
  in the live smoke.

- **Tier 5 — `structured.plan_step` extraction** from `1.2.93.x`
  (step-type enum `1.2.1 = 81`). The agent emits one of these
  between actions carrying step description (`.2`), long-form
  analysis (`.3`), and a status varint (`.5` — observed values 1, 2,
  3). Surfaces agent reasoning that the markdown trajectory and Tier
  3 PLANNER_RESPONSE often miss. **2,438 plan steps DB-wide**.

- **Tier 6 — `structured.final_summary` extraction** from
  `1.2.94.x` (step-type enum `1.2.1 = 82`). The agent emits these as
  polished markdown sign-offs at major milestones; `.1` lists
  referenced file URIs and `.2` is the formatted summary body. **427
  final summaries DB-wide**.

- **Dashboard orphan-token-row stub.** For agentic sessions where
  the upstream API stores no extractable content for most LLM calls
  (gemini-style tool-call-only turns), `/api/session/<id>/messages`
  now synthesizes a `synthetic.api_call` toolCallRow per orphan
  carrying the per-turn token totals so the expand-row view shows
  *something* instead of the previous "—". Gated on orphan ratio
  > 0.5 so claude sessions (where every turn already has narrative
  or a tool call) don't grow noise stubs that obscure real content.

- **Claude Code JSONL prefix-recovery for concatenated records.** A
  rare CLI atomic-write failure can produce a single JSONL line
  containing two records back-to-back (the writer was interrupted
  before the first record's trailing newline could flush, the next
  record's payload was then appended directly). Pre-fix the
  adapter's `json.Unmarshal` returned an error and the entire line
  was dropped. The new `recoverConcatenatedJSONLines` helper scans
  the malformed line for `{"parentUuid":` and `{"type":"` anchors,
  streaming-decodes each anchor-rooted suffix, and returns every
  parseable sub-record. The leading truncated record is still
  unrecoverable (its tail was overwritten); trailing records parse
  cleanly. Verified on the user's host: **6 sub-records salvaged**
  across 4 corrupted lines that would previously have been lost.

- **`structured.plan_step` + `structured.final_summary` + `structured.run_command`
  enum mapping table** added to the smoke recipe doc, including the
  three remaining unmapped step-type enums (17, 21, 23, 65, 81, 82,
  83) probed during this work and the rationale for which were
  shipped vs. deferred (errors, redundant terminal output, memory
  recall, full-file snapshots).

### Fixed

- **Bug 1 — token MessageID rewire (join correctness).** The
  initial Path B commit (`5af3771`) emitted token rows with
  MessageID `antigravity-struct:<uuid>:turn:N`. The subsequent
  bug-fix session moved structured ToolEvents to the shared
  `antigravity:<uuid>:turn:N` scheme so they'd join under the right
  per-turn cluster on the dashboard — but token rows already in the
  DB kept the legacy prefix and were orphaned from every joined
  ToolEvent. The antigravity-project-root backfill now runs an
  `UPDATE token_usage SET message_id = ?` keyed by `(source_file,
  source_event_id)`, refreshing the legacy prefix in place.
  Idempotent — re-runs find no rows to update.

- **Bug 2 — coverage-conditional `markdown.planner_response` dedup
  with bridge re-fetch recovery.** The initial Tier 3 work always
  suppressed `markdown.planner_response` rows whenever any
  `structured.assistant_text` existed. For gemini sessions where
  structured covers <10% of LLM calls (e.g. 803add5e: 3/130), this
  wiped 90%+ of the assistant narrative. Both the live recovery
  (`adapter.go::recoverViaLocalGRPC`) and the backfill
  (`backfillAntigravityProjectRoot`) now gate dedup on
  `antigravity.AssistantTextCoverageThreshold = 0.5`. Below that
  ratio, structured is too sparse to be authoritative; markdown
  stays. The backfill ALSO re-fetches the markdown trajectory via
  the bridge for sessions below the threshold, parses
  planner-response-only events, and idempotently INSERTs them to
  recover any rows a prior over-aggressive dedup pass deleted.
  **1,278 markdown.planner_response rows recovered** across the
  sparse-structured sessions on the user's host.

- **Option 1 — time-based MessageID for `structured.run_command`.**
  Tier 4's terminal-snapshot extraction always pinned each command's
  MessageID to the FIRST `1.2.19` step where the snapshot appeared,
  but the command may have actually run hours later — the dashboard
  showed all FB48 run_commands clustered on turn 0 even though the
  python invocation ran ~8 minutes after the conversation started.
  `nearestTokenMessageID(ts, en.TokenEvents, conversationID)` now
  picks the MessageID of the TokenEvent whose Timestamp is closest
  to the command's `t.startSec`. Token timestamps are spread evenly
  across `[StartedAt, EndedAt]`, so nearest-by-time still places
  commands in the correct turn cluster. Live smoke on 803add5e: 8
  commands previously at turn:0 (4) + turn:117 (4) now spread across
  turn:0 (4) + turn:15 (3) + turn:128 (1).

  A new `updateActionMessageID` UPDATE was added to the antigravity
  backfill (mirroring `updateTokenMessageID`) so existing rows pick
  up the new turn assignment — `InsertActions`' ON CONFLICT only
  refreshes `duration_ms`, so without this UPDATE existing rows kept
  stale ids and stayed orphaned from the dashboard's per-turn
  grouping. Live smoke: **69 action message_ids rewired** on the
  first run; idempotent on re-runs.

- **Option 4A — WSL2 routing for Linux-native conversations.**
  `recoverViaLocalGRPC` on WSL2 used to route everything to the
  Windows-side bridge, leaving the ~18 Linux-native `.pb` files
  under `~/.gemini/antigravity/conversations/` permanently
  unrecoverable. The WSL2 branch now attempts Linux-native
  language-server discovery first (via the existing
  `discoverNativeLinux` helper) and falls through to the bridge on
  failure. The attempt is **path-gated to `/home/...` paths** —
  Windows-side `.pb` files (under `/mnt/c/`) are guaranteed not to
  be hosted by a Linux-native server, so the attempt would be
  wasted overhead. Live smoke: ~80% of conversations (the
  Windows-side ones) now skip the Linux-native attempt entirely,
  saving roughly one failed 5s-timeout HTTP call per conversation
  off Run All.

- **Option 4B — bridge cache-dest race.**
  `bridge.go::windowsCacheDestination` previously re-probed the
  `/mnt/c/...` write target on every invocation, racing concurrent
  bridge calls on a shared `.observer-write-probe` marker (one call
  removed the marker before the other read it; the loser surfaced
  `no writable /mnt/c destination`). The resolved destination is now
  cached process-wide via `sync.Once`, and the marker filename is
  PID-suffixed so cross-process first-calls don't race either.
  Live smoke: backfill no longer surfaces the intermittent
  `wsarecv: An existing connection was forcibly closed by the
  remote host` cascade that previously ran the wall time up to
  ~5min on a typical Run All.

### Notes

- **Conversations under `~/.gemini/antigravity/conversations/` that
  weren't loaded by any running language_server** still fail both
  recovery paths and skip with a warning. The fix-by-reopen path
  (open the originating workspace in Antigravity so a fresh
  `language_server_linux_x64` is spawned with the matching
  `--workspace_id`) is operator-side, not observer-side. Flagged in
  the smoke doc.

## [1.4.28] — 2026-05-03

User-flagged correctness batch: project attribution for Windows-side
Codex data, missing time-elapsed metric on the per-message timeline,
broken days filter on the Sessions tab, and same-timestamp ordering.

### Fixed

- **Codex Windows-cwd → cross-mount translation.** Codex on Windows
  records `cwd` as a Windows path like `c:\programsx\regulation`. On
  WSL2, `filepath.Abs` doesn't recognise the drive prefix and treats
  the string as a relative path, prepending the observer's CWD. Then
  `findGitRoot` walks UP that bogus path looking for `.git` — and in
  the worst case lands on observer's own repo. The user's live DB had
  all 1,350 Codex actions misattributed to
  `/home/marmutapp/superbased-observer`. The codex adapter now
  translates Windows-style cwds via the new
  `crossmount.TranslateForeignPath` helper before resolving (`c:\…` →
  `/mnt/c/…` on Linux). Post-fix smoke: all 1,350 actions correctly
  attributed to `/mnt/c/programsx/regulation`.

- **Backfill: `--codex-project-root`.** New backfill (also wired into
  `--all`) re-reads each codex rollout's first `session_meta` line,
  applies the cwd translation, resolves the new project, and UPDATEs
  every cascaded session/action row whose current `project_id`
  differs. Walks crossmount-resolved homes so Windows-side rollouts
  reachable via `/mnt/c/Users/*/.codex` are picked up. Idempotent.

- **Sessions tab now honours the global days filter.** `/api/sessions`
  accepted only `tool` and `project` — the dropdown's `days=N` was
  silently dropped, so a 30-day window still rendered every session
  in history. Endpoint now accepts `days` (alongside the existing
  filters); `loadSessions()` forwards the global window. Total /
  scored counts share the same WHERE clause so pagination stays
  coherent. `days=0` (or omitted) preserves the prior "no time
  filter" behaviour for older callers. Smoke: 30-day window on the
  user's DB returned 157 of 210 total sessions; 7-day returned 23.

- **Per-message timeline: tie-break ordering on equal timestamp.**
  When a synthesized user_prompt and its assistant turn shared a
  wall-clock (the proxy / adapter often stamps both with the same
  millisecond), `sort.SliceStable` preserved insertion order, which
  was non-deterministic w.r.t. role. Comparator now explicitly
  prefers `role=user` on ties so the timeline reads "user said X →
  assistant did Y" consistently.

### Added

- **Per-message wall-clock elapsed metric.** New `elapsed_ms` field
  on `/api/session/<id>/messages` rows: gap from this message's
  timestamp to the next message's, computed across the full sorted
  timeline (so rows near a page boundary still get a correct
  successor). Surfaced as a new "Elapsed" column on the per-message
  timeline. For user rows it approximates "time the assistant took to
  respond"; for assistant rows it approximates "time the user took
  before the next prompt". `null` on the final message in a session.

- **Per-message tool-execution time + per-tool-call duration.**
  Companion field `tool_duration_ms` sums the contained tool_calls'
  `actions.duration_ms`, surfaced as a "Tool time" column. Per-tool
  rows in the expand panel now show their individual duration in
  square brackets. Differs from `elapsed_ms` (wall-clock between
  messages) by excluding model-think time and user typing time.

- **Adapter coverage for `actions.duration_ms`.** Pre-fix only
  copilot-modern (via `elapsedMs`) and a subset of codex paths
  (legacy `duration: {secs, nanos}` struct) populated `duration_ms`.
  Live coverage: claude-code 0/42,338; codex 0/1,350. Two
  fixes:

  - **claude-code:** when matching a `tool_use` block to its later
    `tool_result`, compute the wall-clock gap and write it to
    `DurationMs`. Anthropic's JSONL has no structured per-tool
    elapsed field so the timestamp delta is the only signal.
  - **codex `response_item`:** when matching `function_call` (or
    `custom_tool_call`) to its `function_call_output`, fall back to
    the timestamp gap when no structured duration is on the row
    yet. Newer codex builds bury the duration in flat-text output
    (`Wall time: 32.3 seconds`) or in nested JSON metadata
    (`{"output":"…","metadata":{"duration_seconds":1.1}}`); the gap
    works for both without parsing variant-specific fields.

  Post-fix coverage on the user's live DB: claude-code 91.1%
  (34,965/38,383), codex 86.3% (1,165/1,350).

- **`actions.duration_ms` refreshes on conflict.** Adapter
  improvements above only populate `duration_ms` on INSERT; the
  pre-existing `INSERT OR IGNORE` semantics meant historical
  rows would stay at zero forever even after a `backfill --all`
  rescan. The insert now uses `ON CONFLICT(source_file,
  source_event_id) DO UPDATE SET duration_ms = CASE WHEN
  excluded > 0 AND existing IS NULL/0 THEN excluded ELSE
  existing END` — picks up new values from a re-parse while
  protecting any value that's already populated. Smoke
  simulation: zeroed durations on a session went from 0/210 →
  286/294 (97.3%) after `backfill --all`. Pattern mirrors
  v1.4.27's `token_usage.model` upsert. Side-effect: the
  `InsertActions` return value (and the `ActionsInserted`
  metric on `IngestResult`) now reports "rows touched" rather
  than "actually new rows" because SQLite's `RowsAffected`
  doesn't distinguish insert from update on conflict; the
  contract remained "no row duplication", which is now
  asserted via `SELECT COUNT(*)` in tests.

- **"All time" option on the global window dropdown.** The
  dashboard toolbar previously offered only 7 / 30 / 90 / 365
  days. The new option sends `days=36500`. Every relevant
  endpoint's `intArg(r, "days", 30, 1, 365)` clamp had its
  upper bound bumped to `36500` (~100 years) so the value
  passes through unmodified. `/api/sessions` also accepts
  `days=0` as an explicit "no time filter" sentinel for older
  CLI / API consumers.

### Schema

No migrations.

## [1.4.27] — 2026-05-02

Modern VS Code Copilot Chat support. v1.4.26 noted that the legacy
debug-log auto-flip is irrelevant to users on Copilot Chat ≥0.45,
which writes to entirely different files in a snapshot+patches JSONL
format. This release ingests that format directly.

### Added

- **Modern Copilot Chat parser.** Single Copilot adapter now dispatches
  on path shape between the existing legacy `debug-logs/.../main.jsonl`
  scanner and a new snapshot+patches parser for:
  - `<workspaceStorage>/<ws>/chatSessions/<sessionId>.jsonl` —
    workspace-bound chats.
  - `<globalStorage>/emptyWindowChatSessions/<sessionId>.jsonl` —
    chats opened with no folder attached.

  Each line is one JSON object with a `kind` discriminator. Three line
  types are handled:

  - `kind=0` — full session snapshot. Multiple snapshots can appear in
    one file (VS Code rewrites the snapshot when a session reopens);
    the parser keeps only the LAST one and discards earlier ones'
    accumulated patches.
  - `kind=1` — replace the value at JSON-pointer-style path `k` with
    `v`.
  - `kind=2` — splice insert: insert the elements of `v[*]` into the
    array at path `k` starting at index `i`, or append when `i` is
    omitted. This is how VS Code adds NEW turns to `requests[]` after
    the snapshot was written; without handling it, every turn after
    the first would be silently lost.

  All patch lines are filtered on `k[0]=="requests"` so
  `inputState/attachments` patches drop without ever materializing
  multi-MB inline image payloads (the user's data has 7.8 MB and 14.8
  MB attachment patches that would otherwise dominate memory).

  Idempotence keys on `requestId` (stable across snapshot rewrites)
  via the existing `(source_file, source_event_id)` UNIQUE constraint;
  `fromOffset` is intentionally ignored because snapshot replay has no
  meaningful resumption point.

  **Model resolution.** `Model` now prefers
  `requests[].result.metadata.resolvedModel` — the actual upstream
  model that processed the turn (e.g. `claude-haiku-4-5-20251001`,
  `grok-code-fast-1`) — over `requests[].modelId`, which usually
  carries the user-facing routing choice (`copilot/auto`) when the
  user hasn't pinned a specific model. `modelId` is the fallback when
  `resolvedModel` is absent (e.g. snapshot written before the result
  patch landed).

  **Per-turn token mapping.**
  - `result.metadata.promptTokens` → `InputTokens`
  - `completionTokens` (fallback `result.metadata.outputTokens`) →
    `OutputTokens`
  - Sum of `result.metadata.toolCallRounds[*].thinking.tokens` →
    `ReasoningTokens`
  - Cache token counts are NOT exposed by this format (VS Code only
    emits `cacheType:"ephemeral"` markers on rendered context blocks,
    no count) — same gap as legacy.

### Changed

- **Token usage rows refresh `model` on conflict.** Previously
  `INSERT OR IGNORE INTO token_usage` silently dropped re-inserts,
  so a row first written with a placeholder model
  (`copilot/auto`) kept that label even after a re-scan with an
  improved adapter resolved the actual upstream model
  (`claude-haiku-4-5-20251001`). The insert now uses
  `ON CONFLICT(source_file, source_event_id) DO UPDATE SET
  model = COALESCE(NULLIF(excluded.model, ''), token_usage.model)`,
  which propagates new model values without ever clobbering an
  existing one with an empty string. Counts, cost, source, and
  reliability are still preserved on conflict — they are
  quality-sensitive and a re-parse must not overwrite a
  proxy-accurate value.

- **Dashboard messages: user_prompt rows show per-turn model.**
  When the dashboard's `/api/session/<id>/messages` endpoint
  synthesizes a row for a `user_prompt` action (which has no
  `token_usage` row to join against), it now looks up the peer
  `assistant:<requestId>` row and inherits its model. Falls back
  to `sessions.model` only when the peer's model is empty. Pre-fix
  every user prompt in a multi-turn session displayed the FIRST
  turn's model (`sessions.model` is set once on session creation),
  which surfaced as a real bug whenever Copilot Auto routed
  different turns to different upstream models.

- **Tool-name normalization for camelCase.** `mapToolName` now
  collapses camelCase (`runInTerminal`, `replaceStringInFile`,
  `editFiles`, `viewImage`, `fileSearch`, ...) and snake_case
  (`run_in_terminal`, `replace_string_in_file`, ...) variants into
  a single key by lowercasing and stripping underscores, so the
  legacy and modern formats share one mapping table without parallel
  entries. New entry: `viewImage` → `read_file`.

- **`globalStorage/emptyWindowChatSessions` watch root.** Per-OS
  variant added to `defaultRoots` alongside the existing
  `workspaceStorage` root.

### Smoke

Live test against the user's WSL2 host on 2026-05-02 against
`/mnt/c/Users/auzy_/AppData/Roaming/Code/User/...`:

- 5 modern session files cursored: 3 workspace `chatSessions`, 2
  `emptyWindowChatSessions` — including a 7.8 MB and a 14.8 MB
  attachment-heavy file, both processed without crash.
- 13 Copilot actions captured (2 user prompts + 2 task_complete + 7
  read_file + 2 search_files), 2 token rows.
- 0 Copilot parse warnings.

Recipe in `docs/copilot-modern-smoke-test.md`.

### Schema

No migrations.

## [1.4.26] — 2026-05-02

WSL2/Windows quality bundle: cross-platform tool discovery, watcher
self-recovery, and one-shot enabling of VS Code's legacy Copilot
debug-log writer.

Note on Copilot: the auto-flip targets the legacy `debug-logs/...
main.jsonl` writer. Modern VS Code Copilot Chat (≥0.45) writes to
`workspaceStorage/<ws>/chatSessions/*.jsonl` and
`globalStorage/emptyWindowChatSessions/*.jsonl` in a snapshot+patches
format observer doesn't yet parse — this is queued for v1.4.27. See
`docs/copilot-modern-format.md`.

### Added

- **Cross-mount adapter discovery for WSL2 ↔ Windows installs.** Pre-fix
  observer running in WSL2 only inspected `/home/<u>/...`; tools
  running on the Windows side (Codex, Claude Code, Copilot Chat,
  Cline, Roo Code, OpenClaw, Pi) were silently invisible because
  their data lives at `/mnt/c/Users/<u>/...`. Symmetric problem on
  the reverse: observer in Windows native couldn't see WSL distro
  homes. With this fix:

  - On WSL2 (any Linux host where `/mnt/c/Users` is statable), every
    directory under `/mnt/c/Users` becomes a candidate Windows home.
  - On Windows (any host where `\\wsl.localhost\` is enumerable),
    every `<distro>/home/<user>` becomes a candidate Linux home.
  - On macOS / pure Linux / pure Windows hosts, no extras are
    detected — behavior is identical to pre-fix.

  Each adapter's `WatchPaths` / `defaultRoots` now expands to the
  appropriate subpath under every detected home, with per-OS
  branching where the subpath differs (Copilot/Cline VS Code
  globalStorage, OpenCode desktop variants). Adapters with uniform
  subpaths (Codex, Claude Code, OpenClaw, Pi) just iterate.

  Auto-detection by default; no config knob needed for the common
  case. Detected extras are logged at INFO at startup so the user
  can confirm what was picked up:

      crossmount: detected extra home path=/mnt/c/Users/<u> os=windows origin=wsl-mnt:<u>

  Verified end-to-end on a WSL2/Windows install: 173 of 525
  ingested files came from cross-mount paths post-fix; codex went
  from 0 → 1,350 actions captured, claude-code grew by ~6,500
  Windows-side actions.

  New package `internal/platform/crossmount` with full table-driven
  tests for both bridge directions (using a fakeFS seam — no host
  dependencies).

  **Copilot debug flag is now auto-enabled.** VS Code only writes
  substantive Copilot Chat debug records when
  `github.copilot.chat.advanced.debug` is `true` — pre-fix this was
  off by default on most installs and observer captured nothing
  even after cross-mount discovery found the file. Observer now
  flips the flag automatically across every cross-mount-resolved
  VS Code install at startup, with a loud INFO log identifying the
  exact file and prior value:

      copilot.setup: enabled github.copilot.chat.advanced.debug path=/mnt/c/Users/<u>/.../settings.json prior_value=missing

  Idempotent: subsequent starts log nothing because the flag is
  already true. JSONC-aware (preserves comments and trailing commas
  via `github.com/tailscale/hujson`); preserves the user's existing
  indent style (4-space, 2-space, or tab — auto-detected from the
  file). Tail formatting and member ordering unchanged. Atomic
  write via temp file + rename. See `docs/copilot-setup.md`.

### Fixed

- **Watcher polling fallback recovers from fsnotify event drops.**
  fsnotify is documented to drop Write/Create events on busy or
  virtualized filesystems — WSL2 reading a Windows NTFS mount,
  network FUSE, certain editor write patterns. When that happened,
  the watcher silently sat behind a growing JSONL until the user
  clicked Run All. The dashboard's `⚠ Watcher is behind on N
  file(s)` banner surfaced the state but didn't fix it.

  Fix: a polling goroutine runs alongside the fsnotify event loop
  inside `Watcher.Watch`. Every `[observer.watch].poll_interval_seconds`
  tick (default `2`) it stat()s every known `parse_cursors` row and
  re-runs `processFile` whenever the file has grown past the saved
  offset. Every 15th tick (~30s by default) it does a full root
  walk to also catch never-seen-before files (the same bug class
  for fsnotify Create drops). Disabled by setting
  `poll_interval_seconds = 0`.

  The poll path reuses the existing idempotent ingest:
  `(source_file, source_event_id)` UNIQUE keeps duplicate inserts
  no-ops; `SetCursor` uses MAX() so a poll and an fsnotify-debounced
  fire racing on the same file can never regress the cursor. Logs
  at INFO only when a poll actually advances a cursor — steady-
  state polling is silent. Closes the kickoff's "live-watcher
  reliability on Windows/WSL2" item.

  New: `store.ListCursors` / `store.CursorEntry` + new
  `watcher.Options.PollInterval`. Threaded from
  `cfg.Observer.Watch.PollIntervalSeconds`, which already existed
  in config but wasn't wired anywhere.

## [1.4.25] — 2026-05-01

Three real-data correctness fixes user-flagged after testing v1.4.24
on live codex sessions and the dashboard.

### Fixed

- **Codex `event_msg/token_count` dedup by `total_token_usage`.**
  User-reported inflation: Observer's per-session JSONL token sums
  exceeded Codex's own final cumulative `total_token_usage` figure
  by ~12% on a real rollout (input +122,680, cache_read +88,704,
  output +731, reasoning +279). Root cause: Codex's runtime
  re-emits identical `event_msg/token_count` records (same
  `last_token_usage` AND `total_token_usage`, 2-3s apart). Pre-fix
  the adapter summed both; the second event double-counts. Total is
  monotonic, so any non-advancing total is a re-emission. The
  modern dispatch now tracks the last total fingerprint per
  `SessionID` and skips duplicates. Verified on the user's
  rollout-2026-04-23T00-29-51-019db690 file: post-fix sums match
  Codex's own final cumulative for all four buckets exactly.

- **Watcher-behind banner no longer shows orphan parse_cursors.**
  Pre-fix the `⚠ Watcher is behind on N file(s)` banner included
  paths whose adapter version had been tightened (e.g. older
  copilot adapter matched any `.log` under `GitHub.copilot-chat/`,
  current adapter narrowed to `/debug-logs/main.jsonl`). The
  parse_cursors rows from the broader-match era stayed in the DB;
  the health endpoint reported them as "behind"; Run All couldn't
  recover them because Rescan only walks paths a CURRENT adapter
  recognises. Banner sat forever.

  Fix: `dashboard.Options.RecognizesSessionFile` is a new predicate
  built from the unified `defaultAdapters()` list (extracted from
  `buildWatcher`). The health endpoint tags rows the predicate
  rejects with `orphan_unmatched: true`, lists them in the response
  but EXCLUDES them from `behind_count`. The JS banner filters them
  out. Banner now only fires on genuinely recoverable issues.

- **Sessions-tab + Analysis-Top-sessions ID columns gained the
  v1.4.24 click-to-copy affordance.** v1.4.24 only updated four of
  six ID renders; the main `#sessions-table` ID column rendered
  `<code>aabbcc…</code>` with no `title` and no idCopy, and the
  Analysis tab's `#analysis-top-sessions-table` had a hand-built
  title without idCopy. Both now use `idCopy()` for consistent
  hover + click-to-copy behaviour.

- **Modal overflow belt-and-braces.** Added `overflow-x: hidden` on
  `.modal` and explicit `width: 100%` (not just `max-width`) on
  `.session-messages-scroller`. The previous fix only added
  `max-width: 100%` which has no effect when the parent container
  has no definite width — the scroller followed the table's
  intrinsic width, defeating the scroll constraint.

### Added

- **Codex `response_item.message.role=user` envelope capture.** User
  pointed out a payload with body
  `<environment_context>\n  <cwd>...</cwd>\n  ...\n</environment_context>`
  was silently dropped. v1.4.23 only handled `role=developer` because
  `role=user` overlapped with `event_msg/user_message` (real user
  prompts). Corpus analysis: 118 user-role response_items split
  ~80% plain text (real prompts already covered) / ~17%
  XML-envelope synthetic context injections that look like user
  messages but originate from the runtime. New discriminator:
  trimmed body must start with `<` to qualify as system-prompt-shaped;
  otherwise stays with `event_msg/user_message`. Rows tag with
  `role=user-envelope` so analysts can split synthetic context
  from real user input.

## [1.4.24] — 2026-05-01

UX + reliability: dashboard affordances for truncated content,
session-detail pagination, npm install clarification, and a
proxy-side fix for the "connection reset by peer" upstream errors.

### Fixed

- **Proxy retries once on transient transport errors.** The user
  reported `write tcp ...: connection reset by peer` from the proxy
  forwarding to api.anthropic.com. Root cause: stale keep-alive
  entry in the http.Transport pool — WSL2 / corporate-firewall /
  mobile-hotspot NATs close idle TCP streams faster than our
  pre-fix 90s `IdleConnTimeout`. Two-part fix: (a) tighten
  `IdleConnTimeout` 90s → 30s + cap `MaxIdleConnsPerHost=16`;
  (b) new `doWithRetry` helper retries exactly once on
  {connection reset by peer, broken pipe, use of closed network
  connection, EOF} after closing pooled idle conns. Non-transient
  errors (TLS handshake, dial timeout) bypass retry.

- **Session-detail messages table no longer pushes the modal past
  its bounds.** Wrapped the table in a `.session-messages-scroller`
  with `overflow-x: auto`; expand row (the "N ▾" drop-down's
  content) gets `white-space: normal; word-break: break-word` so
  long target / error text wraps inside the cell instead of
  inheriting the global `td { white-space: nowrap }` and forcing
  horizontal overflow.

### Added

- **Session-detail Messages pagination.** Pre-v1.4.24 the panel
  rendered every message in one go — for large sessions this was
  crashing the browser tab. `handleSessionMessages` now accepts
  `?limit=N&offset=M` (default limit=100, limit=0 for unlimited);
  response shape gains `{total, limit, offset}`. Frontend gets
  prev/next buttons + a 50/100/200 page-size selector. Filter
  ("Tool messages only" vs "All messages") stays client-side and
  applies after server pagination.

- **Click-to-copy on truncated IDs.** Every truncated session_id /
  message_id render across the dashboard (Sessions tab, Actions
  tab, Compression-events tab, Session-detail Messages panel) gets
  a hover-discoverable affordance (dotted underline, cursor:copy)
  and a click handler that writes the full value to the clipboard.
  Single delegated handler keeps the per-row JS work negligible
  even on tables with hundreds of rows.

- **Click-to-expand on truncated text.** Long Target / Error /
  Command / File-path values in the Actions, Discovery, and
  Session-detail tabs render with a `.expandable` wrapper. Click
  toggles between truncated and full text in-place; full value
  lives in `data-full` so no extra fetch is needed.

### Documentation

- **npm README clarifies global-vs-local install.** Pre-fix the
  Install section showed `npm install -g` followed by `observer
  --version` without explaining what happens for users who install
  locally (`npm install` without `-g`) — in that case the binary
  lives at `./node_modules/.bin/observer` and isn't on `$PATH`,
  so the `observer init` / `observer start` examples fail with
  "command not found". README now lists both forms (global +
  `npx observer ...` for local) and cross-links the Troubleshooting
  → EACCES fix for shared / CI machines.

## [1.4.23] — 2026-05-01

Cross-adapter message normalization, Tier 3: system-prompt and
bootstrap-context capture across codex and openclaw. One new
ActionType (`ActionSystemPrompt`); content-hash dedup keeps the DB
size bounded despite codex's 9-18KB prompts being repeated across
nearly every session_meta and turn_context record.

### Added

- **New ActionSystemPrompt constant** in `internal/models/models.go`,
  symmetric to ActionUserPrompt. Adapters emit one row per unique
  prompt body per session; MessageID is "system:<content_hash>" so
  cross-row queries can group occurrences of the same prompt.
  Adapters MUST hash-dedup or the DB would gain hundreds of
  identical rows per session.

- **Codex system prompt capture (3 sources, hash-dedup'd within parse).**
  - `session_meta.base_instructions.text` — the base Codex system
    prompt (~18KB), repeated verbatim in every session_meta record.
    Emit once per unique body, role="base".
  - `turn_context.developer_instructions` — per-turn permissions /
    sandbox / context envelope (~9KB), nearly identical across all
    turns in a session. Emit once per unique body, role="developer".
  - `response_item.payload.type=message` + `payload.role="developer"`
    — mid-turn system instruction injections. Same dedup behaviour;
    assistant + user roles still skipped here because event_msg/
    agent_message + event_msg/user_message already cover those.

- **OpenClaw bootstrap-context custom event.** Pre-v1.4.23 the
  adapter had no `case "custom"` at all — both customType variants
  in real corpora were silently dropped. This commit handles
  customType="openclaw:bootstrap-context:full" by emitting an
  ActionSystemPrompt row carrying the marker payload; "model-snapshot"
  stays no-op'd because model_change already lifts that info.

### Smoke results vs real samples

The 1614-event codex session captures **+11 unique system_prompt
rows** despite the underlying source repeating identical prompts
across hundreds of records. Smaller sessions: 2-3 system_prompt rows
each. Zero parse warnings across all 9 sample rollouts.

## [1.4.22] — 2026-05-01

Cross-adapter message normalization, Tier 2: feature-parity work
that captures meaningful action/event types previously dropped on
the floor. No schema changes; two new ActionType constants
(`ActionTurnAborted`, `ActionContextCompacted`).

### Added

- **Codex `event_msg/mcp_tool_call_end` capture.** Executor side-
  channel for MCP tool calls (server, tool, structured arguments,
  duration, result.Ok|Err). Pre-v1.4.22 the adapter's event_msg
  switch had no case for it: paired calls (Tier 1
  response_item.function_call(list_mcp_resources*)) kept the call's
  terse data; unpaired calls were dropped entirely. Now merges into
  the pending row with Target="server:tool", ToolOutput from
  Ok.content[*].text, Success from Ok.isError=false vs Err.message,
  DurationMs from secs+nanos. Standalone path emits a fresh row.

- **Codex `event_msg/turn_aborted` → ActionTurnAborted.** New
  ActionType for turns interrupted before the model finishes
  generating (user pressed esc / cancelled). Distinct from
  task_complete with success=false: aborted turns never finished, so
  output is partial — the discriminator matters for cost analysis
  (aborts still consumed input/output tokens up to the abort point).

- **Codex `event_msg/view_image_tool_call` capture (merge +
  standalone).** Pre-v1.4.22 the paired form had stale RawToolName
  and the standalone form was dropped. Also fixes a Tier 1
  oversight: `view_image` was in actionMap but missing from
  extractTarget, so Tier 1 view_image rows had empty Target.

- **Codex `event_msg/dynamic_tool_call_request` + response
  pairing.** Runtime-loaded tools (e.g. load_workspace_dependencies).
  Field-name quirk: request uses camelCase (callId, turnId), response
  uses snake_case (call_id, turn_id) — both spellings tolerated.
  Same pattern as exec_command_end / patch_apply_end / mcp_tool_call_end:
  request creates a row, response merges in success / error /
  duration / content_items text body.

- **Codex `compacted` events → ActionContextCompacted (non-
  searchable).** Top-level type="compacted" event Codex emits when
  the model decides to summarize earlier turns. New ActionType,
  distinct from the searchable file-edit set so dashboard filters
  can suppress these rows from action-type browsers while keeping
  them queryable for cost / compaction-frequency analytics. Row
  Target is "<N> msgs, ~<T> tokens"; RawToolInput is JSON
  {messages, bytes_estimate, tokens_estimate} for analytics. The
  paired event_msg/context_compacted is no-op'd to avoid double-
  emission. Per user direction (2026-05-01): "doesn't need to be
  searchable like file edits" — but DO capture token/event info.

- **Codex `response_item.reasoning` forward-compat capture.**
  Current Codex Desktop builds always emit summary:[] (838 reasoning
  items, 0% non-empty in the corpus). The adapter now extracts text
  from summary[*].text when present and threads it into the turn's
  agentMessages cache so future builds (or summary-populating
  variants) inherit it as PrecedingReasoning without further
  changes.

- **OpenClaw `stopReason='error'` → ActionAPIError.** OpenClaw
  assistants emit empty-content messages with stopReason="error"
  + an errorMessage carrying the upstream provider's verbatim
  response (e.g. `400 {"error":"...does not support tools"}`).
  Pre-v1.4.22 the adapter's stop-reason gate only fired on "stop"
  so these were silently dropped. Now emits an ActionAPIError row
  with status-code-prefix discriminator (`http_400` etc.).

### Smoke results vs real samples

The largest inspected codex session (1586 events) now captures
**+17 previously-dropped rows**: 9 context_compacted, 2 turn_aborted,
6 api_error. Zero parse warnings across all 9 codex sample rollouts.

## [1.4.21] — 2026-05-01

Cross-adapter message normalization, Tier 1: closes data-loss bugs
in the codex and cursor adapters that were silently dropping
significant fractions of real-session activity. No schema changes;
new actions enrich what was already a partial view.

### Added

- **Codex `response_item` envelope dispatch.** Codex Desktop wraps
  every assistant tool intent in a `response_item` envelope
  (`payload.type` discriminates `function_call`, `function_call_output`,
  `reasoning`, `message`, `custom_tool_call`, `custom_tool_call_output`,
  `web_search_call`). The adapter previously had no `case "response_item"`
  at all, so on real Desktop sessions the entire `function_call` /
  `function_call_output` stream (~1613/1612 events per inspected
  corpus) was silently dropped — only the side-channel
  `event_msg/exec_command_end` caught ~⅔ of shell calls, leaving
  every `update_plan`, `view_image`, and `list_mcp_resources` call
  missing entirely.

  New `case "response_item"` routes function_call through the same
  `pending[call_id]` machinery as the legacy top-level dispatch.
  Dedup logic in `event_msg/exec_command_end` and
  `event_msg/web_search_end`: when a response_item.function_call
  already landed for the same call_id, the side-channel merges its
  richer fields (command, exit_code, duration, stdout, query) into
  the existing row instead of emitting a duplicate. If only the call
  landed (mid-session truncation, user interrupt) the row stands
  alone; if only the side-channel landed (resume mid-file) the
  legacy emit path handles it. **No double-counting in either
  direction.**

- **Codex `apply_patch` capture (`custom_tool_call` +
  `patch_apply_end`).** Codex Desktop's apply_patch flow writes
  through three separate JSONL events sharing a `call_id`:
  response_item/custom_tool_call (assistant intent + raw patch text),
  event_msg/patch_apply_end (executor result with structured
  `changes` map), and response_item/custom_tool_call_output (string-
  wrapped {output, metadata}). In real corpora `patch_apply_end` lands
  BEFORE `custom_tool_call_output` so the previous step's pattern of
  deleting the pending entry on the *_output event was wrong here —
  patch_apply_end is now treated as the terminal event for apply_patch
  and merges in its structured fields. ~166 patch_apply_end events per
  representative corpus now land as ActionEditFile rows.

- **Codex `event_msg/error` → ActionAPIError.** Codex emits a
  structured event when an upstream API call fails before a turn can
  complete (`usage_limit_exceeded`, rate limit, content-policy block,
  etc.). Pre-v1.4.21 these were silently dropped — same gap claudecode
  had pre-v1.4.20. Mirrors claudecode's ActionAPIError shape.

- **Cursor user_prompt emission from JSONL transcripts.** Cursor's
  agent runtime wraps user prompts in `<user_query>...</user_query>`
  XML before passing them to the model; this wrapper landed verbatim in
  rows on the live-hook path (`beforeSubmitPrompt`). New
  `stripUserQueryWrapper` helper applied in both the live-hook path
  and a new `BuildTranscriptUserPromptEvent` exported function. Strip
  ONLY when both opening and closing tags are present so partial-
  wrapper text (a user typing `<user_query>`) is not damaged.

- **Cursor sub-agent transcript ingestion.** Cursor writes a separate
  JSONL when the parent agent spawns a sub-agent
  (`agent-transcripts/<parent>/subagents/<sub>.jsonl`). Pre-v1.4.21
  these were explicitly skipped — the parent transcript only recorded
  a `Subagent` tool_use; the sub-agent's actual fan-out work
  (WebFetch, ReadFile, sub-prompts) was lost. Now ingested as
  IsSidechain=true rows under the parent session_id, mirroring
  claudecode's sidechain semantics.

- **Cursor tool-name normalizer extensions.** Real cursor transcripts
  contain tool names previously routed to ActionUnknown:
  `ReadLints` → ActionReadFile, `StrReplace` → ActionEditFile,
  `Subagent` (capitalized) → ActionSpawnSubagent (case-insensitive),
  `call_mcp_tool` → ActionMCPCall (parity with the live-hook MCP path),
  `Await` → ActionUnknown (kept Unknown intentionally — control-flow
  primitive with no file/command target).

### Changed

- **CLI flattened**: `observer scan`, `observer watch`, `observer init`,
  `observer uninstall`, `observer serve`, `observer doctor`,
  `observer status`, `observer tail`, `observer prune`, `observer cost`,
  `observer score`, `observer discover`, `observer patterns`,
  `observer learn`, `observer suggest`, `observer dashboard`,
  `observer metrics`, `observer summarize`, and `observer export` are
  now top-level subcommands. The legacy `observer observer <sub>`
  nesting is preserved as a hidden alias group so installed hooks and
  MCP entries from earlier versions keep working without re-init.
- **MCP registration writes `["serve"]` instead of `["observer","serve"]`.**
  Existing entries continue to work via the alias; to migrate to the
  flat form, run `observer uninstall && observer init` (or
  `observer init --force`).

### Fixed

- `internal/adapter/copilot/adapter.go`: `IsSessionFile` now matches
  Windows-formatted fixture paths on Linux hosts (the `filepath.ToSlash`
  no-op on `\` separators caused `TestAdapter_IsSessionFile` to fail
  under `make test`).
- `gofmt -w` on five files dirty since `bb815b5`.

## [1.4.20] — 2026-04-30

Long-context (LC) pricing modeling, full Analysis dashboard tab, and
fully-editable Settings tab with backfill controls. Largest single
release since v1.0 — see PROGRESS.md for the per-section detail.

### Added

- **Long-context pricing tier in the cost engine.** `Pricing` struct
  gains `LongContextThreshold` + per-dimension LC rates (Input,
  Output, CacheRead, CacheCreation, CacheCreation1h). `Compute()`
  now reprices an entire turn at the LC tier when its prompt window
  (`Input + CacheRead + CacheCreation`) exceeds the threshold —
  closes the under-billing gap for Anthropic Sonnet 4 / 4.5 (>200K),
  OpenAI gpt-5.4 / 5.5 (>272K), and Gemini 2.5 Pro / 3.1 Pro Preview
  (>200K). Defaults baked in for every affected SKU; user overrides
  via TOML or the new Settings → Pricing form. Each LC field falls
  back to its standard counterpart when zero so an entry can pin
  only the dimensions that actually change at the LC tier.

- **Analysis dashboard tab.** New tab between Cost and Sessions with
  four bands keyed off a single time-window picker:
  - **Headline KPIs** (6 tiles) — period vs prior period (with Δ%
    colour-coded), month-to-date + linear projection (+ optional
    budget % when `intelligence.monthly_budget_usd` is set),
    effective rate ($/1M output + cache-write tokens), cache
    efficacy (`cache_read / (cache_read + cache_creation)`), LC tier
    surcharge attribution (turns + extra $ from LC repricing), and
    waste $ (Discovery stale-read tokens × blended input rate).
  - **Trend / cross-session deep-dive** — daily stacked-bar with a
    Model / Project / Tool dimension toggle. New cost-engine
    groupings `GroupByDayProject` + `GroupByDayTool` mirror the
    existing `GroupByDayModel`.
  - **What changed / movers** — top 5 cost increases, top 5
    decreases, and new entrants for the chosen dimension.
    `cost.Options.Until` adds a closed-window upper bound so the
    prior-period query is a clean `[Since, Until)` window.
  - **Top expensive sessions + routing efficiency** — sessions
    sorted by cost with `opus` / `lc_tier` / `many_turns` /
    `large_prompt` badges, and a soft "you might have used Sonnet"
    table for trivial Opus sessions (small prompt, low output, no
    LC turns) flagged by a conservative work-profile heuristic.
    Click-through to existing session detail modal.

  Six new endpoints under `/api/analysis/*`: `headline`, `trend`,
  `movers`, `top-sessions`, `routing-suggestions`. All do per-turn
  pricing (LC dispatch is per-request — aggregating tokens at SQL
  before pricing would false-trip the LC tier).

- **Settings dashboard tab.** Last in nav, two-column shell with a
  rail and 10 sections:
  - **Pricing** — table-form editor (rows = active overrides, cols =
    Input/Output/CacheRead/CacheCreation 5m/CacheCreation 1h, with a
    chevron toggling 6 long-context fields per row). Filter input,
    Add Override prompt (auto-fills from baked-in defaults when the
    model id matches), per-row Reset + Delete buttons. Defaults
    reference list at the bottom (collapsed `<details>`, all 95
    baked-in models with an "Override" shortcut). Saves hot-reload
    via `cost.Engine.Reload` — no restart needed.
  - **Backfill** — table of all 14 documented `observer backfill`
    flags with candidate counts (SQL-checkable) or "scan needed"
    (file-walking). Per-row Run button + Run All. Output panel
    surfaces captured stdout incrementally as the subprocess runs;
    multiple modes can run concurrently.
  - **Observer / Watcher / Freshness / Retention / Hooks / Proxy /
    Compression / Intelligence** — per-field forms driven by
    `SECTION_FIELDS` field specs (kind / path / label / help /
    placeholder / select options). Compression keeps a 4-card layout
    matching its sub-struct shape; the others are flat. Save → file
    is rewritten via the same `.bak`-fallback + atomic-rename path
    used for pricing; a "Restart daemon" banner appears at the top
    of the tab with a confirmation dialog.

  Endpoints: `GET /api/config`, `PUT /api/config/pricing`,
  `GET /api/config/pricing/defaults`, `PUT /api/config/section/<name>`,
  `POST /api/admin/restart`, `GET /api/backfill/status`,
  `POST /api/backfill/run`, `GET /api/backfill/jobs/<id>`.

- **API error capture — both JSONL and proxy paths.** Pre-v1.4.20
  upstream API failures (content-policy blocks, rate limits,
  overloaded responses, invalid-request errors) were silently
  dropped on both surfaces: the proxy returned early on non-2xx
  responses, the claudecode adapter skipped `type: "system"` records
  before any system-record handling. v1.4.20 closes both gaps.

  *JSONL adapter:* new `ActionAPIError` action type. The
  claudecode adapter now decodes `type: "system"` +
  `subtype: "api_error"` records. Captured rows carry the upstream
  request_id (joinable to `api_turns.request_id` when both proxy +
  JSONL saw the same call), the specific error class
  (`overloaded_error` / `rate_limit_error` /
  `invalid_request_error`), and the human message. Recursive
  envelope walker handles the 1- and 2-level-nested shapes that
  appear in real logs. Companion `--claudecode-api-errors` backfill
  flag (umbrella'd by `--all`) recovers historical errors.
  Smoke-tested against 344 live JSONL files: 54 errors recovered,
  52 with the specific class attributed correctly.

  *Proxy:* new `api_turns.{http_status, error_class, error_message}`
  columns (migration 013). The proxy now records a zero-token
  api_turn row when the upstream returns 4xx/5xx — both
  non-streaming and streaming paths. `parseErrorBody` handles both
  Anthropic (`{type: "error", error: {…}}`) and OpenAI
  (`{error: {type, message, code}}`) envelope shapes;
  `extractStreamErrorBody` pulls error JSON out of an SSE
  `event: error` data line when the upstream errored mid-stream;
  `extractRequestID` reads `x-request-id` from the response with
  `cf-ray` fallback. `store.InsertAPITurn` validation relaxed for
  error turns (Model may be empty when HTTPStatus != 0 — some
  upstreams reject malformed requests before any model field is
  parsed).

  Sister Settings → Backfill UI gets a Run button for the new
  `--claudecode-api-errors` mode.

- **Long-context Pricing struct + ModelPricing config fields**: 6
  new TOML keys per model (`long_context_threshold`,
  `long_context_input`, `long_context_output`,
  `long_context_cache_read`, `long_context_cache_creation`,
  `long_context_cache_creation_1h`). Threading from
  `IntelligenceConfig.MonthlyBudgetUSD` via `cost.Engine.Reload`.

- **`config.ResolveGlobalPath(override)`**: mirrors the path
  resolution used by `config.Load` so callers can locate the file
  for save-back operations without reimplementing the rule. Threaded
  into `dashboard.Options.ConfigPath` from
  `cmd/observer/{start.go,dashboard.go}`.

- **`cost.BakedInDefaults()`**: returns a fresh copy of
  `defaultPricing` for the dashboard's pricing-defaults reference
  list. Mutating the returned map has no effect on engine state.

- **Watcher recovery path.** `observer scan --force` (new flag) and
  `Watcher.Rescan()` re-walk every JSONL the registered adapters
  claim from offset 0, ignoring `parse_cursors`. The
  `(source_file, source_event_id)` UNIQUE index keeps the pass
  idempotent — rows already in the DB are no-ops, anything the live
  watcher dropped silently gets ingested. `backfill --all` runs the
  rescan first (before the surgical column-update backfills) so a
  single click of "Run all" on the Settings → Backfill tab recovers
  missing data and patches new columns in one shot. Diagnostic for
  the well-known watcher-falls-behind failure mode (fsnotify event
  drops on busy sessions, daemon restart with stale cursors).

- **Watcher-health endpoint + sticky banner.**
  `GET /api/health/watcher` lists every JSONL the watcher knows
  about with its saved `byte_offset` vs the live `file_size` on
  disk, plus how stale the cursor is. The dashboard polls this on
  load and every 60 s; when any file is behind by more than 10 KB,
  a top-of-page banner appears (`Watcher is behind on N file(s)…
  click to recover via Settings → Backfill → Run all`) so the
  silent-data-loss case the v1.4.20 recovery path was built for
  can't sneak past the user again.

- **Toast feedback for Backfill Run buttons.** Generic
  `showToast(id, status, title, detail, autoDismissMs)` helper.
  Click Run → sticky toast top-right with spinner + label.
  The poll loop tails captured stdout and updates the toast detail
  line live (so Run All shows phase transitions:
  `rescan complete: files_processed=346` →
  `is_sidechain backfill complete…` → `✓ recovered N rows`).
  Done auto-dismisses after 8 s; failed stays sticky with the error.

- **Compression events table — tokens / message_id / linked
  session.** `/api/compression/events` rows now carry
  `original_tokens_est` / `compressed_tokens_est` /
  `saved_tokens_est` (computed server-side as `bytes ÷ 4`, matching
  the cost engine's `CompressionStats` heuristic), plus
  `message_id` (sourced from the joined `api_turns.request_id`).
  The dashboard table replaces the verbose
  Original/Compressed/Saved-bytes triplet with a compact
  `Saved (B)` cell (with original→compressed in the tooltip), adds
  a `Saved (tok)` column, and surfaces `Session` (clickable link
  opening the existing detail modal) and `Msg ID` columns.

- **Actions table — message_id column + linked session.** The
  `/api/actions` response now exposes `message_id` (the upstream
  Anthropic `msg_xxx` populated by the claudecode adapter + the
  `--message-id` backfill). The Actions tab adds a `Msg ID` column
  (truncated, full id in tooltip) and converts the `Session` cell
  from a static `<code>` to an accent-coloured link that opens the
  session detail modal — same affordance the Compression events
  table got.

- **`docs/audits/compression-audit.md`** — verifies which Compression
  toggles are wired to a live consumer (Shell ✓, Indexing
  excerpts ✓, Conversation pipeline ✓) versus stubs the v1.4.20
  audit found (`compression.code_graph.*` was duplicate dead
  config — Intelligence's CodeGraph is the real toggle;
  `compression.indexing.embeddings` is an experimental hook with
  no runtime consumer yet). The Compression form removes the
  CodeGraph card and labels Embeddings explicitly as "experimental,
  not yet wired."

- **Per-section purpose blurbs in Settings.** `SECTION_BLURBS` map
  covers all 10 Settings sections — each renders a one-paragraph
  explainer above the form fields describing what the section
  controls and when you'd touch it. Prevents the
  "what is this for?" foot-gun the audit-screenshots flagged on
  Intelligence + others.

### Changed

- **Cost engine made hot-reload-safe.** `Engine.Table *Table` →
  `Engine.table atomic.Pointer[Table]` (private). New
  `Engine.Lookup` / `LookupWithSource` / `Reload(cfg)` wrappers; the
  Settings → Pricing save calls `Reload`, swapping the active table
  via `atomic.Pointer.Store`. In-flight Lookup callers see either
  the old or new table — never a torn state. External `engine.Table`
  access migrated through the wrapper methods (only call sites were
  in `analysis.go` and tests).

- **Dashboard session-detail per-model breakdown.** Previously
  aggregated tokens at SQL level then called `Compute` once on the
  sum — that would false-trip the LC tier whenever a session's
  summed prompt cleared the threshold even if no individual turn
  did. Rewrote to pull individual rows and bucket per-model in Go
  after `Compute`. Same pattern applied to the headline and
  top-sessions endpoints from the start.

- **Backfill subprocess output streams incrementally.**
  `realExecBackfill` switched from `cmd.CombinedOutput()` (all-at-
  once buffer) to `StdoutPipe`/`StderrPipe` with concurrent drain
  goroutines firing an `onChunk` callback per 4 KiB read. The
  registry appends chunks under a mutex; the existing 2 s poll
  surfaces partial output as it accumulates. Output capped at 1 MiB
  with truncation marker.

- **Pricing reference doc.** `docs/pricing-reference.md` Anthropic /
  OpenAI / Gemini sections now describe the LC modeling instead of
  flagging it as a future enhancement; only Gemini Flash long-context
  remains in the out-of-scope list.

- **Backfill table responsive layout.** Scoped `.backfill-table` CSS
  with `table-layout: fixed`, wrapped descriptions, sticky action
  column, drops the Flag column at <900px viewports. Closes the
  horizontal-scroll-on-narrow-screens issue surfaced in the v1.4.20
  audit screenshots.

- **Loading-spinner drift fixed (CSS).** The chart-panel loading
  overlay's spinner used `transform: translate(-50%, -50%)` for
  centering AND `animation: obs-spin` rotating the same property —
  every animation frame replaced the centering translate with a pure
  rotation, snapping the spinner to top-left then back, producing the
  visible drift on the Analysis tab's Daily-spend chart. Centering
  switched to `top/left: calc(50% - 14px)` so the only `transform`
  on the element is the rotation.

- **Help drawer suppressed on tab clicks.** The body-level click
  handler that opened the help drawer for any `data-help`-tagged
  element previously fired on tab-nav clicks too — every tab switch
  popped the drawer open. Now skips clicks where
  `el.closest('nav')` matches AND the element is a `<button>` with
  a `data-tab` attribute. Tab navigation is silent; hover tooltips
  on tabs still show a one-line definition; the drawer is still
  reachable via the `?` button or any non-tab `data-help` click.

- **Link colour for Session-id affordances.** New `.session-link`
  CSS rule pins the new Session link in Compression events + Actions
  tables (and the existing `.row-clickable` cells across Sessions /
  Top expensive sessions / etc.) to `var(--accent)` instead of the
  default browser blue, keeping the dark theme readable.

### Tests

- 30+ new tests across `cost/`, `dashboard/`, and adjacent packages.
  Coverage highlights:
  - LC dispatch (below/above threshold, zero-fallback, threshold-
    disable, prompt-includes-cache-read, defaults round-trip,
    config-override round-trip, Reload swap-while-reading,
    concurrent-safe under `-race`).
  - Analysis endpoints (period vs prior, LC surcharge attribution,
    cache efficacy, budget echo, trend dimensions, movers diff
    math, top-sessions ranking + badges, routing-suggestions
    heuristic correctness).
  - Settings endpoints (GET full struct, no-file-yet defaults,
    pricing save+reload cycle, no-config-path 409, retention
    section save, intelligence save preserves pricing,
    unknown-section 400, backfill 14-mode coverage, pricing
    defaults shape).
  - Backfill run (allowlist rejection, happy path, non-zero exit,
    config-path arg propagation, partial output streamed before
    exit, 1 MiB output cap with truncation marker, unknown job 404).

  Full suite passes under `-race`.

### Migration notes

- New optional config fields:
  - `intelligence.monthly_budget_usd` (float, USD): hides the
    Analysis budget tile when zero/unset.
  - `intelligence.pricing.models.<id>.long_context_threshold`
    (int) + 5 paired LC rate fields. Ignored when zero.

- No new database migrations.

- `cost.Engine.Table` is now a method (`Table()`) rather than an
  exported field. External Go callers using `engine.Table` directly
  must switch to `engine.Lookup` (recommended) or `engine.Table()`.
  Internal callers in this repo were already migrated.

- The dashboard's Settings → Pricing form preserves the `.bak`
  fallback for the prior `config.toml` on every save. Comments are
  lost when the engine re-marshals the file (Option A from the
  planning doc) — the `.bak` is the recovery path for users who
  hand-comment their configs.

## [1.2.1] — 2026-04-23

### Fixed

- **Pidbridge attribution for recent Claude Code versions.** The
  `SessionStart` hook now registers the whole non-shell ancestor chain
  (hook parent → grandparent → ... up to the shell) instead of just
  `os.Getppid()`. Recent Claude Code routes hooks through a short-lived
  Node worker; registering only the worker's PID caused every
  `api_turns` row to land with `session_id = NULL` once the worker
  exited, because the proxy's `/proc/<pid>/status:PPid` walk could not
  cross the dead worker to reach the still-live main process. Walking
  multi-step at registration time guarantees at least one still-live
  PID is in the bridge by the time the proxy looks up traffic.

## [1.2.0] — 2026-04-23

### Added

- **`observer uninstall`** — clean reversal of `observer init`. Removes
  hook entries from `~/.claude/settings.json` and `~/.cursor/hooks.json`
  and the `observer` MCP server entry from `~/.claude.json`,
  `~/.cursor/mcp.json`, and `~/.codex/config.toml`. User-authored hooks
  and other MCP servers are preserved.
- Checksum-based drift detection: uninstall refuses to touch a config
  file that has been modified since install unless `--force` is passed.
- `--purge` flag to additionally delete `~/.observer/` (observer.db,
  config.toml, hook_checksums.json).

### Changed

- Config env-var prefix finished the superbased→observer rename:
  `SUPERBASED_*` overrides now read as `OBSERVER_*` in
  `internal/config/config.go`. Doc comments and test fixtures updated.

## [1.0.0] — 2026-04-17

First stable release. Captures, normalizes, and analyzes tool call activity
from AI coding assistants (Claude Code, Codex, Cursor, Cline, Copilot).

### Core

- **Multi-adapter ingestion** — Claude Code (JSONL), Codex (rollout),
  Cline/Roo Code (JSON), Cursor (hook-based), Copilot (experimental)
- **SQLite storage** — WAL mode, migrations 001–006, pure-Go via
  `modernc.org/sqlite` (no CGO)
- **Freshness engine** — content hashing, stat fast-path, 5-state
  classification (fresh/stale/new/unchanged/unknown)
- **FTS5 excerpt indexing** — searchable tool output excerpts (2KB cap)
- **Secrets scrubbing** — regex-based pipeline (Bearer, AWS, API keys,
  connection strings, env vars)

### Proxy

- **API reverse proxy** — Anthropic + OpenAI, streaming + non-streaming,
  per-turn token/cost logging in `api_turns`
- **Session attribution** — `X-Session-Id` header + Linux `/proc` pid
  bridge via SessionStart hook (migration 004)
- **Conversation compression** — content-type pipeline: per-type
  compressors, importance scoring, budget enforcer, Anthropic cache
  alignment with `cache_control` breakpoint injection
- **OpenAI compression** — Chat Completions MVP (Responses API deferred)

### MCP Server

- **12 tools** — `check_file_freshness`, `get_file_history`,
  `get_session_summary`, `search_past_outputs`, `check_command_freshness`,
  `get_session_recovery_context`, `get_project_patterns`,
  `get_last_test_result`, `get_failure_context`, `get_action_details`,
  `get_cost_summary`, `get_redundancy_report`
- **Codegraph enrichment** — `check_file_freshness` and `get_file_history`
  include `structure: {functions, callers, imports}` when graph DB is available
- **Registration** — auto-configures Claude Code, Cursor, Codex MCP configs

### Intelligence

- **Pattern derivation** — hot files, co-changes, common commands,
  edit-test pairs, onboarding sequences, cross-tool files, knowledge
  snippets (from preceding reasoning)
- **Session quality scoring** — error rate, redundancy ratio, onboarding
  cost, retry cost
- **Cost estimation** — per-model pricing table, proxy + JSONL source
  merging, compression savings tracking
- **Failure correlation** — error categorization, retry detection,
  `observer learn` correction rules
- **`observer suggest`** — generates CLAUDE.md / AGENTS.md / .cursorrules
- **AI session summaries** — Claude Haiku generates 2–4 sentence summaries,
  scrubbed before storage (migration 005)
- **Dashboard** — embedded HTML + `/api/*` JSON endpoints

### Compression

- **Shell output** — TOML-driven filter engine with 6 embedded defaults
  (git, go test, docker, kubectl, cargo, pytest), `observer run <command>`
- **Conversation layer** — message importance scoring, budget enforcement,
  prefix-stable cache alignment, savings metrics in `observer cost`

### Observability

- **Prometheus `/metrics`** — 29 gauge families from `diag.Snapshot`,
  cost engine, and pid bridge; `observer metrics` serves text format 0.0.4
- **`observer doctor`** — DB integrity, hook checksums, MCP registration
  drift, pid bridge health
- **`observer status`** / `observer tail`** — live activity monitoring

### Semantic Search

- **Feature-hashed TF-IDF vectors** — 256-dim, FNV-1a hash trick, stored
  in `action_embeddings` (migration 006)
- **Cosine similarity search** — brute-force scan, gated behind
  `compression.indexing.embeddings = true`

### Codegraph

- **Auto-install** — downloads latest release from GitHub
  (DeusData/codebase-memory-mcp), verifies SHA-256 against `checksums.txt`,
  extracts platform binary
- **Graph queries** — `FunctionsInFile`, `ImportsInFile`, `CallersOf`
  against confirmed `nodes`/`edges` schema

### CLI

`observer scan|watch|init|doctor|status|tail|prune|cost|score|
discover|patterns|learn|suggest|dashboard|metrics|summarize|export`
plus `observer proxy start`, `observer start`, `observer run <cmd>`,
`observer hook`.

## [0.6.0-alpha] — 2026-04-17

Phase 6 Strand A items 1–4: pid bridge, dashboard savings, cache_control
injection, OpenAI conversation compression.

## [0.5.0-alpha] — 2026-04-17

Phase 5: full compression layer (shell + conversation).

## [0.4.0-alpha] — 2026-04-16

Phase 4: intelligence layer (patterns, scoring, cost, dashboard, suggest).

## [0.3.0-alpha] — 2026-04-16

Phase 3: API proxy, MCP server (12 tools), codegraph skeleton, Cursor +
Copilot adapters, doctor/status/tail/prune commands.

## [0.2.0-alpha] — 2026-04-16

Phase 2: freshness engine, failure context, FTS5 indexing, Codex + Cline
adapters, init command with hook registration.

## [0.1.0-alpha] — 2026-04-16

Phase 1: foundation — config, SQLite, migrations, Claude Code adapter,
storage layer, scan + watch commands.