Releases

Release notes for aterm, newest first. Each entry links its tag; the current download is on /aterm, and every release with its assets and .sha256 sidecars is on github.com/alabsystems/aterm/releases.

v0.108.02026-10-21

aterm v0.108.0

2026-10-21 · 1912 changes since v0.107.0

Features

machines, gui: live continuous fleet & system monitoring native app tab (/monitor) and CLI
gui: slice 2a — one end, the tab's done mark, the work since a task opened
ctl: a headless instance's chrome prints the tab line its strip would show
agent: harness consumers follow FOREVER LAND; surface the worker's NEEDS YOU
autopilot: FOREVER CRUISE / FOREVER LAND in the GUI, task record, spawn and lab workers
harness: show selected subscription and weekly quota
land: widen Land's strict reading by word family and clause, measured on a defense table
abrew: evaluate search /regex/ natively under bounded aterm-regex
abrew: accept brew's plural --formulae/--casks switches natively
abrew: accept brew's deps direct aliases -1/--1/--declared
abrew: answer named --cache/--repository queries natively
abrew: desc --search/--name/--description over the catalog
abrew: deps --for-each and brew's flat-deps contract
abrew: deps --union and --topological/-n in brew's expansion order
abrew: options --compact/--installed/no-names scopes
abrew: list --multiple and multi-name --versions
abrew: list --versions --json; unlink keeps the opt pointer

Fixes

windows: read Git Bash's MSYS cwd as the drive path it names
windows: atpkg answers the account's own profile and reads a shim's target
windows: the disk scan reads atpkg's own store and its .cmd shims
disk: name the live Claude Code version on Windows and keep what holds the rest
windows: keep the disk reserve on Windows, holding its blocks
windows: a headless package lane runs only over a store inside its scratch home
disk: the owner's watch removes nothing while its home's device cannot be named
windows: a worker with no HOME resolves its Claude Code dir under its USERPROFILE
windows: replace a thin reserve, journal a standing refusal once, test reparse points that are no link
disk: judge every Claude Code version from one process scan
windows: clause 5 records a shim's program as the candidates are spelled
windows: rewrite an MSYS cwd to a drive path only for a report from this machine
windows: the disk watch's discovery finds build directories by file id and places paths by the one rule
windows: tier 3, the guards and the verb place every path by the one rule; an unknown tab cwd refuses tier 3
windows: await sys waits on Windows volumes; a test pins status disk= for a Windows tab
windows: the Claude census tells the measured services apart
windows: the transcripts fence sees through a linked \~\\.claude, the census reads claude.exe, ProgramData is the system's
census: scan executable code after imports and each clock hit
messages: bound future-stamp zone observation to a day
ctl: preserve uncertain delivery after request transmission
amacs: refuse unframeable session selectors before resolution
gui: a word carried onto a restored shell keeps the task's work
gui: Off's busy time is no task work for the one end's floor
init: admit the configured GitHub endpoint before cloning
grid: fence ink, fingerprints and lend see every visible mark
core: holder fence evicts before it lays, and a tail never continues
grid: a width change that brings a line head back keeps non-BMP cells
grid: a double-size row is ink to the holder fence
harness: a task's end is noted right after its point's line, never owed past the host's step
harness: a task's end is noted when its point's print or a request after its fold fails; an older build's journal keeps its holds across point lines
agent: retire inherited login seed when work starts
read another program's live SQLite database with no lock on it (agy's summaries, tccd's TCC.db)
v4 slice 3: a first-look cheer appears on its stage, a cut flight flies again, a spent cheer goes home off glass
autopilot: close the adversarial review of FOREVER CRUISE / LAND
supervise: Land keeps a landing only over a clean repo, types Land's words at walls
gui: a self-claim lands only under Land; the end gate pins the clip again
supervise: the three supervise::run reds … landed unrun
ctl: ready answers no prompt from a parked reader's parser (r8 lead U12)
update: a rollback to v0.93.0+ carries the exact screen and its history (r8 lead U24)
update: stand down a successor still undialled when its dial wait ends (r8 lead U41)
update: hand a launched successor the launcher's control directory explicitly (r8 lead U42)
ctl: an update's park ends when the resumed reader has parsed what queued (r8 lead U12)
spawn: build UpdatePark's park, mark and catch-up only where a reader parks
needs: read every NEEDS YOU head form, and none said with more words
repo\_work: keep the repository's own excludes, follow global includes
gui: the meta wire test runs the meta arm's own wake loop
autopilot: a landed task's own wake keeps the landing only over nothing open
autopilot: a successor lands only a land act it sees taken, and holds a recorded landing over others' edits
autopilot: every harness's tall report is read whole before it lands
autopilot: a Claude Code turn whose start is above the screen is read whole before it lands
autopilot: name every program where the loop picks Claude Code's turn read
needs: a none that asks, or leaves work open, is no clean none; wrapped prose is no head
repo\_work: judge the person's conditional includes in the repository; expand a repository's \~/ under their home
autopilot: a Claude Code turn whose start cannot be read lands nothing
autopilot: a turn read that reaches the history's first row read it all; fixtures serve history
autopilot: a land act nothing can read as taken is judged by its yield's words
autopilot: a successor whose first read is the landed task's own wake keeps the seeded landing
agent: a landed task's own wake keeps the landing over someone else's edits
phase, agent: read a turn's earlier words on every harness
agent: a seeded landing's own words hold over a cut turn read
pet: owner-eye-6 review: the rest seat is reachable, off ink hulls, on the ground plane
pet: keep the rest seat while it is still ground the cat can reach
pet: typing or streaming into Claude Code's composer no longer sets the cat hopping at its rule
harness: login carry, limit notices and logins.json told as themselves
help: login-notice names its disk form
band: a step's short form gets its head back; a step's cut keeps its mark
harness: the limit notice beside a ready row says why the tab stayed
settings: NEEDS ATTENTION holds only the files that did not load
land: close the ninth review's twenty-one strict-reading holes, measured on the defense table
land: read the tenth review's strict-reading holes narrow, failing toward open
land: read the eleventh review's strict-reading holes narrow, failing toward open
link: satisfy strict lint for frontier simulation
keep fresh copies until shown to run; Messages keeps its place when Search closes the Tag pop-up
harness: a usage limit's notice promises only what aterm will do
harness, settings: read an unanswered Autopilot word at the first look; a closed Timer gives its scroll back
settings: keep Messages position across a menu-close resize
shell-integration, effects, uds: export AGY\_CLI\_FAST\_PROMPT\_EDITOR in live body, adopt flowing cohorts on typing, and fix census/soft-limit gates
harness: a limit's wait hears a relaunch edit; limit notices name only true causes and steps (r5h-1..4)
card-engine: A4 review findings: registry rung across fg, admitted reading kept, cheapest first
census: register identity\_holds and emptying guard helpers in lock-order census

Security

the MACOS ACCESS block's form is measured against the first screen

Tests

windows: pin that atpkg's account\_home is not the USERPROFILE a process is given
disk: drop an explicit deref clippy flags in the one-scan versions test
no stop signal meets an exec in flight; the SIGSTOP siblings of …
agent-link: a stand-in agent's banner no longer holds its kill in the tty drain
agent-link: the wedged-roster arm gives up at 50 ms, not the product's 2 s
agent-link: a relaunch's held wait polls at the shell look's pace
agent-link: the never-held agy lock is waited out for 50 ms
agent-link: aterm-json at opt-level 2 in dev, a ledger row in one write
agent-link: bridge fixtures admit sixteen cases where descriptors allow
agent-link: the one-write ledger row names record\_with, main's writer
agent-link: a scripted line's end is read over 20 ms, not a real shell's 300 ms
agent-link: trustfmt the four aterm-gui files main left unformatted
agent-link: what the check found
conformance: the login wall walk reads each real look once and judges a defect until it is caught
conformance: the footer walk's replay threads reset one world each instead of making and removing one per replay
conformance: the limit-queue walk judges each defective model until it is caught
conformance: the JSON reader builds at opt-level 2 in dev
conformance: the never-strands walk judges each defective model until it is caught
conformance: question text-mode walk on the resolved interpreter
conformance: the usage-wall defects walk each case until it disagrees
raster: display-glyph containment asks each face's fit once, per set
raster: the never-panic fuzz runs its fixed rounds on a pool
raster: what the check found
restore-census: engine conformance checks each distinct state once
restore-census: census suites walk synthetic trees held in memory
restore-census: scan\_set fixtures return the census's answer directly
restore-census: what the check found
host-live-2: a 2 s upgrade settle, and the rating cards side by side
host-live-2: turn\_submit's three follow-ups side by side
host-live-2: the fleet listener's retry seam, and the silent port's own read
host-live-2: the spare's scan spacing, and the daemon's release
host-live-2: what the check found
fabric-world-2: hash the binary signature optimized in dev builds
fabric-world-2: judge the no-ack stub under a quarter-second ack deadline
fabric-world-2: what the check found
gui-leftovers: accounts-lock tests hold the lock with a one-try ladder
gui-leftovers: the park's engine hold ends at its give-up, not a 1.5 s sleep
gui-leftovers: astream-digest (SHA-256) at opt-level 2 in dev
gui-leftovers: what the check found
release-publish: site\_sync lays a built lab instead of building one per test
release-publish: lane and group repos are made once per process
release-publish: a first run's vendor grace is a pass seam, not two seconds waited out
release-publish: a made fixture is built in its first caller's dir
auth-survivors: kill control\_auth's race-only and accounting survivors
auth-survivors: what the check found
uds-survivors: ListenerId's inode and birth each tested; fix its rebind test on Linux ext4
uds-survivors: config writer's race windows staged by a cfg(test) racer
uds-survivors: a receive the kernel could not install whole is refused
uds-survivors: others\_can\_write\_at judges a link as it stands
uds-survivors: what the check found
pkg-verify: a mode-000 rollback floor is not "published"; the floor advances under its lock
pkg-verify: windows for a reused temp name, a swapped claim lock and writes that did not land
containment: a reader that outlives the tool is waited for, not timed out
pkg-verify: name the floor-window act's type
crypto-pkg-survivors: what the check found
gate-gaps: one test-shell resolver; atpkg runs every hook dialect or COULD NOT RUN
gate-gaps: tty Ctrl-C check ends on input, not a 4 s sleep; live shells start with SIGINT at default
atpkg: two suite tests launch claude with a switch the yolo rule knows
aterm-gui: a restarted done's tests wait for its note, not for three screen reads
atpkg: selfsetup's fish arm finds fish through the shared resolver
handoff: v0.107.0's producer fixtures, written by its own cut
core: the holder-fence oracle reads whole cells and the perf corpora
bound subscription acknowledgement reads and diagnostics
satisfy tippy in the fx damage and blit tests
say only what the overshoot test's control showed
two outage and journal checks judge order, not the host's pace
v4 slice 3: the open pane's cat goes home on glass; a cut flight's control fails on where it cheers
gui: serde corpus records CheckpointMeta's holder field
aterm: the held worker's stand-in draws its submitted prompt as Claude Code does
supervise: the skipped-continuation replay names Cruise's continuation
supervise: the turn-end live suite types Cruise's continuation and the answer's NEEDS YOU hint
silent-passes: a multi-lane shell test lacking zsh or fish ends COULD NOT RUN
silent-passes: the frozen job of the signal-term tests ends only by a signal
silent-passes: parked stand-ins outlast the hang detector
silent-passes: a fixture root reads through ends COULD NOT RUN
silent-passes: held-successor and reset-zone tests run on every host
silent-passes: a host prerequisite a test lacks ends COULD NOT RUN
silent-passes: what the check found
spare-races: the escape scan tells another terminal's orphan from the run's
spare-races: a child gone with its gone parent leaves the scan whole
spare-races: a stranger's orphan in a clean run is COULD NOT RUN, not FAIL
spare-races: L9 observes the quit's retire
spare-races: what the check found
proc-table: read the process table in-process, held to ps
proc-table: kproc reads kinfo\_proc at the job probe's SDK-held offsets
proc-table: what the check found
agent-cpu: the drive grant's hand-named peer resolves at once
agent-cpu: the gemini and agy exit binds reset one rig and look once per world
agent-cpu: the account rotation graph steps the resolved model and the defects walk asks only the defects
agent-cpu: a resume the gemini exit's own pre-check refuses records nothing
agent-cpu: the footer walk floods just past the tail window and resets only what a replay wrote
agent-cpu: the split-append fold test appends through one writer
agent-cpu: the hand-entry grant test dials the book's bare name under a short deadline
agent-cpu: the rotation read back names its variable without an explicit deref
pkg-shell-speed: a lay holds the publication turn for its rename only
pkg-shell-speed: the removed-member hold runs its nine lanes side by side
pkg-shell-speed: the hook dialect test starts pwsh once for its eight cases
pkg-shell-speed: the small-file extract test pins two allowances with 16 files
pkg-shell-speed: live shells wake on their bytes, fish runs no man-page generator, independent shells start side by side
pkg-shell-speed: independent model steps, records and programs run side by side; the copy run links the binary
gui-speed: five settings and chrome tests stop redoing work
gui-speed: the two phone-width tests read one walk of the screens
gui-speed: two issues at once race fifty rounds, not four hundred
gui-speed: the stacked row's flow test deals its hosts to eight runtimes
gui-speed: many restarts of one program join four times, inside the grace
bus-link: astream stops its writer on a queued stop; notify tests stop brokers before removing their dir
bus-link: backlog tests publish pipelined and page small; the committed incarnation walk runs beside the rest
release-speed: the over-real-curl transfers notice a silence in seconds
release-speed: forge check resolves its cells at once after the first
release-speed: publish fixtures lay one pack and no git template
release-speed: release hooks, moves and site labs spend less on git and files
release-speed: the it crate holds its exec-path-first PATH helper
release-speed: what the check found
coverage-leads: the census walk's skips and its fail-closed stop are pinned
coverage-leads: the bounded run's reader ceiling is spent by the test, not waited out
coverage-leads: the footer floor and the work end at a break are bound
coverage-leads: what the check found
spawn-race: PRODUCT FIX: the bridge adopts its lanes by the descriptor, not a racy /dev/fd stat
spawn-race: probes read the child's own table, never a /dev/fd/N path lookup
spawn-race: name racing\_lookups' test gate where the wasm census reads it
spawn-race: what the check found
main's two reds — parse\_hold's guard row, and the live turn-end tests on Cruise's continuation
census: parse\_hold's synthetic fixture, the half of …'s registration it left out
uds: posix\_spawn\_raises\_note\_fork runs alone, where its parent's children are its own
autopilot: the carry test reads the carried work as a range, not an exact ms
update: drive both undialled arms through the one filing that stands the successor down (r8 lead U41)
the share row pins its answer; a long share pins that nothing is read
pet: pin the cheer's stage below a home under the footer; claim each control as run
needs: pin the two none readers' union, failing toward a need
census: drop parse\_hold's synthetic fixture with the helper
fd-probes: one shell probe of a descriptor, pinned under contention
fd-probes: every /dev/fd/N path lookup reads the descriptor instead
fd-probes: the inherited-display-socket test sits above the next test's doc
fd-probes: what the check found
clocks-pkg-update: curl's retry backoff at a thousandth under the fast-timers seam
clocks-pkg-update: the store lock's wait runs on an injected clock
clocks-pkg-update: passes on their test's own slot and clock; PASS\_TEST\_GATE gone
clocks-pkg-update: checker loops on their own lane and gate, each behind a hang detector
clocks-pkg-update: what the check found
release-tail: the Linux verifier corpus asks OpenSSL once per distinct proof
release-tail: snapshot\_take lays its fixture from a template made once
release-tail: publish fixtures and FakeHost run git directly, maintenance off
release-tail: claim\_landing\_model reads a view in one cat-file
release-tail: site, hooks and snapshot fixtures start no maintenance run
gui-flake: a held Commit claim is chosen by its cost, never raced
effects-speed: aterm-effects' test units build at opt-level 2, off other crates' opt-0 generics
effects-speed: the flash meter reads only the pixels a frame can change; the streak's runs run once each, side by side
effects-speed: the knob law scripts each distinct knob set once
effects-speed: probe\_f4a replays its twenty takes side by side
effects-speed: what the check found: the typing-streak flash test reads the shipped one\_row line
models-link-speed: the model sweeps walk each space once per question
models-link-speed: the link refinement tests make each real call once
models-link-speed: the liveness witness is the space's, at seven arguments
models-link-speed: what the check found
card-engine: A4 review controls: build rung by build, token first, byte arm's group edge; docs
card-engine: the byte arm's group-edge test takes a session id and pgid of its own
small-gates: a gated run the hang detector let go never reads as the expected run
small-gates: each rm\_breaker probe lane must find its own shell's names
small-gates: an isolated signal test fails when its child ran no test
small-gates: a fish warm hold's appended history is stamped after the hold began
small-gates: an init-parented waiter starts behind a FIFO gate, not a sleep
small-gates: an atpkg hook test with no zsh ends COULD NOT RUN, not a pass
small-gates: the stub durability ranking holds its bundle shape and temp roots
small-gates: handoff\_rendezvous's own test sockets bind under /tmp, not $TMPDIR
small-gates: a stale-pid teardown is judged after its reaps settle, not after 500 ms
small-gates: a retired holder beat is judged after two of its beats, not after 600 ms
small-gates: hook\_reroute\_first passes each shell by the reference it already is
small-gates: what the check found
spare-2: a stand-in that readied and ended between two looks readied
spare-2: escape fixtures name their own session; a revoked terminal's orphan is no escape
spare-2: a startup hang names where the instance waits
spare-2: a time budget missed on an oversubscribed host is COULD NOT RUN; each L4 case names its rule
spare-2: what the check found
proc-reads: fabric enable reads the login home and uid in-process
proc-reads: one KERN\_PROCARGS2 reader and parser, in aterm-uds
proc-reads: lane lock holders by libproc, process names read when asked
proc-reads: live tests ask again when the instance answers busy
proc-reads: SPECS rows name the shared parser and the file scan
proc-reads: the lazy row name's constructor has a name of its own
proc-reads: the holder conformance test compares lsof and the scan alone
proc-reads: what the check found
gui-cpu: aterm-scrollback at opt-level 2 in dev
gui-cpu: the clear-keyframe test reads the region once
gui-cpu: seamless tests no longer park the module on ENV\_LOCK
gui-cpu: a headless App opens its draft journal at the first look
gui-cpu: the prewarm-worker tests run their worker at Responsive
gui-cpu: name the deferred journal slot's opener type
gui-cpu: what the check found
clocks-agent-gui: the hosted engine runs on the run's own clock
clocks-agent-gui: turn\_end tier1 runs its twelve walks on threads, the task scan cached
clocks-agent-gui: nudge conformance runs on its rig's own clock
clocks-agent-gui: seed\_matrix: the dated-try cases on threads, the loop's ledger mirrored
clocks-agent-gui: name the hosted stop's condition type
clocks-agent-gui: control lanes conformance settles before it dials and projects
clocks-agent-gui: what the check found

Docs

harness: the tab's done mark in the CHANGELOG and aterm help harness
gui: one doc line of harness\_task\_moved, not two
the review's corrections to slice 2a's words
a bundle started through a link posts no notice, and opening aterm.app itself is the fix
predictive editing as the code does it, in adaptive and in always
land the recursive multi-agent audit; ignore aterm-link's stray lockfile
ordered is served when named, in the help, the manual, the module docs and the CHANGELOG
B2's review fixes as built; the row path's overshoot seam is a known issue
the crash restore as built, its measured costs, and the soak gate (increment 8)
v4 slice 3: the kitty's cheer in the changelog, the manual and §11.3.7 As built
v4 slice 3: the cheer appears on its stage at a first look and fades home off glass
known-issues: U6 and U13 cannot happen — no update authority names an older build
update: the launched successor inherits its launcher's XDG\_RUNTIME\_DIR and HOME (r8 lead U42)
a placed spelling is verbatim once a short name is spelled long
TRUST-REFUSED measured: four refused floors at a 6 GiB ceiling, and ROSETTA's rise attributed
harness: the post-landing check's decisions, changelog and manual
harness: §11.13, CHANGELOG and manual as the review's fixes built; the seat test settles the landing first
cli: iTerm2's close and Quit measured for CLOSING A TAB
DESIGN-init-system — one converge engine for every provisioning surface; which outside programs aterm really needs
FOREVER LAND and CRUISE measured live on the four harnesses
init design S1, the §9 doc rows that need no code (A4, A5, A16, A21, A36)
the hung-volume decisions name the picker's first budget and the restored identity tab
L-BROWSER's record names …'s aterm-gui change; the help splits the browser halves
predictive editing measured; aterm-predict SPECS: increment 5's rows
predictive editing measured, with what its review found
predictive editing before the plan and now, at 30, 100 and 250 ms

Other

sysprobe: one Windows path key for every cross-source comparison
sysprobe: the Windows mount table, volume reader and file identity
gui: match a mount's volume row by Mount::key
sysprobe: fold Windows names as NTFS does, hold 8.3 names, relate two roots only through the table
sysprobe: one table rule for two Windows paths, and the table's own fences
disk: the walk's Windows device is the volume serial, never 0
aterm-dirfd: the unix half moves to src/unix.rs behind a platform root
aterm-dirfd: a Windows half for the disk reclaim — handle-relative, never through a reparse point
aterm-dirfd (Windows): only "not found" is gone, pin starts only at a local volume root, no backup intent
aterm-uds(windows): expose the raw creation FILETIME for procStart
aterm-uds(windows): the path-user scan (holders contract C5)
aterm-agent(windows): kernel\_start reads GetProcessTimes, never ps
aterm-uds(windows): the path-user scan holds what it cannot read, and never hangs
aterm-dirfd(windows): a facts-only open, and the owner read through a handle
aterm-sysprobe(windows): is\_fixed, the drive kind of a mount's volume
harness disk(windows): reclaim build caches on Windows, by handle
aterm-dirfd(windows): never unlink a folder a volume is mounted on
harness disk(windows): keep a volume mount point, judge tier 3 by its listed id, fence non-fixed drives in the report
aterm-uds(windows): the path-user scan places every kernel path through sysprobe's one rule
aterm-toolchain(windows): the gone-checkout rule reads devices and places paths as Windows spells them
aterm-uds(windows): a module loaded through a junction is placed by the file the kernel mapped
aterm-toolchain(windows): a drive root is never a mount between, and only $HOME's drive is looked at
aterm-agent: tier 3's tree walk asks the device first again, and its docs say what Windows cannot see
aterm-uds: one PEB reader on Windows, and a process's command line and environment from it
atpkg: process\_args reads a Windows process (argv as the C runtime splits it, its environment whole)
aterm-uds: build a process or duplicate handle only when the call returned one
harness: one rule for the variable a Claude Code's home comes from (USERPROFILE on Windows)
disk census: read Windows processes whole, homed by USERPROFILE, in their working directory
build cache: say why the workspace rule needs no Windows inverse
aterm-uds: never answer a working directory torn by a cd
aterm-sysprobe owns the one Windows PEB reader; process\_cwd answers there
aterm-sysprobe: a test junction from its own FFI file, no aterm-uds dev-dependency
Windows disk code: the system's error boxes off on every thread that asks about tab and agent paths
Windows disk code: a path spelled with 8.3 short names is spelled long by one sysprobe rule
aterm-uds: a Windows path-user scan reads an unreadable process once more before holding it
aterm-uds: no default test scans the whole account; the Namer doc says what a close does
aterm-uds: the holders module doc says how a short-spelled path and a second read are handled
aterm-sysprobe: an 8.3 spelling is spelled long lexically, through its last short name only
aterm-sysprobe: the quiet guard cannot leave the thread whose mode it holds
aterm-uds: the scan spells a short path long on its naming helper, under the deadline
aterm-uds: a process that refuses the scan's open is held without a second read
Windows disk code: the call sites' tests of the lexical 8.3 spelling
aterm-dirfd: see cloud placeholders as reparse points; name a handle's volume by its GUID
disk: fence the measured volume by its GUID too, not by its serial alone
disk: never search or reclaim inside a cloud sync root
aterm-dirfd: name the disguise seam in plain code on a release-built field
disk: keep the walk's volume GUID a Windows-only field
disk discovery: the walk holds its placeholder guard, and reads into no root before it is found outside a sync root
harness disk: test that the tick removes with placeholders exposed; say why the verb's guard has no test
aterm-dirfd: check a sync root's residue on the tree, not in a registry it never writes
disk: read tier 3's sessions again at the removal, not the survey's copy
disk: spell paths plain in the text form; keep the verbatim spelling for tools
ctl help await: name why=automounted and why=no-mount
cwd\_native: a drive-letter OSC 7 report from another host is not this machine's
disk\_private: dev\_of reads Windows devices; say so and test it for real
disk versions: place a process's use on its entry by the one path rule
disk versions: stamp a digest by the one identity export at its full width
harness\_host tests: format the removal-reader test as rustfmt 1.97.1 does
sysprobe: export quietly, the thread-scoped no-box guard for an open
disk: resolve a session's cwd quietly, and never on a share or automount
process: read the NetBIOS name from the OS, not from %COMPUTERNAME%
cwd\_native: a foreign report stays as written for every consumer; say so
harness\_host: the look's remover is one fn, and a test drives it
disk tests: the tier-3 re-read test fences on the volume it measures
Move the document host and its I/O contracts into amacs-files
Stop calling amacs-files a placeholder in amacs's crate docs
Keep amacs-files under the guards it had inside aterm-gui
Say why LegacyJournal's fields are pub, and when they narrow again
Record amacs-files's trust floor
Settings: Off keeps the style it replaced, so leaving Serious Mode loses no cursor style
Settings: HDR glow's row says the preview cannot show it
Settings: a press on a cut control scrolls it whole by its hidden part, under the pointer
aterm-gui: drawn\_cursor\_trail\_style takes its lifetime by elision
Settings: the Adjust card lists a tall row's note after it; its bound counts the row alone
Settings: a press's nudge stands until the list scrolls
Settings: the style kept before Off is a style, by its name in the list
Cursor Styles: the saved Off names the style it replaced
aterm-gui: the nudge test's seat takes its tuple by then\_some
serde corpus: CheckpointMeta/(root) records holder
Refuse unknown abrew config and require fresh update indexes
Keep extracted document test helpers available in every test profile
host\_live: journaled\_at waits for the record; the host journals an approval after its key
atpkg: audit yolo posture spellings; add gemini
supervise/tape: say truly why the policy's home stays put, and replay a run that looked there
Check physical brew roots before native abrew work
Keep cask artifact receipts scoped to their payload version
Keep cask non-UTF8 captures independent of Mac filename support
Normalize abrew cleanup link targets before unlinking
Collapse the cleanup link predicate for strict lint
atpkg: drop the gemini-cli yolo route — agy is the Google lane
Test stand-ins: sign each Apple binary once, then copy the signed file
One fact separator: the palette's theme label and the joins Settings shows
Settings colour picker: measured to its column at every width and text size
fence: the ring round trip also reads a lone emoji
grid: a lent point a trim left past the screen is below the cursor's line
aterm-gui: the seal island records that all three seals hold with cell's Desk::next\_need\_after entry
Preserve debug document helpers alongside explicit test support
atpkg: resolve a shim's parent only for a shim's name; drop the tautological Store cross-check
gui: the C cut is the engine's C; the edged inbox charges a refused due visit; one output-wake path
status: the pool walk charges a refused due edged visit; a relative script is no shim
Preserve literal holder image paths outside Linux
Add local macOS workstation initialization
Preserve complete keyboard maps and await sign-out confirmation
aterm-census: supervise-fx follows an import that binds a clock to a bare name; a reader's home is its own fn in its own file
supervise/fx: say where "every clock goes through the door" ends
aterm-gui: trustfmt the four files main left unformatted
Format holder and timeline changes composed with macOS init
aterm-gui: the Windows cells build again (stale ConPTY dead\_code expectations)
aterm-link: bound\_reads goes; astream's Closer takes a hung-up socket's EINVAL
Add the amacs client: aterm edit, the amacs argv0 alias and its alias lists
Wait on the mock window with a hang detector, not CONNECT\_WAIT
Say at the --no-wait handoff what the server makes of it
Settings: a label given its own measure is drawn whole, not elided by f32 rounding
Messages: a page's clock is republished when its time words move, never on a blind minute
Settings search: Harness and AI CLIs are found by every agent's name, read from the rosters
Settings: a panel is composited once per distinct pixel, not once per pixel
tray\_raster: the rim memo's entry is a named type, and pixel fills take fixed chunks
Messages: the page's clock counts the Mac's sleep, the zone's offset changes and a moved zone
metrics: a key a native page takes is timed to the present of its answer
ctl help metrics: say what closes a native page's key in input\_\*
Settings: the compact toolbar names the page where it holds the title
Software Update: the status card measures its headline, detail and button words
Settings: About, Software Update and Messages measure against the layout
Settings lists: a hard edge never cuts through a card's caption
Software Update: the detail line's value stays the whole sentence
SPECS layout-policy: the compact toolbar names the page where it holds the title
Settings tests: the page-measure test's doc list ends before its controls
Packages: the consent note wraps to the card's column
Settings lists: one caption rule for the last, nudged and pressed screen
aterm-restore: layout v1's step records are pinned byte for byte against the vendored astream
docs, aterm-cli: fleet allow and the --host step-in are named; link drops hook
docs, aterm-cli: survey --host is a fleet read, not a driven verb
6A-1: the cross cells check clean through their test-target pass again
6A-2: a relaunch under the same sid takes a new epoch, never a repeated one
6A-3: a carried fold must agree with the carried log
6A-4: what reaches the program is what the seam sends, on every platform
6A-5: the turn tracker model tells ctl from the harness
6A-6: the transcript hand tests that are sequences get their .seq twins
6A-4 (review): a paste reaches the program only where the seam writes it bytes
6A-2 (review): no told epoch saturates the allocator, and a relaunch under an adopted id goes above its predecessor's
6A-2 (review): a #handed link keeps one seq space through a disagreement
6A-1 (land): the Windows and Linux cells compile main's new code again
6A-1 (land): the cross cells build main's edit hold and B1's leaf field
serde corpus: CheckpointMeta records holder
6A-1 (land): the Windows cells build main's holder wiring, and main's new tests are formatted
Cover Settings control nudges at both clipped list edges
Preserve launch posture past leading option values
fmt: the four aterm-gui files 0.107.0's verify found unformatted
Require a complete recognized keyboard census before local initialization
style(gui): format harness\_screen.rs with trustfmt
Make native casks real: measured 0% of the cask index admitted, now \~17%
Evaluate formula requirements/conflicts as data; golden\_gate bottles
aterm-durable: a failed barrier is returned, only a refused one gets the full flush
aterm-durable: pin the barrier's production pair on /dev/null; true its docs off Apple
Make local init converge, recover activation, and apply preferred scrolling
Use boolean assertion for native scroll readback test
Verify real shell selection and repair filesystem test modeling
aterm-restore: the layout v1 pin judges both directions before asserting either
Resolve formula variations; more cask artifact kinds; global PAX
crash restore: a shed region's custody outlasts a full keeper queue; the owed shed stays private and idle
memory pressure: a merged WARN|NORMAL mask is read as the level the system is at now
pressure verb help and CHANGELOG: journal\_ring=shedding, the level macOS reported
crash restore: the pressure cell's lock is taken where it is held, so the lock census sees it
Read Claude Code's disk-full notice after the vendor's warning glyph
Read the autocompact offer at any size Claude Code can draw
Forget the autocompact stepper's record once the offer has left
Say why each swept build cache went, with the figures it went on
Delete the disk and autocompact code nothing reads
Journal and log a refused disk reserve once per reason
Say the disk-full alert's cause once, true to its case, and show its step
Wait an hour before writing the disk reserve again after a failed write
Themes pane: fix the audit's focus, list, naming and isolation findings
spare: the verification's window wait wakes on time, so a spare is back \~60 ms sooner
gitignore: keep the retired tools' build output ignored
command\_wrapper casks and exact macOS bounds
primer, harness: stop teaching ATERM-TASK-DONE; a job ends in words
harness\_host: carry the conformance test's successor on its own clock
Add configured GitHub authentication and repository bootstrap to init
Bind native input latency to handled view revisions
serde corpus: record v0.107.0's shipped-state answers
libc: declare libproc's task, thread and fd readers for the stuck-job probe
sysprobe: the job probe, what the stuck-process engine reads per member
vitals: the stuck-process engine, jobs to verdicts (§11)
models: StuckVerdict, bound to the stuck engine by a Tier-1 replay (§17)
sysprobe: the macOS sweep asks getsid for the session leader
vitals: an agent's call stays a call when its leader exits unreaped
sysprobe: a live check of the stuck engine on this host
Stuck engine: one job per block, safe names, review fixes
Keep identity records within owned staging files
Judge journal spaces only from admitted authoritative rows
Persist desktop activation marker names before preferences
supervise/tape: an inexact policy's tape reads, the loop waits in its setup's step, a header is read in one pass
supervise/tape: a header the format's first build wrote decodes again; redecide\_after\_skip is supplied, not required
supervise/tape: say which headers lacked redecide\_after\_skip
supervise/tape: drop the format-1 fixture; say only what the tape fixes did
Lead the disk-full alert's band with the bytes left
Library plugin casks, per-entry variation admission, admission tool
harness(autopilot): who set this mode (design §11.7, slice 7)
harness(autopilot): who set this mode — the row fits; negative controls run
harness(autopilot): a SESSIONS row says who set its word on a line of its own
harness(autopilot): every SESSIONS row has its setting line, so a press moves no row; the review's controls
harness(settings): a stacked row's flow test sees each row whole on some page
restore: main's log\_ep and this branch's autopilot\_by meet in two leaf literals
aterm-dbus: bound a connection's sends and its handshake on request
aterm-a11y: a deadline on the AT-SPI bus writes, and a backed-off rejoin
aterm-a11y: the no-deadline controls wait out the thaw and leave no thread behind
aterm-gui: Linux reads reduced motion from the Settings portal, not gsettings
aterm-lab: the Linux lane runs the accessibility runtime, Orca included
aterm-a11y: a window focused before its first tree is announced activated
aterm-gui: the Settings portal round trip ends COULD NOT RUN with no dbus-daemon
aterm-a11y: name the glue's first publication first_tree
aterm-lab: the a11y verb's help names speech-dispatcher's log as the sink
aterm-gui: Linux's motion=auto copy says it follows the desktop's setting
aterm-lab: the a11y rows run live\_atspi as main's acceptance bench
aterm-lab: an a11y gui row Rosetta ended is NOT RUN, and says how the gui ended
aterm-dbus: open\_within's test holds the join to the bound it was given
aterm-lab: Orca's terminal text is a string of its own, before the typed line
aterm-a11y: a join of the accessibility bus waits at most WRITE, and a failed status read keeps the backoff
aterm-gui: text-scale installs the preferences on Linux, which has no OS re-sample
aterm-gui: the portal read's bound is tested, and its live test paced and timed
aterm-lab: Orca reads aterm-gui under Mutter too, on its Xwayland and as a Wayland client
aterm-lab: Orca's output counts when it is spoken with its whole line
aterm-lab: lab linux help names Orca's Mutter rows
fabric bench: the ping-pong arm's four open review findings (w5/s0)
fabric bench: name a fold only where the commit covered the answer (w5/s0)
aterm-link: subscribers re-bound through astream's closer; bound\_reads goes
aterm-link: fabric tail --filter passes astream's filter grammar first
fabric\_world: a filter the broker would refuse is a usage error before the dial
fabric tail --filter: the notes say what the parse refuses, under Unreleased
aterm-restore: erase\_region, for a region that outlives its writer
crash restore: a clear while a shed's custody is owed erases the region the keeper holds
keeper\_link: the custody test's regions are files of their own
SPECS: mp-level-table states level\_of, resolve, scrollback\_shed and level\_line(mask, level)
aterm-net: a proven peer's survey speaks only for the node it proved
aterm-net: a member leaves out a copy as itself only on its own proof
verify wasm-glue: the oracle reads a machine-wide wasm-bindgen that ship provision installs
ship provision: the wasm-bindgen install is forced over a copy that does not answer the pin
aterm-link: ls is this machine's escalation view, and astream's fabric design says so
aterm-gui: the win cell type-checks again after the holder edge landed twice
aterm-ctl: the edit tests' hang detector is unix-only, as its one reader is
atpkg: a cask artifact's exec flag is read off unix too, so Windows builds clean
aterm-sysprobe: the stuck\_live example type-checks for Windows again
aterm-gui: the setter's restore test captures a handoff only where one exists
Native upgrade (single and bare), naked casks, bundle dump --file
aterm-link: a poisoned broker log exits 75 for its supervisor; the bridge stops calling it connected
fabric\_world: a poisoned broker log, cured by the broker's exit, end to end
docs, fabric\_world: a poisoned broker log in the CHANGELOG and the manual; the world waits for the inbox
fabric\_world, manual: trustfmt the poison world; the manual says a poisoned broker exits within seconds
aterm-link: the poison exit line reaches doctor at real lengths; the docs say what a poisoned broker really does
aterm caffeine: the audit's fixes — uninstall, quit, rollback, the copy, a scratch HOME
aterm caffeine: the fix review's findings — quit's reach, the lock's patience, the decline
aterm-ctl: the Windows cells build again (HANG\_DETECTOR is the unix socket test's)
aterm-sysprobe: stuck\_live builds off unix again (the Windows cells)
aterm-gui: the autopilot setter's restore test is unix's, like the handoff it rides (the Windows cells)
Native cask upgrade under --cask
Collapse nested if in cask upgrade cleanup (tippy)
aterm-sysprobe: stuck\_live takes main's Windows fix alone
atpkg: trustfmt the cask upgrade's cleanup, which main left unformatted
Renew a stale LaunchServices record by a same-image handoff to a fresh launch
aterm-hash: FNV-1a/64's byte loop and offset basis are astream-wire's
aterm-codec: Crc32 is a thin wrapper over astream-wire's CRC-32
aterm-png: chunk CRCs fold through astream-wire's CRC-32
aterm-codec SPECS: the crc rows' blocking gaps after the move to astream-wire
aterm-hash, aterm-codec, aterm-png: say where astream-wire enters each graph
trust floors: aterm-png's floor goes down with the CRC-32 tables it no longer holds
aterm-codec, aterm-hash, aterm-png: the tests the docs name catch the mutants they name
font-oracle recorder and the two fuzz workspaces: their locks follow aterm-hash to astream-wire
aterm-codec and aterm-hash are no longer dependency-free: say so where they are described
SPECS (aterm-codec, aterm-png, aterm-hash): the hash specs cite a contract astream-wire does not have yet
Cargo.toml: the CRC's move to astream-wire, measured in dev, earns astream-wire no profile row
Native formula reinstall with restorative same-keg swap
aterm-render: prove shaping-gate, delete the two tests it subsumes
aterm-gpu: prove should-slice-nonempty
SPECS.md: measured blockers of the scalar-signature specs on Trust seal …
Native cask reinstall, completing lifecycle symmetry
aterm caffeine: the menu opens through accessibility (a Show Menu action)
Greedy cask outdated/upgrade, uses --installed, fetch resolves variations
Preserve preexisting names while staging the disk reserve
aterm-gui: renews\_launch\_record is asked only by the unix handoff lanes
Multi-name install/uninstall/reinstall/upgrade, planned as a batch
harness: surface multi-day Claude limit notice, resume on /login, and fall back to rclone in accounts sync
Fix unused binding and stale help wording (multi-name follow-up)
fmt: the R6 review tests, as trustfmt lays them out
crash restore: a second shed while a custody is owed keeps the region the keeper holds
aterm-predict: overlay\_frame, and a chain composed before any reconcile paints only what it changes
aterm-gui: hand ←, → and Backspace to the edit lane, paint a chain all or none, predictive\_echo\_editing
aterm-predict: a flush takes the chain's cursor with it
aterm-wasm, aterm-gpu-web: predict\_edit\_key and predict\_overlay\_cursor; the CPU replay re-recorded
aterm-predict: the review of increment 2, and an 800-seed sweep, held by the theorem
aterm-gui: a keypad arrow is an edit key unless Kitty reports the keypad; an edit key at a no-echo tty is unmodelled
aterm-predict: a carried epoch's proof is held to its standing tail and its mark
aterm-predict: the theorem's floor counts re-taken after the carried standing tail
atpkg: trustfmt abrew/commands.rs, which main left unformatted
atpkg: trustfmt abrew/mod.rs, which main left unformatted
aterm-agent: replay --why explains one decision on a harness tape (T8)
aterm-agent: replay --why keeps what a tape holds when its header does not read
aterm-agent: replay --why names what this build supplied, rebuilds a box head's join, reads a local time as an instant
aterm-agent: a test that the run's python globs reach replay --why's re-decision
aterm-agent: replay --why boxes a joined box's reading (tippy large\_enum\_variant)
Refuse incomplete Abrew metadata and preserve owned artifact custody
Complete the constrained cask fixture call for reinstall admission
Messages page: a failure stays listed, a moved-on entry stays open, a story is timed from its start
aterm-verify: verify cells runs both windows-sys oracles with a Windows cell
aterm-gui: typed\_into compiles where its one caller does
aterm-window: single-backend Linux builds match the Headless loop
aterm-font: GSUB walks spend a sanitizer-sized budget
aterm-font-fuzz: bound the face target's subtable walk; refresh its lock
aterm-font: cite the autohinter's measured cost on aliased GSUB
aterm-verify: the wasm lane fences the GPU module's size too
aterm-gui: the hold reader, carry clock and symlink test compile off macOS
aterm-containment: the bundle-walk test reads its euid without libc
aterm-gui: the text-scale verb lays its scale over Linux's default reading
aterm-font: the shaper parses every GSUB lookup before any applies
aterm-font: the GSUB budget is aterm's own, its margin 0.26 traversals
aterm-win32-oracle: fetch registry windows-sys 0.61.2 when no copy is cached
atpkg: the cask artifact check compiles clean on Windows
aterm-ctl: the edit tests' hang detector compiles where its one reader does
aterm-containment: drop the unix libc dev-dependency its one reader left
aterm-sysprobe: the stuck\_live example compiles on Windows
Launch-record renewal: withdraw the adopted entry, end on auto\_apply off, defer a press
aterm-restore: the control slot's record, writer and reader (crash-restore increment 7)
crash restore: the turn ledger rides the region's control slot (increment 7)
keeper restore lane: a crashed window's turns are still in history (increment 7)
crash restore: a crash carry is held to an update sidecar's bound, and unix-only ledger items are gated
Settings themes: one choice rule by what a theme is made for; Follow system round-trips; side and trial state scoped to the surface on glass
Settings theme card: the Follow system switch leads, Browse themes is its own row, a slot picker lists its side first, controls records bind the theme in every mode
Settings preview: one cause for reduced motion; the HDR glow row and preview say the preview caps HDR glow at standard range
Settings pickers: the wheel scrolls, a search seeds by a theme's name, headings are structure, the last screen fills, and one preview rule over a picker; a short page scrolls its preview instead of dropping it
Settings specimens: whole rows at the renderer's real pitch, a fuller text specimen, Top specimens cut only for a control row
Settings window sample: opaque title ink on a whole pixel, a rim where the bar meets its own side's terminal, and Auto takes the terminal theme's side everywhere
Settings Themes: the page keeps its heading, and every screen of the chooser and Customize names the section it starts in
Settings preview ticks: repaint only what moves, draw nothing under an opaque specimen, upload only the changed rows; Top Settings schedules the previews it draws
Settings Themes: the demo gives up whole rows down to one, exactly, so the chooser never runs past a short page
SPECS: the window sample's one Auto rule and rim, and Top Settings' cadence from the preview it draws
Settings search: clearing a search ends what Search Results chose, as starting one does
Settings lint: a picker's peek is one expression, the occlusion rects have a name, the recompute helper goes with the OS-flip tests
Themes Customize: an open colour picker is one whole screen where COLOURS cannot head it
Settings theme card: on a compact list the Follow system row is a switch row like every other
Settings pickers: a key before the opened picker's first layout takes the window with it
Settings theme card: a stacked Follow system row seats Reset after its switch, as a stacked switch row does
aterm-gpu: a tray card slot waits only for the presents that sampled it
Settings Themes: the demo gives up rows for the Customize sheet's least, not the chooser's
Settings tests: the short-host preview cases follow the room main's compact toolbar gives
Settings HDR glow: one cause and one set of words for what the preview cannot show
aterm-agent: the sleep count's boot is astream-sys's 16 bytes; aterm-uds's copy goes
aterm-caffeine: the state file's boot is astream-sys's reading; the unsafe sysctl goes
aterm-update: the Linux lane's steady clock is named only by a boot id astream takes
aterm-census: boot-id-door, the kernel's boot id is read by name only in astream
Preserve validated captured boot spelling in replayed ledger output
Keep package replacement and failed-plan cleanup within prior ownership
Preserve same-keg reinstall receipts in an exclusive recoverable aside
Share receipt-backed reinstall custody with casks and preserve dry-run cleanup
Keep reinstall cleanup conditions explicit for strict lint
Remove redundant borrow in owned-link restoration
Refuse whole-command delegation after successful native package work
Preserve restored holder uncertainty and every visible image layer
Exercise restored holder uncertainty without rebasing the signed block
shell-integration tests: keep the host's VISUAL and EDITOR out of the hermetic shell
update-core: the real-curl transfer tests' hang detector times a step, not the call
aterm live tests: every aterm ctl call waits a one-minute hang detector, not the client's 10 s
update-core: the transfer hang detector also fails a lane that asks past its loop's bound
Launch-record renewal: withdraw without resolving, read the cancel before launch
aterm-gui tests: a restored holder's lineage bit is not screen state
aterm-agent: a boot is written back in the case it was read in
aterm-boot review: true contract row and docs for the boot readers
Fix renewal cancellation before LaunchServices launch
Preserve original posted severity across message handoff
Settle committed Metal rendering when presentation refuses
Carry a lost login's /login across a loop that starts inside it
Deliver the carrier's turn again when the login comes back elsewhere
Tell Console's sign-in menu as the owner's choice, not a stop
Make the login notices lead with the step and say what they mean
Name every accounts form in the manual and say where notices go
Wait for the band's reveal before lab instance --image takes its frame
Bind the login back elsewhere to the login wall model, carrier included
Hold the standing ask to the step-first order, and quiet tippy
Lay out the from\_ref assertion as trustfmt does
Flag and name-form parity for common brew spellings
Preserve admitted replay boot spelling without changing kernel output
trust lane: a run's dep-info is what its emptied slots hold, whatever the clock
trust: aterm-grid certifies stack\_image's six alone and paired (1173/4747); keeper 233/919; close ATERM-KI-1015-5
trust facts: conclude maps the plan's filing (clippy::manual\_map)
trust: aterm-grid 1186/4785 on the tree merged with origin/main …; keeper holds 233/919
trust lane: only a run that files stops on a slot it cannot empty
trust: aterm-grid 1186/4785 and keeper 233/919 hold on the merge with …
trust: aterm-grid 1185/4800 and keeper 234/935 on the merge with …
abrew: name dead reroute stubs and missing prefix PATH
Prime coding agents at the windowed launch, so an update's tabs get the new primer
Wait for the Commit before the launch's primer pass, and prime every identity there
Gate changed\_row\_band to the Metal and wgpu arms that call it
Launch-record renewal: say why the installed bundle is unproven
Say what the limit reset takes on Claude Code 2.1.304 in accounts --help (ox-19)
aterm-restore tests: a restored holder's lineage bit is not screen state
history help: a crash restore carries the turn ledger too (increment 7)
abrew: an interrupted pour no longer wedges the prefix
agy live test: the summary database is read only once the holder's write is committed
abrew: restore a stranded reinstall aside instead of reaping it
holder image: a re-read keeps an unchanged process's image; time the reads; As-built notes
Refuse ambiguous or mismatched qualified Abrew package kinds
abrew: doctor names installed-but-unlinked kegs
Give the live-stub fixture an exclusively owned scratch directory
Real disk-image checks run in a macOS guest: lab mac dmg, a uds fix, the no-zip lane and install.sh's image path covered
lab mac dmg: a killed lane's VM is reclaimed, a failing row says why, a guest refusal is NOT RUN
crash restore: the turn-id count rides every region, and the lag counts what the slot sheds (R7 review)
Bind message navigation to the session it names
Prove amacs-term's scalar core with Trust contracts and record its floor
Map main's unsendable await error to a failed wait in amacs-term
Format amacs-term's await-error arm
Refresh amacs-term's trust cost row from the final-tree lane run
Refresh amacs-term's trust cost row on the merged tree
Note the second merged-tree lane run in amacs-term's SPECS.md
Prove aterm-tty's decoder byte classes and bound its screen
Format Screen::new's clamp as trustfmt lays it out
Record aterm-tty's Trust floor and its specs
Prove aterm-tty's CSI parameter classes and the trailing UTF-8 bytes
Pin how the decoder reads a broken UTF-8 character
Raise aterm-tty's Trust floor to 208/696 and list its open obligations
Say why aterm-tty's 28 SAFETY-comment rows stay failed
aterm-gpu: read wgpu timestamps only after the frame ran; record the plan's Unorm work
aterm-pty: declare\_interactive\_thread on every platform
aterm-effects: share the harness card's nova step with its host
effects harness: price the GPU clock, calibrate the reference, cover the B5 producers
verify perf: a trend row names a dirty tree; drop the rows measured on one
gui metrics: an ablation reading cannot fail open; count ink, char\_fg and fx layers
effects harness: a counted report needs every way's instruction sample
verify perf: the effects keys written once; ref\_text\_gpu\_rel gated; baseline re-recorded
verify perf: format the effects keys and the trend's tree label
6B-1: the session journal is on by default (D3)
6B-2: the clause is on by default and names a label's author (D6)
6B-3: the session log's Settings switches are proved Bool rows
6B-4: RFC §1 is rewritten as D1 ruled; the supervise skill reports by mark
6B-1: a finished command is logged by its program alone (D3, U21)
6B-1: the armed successor's no-writer check waits for the lane's decision
6B-2: a need or work row names no author, pinned (D6, U22)
6B-1, 6B-2: the D3 and D6 texts say what ships, under \[Unreleased\]
6B-4: the supervise skill's mail answer is a command post accepts (D1)
Retain unowned Abrew scratch and complete dependency views
Preserve unclaimed lab VMs and exclusively own each run scratch directory
Make the lab scratch guard available to its executable
crash restore: say what a superseded region's count word holds
crash restore tests: wait for the worker's level with its shed, not after it
aterm-uds: read another process's cmdline and program as the kernel holds them, Rosetta's leak avoided
aterm-gui: waive the sidecar's Speculate where the launched lane does not run
aterm-models: print a digest of each collected spec registry
Remove the prose-only required-options test
models: SuperviseReplayCursor's acts arm, a scenario (replay plan T9, model 2)
supervise/tape: acts mode, the counterfactual replay's cursor (replay plan T9)
aterm-agent: counterfactuals over a recorded loop, hosted and engine (T9)
supervise/tape: the shadow, every recorded decision decided again (T9)
aterm drive replay: --set, --policy and --shadow, options of the replay (T9)
supervise/tape: the acts cursor looks up by index, and its guard is tested
supervise/tape: a keyed probe in acts mode is read from the cursor's index
supervise/tape: T9 review — acts mode never compares housekeeping, names the act a candidate goes on without, and ENDS a tape with no end only when spent
supervise/tape: only a WAIT held past the act is the act skipped; a read there stays STALE
session-log journal test: wait for B's first segment before listing the folder
Messages keeps its place under a told-on top row; pack ids stay as shipped
abrew: name the cask artifact that forced delegation; doctor walks Applications
aterm-link: serve ordered for real, with the records a person would miss escalated
aterm-link broker usage docs: one listener, guarded or not
aterm-link notify: on a broker that serves ordered, page a record only once it is durable
aterm-link notify: trustfmt the ported test's connect
fabric bench: the ordered arm, acked and durable apart, flushes counted, on S0's ping-pong
aterm-link notify: a reconnect off ordered pages what it held
fabric\_world: the ordered tier end to end, the tests that assume no default
aterm-link: ordered is the default for a guarded broker on macOS, at a 100 ms horizon
aterm-link durability docs: reflow the paragraphs the port widened
Describe only reported fabric durability and bounded notifier guarantees
aterm-link: the ordered promise is astream's bound, and astream decides where ordered is served
verify perf fabric: a bare run measures what aterm ships, and a plan pins the build's git facts
vendor/astream: bump to defb053; notify and the presence view read recv\_live\_event
aterm-link durability: trustfmt the merged promise
fx: identity damage and scroll-blit marking for fx layers
fx: replay the fx layers into the spill band
gui: carry Window-space fx and occluders through the GPU transport shift
style: trustfmt the fx damage, spill and transport tests
gui: the paste and close questions are in the repaint key
gui: chrome cuts the fx light, panes place it, presents carry hints
bench: the scroll blit under a settled card, against B1a's repaint
render: the scroll blit's overshoot aprons finish the glyph phase
render: the damage seam takes RowBands, with no bare cell\_h
gui: the composed repaint gate's hint and question terms get tests
gui: three chrome surfaces cut the fx light in one frame
Prove four amacs-files predicates with Trust contracts
Make amacs-files' read, decode and lock-retry bounds provable
Raise amacs-files' Trust floor to 153/674 and record its specs
Bind amacs-files' contracted limits to their spec literals
Re-measure amacs-files on the final tree: 153/676, and record the review's decisions
aterm-gui tests: one step up is from this platform's default font size
aterm-gui test: copy\_on\_select's default is the platform's
editor key table: the page rows read the editor's screen
settings chip click test: a picker row every platform shows
tab strip test: the short version rung is never longer
quit\_safety test: bash stands in for a job-control shell
login PATH tty test: every interactive shell the host has
quit\_safety test: refuse only a missing bash, and clean up on failure
aterm-machines: the envelope tests make their scratch owner-only under any umask
atpkg: an abrew rollback never removes a foreign entry on a recycled inode
aterm-gui: waive Speculate where speculate\_layout is not compiled
aterm-render: the by-name bundled-font tests run with an empty HOME
aterm-gui: the stopped-parker conformance test dials only once the lanes are free
atpkg: pin abrew's kind check and activation target check with tests
Declare macro\_attr only in the builds that expand an anchor
aterm-gpu: compile apply\_hdr\_surface\_upgrade only where something calls it
Read fixed-width words with as\_chunks instead of chunks\_exact
aterm-machines: scope the enroll sink instead of dropping it by hand
aterm-gui: spell the presence test's TIOCSCTTY request as the tree does
aterm-gui: the mac-arm and win cells lint clean again
Settings: Software Update reads the one platform-updater fact on Linux
Settings: a Top card's short choice wraps its segments rather than cut a label
Settings: the Customize sheet is as wide as its colour rows need
aterm-gui: Settings tests read macOS-only rows from row\_available\_here
aterm-gui: the GPU-parity test uses a key the GPU gates on every platform
aterm-gui: two Settings tests follow decisions their parallel branches made
aterm-gui: Settings tests hold on a host with no audio output
aterm-gui: two Settings row tests stop depending on the UI face
Settings: a row's name wraps by the painter's own fit test
Settings: the status bar's Undo is as wide as its word needs
aterm-gui: Top Settings' wide check takes the no-audio host's height too
Settings: a Linux copy's update caption is Linux's updater's
aterm-gui: the no-updater lane test picks its arm by the host, not the page
aterm-gui: Universal Control's Linux note is read from its one owner
aterm-gui: the press-nudge test checks the keyboard on every nudged screen
aterm-gui: the draft bar's stacked case is measured in the host's UI face
Settings: the Serious Mode note keeps its pin at 80x24 in Noto Sans
aterm-gui: the ring-cap log test compares both logs in the same room
aterm-gui: page-down test sees a note line the room cut away entirely
aterm-x11 live test: map its window past any window manager
spare live suite: run under the host's shell, zsh or bash
worker spawn live tests: no silent bash where they name zsh
free\_sprite\_gpu: hold the cat to the cat bar and its text to the glyph bar
aterm-gpu: the GL oracle takes the instance and lock GpuContext::new does
Live suites: one test-shell resolver, and need\_zsh names the test's line
aterm\_spec::host: say what each of its two helpers is for
aterm-gui: the folder verdict test waits a hang detector, not the 250 ms budget
aterm-core, aterm-restore tests: a restore's seed lineage is not screen state
aterm-machines: the real-git init tests need the Command Line Tools' git
aterm-gui: a ready index's park waits a hang detector, not 20 ms
aterm-verify: the borrowed-tools test runs each stand-in once as it lays it
aterm-gpu: changed\_row\_band is built where a tray card uploads
Settings: a focus that left the Tab order resumes where it stood in a list too
aterm-gui: the handoff fixture generator refuses a host with no trustc
aterm-gpu: keep apply\_hdr\_surface\_upgrade's arm cfg across the merge
aterm live lanes test: a reset is the listener's close, as on macOS
aterm-win32-oracle: read imports with the stock toolchain's llvm-nm
aterm-gpu: the free open\_frame is Metal's
aterm-gui tests: the folder check is a hang detector in this crate's tests
Keep session journal fixture roots and workers owned
crash restore: the soak gate, judged from the recovery ledger (increment 8)
fmt: the soak gate, as trustfmt lays it out
crash restore: Q1 read in the real-Claude lab; Claude Code repaints in place after a pulse
harness(autopilot): an end nobody has looked at is a Done for you row (v4 slice 4, design §11.4)
harness(autopilot): Go's test clicks from behind another app, where only Go's own mark can quiet the end
harness(v4 slice 4): Read Result is a look at the end; a landed worker's row says landed
status\_end\_tests: the module doc names Read Result's look
Refuse oversized process argv before translator normalization
abrew: cross-check admission simulator against the binary; fix three divergences
abrew: admit wrappers that exec from their own Caskroom tree (prince)
harness(v4 slice 3): the kitty cheers the landing, when you are there to see it
harness(v4 slice 3): the pet's ♪ and ♥ on paper take the mark's ink
harness(v4 slice 3): the landing's cheer plays in an agent's pane, on open ground
harness(v4 slice 3): the cheer's stage is searched by the motes' own reach, and a sleeper on reserved chrome finds it
cursor trails: one spelling table in the engine; the picker offers 13 looks, default first and Off second
review: trail spellings — no reference to a deleted test or predicate survives; one duplicate picker test trimmed
Settings trails: every choice says what it looks like; reset, search, knobs and page text tell the truth
review: a style-only Off keeps its typing glow in Settings' words; the aurora holds an ink between floor and target
cursor trails: one colour law for both hosts, the intensity dial reaches every body, truthful trail status
review: correct the prose the colour law and heat target left false; the glow demo asks the shipped law
cursor carets: every effect-owned caret keeps 4.5:1 on its page, light pages deepen instead of whitening, bloom fades on light
review: the momentum tint cools onto the plain cursor without a step
momentum glow: one budgeted halo, a veil on light pages, and a cool-down that runs to cold
review: the momentum settle tests pin the analytic step and the page's active term
aterm-effects, aterm-render: the cursor streak rasterizes with no per-frame allocation
aterm-effects: every dark streak spends one over-ink contrast budget; sparkle gets its own tight stack
aterm-effects: light-theme streak rails stay in their row, cap their veil and run unbroken
review: wp08 docs say what the streak budget and its tests actually do
aterm-effects, aterm-render: lightning flashes once and counts it, water and lightning show on light, particles keep off the text
review: wp09 comet glint lays over its body, black ink paints, black lightning stays legible on light
aterm-effects: the fire caret rests as an ember that reads on its page
aterm-effects: fire on a light ground is ink, with flames that read on white
aterm-effects: fire's lights over the letters spend one over-ink account; steam stays off the line above
review: wp10 light fire holds an unread row at the text ceiling; test docs say what is judged
aterm-effects: the default rainbow kitty keeps typed text at the bar on light themes
review: V2 §24 states what the light bed's bar costs in colour; a stale veil comment goes
aterm-effects: the classic wake settles, shows on light, and rides scroll
review: classic settles the light another style left, and keeps the caret it saw
aterm-effects, aterm-gui: Trail Packs draw on light, every knob works, examples install
aterm-effects: water\_seen's doc names its second user, the pack light rails
review: wp12 Trail Packs tests discriminate, a bare pack: says why it falls back, stale names go
aterm-effects: re-bake Fire's licensed typed fold for wp10's fire emitter
settings preview: the cursor demo is a real CursorFx host, composited by the terminal's renderer
review: the focused cursor card keeps only its own page's subject; preview tests prove what they claim
cursor trails: integration fixes across the five lanes
cursor trails: post-merge fixes — tippy clean, no hidden #\[ignore\] tool, formatting
aterm-effects: the dark streak budget caps each sample's peak, so every trail keeps its fade
aterm-effects: the rainbow kitty caret reads at 3:1 on every shipped light theme, pinned
trust: memory.tsv keeps one row per library and RAM; the floors merge doubled seven
aterm-effects: a typed streak run keeps every sample, so the streak cannot re-flare at the typing rate; the flash meter covers it
aterm-effects: the light-theme aurora returns as a soft translucent veil, not a flat bar
cursor carets: the effect caret's floor holds against the cell under the caret, not only the page
Settings preview: a newly highlighted trail starts its own loop, so its first paint replays the warm-up, not the cycle so far
aterm-effects: an output comet retires when the ink it marks is erased, so Ctrl+L leaves no ghost cell
aterm-effects: the comet's cell bed is held to a contrast budget, so the letter beside the caret reads at 3:1 with the momentum glow on
cursor trails: every style that reads the rows beside the caret is handed them, not only the rainbow kitty
cursor trails: the lanes' cheap low-severity review items
trail status: comet\_alpha\_max is said to follow the bed's legibility share too
trust: aterm-gpu-web's floor follows a verifier lowering gap the trail integration exposed (122 -\> 120), with the measurement
aterm-gui: trustfmt the unaccepted\_value\_warnings assert in app\_config's tests
aterm: bring upstream's fabric repair-test fix onto the trail branch
aterm-agent: the two tests that drive a real flow runner hold one lock on the process's interrupt dispositions
aterm-gpu-web: pump\_reflow\_on\_render\_tick's grace step proves again, so its floor is back at 122
aterm-effects: classic on a light ground is ink under the letters, and a jump is one stroke
aterm-effects: a pinned cursor colour is the caret at rest
aterm-effects: the light comet nucleus rests clearly above the page floor
aterm-effects: the light page's momentum glow is one round glow in the caret row
aterm-effects: the emitter block's aura is a round glow inside the caret row
aterm-effects: a light band that leaps rows stays on the landing row
aterm-effects: light bands give way to rails over wide glyphs
aterm-gui: the preview's trail verdict judges the whole cycle, the pause holds mid-line
aterm-effects: the serde corpus keeps a Trail Pack v1 manifest that still loads
aterm-effects: with no trail drawn the light momentum glow wears the caret's colour
aterm-gui: Cursor Styles writes a pack's description as it writes the built-ins'
aterm-effects: knob reach is read off the engine, not kept in a table
aterm-gui: a preview of a pack that is not loaded names the trail it draws
aterm-lab: trail-gallery and trail-contrast, the cursor-trail gallery and its WCAG probe as lab verbs
aterm-effects: on a dark ground the streak lies under the letters, and one account holds every light over them
aterm-effects: the dark streak keeps its glow over air and its colour under the letters
aterm-effects: sparkle burns gold over a dusk, fire rises in tongues, every glow is round
aterm-effects: Classic wears its crown on a light ground, as ink on the caret's row
aterm-gui: the cursor preview's least height is a control's, so a short page never cuts its Pause/Play target
core, render: the fx engine's cost counters and one slicer for every backend
gpu: draw fx layers on Metal, wgpu and GL through one instance law
models: MetalAtlasResidency holds the fx regions and the palette ring
gpu: fx parity, band, hazard and binding checks on every arm this desk runs
gui: metrics reports the fx engine's per-frame and at-rest counters
gpu, render: the pass law under test; tippy clean on the lane's crates
gpu: fx\_prefetch makes arts resident without drawing, under test
gpu: UPLOADED\_SAMPLED is live on the GL arm now that the fx atlases mint through it
gpu: the fx layers under test on the GL arm, against the CPU and against wgpu
Keep paused GPU clocks from booking skipped readbacks
docs, gpu: B1b's GL arm as run on this desk; why the GL palette keeps a ring
Use compatible source-over endpoints in the canvas differential fixture
Put run\_verbs' doc back on run\_verbs in lab instance
Disk watch: record a finished stage, and say when a full disk kept a pass from removing
Login carry: tell the owner to close a dialog whose login came back, and follow a renewal made while /login was up
Weekly limit on a roster row: name the roster's step, never /login in the tab
Accounts: a login signed back in at the tab is ok again
render: preserve unsigned row-band geometry before signed arithmetic
abrew: evaluate depends\_on xcode: from data; drop build/test contexts
spare: a new tab takes a spare while its escape scan waits out the grace, and a verification is not spaced
spare: the grace's wait holds back verification and the next fork, not a tab; two runs pooled
spare: the design's I3 names Verifying; the unspaced-verification test takes whatever the scan reads
Refuse unbounded policy input and preserve unknown shadow evidence
abrew: cask depends\_on formula/cask install natively first; nested .app.tar unpacks
crash restore soak: a kill a keeper-absent run's link held is judged; refusals count
docs, census: the soak's keeper-on is the link; the wire table whole; restore-stays-local as checked
keeper link: the boot sets the census's keeper= word; refusals reach the row; a live test reads it
Keep an ask's step whole on the band before its title (audit3 copy-3)
Say what to do about a lost login, a stuck rotation or a full disk in plain words (audit3 copy-1, copy-2, copy-4)
amacs-files: admit missing files, keep BOM and CRLF, resolve open paths
Raise amacs-files' Trust floor to 153/717 and record its specs
amacs-files: compare a version's text in file bytes; saves make no folder
Raise amacs-files' Trust floor to 158/748 with the review fixes
aterm-agent: FOREVER CRUISE / FOREVER LAND policy core, and NEEDS YOU
repo\_work: count the commits on HEAD the remote's default branch lacks
models: SupervisorCruise and SupervisorLand, bound to the real decider
Teach FOREVER CRUISE / FOREVER LAND and NEEDS YOU; retire the token's teaching
aterm-agent: a left NEEDS YOU entry comes down; wall acts end on NEEDS YOU; retire dead policy items
codex-alab's wire for FOREVER CRUISE / FOREVER LAND: policy texts, act words, needs beside a self-claim
lab restore --land lands on a clean defense; the harness docs follow FOREVER LAND
summarize: a private folder of aterm's own, or no summary at all
end gate test: a relaunch's first point may journal a SKIPPED act
fmt: the merges' test edits, as trustfmt lays them out
update(handoff): a seamless successor's own update facts wait for its Commit (U14)
timeline: an anchor above every id handed out reads from the first row (U13, keeper lane)
timeline: the shared wire oracle reads the new arm; no link to a cfg-gated item
abrew: $APPDIR generic targets and container nested: archives
Keep result clicks bound to the end their menu captured
abrew: read-only scripted forms stop delegating to the wrong prefix
abrew: help and manual text catches up with rounds 6-22
Run test stand-ins in place; delete a copy only after it echoed (sp-1, sp-2, sp-3)
Hold aterm-agent's test child waits to a hang detector (health-relaunch-unbounded-wait)
Bound the two sqlite3 waits main just added to the agy live-read test
aterm-uds: ProcWatch, the kqueue witness of a session's execs
card engine A2: kernel exec edges through the PTY reader
procwatch tests: use the descriptor-safe child launcher
procwatch tests: use the launcher stdio type with its child
procwatch: keep explicit gather inputs and simplify the test exec guard
ForegroundHandback: ObserveExec and the exec cut's laws
card engine A2: the process watch on a real zsh
card engine A2: I1 through the real reader with a process watch
card engine A2: as built, and the drain's time in metrics
card engine A2: trustfmt over the lane's files
census: register parse\_hold as a term guard helper
crash restore soak: a recovery that refused every offer is no recovery to report
Preserve local text contrast across the light fire palette
Use the standard range predicate in the light fire fixture
Judge mixed light fire contrast across each glyph scanline
aterm-lab: lab instance measures in aterm.app's scheduling band (own coalition, APP task, role UI\_FOCAL)
aterm-lab: the band test runs aterm-lab band-standin and builds off macOS
abrew: clean not-found errors with suggestions; info falls back to casks
atpkg: lift the pending stub's DirWatch into atpkg::dirwatch::Watcher
claude\_footer: read awaited registry rows by push; delete the first-row ladder
card engine A5: re-ask the footer at a drawer's exec edge; registry drift is an exception entry
atpkg dirwatch: the inotify fd accessor is a test seam; pending\_wake doc names the shared watcher
claude registry: a level outside sessions/ reads no row; the lab hands ATERM\_DEV\_ seams
card engine A5: as-built note, live measurements, specs and changelog
abrew: multi-entry bundle install is native with batch planning
abrew: cleanup --prune=\<days|all\> and -s prune cached downloads
spawn: the Windows reader passes read\_or\_wake's process watch and matches Proc
aterm-link: aterm fabric and both doctors say what the broker says of its log
aterm-link: a ghost node's rows go to that node's publisher; the health and remedy text says only what holds
aterm-link, aterm-cli: trustfmt the review fixes
fx: one frame art budget every backend obeys; GPU admission packs drawn arts first
fx GPU tests: palette overreach, slot order, bloom feed and crown, art budget
fx GPU: ring-slot residency model, palette identity drill, prefetch gate, fx demand
fx: a fail-closed staging seam and test; B1b finish as-built notes
Re-admit FX art when a layer changes draw eligibility
Reject overflowing cleanup ages before native effects
Keep pending journal regions counted until keeper acceptance
Read the production custody status in captured fixtures
Keep app-band shutdown under launchd label custody
aterm-core: paint\_prediction\_span, an all-or-nothing painter for a state chain whose shifts move text
aterm-predict: edits that move the tail, held by the safety theorem
aterm-gui, aterm-wasm: a shift's chain painted as one span, its moved text in its own style
aterm-predict: the class ladder bound to the model for every class; tail adoption declined
aterm-predict: say why a glyph a chain cannot place inside the text flushes it
aterm-core: a span cell moved onto its own column is painted; the order test reads styles
aterm-predict: shifts judged by the in-place worlds, a pair that cancels, the standing tail at every chain start
aterm-predict: two thousand seeds: a proof holds its echo's glyph, a cancel owes its blank; decoration tagged
aterm-predict: name only provenance this harness reproduces
aterm-predict: a state an earlier op's echo shows part-way is no match; the world hides a secret on redraw
supervise/tape: the corpus — a check in acts mode, the scrub, the lint and promote (T10)
supervise: format the corpus loop tests
supervise: the loop takes its hand under its setup's holder, so a hosted tape replays in any process
aterm-lab: tape promote, lint, replay-jailed and rerecord; the corpus scenarios c1-c3 (T10)
aterm-agent: the harness tape corpus — eleven lab runs over Claude Code 2.1.304 and their test (T10)
aterm-lab, aterm-agent: the wall scenario waits its rung plus a minute; the drive help does not promise the public build a corpus
aterm-lab: a promote refuses a failed run and a tape that loses what the corpus kept; the manual names every replay --check exit
aterm-agent: the scrub's docs and tests survive the public export
aterm-lab: a corpus scenario finds the idle journaled with its decision
aterm-lab: a rerecord's loss is fewer acts or a kind of decision gone, not a count of decisions
theme pack: only the name line an earlier release wrote reads Installed (r2-6)
Login notices: a sign-in step opens with the account's label (r2-3)
Tests remove a copied test binary only after it wrote a line (r2-1)
session log transcript test: run the kept bash stand-in in place (r2-2)
Abrew: deps --tree --direct and no-name installed trees are native
keeper live test: the shed waits for the keeper's confirmation before shed
Abrew: list --full-name is native; search /regex/ delegates honestly
dirwatch: a watch the kernel let go is gone; the registry places it again
claude registry: the let-go test holds its root as main's fixtures do
Complete gone-watch API on unsupported platforms
Use a hang detector for the removed-object watch edge
crash restore: a clear whose keyframe a replacement skipped is erased from the region the keeper holds (R9 c, b)
keeper link: a full queue drops nothing the keeper is told once; owed ops go in order (R9 a)
keeper link: a live test that a replacement's receipt is the keeper's read, not the write (R9 b)
keeper link: PENDING and BYE have room no owed op takes; the BYE drops what is owed (R9 review)
crash restore test: the skipped-keyframe clear's control is the one the test asserts (R9 review)
update: measure the whole auto-update in a guest; an armed update starts as its read ends
census: register parse\_hold, the PTY reader's term hold, as a guard helper
update: one 20 ms read poll for both lanes a pre-park read holds; the intent spec says due at once
Abrew: download setup/publish errors name the path
harness(autopilot): the carried end — an unseen end, its clock and its task's work cross a seamless update (v4 slice 2b)
harness(autopilot): the carried end after review — a done then landed crosses, a withdrawn done stays withdrawn, the intake is tested end to end
harness(autopilot): compose the carried end with the cheer and Done for you (v4 2b+3+4)
harness(autopilot): the carry tests tell the end's instant from its minute (v4 2b review)
render: the fx art registry, its builders and CPU painting (card engine B3)
Reject oversized art before building texels and clip public CPU painting safely
aterm-release: a git credential helper waiting for a person is ended, not waited on; verify export's ceiling lets the release stop its own children
Read Claude Code 2.1.304's limit-reset kinds in the reset step
Port the limit-reset spec and docs to Claude Code 2.1.304
Hold the case-blind read of a first takeable reset row in tests
Refuse a reset menu with a row of a kind this build does not name
Read a zone after the confirmation's week as the week's failure
Delete the duplicate 2.1.287-wording reset test; fix SPECS.md's count of the port's tests
Hold ce()'s count grammar and Kg's {Kind} rule in the reset template canary
Carry a reset's kind past the reader, and end no wall on the still-walled line
Hold the declined row's name to the taken kind's title when none is drawn
Hold reset\_shows' title read: a successor Escapes a titled frame with no box until its Enter
Correct the reset docs: limit\_reset's rule, spec §0's screen-reader layout, §2's declined row, KI-1019-1
Read a reset row's kind only where its head is a word of its own; hold the measured 2.1.304 dialog again
Hold the offer order and Yn's {limits} in the reset template canary
Read the weekly session reset's in-flight answer as no wall
End only the walls a reset refilled: the claimed one and its kind's windows
Relabel the reset tests' and models' bundle sources as 2.1.304's
Say in the tape codec that a reset step taped before the 2.1.304 port does not replay
Hold how the reset step ends on a walled or count-less spend
Format the reset reader's new test rows
Format atpkg's image.rs as verify fmt --fix leaves it
limit reset: read a spend by its kind's head, add limit\_reset\_kinds, fix stale docs
limit reset: the accounts page says the one-on-offer rule is the default
Keep recovered turn counts fenced until a new journal is accepted
claude registry: hold the forwarder to the kernel's events; restate A5's final-tree figures
6C-1: a harness relaunch lifts the failure it caused, and only that one
6A-7: the fold's failure comments say what the code does
6C-2: brief keeps by= and ledger= for a turn whose open was evicted
6C-3: brief notes the mail a turn probably answered, always with \~
6C-1, 6C-3: a relaunch lifts only the failed agent run it replaced
census: register parse\_hold, the PTY reader's term hold
Bind credential cleanup to kernel process identity
Keep identity-bound orphan cleanup alive after git exits
Stats bars: visual audit fixes, the sill, the lens, View ▸ Stats Bars, meters for VoiceOver
Tab chips: a load meter, each tab's share of the machine (design §12.4)
Stats lens: no work on a wake when nothing is due; the changelog names only what the keyboard lens does
Stats bars: clean under tippy -D warnings
Menu: the Stats Bars form getter exists where the native checkmark reads it
Stats bars: live stuck marks, a truthful lens, and the review's fixes
Stats lens: name no verb that does not exist; say Return in its hint
shell-integration: a shell started before 2026-10-16 proves an older script's \~/.aterm/bin by its start; ATERM-KI-1015-3 closed
shell-integration: the build that spawned a shell answers for an older script's \~/.aterm/bin where its loader cannot
shell-integration tests: name the spawned-by env type (tippy type\_complexity)
harness: the login carry's review (acct3-1..5): no dead login proven by its own dialog, one step per loss
Abrew: outdated and missing take name scopes natively
aterm-link: a sequence reservation is an atomic write, fenced by the durable incarnation, not a durable write
aterm-gui: ATERM\_DEBUG\_LOOP\_FIRST, a dev seam that builds the event loop before session 0
aterm-gui: a dense output burst streams at its 16th pass, not only after a frame
aterm-gui: a foreground edge ends the output burst, so a prompt is never held
keeper link: the room's counter uses try\_update (fetch\_update is deprecated on this toolchain)
Hold a session's typing while its edit ticket is open; Option is Meta in the Editor
Serve edit … wait=0 so amacs --no-wait holds nothing; hold App-lane typing
Keep pointer status answerable under the edit hold; record the amacs and amacs-term Trust rows
Record the merged tree's amacs and amacs-term Trust rows; note the real-Claude check
Give TR4's for-word alphabet test the wait field
handoff carry: a tail short of its room keeps its newest rows (KI-1015-2 U30)
update: a stray launcher limit is nobody's (KI-1015-2 U1)
update: a missed park's rollback never waits on an engine (KI-1015-2 U44)
handoff fixtures: hold the fields each release's desks write; narrow U10
handoff fixtures: the field hold passes a field no handoff writes
handoff fixtures README: name NO\_HANDOFF\_WRITES beside the field hold
handoff fixtures README: the exception list in a paragraph of its own
handoff carry: a crowded desk shares its rows alike, newest first (KI-1015-2 U30)
update: no rollback waits on an engine; the busy one's size is owed (KI-1015-2 U44)
handoff fixtures: what a baseline wrote stays held, reached or not; variants too (KI-1015-2 U10)
update: the park asks the export to pause and never waits for its last look (KI-1015-2 U20)
generator: carried-state writes autopilot\_end, which the field hold refused unwritten
aterm-release: the release's own git never prompts on its terminal, so an ended credential helper ends in git's own failure
aterm-lab: c4-read, the corpus's first box whose decision looks at the machine (T12)
aterm-agent: tape\_shadow\_cost, what --shadow and --why cost on a long hosted tape (T12)
Register the parse stage's term hold with the lock census
Read the foreground only for a drain that holds an exec
Format the gather's lazy foreground read (trustfmt)
Keep the parse stage's slice hold a plain term\_lock binding
Note the slice-hold probe change in the fork-loop record; trustfmt
seamless: WireCaps' carry queries build for tests on every OS
sysprobe: errors\_quiet is a test seam, gated as one
uds: the Namer's deadline is per instance; tests wait a hang detector
uds: a path use is reported in the spelling that placed it
harness: a session's cwd is opened only on a local volume, link by link
harness: tier 3's removal reads its sessions on a mount table read whole
sysprobe tests: the output-tail placement test is unix's
disk: say each cloud sync root the home search meets, and why a named one is refused
disk: remove a Claude Code version on Windows through its pinned folder, fail closed
disk: the Claude census passes over its own process, and a Claude scratchpad's programs
disk: the census spells a scratchpad path long, and every claude on a path in the temp root is the temp path's
disk: the home search never opens an entry a look could fetch, a reparse point included
disk: a Claude Code version is removed on Windows only from a fixed disk
disk board: a wait's own reading keeps the watch's room, lines and reclaim
disk board: an 8.3 tab reads its volume's row before any look, and with no watch
disk watch: on Windows a tab busy at the removal is unknown, never the look's copy
disk watch: a private instance says once a change why it removes nothing
disk board: the cwd hook tests a report's spelling before it allocates
disk watch: disk\_sessions\_now's doc says where the look's copy is still read
disk watch: a private look names the rule that made it private
disk board: an 8.3 spelling waits on the file system one deadline at most
title drift tests: the cwd hook hands an 8.3 directory to the disk board
message reporters test: one private cause, as the glass says one reason for every rule
aterm-gui: one foreground read per status look, the activation wake armed off the main thread, one stat per stamped path
vendor/astream: d9ad10f, the client refuses a request behind an owed ack (AcksOwed)
Control: a glassless pointer's reply reads the frame its event left
Control: pointer wheel turns the wheel through the path a hand's wheel takes
Settings pickers: a wheel at the list's end leaves the tile under the pointer hovered
aterm-gpu: a tray card drawn by a command buffer waited inline records no reader
aterm-gpu: the tray card ring's reader bookkeeping is a pure machine, bound to a model
Control: pointer wheel over a terminal reaches its history, as a hand's wheel does
Control tests: the click reply's look copies the switch's state (tippy clone\_on\_copy)
Control: on glass a pointer's reply reads the frame its event left
Control: a pointer's ERR over a native page means the page, and says what is shown
style: trustfmt the b8 residual fixes
harness: close the b8/residuals review (wakes, tall turns, none forms, land acts)
Abrew: list -l/--long is native
Settings: Undo puts back a spelling only the file held
Settings: an old classic mono keeps the cursor's colour when the writer rewrites it
Settings: the Trail color row takes the cursor's colour by its word
harness host tests: a run is counted only after what it records
harness host tests: a restarted loop's first point is waited for as the event it is
update handoff: a test park waits out the scrollback export's pause and halt
Settings: a trail colour's Reset is named by what it gives back under the saved style
watchdog: the main-thread watch is a value, and its tests drive their own
Settings tests: choosing Classic over an old classic mono keeps its colour on the Trail color row
Settings: Modified names a style knob's default by the style aterm.toml names
Settings: an old classic mono over a trail colour the loader ignores keeps the cursor's colour
Settings: the trail colour's picker chooses the cursor's colour
Settings: an unset trail accent is named by what a window brightens
Settings: Undo after a later change puts back what the file said
crash restore tests: the custody tests read due stamps on a held ring clock
notices: a command is whole or replaced, limits name their reset, the open entry reads through its last line
Put amacs's scalar core under proved Trust contracts
Raise amacs's trust floor to 310/939 on …
Drop the two remaining provable index hazards in amacs
Record amacs's specs and raise its trust floor to 311/935
Expect clippy's clamp and range-contains lints on the amacs contracts
Re-measure amacs on the final tree: 311/935, every row unchanged
Prove amacs's completion wrap and percent-escape indexes; floor 318/935
Prove amacs's projected column limit; floor 325/942
Bring amacs's SPECS up to the reviewed tree: 325/942, seven contracts
Record the repeat measurement of amacs's 325/942 floor
Re-measure amacs on the merge with main: 325/942, every row unchanged
Re-measure amacs on the merge with main …: 325/942, floor unchanged
supervise/tape: one keyed index per tape, shared by every probe on it (T12)
tape\_shadow\_cost: check each grown copy against itself; say what --shadow costs on its own build (T12 review)
Abrew: zip structures the strict reader refuses delegate, not fail
trust: re-measure aterm-gui floor on local 1.101 prover (6184/327090)
aterm-lab: an app-band instance is a ProcessType App job, not a utility-clamped submit
aterm-lab: an app-band job is unloaded and asked by its GUI domain, and a path it cannot carry is refused
trust: aterm-gpu holds 462/3366 and atpkg 585/10658 at a 6 GiB ceiling; aterm-gui is cap-bound
trust: aterm-gpu 484/3529 and atpkg 692/9094, re-measured on the tree merged with main
trust: aterm-gpu 514/3805 and atpkg 701/9160, re-measured on main …
trust: atpkg 719/9271, re-measured on main …
trust: atpkg 722/9291, re-measured on the tree composed onto main …
trust: aterm-gpu 513/3714 and atpkg 723/9309, measured on the tree composed onto main …
trust: atpkg 726/11497 and aterm-gpu 513/3714 hold on the tree composed onto main …
aterm-gui: the debugger-access alert is short lines and bullets
aterm-gui: the debugger alert says "your admin password" only to an admin
aterm-gui: the debugger alert's bullets fit one line, and its undo names aterm's Settings
harness(page): the post-landing check's Settings ▸ Harness findings
harness(page): each fact card sizes its label column from its own labels
harness(page): the review's fixes — values wrap whole, labels whole, the timer grid on the row's slots, the fleet raised not re-read, the successor reads at Commit
fabric endpoint: lineage reaches it — link log <id> continues=<f> was=<id> (bridge lane 3)
CHANGELOG, SPECS: lineage reaches the fabric endpoint
fabric\_world: a reply and a verdict made while the poisoned broker is down land after its restart
fabric\_world: trustfmt the lineage world's stray post line
fabric endpoint: apply each log move once, with no window of its own
fabric endpoint: the two-move test holds parked waits and the watch list's pruning too
Lineage docs and specs say what the endpoint does, and when it matters
trust: one floor ceiling for aterm-gui memory rows after re-measure
gui(claude card): the card's glass is ground the cursor pet keeps off
effects(kitty pet): a pet moved off a protected stand rests on clean ground
effects(pet world): host exclusions read as per-row column spans
aterm-wasm: the CPU replay records Copy All's new spoken name
atpkg abrew: an entry's identity is its device, inode and file type
lab linux: the guest has PowerShell 7, and x86\_64 execs run tests one at a time
verify: a selection holding a web module runs wasm-smoke with its tests
aterm-gui: Linux's lib tests pass, and two Linux Settings cuts are fixed
Fix forward main's reds the merge brought: core checkpoints, a Linux dead fn, a focus test
aterm-gui: a stranded focus inside a Settings list resumes where it stood
aterm-gui harness: a tab's newer lost word replaces its earlier one in one step
aterm live tests: a refused connection that Linux resets reads as the close
aterm-gui: main's Top-card segment wrap stands; this branch's is dropped
aterm-gui: the About tagline is judged at the column the hero drew
aterm-wasm: the CPU replay records the cursor effects' new frames
aterm-gpu: page\_bloom\_strength is built where a bloom pass calls it
aterm-gui: main's stranded-focus fix stands alone; the branch's guard goes
aterm live tests: main's hung\_up already reads Linux's reset as the close
aterm-gui harness: lose() forgets a word that took the tab mid-call
verify: a selection holding aterm-wasm-abi runs wasm-smoke as well
lab linux: pwsh unpacks beside its install, so the rename is one step
Fix forward main's cross-cell reds: the Windows reader, card-engine dead code
verify wasm: node drivers end by exitCode; process.exit() hung the replay
atpkg: the world-writable-ancestor test runs on Linux against /tmp
aterm-gui: main's own Windows Proc arm stands; an unread field is unix's
aterm-gui: Windows test targets build without warnings again
aterm-gui: two more test-target warnings off macOS, from main's newest
aterm-gui watchdog: current and park\_modal are macOS's now that tests own a watch
cast: the header names the geometry in force at the first retained event
cast: the cast reply serializes off the recorder lock, into one buffer
cast: one asciicast codec in aterm-control writes cast and reads it back
replay: cast frames and temporal replay on the engine cast drift folds on
core: Terminal::replay_fork copies an engine that continues as it does
cast drift: variants fold from a fork of the faithful replay at the anchor
replay fork: review fixes for Terminal::replay_fork and the anchor fork
temporal: replay stays reachable in long sessions, and status says where it starts
core: checkpoint_continuing_bounded projects a live engine with its history bounded
temporal: replays fold off the recorder lock, and dropped input is a break a live keyframe closes
temporal: a break waits out a sequence its keyframe would swallow, and a gone writer gets no keyframe projected
temporal: a hold queues its slice as a range of the reader's one batch copy, which the cast tap reuses
temporal: the real reader's test holds every unchanged tap burst to the slices that share it
cast: a snapshot shares the recording's sealed chunks, and each event is charged what holding it costs
cast: the reader records each burst itself, and cast drift waits for the recording instead of sleeping
cast: a deep unseal gives its deque slots back once resealed, so the slot bound holds for every insertion
codec: base64 appends into a caller's buffer, and the image byte reply uses it instead of its own encoder
temporal: the reader test's burst partition lets its element type be inferred
codec: base64's encoder lengths are bounded where the verifier can see it
window/controls/open: the GUI targets are one keyword list, and a retired name is a parse result
window/controls/open: review fixes for the one GUI target keyword list
update: update status folds the updater's last installed-bundle observation; no lock spans codesign
update: an installed-bundle observation is fresh from when it is recorded, not when its probe began
control lanes: a new wait lane is spawned with no lock held; a lane that cannot start gives back its own wait
control bind: startup and handoff binds share one retry policy; a handoff successor wakes at its predecessor's exit
control bind: review fixes for the handoff successor's exit wait; a live predecessor's stand-down is tested
control help: bare help, help --full and help --json are built once per process
control lanes: a connection reads through one buffer for its life; a request switches its socket's mode twice, not six times
control lanes: review fixes for the one read buffer; a parked connection keeps at most READ\_BUFFER, and the handshake's mode reset is tested
control: an idle authenticated read waits on socket readiness on every unix, not only macOS
hangup: one peer probe tells idle, readable, half-closed and gone apart; a parked operator next sees a client that closed behind a queued request
update: update status and update apply report the reducer's staged activation; no control lane probes the installed bundle
update: review fixes for the reducer's staged activation on update status; its two choices are tested where they are made
metrics: a histogram's count is the sum of its buckets, read once
echo\_rtt: sort a copy of the window, not the window under its lock
metrics: label tables are declared once (label\_enum!)
metrics: count wakes by variant without a lock or a payload format
metrics: reset cannot change what the loop arms; the healer and the typing hint move out
metrics: one clock read per present; the window owns its gap, the UI thread its slow episode
metrics: a present's input booking is pinned through record\_present\_at; witness tests serialize
metrics: a reset never reaches the strain engine; the turn census owns its histograms
metrics: the strain sample is the oldest key's or none, pinned with a controller key first
metrics: one emitter per form drives both the text and the JSON sink
metrics: the verb's routing of each form is tested; a text pair key escapes its separators
metrics: typed window ledgers replace the loose statics; reset is generated and Snapshot is gone
metrics: the coverage check pokes each part of a composite instrument alone; a refused key's count is pinned
metrics: the startup ledger is a module of its own; a write-once fact is derived once
metrics: the GPU probe is read whole or not at all, so a kept split is never torn
privacy: status reads the Full Disk Access cache and never dispatches a probe
privacy: consent wakes repaint only the Security view whose block changed
privacy: the \[privacy\] policy is published on ConsentState and its protected roots resolve once per config
privacy: await consent reads off the event loop and wakes on consent publications
privacy: await consent notices an exit on every platform, and no probe starts under a gate a reload closed
privacy: the report takes one main-thread hop and waits on slot publications off the event loop
privacy: no census or Developer Tools probe starts under a section a reload turned off, and the report asks the SPI before its wait
privacy: the report resolves the responsibility SPI once for all its sessions
privacy: the four probe slots are one SlotCell with one kind-tagged wake, and no slot answer is keyed on the identity
privacy: a read that claims a refresh as a retirement meets its lock serves nothing and moves the claim to the new epoch
privacy: a config reload or a returned cold exec stops or starts the tccd observer it changes, and the park reads the running mode
privacy: a slot read's answer-and-ticket pair has one name, so the gui crate lints clean
privacy: the \[privacy\] master switch turns the Full observer off too, the EPERM path's tab mark and banner included
privacy: a restarted tccd stream announces nothing the stopped one was correlating
privacy: the tccd observer wakes the loop once per drain and judges prompts only when the queue, the roster or the 3 s threshold moves
privacy: the tccd verdict gate's tests fail when a pass runs before the threshold crossing
privacy: a stop ends the tccd stream at any point and signals its child only while unreaped, and the lookup watchdog waits on the reap
privacy: the consent model, the report and the signing identity leave control\_privacy.rs, which keeps the two verbs
privacy: a test that changes \[privacy\] republishes the mirror the off-loop readers read, and the status test leans on no probe interval
capture: every route layers its chrome in one order, and the terminal present paints the one host visual policy
capture: every pixel capture enters one door, and a deferred one re-enters it
capture: every capture is bound by one barrier, and the binding copies no model
metrics: a present a capture forced books its latency as tainted
metrics: capture\_presents counts the samples a still capture's barrier forced
capture: image and the snapshot resolve their source once and finish in one rerender
capture: tests pin a recording still's retained visuals and the windowed recording barrier
capture: window is one body on macOS and Windows, parameterized by the platform photograph
render: one placement law places a frame in its surface, for both presents, dims and the capture crop
gpu: a presented snapshot keeps the swapchain copyable for 2 s, and says when its copy is verbatim
capture: a windowed image is the destination its own present submitted, cut to the frame
capture: a translucent window's image is a rerender on every platform
png: the encoder streams rows into IDAT chunks and holds no copy of the image
capture: encode jobs carry the pixels their producer made, and the permit charges the encode's peak
png, capture: the encoder's pending output is one reservation it never outgrows; a capture is charged the allocation it holds
capture: the main thread takes a present's destination as mapped; the encode worker converts, cuts and fingerprints it
capture: window stitches on the encode worker; the AppKit chrome is copied as its bitmap holds it
capture: admission reserves the payload a capture carries; the AppKit chrome copy is tested on real reps
gpu: a capture's sRGB transfers are table reads, byte for byte the powf they replace
capture: image, window and a video recording are counted main-thread hops; the image queue is gone
video: a frame's fp hashes every pixel and delta counts changed 8x8 tiles; keys analysis needs no time order
turn: a block-mode submit is verified by the shell's started-command counter, read in one hold per press
turn: review fixes for the started-command verdict — a C that moves no content verifies, and a restore keeps the C's its blocks prove
aterm-core: a content batch renders only the visible rows an armed row watcher can read
aterm-observe: Rows\_e is \[\] when no scanning range meets the grid, as observe\_at passes
ring verbs: history, timeline and exits format their page after the ring's lock is released
turn: the submit-verification rows name their control's type, so tippy passes on aterm-gui
session log: log and brief copy the ring's shared records under the timeline lock, a count bump each
session log: brief all scans each session's window once, for its floor and its share
wire: rows are shown through one collapse-and-trim primitive, and blocktext frames its reply after the terminal is released
bidi: text order=display reads a row the renderer leaves in logical order in one text pass, before gathering any reordering input
bidi: text order=display orders a row's written cells as the frame does, through the walk the pointer read uses
search: a history line read only to its first MiB is counted as a line not searched to its end
search: find reads its rows through the engine's one search-row reader, so a viewport scrolled back joins the soft wraps the live screen has
aterm-release/trust: re-measure aterm-search's row after the cut-short line count (195 / 584)
search: every check compares one SearchKey, and search names a frame that moved under it moving
search: the query layer (soft-wrap join, physical re-expression, point selection, narrowing) is aterm-core code
aterm-core/SPECS: search-query-layer quantifies over the stacks its own calls left, not any NarrowStack
search: the terminal owns one index slot, planned and finished in one hold each and built off its lock
search: a refresh's boundary walks run in its first chunk's hold, so a plan's hold walks only the anchor's run
search: find and search run through the terminal's index slot, and the GUI keeps no index of its own
search: no terminal hold frees an index, and a point step answers a hit as it answers a build
integration: aterm-core SPECS.md tallies count every spec and test row it lists
screen: the styled frame is the live screen in every field; a viewport scroll is not a change
screen: a Kitty placeholder's image stays in the live frame while the viewport is scrolled back
subscribe: a watch carries its session's context, seeded under one engine guard
subscribe: a closed tab's master closes under a live subscription
subscribe: each push stream asks one frame key its own question; a frame change at an unchanged seq pushes cells
subscribe: a batch that changes no frame pushes no cells, and every-frame never re-sends an identical body
screen: each session's text and styled frame are built once per change and served to every reader
subscribe: a watch reads its content at most once per 16 ms of wakes, and the last change of a flood still lands
subscribe: a session's watchers live on the session, and the write that changes what they read wakes them
subscribe: an exit's own ring ends a parked wait, a post arms its debt before it rings, and the operator observer is paced
subscribe: a wake reads only the watches whose session rang, and a pass asks the roster journal before it probes for a close
subscribe: a content watch's backstop is timed per watch, and a prune that frees a slot runs the next membership pass
subscribe: a push stream's hang-up is a wake, and an idle events subscription makes no pass
subscribe: review fixes for a push stream's hang-up is a wake
subscribe: a host's own write rings the screen readers as its hold ends, and an idle content subscription makes no pass
subscribe: review fixes for a host's own write rings the screen readers as its hold ends
census: term\_write is laid out as the formatter writes it
control: one park for every blocking verb, and a slice with no wake asks only after the caller
control: review fixes for one park for every blocking verb: a fabric wait parked with nothing owed looks again within STALE\_AFTER
subscribe: a push frame is written from its segments, one vectored write per producer, and its T stamp is the instant it was read
subscribe: review fixes for one vectored write per producer: the gather raises no SIGPIPE, Windows gathers, and a T may step back
screen: the styled gather and cell read each cell once off one held row, and a complex cell's text is appended without an allocation
screen: an inline image is base64-encoded once while it stays on screen, and each image is written straight into the frame
screen: review fixes for the image payload memo and the one-held-row gather: a batch never evicts an entry it found already kept, and cell_grapheme has no row-sweep twin
control: subscription lanes grow on demand up to a share of the descriptor limit, not a fixed four
verb table: sub-forms are row data; framing\_of and the artifact ACK project from it
control: authority, lanes, --json and help read each request's form off the verb table
control specs: update's owner-only rule is stated again, and the front-drive row names scope\_holds\_need
control: a request line is parsed once by one shared grammar, and its selector resolved once
control: the subscribe handler serves the request its lane parsed, and a sid is lower-case hex
control: one router serves each verb class once; owner verbs need no terminal and @\<sid\> panes aims
control: @\<sid\> subscribe's usage is one line, and owner\_aim alone decides which owner verbs need a terminal
control: a driven write records its licence fence on the session, and each window applies it before it arms or judges a licence
control: the licence fence's frame tests press through the real input seam and pin the switch's own close
verb table: each verb's input class is a column, and every input gate reads its flag there
control: every input request passes one admission in one order, and its route is chosen once
control: review fixes for the one input admission: a frame test pins the lease before the gate, and the specs and help name C6b's shapes
control: a forward reaches the instance hosting a session with that instance's own token, its connect is the only liveness look, and its relay borrows both streams
aterm ctl: a request naming @\<sid\> dials the instance hosting that session, and a graph entry's socket is dialled only by the connect that carries the request
aterm ctl: review fixes for dialling a session's host: a host that took the request is the call's, even when cast drift reconnects
supervise transport: RelayCtl keeps one connection per instance, and a request naming a session goes to that session's host
control: an artifact's handoff rides its connection's outbox, and the parker awaits its acknowledgement
control: artifact captures admit against two budgets of their own, and a quarantined path capture no longer refuses --bytes
verb table: the frozen pre-table copies leave, and the table's own tests pin every sub-form
control host: the SessionHost trait carries no input sink or placements, and GuiHost resolves a selector through the dispatcher's lookup
control specs: image-reply-encoding takes the budget prepare\_image\_target admits against
integration: the metrics routing test reaches the JSON form through the dispatch's json\_ask
integration: the reply-fidelity test module carries no doc for the removed connect\_and\_relay
integration: the forward-handshake model names the code it binds to
integration: the verb table reads a form past the App lane's unread=ok
integration: the glance and need-publish instruments publish what they keep
integration: our tests read main's search header, clears, grammar and writers
integration: docs name the merged provision and task wake
integration: no replay fork past a resize whose hand-back stands
integration: the replay-fork test states where a fork must be refused
integration: the session log's entry cost counts the shared record
integration: a lifted timeline hold is drained on the next liveness pass
integration: a close wakes its watchers once its closed log is linked
integration: line's ERR unreadable has its test and spec statements again
integration: privacy spec rows cite the tests main kept
integration: grammar rows state the merged selector and leading options
integration: comments name only tests and mechanisms that exist
integration: the consent wake doc names the wake census
integration: aterm-gui and the libraries it reaches lint clean under tippy
integration: Slots::used builds only beside its callers; the cleanup queue test pins its limit
integration: App-verb docs name every aimed verb and the window-surface drives
control: edit and await edit post their requests as counted main-thread hops
integration: dispatch rows and docs name the merged tombstones, escalations and routing
session log: the owed wake's doc names the watchers it rings and where
control: a write handed to the ordered writer waits in the one park
control: a request's own words are told before the unread-input gate
control: an over-cap screen read reuses its snapshot and gathers again only for pictures
subscribe: an events watch's reads are paced under an output flood
integration: SPECS rows cite the merged park, beat, startup split and replay fork
control verbs: the input-class, framing and selector rows state the merged table
trust: aterm-search's floor follows the merged tree (171/520)
supervise: the relay-connection row names the preferred token's one retry
integration: search-note, hangup and fabric-record docs state the merged code
integration: a replay fork continues its source's restore lineage, not one of its own
integration: restore conformance holds the screen to the live engine and the lineage bit to its rule
integration: a deferred shed replacement's retry is checked against its own try, not a later clock read
integration: the bench-support build compiles its capture path again
integration: crash-restore's visible() drops the lineage bit through the seam
metrics: a stale fx sample can no longer lower the base a reset takes
SPECS: m-reset-window states the fx sample Metrics::reset takes first
SPECS: devtool-list-probe-gate states the list probe main's … rebuilt
integration: the keeper live tests connect to a recovered instance once its recovery-count fence lifts
control: the recovery-count gate is named first in the gate order and among the retryable errors
Tests keep a directory of exec'd copies until each copy showed it ran
Abrew: help text catches up with rounds 33-39
aterm-lab meta-keys: measure German and French as well as U.S., rows derived from each layout
aterm-lab sys::tis: build an Owned only for a non-null reference
crash\_restore test: a clear makes the worker due at once, not at exactly now
ATERM-KI-1015-9: Meta mode types what a layout reaches only with Option; the layouts lane puts each layout back
aterm-lab: the bookkeeping fns take input\_sources::Pref; is\_multiple\_of (tippy)
Retire unsent keeper lifecycles and fence waited admission
Declare the keeper receipt fixture scratch dependency
handoff fixtures: every carried field and variant is held strictly; closes ATERM-KI-1015-2
Abrew: known delegated brew verbs are not "unknown commands"
control tests: the feed-bin routed helper is unix's, as every test that calls it
gpu: the GL arm answers no virtual snapshot size
effects: the harness card on fx layers, held to its quad oracle (card engine B3)
Migrate the harness card to retained layers with bounded art admission
gui: the harness card host on fx layers (card engine B3)
gui, bench: card seed= pins the card's constellation; the effects bench drives fx layers
gpu: the harness card's layers are byte-exact on the GPU (card engine B3)
Expose card layer observations only to sibling fixtures
Bound pet exclusion span search over public geometry

_Truncated to fit GitHub's release-body limit — the complete note is release-notes/v0.108.0.md in this release's source tree._

Source release. SHA256SUMS is a per-file manifest of the released tree, with a detached Ed25519 signature (SHA256SUMS.sig) by a machine key named in the attached master-signed roster (aterm-machines.toml + .sig). Verification chain and key inventory: SIGNING.md in the publication engine; the roster pin is committed in aterm crates/aterm-update-core/src/pins.rs.

v0.107.02026-10-20

aterm v0.107.0

2026-10-20 · 2074 changes since v0.106.0

Features

keeper: a RELEASE the keeper dropped unread is told again until a SYNC answers behind it
harness-card: the rainbow prints vivid on a light theme
harness: DECIDED FOR YOU — the choices the harness made in the person's name today (§10.4, slice 3)
autopilot: the pause told — a short-turn back-off reads "pausing until 18:41" (design §10.5 slice 4a)
autopilot: the A/B book by word and cause — boxes and questions compared, not idle time (design §10.5 slice 4b)
autopilot: the A/B book kept for seven days, one file per process (design §10.5 slice 4c)
windows: overlay scrollbar, hairline split seams, hollow pane cursors
windows: jump list Recent directories and a taskbar bell badge
windows: ship a pinned, signed OpenConsole.exe beside aterm
windows: the bundled OpenConsole is the default console host
aterm-lab: the crash verb, and LAB\_INSTANCE\_ENV recorded for the lab's own instance
agy, gui, effects: agy launch card, composer harness rule, markdown glass & multi-line rainbow wrap
agent, ctl, gui: fleet accounts CSV/LAN sync, dashboard, and limit account introspection
phase, agent, gui: unified ALab kitty border-and-banner branding, single harness toggle, and visual markdown hierarchy for claude, agy, and muse
gui: Autopilot v4 slice 6 — the verdict up front, and the ends counted
gui: Settings ▸ Harness's Every session row (Autopilot v4, slice 5)

Fixes

keeper: a quit whose BYE was lost owes its returned offers nothing, so it relaunches nothing
keeper: a stale RELEASE read late from an older link never ends a newer link's claim
harness-card: tippy's cloned\_ref\_to\_slice\_refs in the vividness test; doc wording
harness: DECIDED FOR YOU says what was decided, in the run it was decided in (§10.4 review)
autopilot: the A/B book splits every session's stretch at midnight; review fixes on 4a-4c
autopilot: the A/B book's charge never loops on a midnight that would not move on
autopilot: a read title rebuilt by main's TitleReading::refresh keeps the pause as a stamp
harness: a limit's end answers a plain question or stop as continue@v1 does
harness: a 403 authentication\_failed notice is the lost login, not a refused request
harness: an image or attachment full context is told the way back its notice names
harness: a notice behind a prompt command right after an error notice is read again
harness: an answer typed at a limit's end under any question priority is the limit's try
harness: a limit episode closes where the policy reads the limit over, busy read or not
harness: a countdown whose notice was written before the agent started goes on by nobody
harness: at a limit's reset, another conversation's words get the continue policy's act
harness: behind a background shell, another conversation's done report gets no keep going at a limit's reset
harness: the vendor's word that it went on, read before the limit's reset, is another day's
harness: a conversation's move outlives the record that carried it
harness: a relaunch's first decision reads the limit its transcript stands at
harness: a bucket's notice older than the relaunched process is the one the fallback left
phase: a generic countdown row under a model's bucket is the bucket's
harness: a bare API Error: 403 … whose login failed is the lost login
harness: a turn seen running asks the transcript whether a limit stands
harness: aterm drive watch|supervise read the tab's Claude Code's record
harness: a done report said as a condition is none; already completed after the task's subject is one
harness: the token first over open work at the done check gets the challenge, not the end
harness: a conversation only a peer directed has a task
harness: the record reads a wall's retry by its ledger rule, not by the words alone
harness: a release typed at a break of background work is a carry-on, as at an idle point
upgrade: the upgrade\_ask look reads a token behind long wakes (ATERM-KI-1016-1)
turn-end: a loop that follows an older build's ledger knows the job was challenged (ATERM-KI-1016-1)
upgrade: Land's answer after the instruction is Land's check to the record (ATERM-KI-1016-1)
turn-end: the vendor's own continuation delivers the check a limit cut again (ATERM-KI-1016-1)
upgrade: a /loop wake on a build that numbers no turn is a turn of its own (ATERM-KI-1016-1)
relaunch: the hand-run sweep's carry-on reads the tab's own Autopilot (ATERM-KI-1016-1)
upgrade: a restart's finished read reaches back past a window that settles nothing (ATERM-KI-1016-1)
turn-end: a done phrase led by any subordinator is no done report (ATERM-KI-1016-1, KR-DONE-1)
turn-end: a subject that names part of the task is no done report (ATERM-KI-1016-1, KR-DONE-2)
upgrade: a missed task's notice is a turn of its own with no promptId (ATERM-KI-1016-1, KR-DONE-4)
upgrade: one carry-on reads the record once, and the look's memo is pinned (ATERM-KI-1016-1, KR-DONE-3)
codex: a relaunched Codex reads Land and its redrawn last reply before its carry-on (ATERM-KI-1016-1, KR-DONE-5)
turn-end: the switch's reset types no carry-on into a done task (ATERM-KI-1016-1, KR-DONE-5)
turn-end: the switch's own steps neither reopen nor hold a done task (ATERM-KI-1016-1, KR-DONE-5)
harness: a loop that follows reads the end of a turn the loop before read running as a turn that ran (ATERM-KI-1016-1, follow-4)
harness: a loop that follows takes up an API error's retry ladder (ATERM-KI-1016-1, follow-3)
harness: a loop that follows counts a no-reset limit's first rung from the wall (ATERM-KI-1016-1, follow-1)
harness: the ledger's cut keeps the rows of states that stand for days, records not counted (ATERM-KI-1016-1, follow-6)
harness: a loop that follows reads its own first look as an unread try's first read, however late (ATERM-KI-1016-1, follow-2)
harness: the first loop after an older build's reads where that loop stood from its journal (ATERM-KI-1016-1, follow-5)
harness: a loop in a tab a cold restore reopened takes up the books of the tab it was reopened from (ATERM-KI-1016-1, follow-7)
harness: the ledger's cut reads its files in harness::cli again, as the supervise-fx guard asks (ATERM-KI-1016-1, follow-6, follow-7)
harness: a second cold restore reads the earlier books only as far as the tab between still carries them (ATERM-KI-1016-1, follow-7, KRF-3)
harness: the ledger's cut keeps only the rows that move a standing state, so it stays bounded while Land or a switch stands (ATERM-KI-1016-1, follow-6, KRF-2)
harness: a person's exchange left to them is keyed by its prompt (ATERM-KI-1016-1, person-5)
harness: the live upgrade asks nothing at a person's own exchange (ATERM-KI-1016-1, person-8)
harness: a wall's retry keeps a person's exchange at the wall open (ATERM-KI-1016-1, person-7)
harness: a loop that follows leaves a person's exchange as the loop before it (ATERM-KI-1016-1, person-6)
harness: an Esc on the act's answer ends a follower's carry too (ATERM-KI-1016-1, person-6, review KR-P6-ESC)
harness: a command the agent does not answer is no turn of its own (ATERM-KI-1016-1, person-5, review KR-P5-CMD)
harness: an owed release's settle owns its point (ATERM-KI-1016-1 host-2)
supervise: a move repeated at an unchanged point spends a follow-up (ATERM-KI-1016-1 host-3)
harness: one unreadable upgrade record keeps its last row, not the whole view (ATERM-KI-1016-1 host-8)
harness: the window keeps a tab whose upgrade record cannot be read (ATERM-KI-1016-1 host-8)
harness: a carried restart that did not land is said as its record's agent (ATERM-KI-1016-1 host-6)
harness: a restored end is decided before its tab's word is cleared (ATERM-KI-1016-1 host-4)
harness: the window words the restored agents' row from what the host said (ATERM-KI-1016-1 host-7)
harness: a restored step that panicked reads its record before it is said (ATERM-KI-1016-1 host-5)
harness: one tab's part of a host pass that panics is that tab's alone (ATERM-KI-1016-1 host-1)
harness: the owner is told when the upgrades' records cannot be listed (ATERM-KI-1016-1 host-8)
harness: a typed relaunch line is recorded before the ledger line (ATERM-KI-1016-1 host-5)
harness: a tab's stage that panicked is asked again on the host's back-off (ATERM-KI-1016-1 host-1, KR-HOST-1)
harness: a restored landing that is only its record in flight is said at the fault budget (ATERM-KI-1016-1 host-5, KR-HOST-3)
harness: a restored landing's end asks no hook once its attempt is off the queue (ATERM-KI-1016-1 host-4, KR-HOST-6)
harness: a restored row nobody saw through comes back inside the next (ATERM-KI-1016-1 host-7, KR-HOST-4)
harness: an upgrade record this look cannot read leaves its tab exactly as it stands (ATERM-KI-1016-1 host-8, KR-HOST-2)
harness: an unreadable upgrade record keeps its conversation's tab and is said to the owner (ATERM-KI-1016-1 host-8, KR-HOST-5)
harness: a tab stage's rung that has passed wakes the host for nothing (ATERM-KI-1016-1 host-1)
phase: a rating card whose first box Ink wraps is still the card (ATERM-KI-1016-1 dialogs: rating cards)
phase: a Select label Ink wraps at a name or inside a word reads whole (ATERM-KI-1016-1 dialogs: held message, Computer Use, usage-limit dialog)
phase: a button row with the text's residue glued to it is no button (ATERM-KI-1016-1 Questions: the one-word residue)
harness: a question the loop's Enter answered, asked again with no read between, is a new dialog (ATERM-KI-1016-1 Questions: the gap no read samples)
harness: a draft over a slash menu that marks its entry in colour only is sent only onto its own command (KR-DLG-2, ATERM-KI-1016-1 dialogs: no pointer)
harness: a box taller than the pane is answered whole from its head in the main screen's history (KR-DLG-1, ATERM-KI-1016-1 dialogs: a box whose head is off the screen)
restore: a held tab's agent the owner's lift left with no hold is named on no leaf inside the drain
crash-journal: a word's OK is a durability ack, and an image the writer could not publish is owed again
crash-journal: an agent publication owes the journal a capture now, not at the write interval
harness: the record a crash left is what the layout names through the relaunch's back-off
harness: the worker's own readers follow the agent's record before they read the kept copy
harness: a layout's read of an agent's record holds the window's loop one bound at most
crash-journal: a capture activity prompted owes one trailing settle at the interval's end
restore: Windows' end-session snapshot takes a word about typing at once, and carries the holds
control: only the owner's slot waits on the crash journal; the fleet's holds are answered at once
restore: a held tab lifted inside the cold drain says its agent's record at the lift
restore: a held tab lifted on aterm's last turn is said before the message log closes
relaunch: a moved agent's finish is found without the host's note (ATERM-KI-1016-1)
relaunch: unset login under another home is that home's login (ATERM-KI-1016-1)
aterm-lab: ps <tag> and down <tag> act on that tag when its lab is down (ATERM-KI-1016-1)
aterm-lab: restore --codex judges the relaunch's continuation (ATERM-KI-1016-1)
upgrade: an afresh move's row takes a word and names its mark's command (ATERM-KI-1016-1)
upgrade: the first move onto a never-run build is probed before it ends an agent (ATERM-KI-1016-1)
upgrade-view: an agent-down row the owner answered stays answered across an aterm restart (ATERM-KI-1016-1)
upgrade: the build-start probe's test seam is the tests' alone (ATERM-KI-1016-1, relaunch-3)
harness: a lost word crosses a seamless update with its tab (ATERM-KI-1016-1, relaunch-1 LC-4)
handoff: the person's stamp crosses a seamless update (ATERM-KI-1016-1, relaunch-1 LC-4)
restore: the leaf's lost word is boxed, the view's size lint allowed as the tree's (ATERM-KI-1016-1, relaunch-1 LC-4)
aterm-lab: restore --codex's verdict is one pure function its run returns (ATERM-KI-1016-1, relaunch-11)
handoff: the successor's Commit takes the supervision over in one step its tests run (ATERM-KI-1016-1, relaunch-1 LC-4)
harness: a never-keyed shell says since when, so a relaunch through a hand is typed at its lift (ATERM-KI-1016-1, relaunch-1 LC-4)
relaunch: a sweep types a restore look's line where the tab's own Autopilot is on (ATERM-KI-1016-1, relaunch-6)
upgrade: a fresh shell-gone row is answered by the new tab's Claude Code (relaunch-4, KR-7)
harness: the drive directory keeps the session journal's budget (relaunch-10, KR-5)
harness: the upgrade ledger links a tab to the tabs it held a conversation in (relaunch-7, KR-4)
gui: name the Commit's host-resume probe type (tippy type\_complexity, relaunch-1 KR-1)
upgrade: a move onto a build that fails only at a real start is taken back onto the build the agent ran (LC-5, ATERM-KI-1016-1)
harness: a draft over an older Claude Code's @ menu is sent only with no entry selected (ATERM-KI-1016-1, dialogs: no pointer)
aterm-lab: a wait on a child the kernel will not watch waits until it is reaped
windows: aterm-uds's ownerlock module exists on every platform
windows: atpkg on Windows: gc reads the process table, ALab entrypoints stay in their package
windows: Windows TLS verification requires a subjectAltName match
windows: the Trust toolchain is found on Windows; small crates' tests run there
windows: the harness, supervise and ai review work on Windows
windows: colour emoji on Windows, fitted to their cells
windows: local time, path links and video retention work in aterm-gui on Windows
windows: aterm-agent's Windows tests pass, its flakes wait on events, two Windows bugs fixed
windows: directory pins share delete like a Unix descriptor
windows: whole colour emoji, letter flags, spinner stars, CJK weight
windows: legible theme colours: contrast floor, blues, COLORFGBG
windows: shells report the right exit code and line; Ctrl+J runs it
windows: layouts, dead keys, Alt codes; PSReadLine keeps its chords
windows: aterm's own icon, sharp at every size, and an aterm class
windows: close-all asks every window; windows open placed and themed
windows: caption, tab band and Settings as one surface in your accent
windows: pane-scoped find bar, F3, Fluent palette and switches
appearance: light Settings cards rise above the page on Windows only
windows: COLORFGBG names the side of the theme the tab will draw
core: theme floor caps only page text under SGR 7 and DECSCNM
windows: a theme replace also retries a sharing or lock violation
windows: pwsh: a parse error reads 1, a repeated native code holds
windows: a held key after an uncomposed dead key repeats alone
linux: Linux keeps its tab strip look; the new one is Windows-only
windows: captures and recordings of a minimized window still present
windows: a window re-asserts its menu side as it activates
windows: a split's find panel lays no rail that lifts its sibling
windows: the palette scrim is its own layer and lifts for themes
windows: aterm-gui builds on Windows with no warnings again
windows: elevated aterm holds its control socket to Administrators
windows: OpenConsole leaves a killed pager's alternate screen
windows: keep OpenConsole's five arguments and kitty keys off
windows: Git Bash keeps every key after a resize in OpenConsole
windows: OpenConsole's health check blames only the host, and a GUI program runs once
windows: aterm.exe, not cmd.exe, leaves a dead app's alternate screen and keeps the console input mode
terminal: the console host's switch out of a dead app's screen releases the app's modes
ctl: mainscreen says ERR timeout when the console host does not leave
windows: a program left by an earlier tab no longer counts as running in a new one
windows: main's worker tasks, survey and spawn line read Windows paths
windows: gate the Unix-only fleet, bye and handoff-carry items so aterm-gui and aterm-net build warning-free
windows: refuse xterm modifyOtherKeys behind a console host, as kitty is
windows: a killed full-screen app's bracketed paste and size reports end at the next prompt
windows: KP\_Begin, F13-F20 and the DECKPAM keypad reach console programs under OpenConsole
windows: Alt+U, Alt+L and Alt+C change a word's case in Windows PowerShell 5.1
windows: terminal replies pass the ConPTY resize guard, so a window drag no longer types into Git Bash
windows: the host's alternate-screen leave also turns off in-band size and colour-scheme reports
windows: the split divider shows which pane has focus, and its scrollbar sits on the line
windows: the tab strip draws Windows 11 tabs, with air under its rule
windows: Git Bash tabs read their home as \~
windows: Settings' resting controls rise above their cards on light themes
windows: Settings' colour preview draws its title bar the way the window will
windows: the command palette opens on a search box, selects like Settings, and keeps grey for disabled commands
windows: find keeps its toggles in a split, gains ↑ ↓ ✕, and its current match reads at full strength
windows: the app folder and install carry every licence text NOTICE cites
windows: a tab's shell integration follows the program it runs
aterm ctl settings set|unset names a key written by hand
windows: the keypad stays key records in keypad application mode under both console hosts
windows: a size report a pwsh command turns on is no longer typed into its next line
windows: the pwsh prompt on a killed app's screen comes along when the console host leaves it
closing the palette or a card replays no pointer the window has lost
windows: the selected tab joins what lies under it, sizes to its title and draws its emoji
windows: the divider between two pane headers wears the headers' own fill
windows: a split's scrollbar thumb lights the divider's line, a stroke clear of the focus ring
windows: the find toolbar ends on its ✕ at the bar's end, and its toggles are buttons
windows: Settings' window sample wears the caption's band tone, rimmed on light themes
windows: the stacked Themes demo gives up rows so the chooser shows a whole stop
windows: aterm-gui is clippy-clean on Windows
windows: aterm-primer, aterm-agent and aterm-keeper are clippy-clean on Windows
windows: vim redraws after every resize: unasked reports pass the ConPTY resize guard as input, and the guard's record goes by itself
windows: the Gemini CLI and agy lanes read a rooted home and project on Windows
windows: a size report vim asked for no longer reaches the shell after a kill, so pwsh's prompt lands whole at any vim cursor row
windows: read a process's start from GetProcessTimes, never ps, so a proven claim and a restart stamp name their process
windows: gate main's macOS- and Unix-only items so aterm-gui and aterm-uds build warning-free
windows: a tab cut keeps a command's file
windows: a selected tab the band would swallow wears the seam
windows: an unfocused pane header stays closed against its grid on light themes
windows: split scrollbars rest as one thin indicator, and the focus ring turns into the header's rule
windows: an off find toggle stands off a light find bar
windows: a CJK tab title is a band tab from its first frame, with its hairlines
windows: the Themes demo is drawn as a Windows 11 aterm window
windows: aterm-gui-fabric builds in a Windows release again
windows: bright yellow is a yellow again, not a cream beside Gray text
windows: Git Bash tabs start as a login shell, loading Git's prompt once
windows: the find bar draws its Fluent face over its cells
windows: a split's gap thumb leaves the focus ring whole and is one tone over the divider
windows: every selected tab on a light band wears the outline
settings: a scrolling Settings page draws its thumb in the page gutter in the terminal's idiom
windows: tab titles' CJK and Hangul take Segoe UI's own fallback at the label's weight
windows: the Themes demo and Settings' samples speak PowerShell and wear the tab's contrast floor
windows: Settings' quiet text buttons are standard bordered buttons
windows: closing a Store pwsh tab ends the programs it started outside the tab's job
terminal: a light theme's dark white on a colour takes the page colour under the floor
windows: each tab's title is cut to its own tab, in the selected weight
windows: a cmd tab reads the profile folder as \~
windows: the Themes demo's selected tab wears the strip's outline
windows: a PowerShell tab takes aterm's own legacy Emacs block back to Windows mode and the readline keys
render: the Windows default draws Iosevka's own low asterisk, so Claude Code's spinner stops hopping
windows: a dead key then Space types the accent, found by replaying recorded key messages through the real key path
windows: the bell's taskbar badge comes back after a refused icon; the jump list is read back from the shell
windows: the clipboard test runs on a window station of its own, not the developer's clipboard; right-click copy is tested under Windows' default
harness: an idle report alone answering the done check in a short turn ends the task (done-1)
harness: a full context inside the done check gets the check again after the /compact (done-3)
harness: a loop that follows reads Off standing at every park the journal says (done-6)
harness: a person's exchange an older build noted left stays theirs in the next loop (done-5)
harness: a loop that follows an older build's books reads the job's challenge off the record (done-4)
supervise: a limit's try a loop met again is owed its next rung however old (ATERM-KI-1016-1 limits-1)
supervise: a turn an act began that no read saw run is measured by its done row (ATERM-KI-1016-1 limits-5)
supervise: an act's time is the wall clock's across a sleep, as the done row it is set against (ATERM-KI-1016-1 limits-5)
supervise: a limit's try nobody read is taken up met where the screen or the transcript dates its answer (ATERM-KI-1016-1 limits-1)
upgrade\_status: a restart's agent no look saw gone is read gone by the process table
upgrade\_status: read a restart's unstamped exit off the process table only past the hung-exit bound (DR-LC-1)
upgrade\_status: a restart down in flight is lowered once its conversation is live again (DR-LC-2)
harness: an Edit file box is read off the whole grid, so its call's row above a tail=40 read counts
upgrade: a restart's agent the process table says gone is stuck:exited, never "has not exited"
supervise: an act answered faster than any read is taken by its row or its record, not only by busy
supervise: a draft that held the point, sent or cleared, lets the session go on
supervise: a draft holds the point only for its own escalation
phase: a prompt a hook stopped is no answer, and Claude Code's label over a hook's words is no words of the worker's
fabric: refuse aliased program directories before writes
supervise: retain every possible tool's owner hold
slog: refuse repeated retained snapshot slots
slog: keep partial transcript outcomes additive
supervise: widen turn-work date comparisons
shell-integration: take an older script's \~/.aterm/bin off only where the shell proves it put it there
supervise: a sleep of the Mac inside the turn an act began is no work of that turn's (ATERM-KI-1016-1 limits-5 live)
json, toml: non-string map keys read back as themselves (ATERM-KI-1015-7)
toml: refuse a None TOML cannot leave out, never drop its field (ATERM-KI-1015-7)
serde, json, toml: buffered map keys read back, and TOML refuses every None it cannot leave out (ATERM-KI-1015-7 review)
gui: every Unix successor settles its descriptor limit, Linux too (ATERM-KI-1015-2 U9)
update, gui: say every Linux crash loop and held build on the band; keep unseen rows until seen (ATERM-KI-1015-2 U21, U37)
update, gui, messages: the review of ATERM-KI-1015-2 — crash-loop ends wait for a window, queued owed rows keep their patience
machines: refuse retirement through aliased home ancestors
gui: keep discovery off Harness state publication
gui: stamp path-helper entries before warm adoption
core: retain typed columns when rendering row slices
render: name CPU and GPU foreground memo types
windows: retain clearable badges after a refused show
gui: bind node log cursors to the launch identity
update: check the preflight deadline between entries
render: repaint clipped wide selections on cached frames
gui: preserve literal agy cells before markdown presentation
gui: include the fourth agy row in card margin admission
gui: retain the scan family for incomplete cards
agent: require a complete same-origin accounts request
agent: refuse invalid generated account labels
agent: keep quoted CSV notes in their account record
messages: preserve owed warnings while their rows are queued
editor: preserve prefix arguments through M-x
harness: admit shared logins through settled settings
status: leave other agents login walls with their owner
agent: choose login method from the effective profile
input, search, effects: paste space normalization, Shift+Backspace Kitty encoding, Ctrl-R/S composer cursor snap, and trail revive/ring fixes
recovery: refuse multiply named journal images
release: keep raw proof reports after reduction fails
settings: a landing stands until a render has seated it (post-check behaviour-2, owner-eye-2)
settings: the landed SESSIONS row's card holds its whole block, clear of its words (post-check owner-eye-3)
harness: one name for each count on Settings ▸ Harness, and unproven said once (post-check owner-eye-6)
harness: STATUS's today notes in the page's plain type, Hero only for counts (post-check owner-eye-7)
autopilot: the menu says its session's whole name and stays in its pane (post-check behaviour-3)
harness: a note keeps the counts' room, so nothing under STATUS moves when they come
settings: every open of Settings ▸ Harness replaces the landing before it, the top too
autopilot: the menu keeps to its pane's rows too, and gives a tight pane its words first
autopilot: a card neither side of its chip holds covers the chip's row, whole
input, update: one busy answer for a full input queue; the Commit never cuts an owed input reply
update: the cold lane's exec waits for a closed tab's shell reap
kitty: consume a t=t file or t=s object only once the engine took it
control: background input on the ordered writer's route answers from the write
pty, sink: Stop paste and a tab's close release a writer blocked in ConPTY's WriteFile
gui: drop 14 dead\_code expectations no foreign cell fulfils
gui, session, pty: the review of ATERM-KI-1014-6
grid: normalize offload geometry before planning
agent: require the restart intent before signalling
vitals: age each trend from its last valid reading
supervise: every turn and every loop reads a done row less the machine's sleep inside it
supervise: a placed sleep is wholly inside a turn or outside it; a person's keystroke is read against the turn at its longest
lab: no developer account, run ids or host-like name in the lab's test text
tty: cap decoded paste text and complete control sequences
lab: the publish audit's last scrubs, and the jail denies \~/.aterm and \~/.secrets
lab: revalidate the instance before sleep signals
objc: make void block fixture callbacks return unit
gui: forget login stories when their session retires
abrew: preserve foreign links and admit physical traversal directories
abrew: preserve special leaf entries during link overwrite
abrew: admit opt parents before repointing formula links
gui: disregard exited children in cwd program probe
gui: bind notification clicks to their process incarnation
render: saturate bloom reach and bound invalid CPU radius
core: carry a stale shell phase until its prompt
gui: credit control typing only after nonempty input acceptance
harness: keep known credits held when transient notices disappear
settings: account for implicit config writes in undo and conflicts
gpu: reject unrepresentable frame timing and summed spans
gpu: use current checked atomic update API
gpu: publish useful timing and isolate its test rings
discovery: report observed facts and bound endpoint probes
control: spare only live connection-bound claims
security: own the posture fixture scratch directory
harness: bound streamed journal rows and retained state
control: resume actionable mapped frame headers
settings: a SESSIONS row's landing draws all of the block it selects
harness: the presses no safe rule proved are named one way, as a part of Approved
autopilot: the menu takes no press its pointer did not see, and never leaves its pane
autopilot: the hovered chip's title keeps its clicks once its explanation goes
autopilot: the timer's fire record speaks the chip's words and names its pane
autopilot: a done task keeps the time it finished when its supervision restarts
autopilot: a restated done or landing carries the time its end was noted
autopilot: a restated end's note carries the end's first time forward
gpu: retain timestamp slot custody until it is sealed
gpu: read timestamp pairs with the Trust chunk API
gpu: enable the timing sink helper for wgpu tests
harness: the lead's working times stand on their Hero figures' baseline
gui: slice 6 review — the span follows the mode, the rows stand, a quiet landing is one end
gui: the Every session row's presses wait for a look, and its words count what they cancel
gui: the look runs both ways: a row's button moved under a pointer resting on the bulk row waits too
gui: the Every row's Timer paints the words its name says

Performance

output: a line-at-a-time writer costs one loop pass per 4 ms, not one per read
windows: a held line-per-call stream is read in batches, not a line at a time
wave4: slice-backed row render, hoisted selection/fg memo, UI lock fairness & formal proofs

Security

the MACOS ACCESS actions row sits under the verdict, not after the details
the posture source is injected, and a dev build can stage one headless

Refactors

metrics: name effect stream readers and initialize their fixture

Tests

harness-card: the light border's colour and the paper are in the law; the light-ink comment states its real criterion
reproduce S2R-F3 and S2R-F4, ignored until fixed
reproduce the grow-first and overshooting S2R-F4 flaps, ignored until fixed
reproduce S2R-F4 through a width change, the ring-bound reveal and the home ED 0, ignored until fixed
handoff: v0.106.0's producer fixtures, written by its own cut
harness: the usage-wall walk counts the clock rule's refusals apart from the tie
harness: no needless borrow in the 2.1.302 shape of the cancelled-bucket test
harness: the record host reads the finished record's stop in the loop
seed-matrix: drop an unused import in the challenge's journal-rule test
harness: the seed matrix's acts in a limit's place, their first read 70 s on (ATERM-KI-1016-1, follow-2)
corpus: the conversation projection keeps durationMs (ATERM-KI-1016-1, person-7)
harness: the host-8 tests read as tippy asks (ATERM-KI-1016-1 host-8)
a tail cut at a chat row a person focused is read whole (ATERM-KI-1015-1 F2 residual: stale)
a box whose head is off the screen is held because its tail names no box (ATERM-KI-1016-1 dialogs: by rule)
phase: the completion menus read as what Enter did with them, measured on 2.1.302 and 2.1.268 (ATERM-KI-1016-1 dialogs: no pointer, stale)
harness: name the seen row's type in the crash-record test (tippy's type\_complexity)
crash-journal: a word's durability wait is a hang detector in tests, not a 5 s budget
control: the meta arm's Autopilot word waits on the journal through the verb's own door
harness: the hung record read is counted once the records thread has started it
aterm-lab: ps <tag> and down <tag> of a lab that is down are pinned through the verbs (ATERM-KI-1016-1, relaunch-12)
harness: person-7's next loop waits out the retry's take window follow-3 seeds
aterm: the live upgrade tests pin relaunch-3's probed first move
box-head: the cut question's test is one case, not a loop over one (tippy, after the merge)
windows: gate main's new Unix-only disk and mount tests to Unix
supervise: name LimitTry from turn\_end, not through approvals' private use
weak, latency-bound and flaky tests made to fail on the old code; atpkg reads a Windows process birth
windows: the workspace's Windows test build has no errors or warnings
windows: aterm-gui and aterm-toolchain reds green; aterm-gui's Windows test build warning-free
platform-b: cut five long poles and merge 17 integration binaries into 4
platform-b: restore what the negative controls showed load-bearing
platform-a: faster corpora and checker waits, two binaries folded in, three police tests cut
platform-a: restore what the negative controls showed load-bearing
gui-a: stop waiting on what is not the subject; one table for the sudo-debugger cases
gui-a: restore what the negative controls showed load-bearing
gui-c: fold duplicate families, bind the fds wire to its receiver, cut a 10 s wait
gui-c: restore what the negative controls showed load-bearing
engine-a: cut duplicates, fold families into tables, shrink slow inputs
engine-a: restore what the negative controls showed load-bearing
engine-b: cut dead and duplicate tests, merge test binaries, speed up the slow suites
engine-b: restore what the negative controls showed load-bearing
tail: cut probes and a duplicate, merge six crates' suites, run the slow sweeps on every core
tail: restore what the negative controls showed load-bearing
agent: skip held waits on a test clock, shrink the seed matrix, one ctl test binary
gui-b: replay the crash journal's transition cover, pace restored back-offs by the pause seam, cut two
gui-b: restore what the negative controls showed load-bearing
astream: bump vendor/astream to 7b8eff2, its suites consolidated
Node::quit waits on the child in place; a lane test doc names what it sends
forge: close 12 coverage gaps
forge: what the check found
keeper: close 15 coverage gaps
keeper: what the check found
shell-history: close 9 coverage gaps
shell-history: what the check found
update-verify: close 74 coverage gaps
update-verify: what the check found
font: close 15 coverage gaps
font: what the check found
session-log: close 10 coverage gaps
session-log: what the check found
agent: close 15 coverage gaps
agent: what the check found
engine: close 12 coverage gaps
engine: what the check found
tail-misc: close 4 coverage gaps
tail-misc: what the check found
gui-harness: close 13 coverage gaps
gui-harness: what the check found
windows: OpenConsole tests run this build's console client; two lints cleared
windows: the web band golden pins the portable palette; the serde corpus records win32\_input\_openconsole; dead\_pid() runs on Windows
act's off-screen Themes row test sizes its window in points, not the platform's cells
a theme-demo tick is held to the demo's strip and frame, not to an area ratio
a test binary's per-user folders are its own; the stats reading dials siblings on their AUTH line
no aterm-gui test reads the person's \~/.claude or \~/.codex; a test root is made, never adopted
the agreement property gains its presence leg; the no-regrid test its control (S8 fix)
four reds on main pass on macOS again — each test now checks what its change does where it does it
probe runs end on steps, wasm replay follows the engine, no disk image in a default run
fabric: remove new detached-supervisor argv fixtures
toml: group the None property's seed so tippy's byte-grouping lint passes
gui: remove help wording policing fixture
update-core: own transfer server and unreaped probe cleanup
update-core: publish owned probe completion before cleanup
gui: iterate the preserved footer rows directly
gui: remove the platform-wording assertion
gui: wait for the captured band shrink before requeueing
gui: anchor owed holds after the visibility-credit sweep
gui: read the owed warning actual fold deadline
lab: the Gemini loopback test waits for the stub's last log lines
lab: trustfmt the loopback test's wait
could\_not\_run lives in aterm-uds; trustd/hdiutil silence ends COULD NOT RUN
the remaining print-and-pass host skips end COULD NOT RUN (OF-30)
four load-only reds fixed by construction, not by retry
gui: type the observed input target explicitly
harness: fit the unplaceable credit notice in its captured footer
one helper copies an Apple binary and signs it ad hoc, and says why codesign refused
control: implement live authority in every lane service fixture
journal: own the sweep fixtures temporary directory
restore: kill every boundary mutant of the tail walk, ring read and writer
restore: what the check found
control-auth: pin every refusal of the control-socket auth boundary
control-auth: what the check found
control-auth: align with main
containment: kill 148 surviving mutants in consent, sbpl and posture
containment: what the check found
containment: align with main
sandbox-uds: kill 62 surviving boundary mutants in the sandbox and uds trust edges
sandbox-uds: what the check found
sandbox-uds: align with main
pkg-verify: kill 52 surviving mutants across verify, admission and keys
pkg-verify: what the check found
fabric-world: wait on the round at test pace, stop sitting out real deadlines
fabric-world: what the check found
phase-sweep: the reader at opt-level 2, two hot paths cut, the canary scan in cache
phase-sweep: what the check found
host-live: let scenes go when the host has looked, not after fixed seconds
host-live: what the align check found
gui-slow: carry on a stepped clock, seamless guards off the env lock, one-pass elision
gui-slow: align with main
gui-slow: what the align check found
autopilot: a real supervision restart keeps a done's first time, end to end in aterm-gui
harness\_host: count the successor's claims where the wait read them
gui: drop the obsolete standalone banner encoder comparison
harness: the end clock's week is built in its initializer (clippy field\_reassign\_with\_default)

Docs

verify cells judges aterm-gui since astream b8a8cff; the seal island's counts at …
design: a done task's switch closes back on its own model, and its face reads done (ATERM-KI-1016-1, KR-DONE-5)
harness: an aged-out limit's try is a decision for the owner, not "never sooner" (ATERM-KI-1016-1, follow-1, KRF-1, KRF-4)
phase: struct Options keeps its doc line; NAMED\_LABELS's doc opens on its own subject (KR-DLG-3, …)
manual: hold's and meta set autopilot's OK come once the word is on disk
BROWSER-SWIFTSHADER's record, and the browser lane's status in the audit
GONE-2's review fixes recorded: Mutter's oracle rows, the stderr control, verify linux green
the skills and help teach workers, not drive task|report|watch|await-turn
no removed drive verb, manager mail or title summariser is named live
nothing plans on the sealed transport, and the astream README's recipe runs
help and docs stop naming the removed drive commands and manager mail
help and doctor say the embedded operator is removed
aterm help, the README and four comments describe aterm fleet as it now is
one fleet entry, what --fleet reads, every worker gate, and the bus's fleet told apart
run the fleet's reader on the issuer, where every member is in the book
no removed verb taught as live after the main merge
the security model, AGENTS.md and the fabric laws say what the network and the bus are now
the security model names the issuer's join on the fleet port
the survey's teaching says what a tight read keeps and what it says
session log Phase 3B as built
the audit's lock ends at 10 since AEAD-RING; ring's rows name the sealed transport
the warm spare's L7 and exact-cwd rows name the held-pane and retarget rules; U3's doc drops the held pane
any machine reads the whole fleet; the book's wire and its copy file as built
a fleet read gives each peer one deadline, the first 32 at once sharing it
main's program-state and strip-header notes name the hover, not the row
the merge's text names what is left, not what either side removed
harness: the done check is read by its words, whoever typed them (done-2, decided)
manual: a relaunch owed under a limit types nothing into the limit (ATERM-KI-1016-1 limits-3)
Claude Code 2.1.290 draws the menu's pointer; colour only is 2.1.289 and before (MEASURED)
supervise: explain conservative owner holds
DESK-APPKIT review round, a person's click took the toolbar drive's activation
update-core: qualify the continuation scheduling clock
say what a lost login now gets, in the settings help and the code
manual: say which terminals' closes were run and which replayed
cli: Terminal.app's close and Quit measured for CLOSING A TAB; fmt
the fleet's node keys are built; say so where the notes said not
an unbound node binds only where it was recorded, and reads say what is unproven
aterm's own notices are aterm's once macOS allows it
which cwd report sets a tab's folder; ATERM-KI-1015-8 closed
say what the credits hold holds, where it ends, and what may still be billed
navigation\_is\_chip keeps its doc comment; ladder-fit names the About hero's measured column
card-light: the burst's two tones, the wordmark, AA's warm letters, measured figures
run damage example against public API and align stand-in inventory
close ATERM-KI-1015-14 and ATERM-KI-1016-1; their limits move to the manual and the design
control: scope admission count to its parking stages
autopilot: say which restarts keep a done's time, and read the title ladder in order
harness: the verdict up front in the manual, CHANGELOG and the page's module doc
harness: the Every session row in the manual, CHANGELOG and §11.5.7 As built
A3 as built — the fence, its model, its knob counts and its cost
A3 as built after the 3 000-seed find and main's anchor refinements

Other

Restore signal-test state and join its worker on every unwind path
Admit fallback cache custody before automatic cleanup
Refuse fleet briefs beyond the retained session and node bounds
Reserve mirrored cursors within handoff carry budgets
Cover session-log helpers by prefix and own world command output
Validate mirrored carry counters before adopting a log
Keep mirror mutations within the owning bridge transition
Show incomplete snapshot needs as partial and preserve claims
Format the joined session-log wave in each owning Rust edition
Reject conflicting agent restore tables before conversion
Refuse unreadable lock holder census before Muse resume
Describe the standard Muse turn settle behavior accurately
Describe Swift override class matching as a name heuristic
Remove native handle fixture with fabricated platform resources
Format the conflicting restore table rejection with its owning edition
Remove the AppKit oracle fixture with a fabricated view
aterm-gui: a citation's shell must be alone in its group, and the review's other fail-open paths close
aterm-lab: codex-alab-proof proves Autopilot Off gives the claim back and drive task mails alone
round 4: trustfmt the review fixes and the lab step
aterm-sysprobe: SPECS rows for lone\_group\_leader and stat\_pgrp
review(keeper): two verified custody defects fixed, for the keeper's owner to finish — NOT for main as is
Require a complete positive process-group census for local citations
Keep the headless citation probe inert by default
Keep display reports out of local citation authority
Preserve explicit first-call custody for inherited bridge lanes
Refuse unsupported or exhausted keeper synchronization
Keep lab broker shutdown within unreaped child custody
aterm-update tests: the notice fixtures carry the diagnosis stamp … now requires
harness: transition Claude Code subscriptions early on warnings, credits, and multi-account taps
Clarify account attribution and reported renderer measurements
aterm-verify: the GL lifetime fixture says COULD NOT RUN without node, and keeps its root only when it fails
machines: the host locks a Screen Sharing login itself when screen vanishes
machines: screen's pane open waits out a host busy after a login; the watch measured after one
machines: the screen watch hears busy refusals, and screen arms it again after a gap
Keep acknowledged screen watches through replacement failures
aterm-predict SPECS: main's two edit-lane guards mapped; 112 tests under 33 specs
aterm-predict SPECS: §3 counts the fourteen specs added since the 19-spec recovery
supervise/policy: name the shell startup's tape form (ShellWire)
aterm-gui: the Autopilot term's bit-table test reads the weekday main packs
aterm-gui: SessionLights::glass's doc names only what the glass carries
rainbow kitty: ink on paper keeps each stop its hue on white backgrounds
harness: the honest chip's review: the menu's switch note tested, a week-old clock names its date, the permission light floored
Keep decision bursts separate across extreme timestamp gaps
Format each decision clock with its own historical zone offset
Keep newer Autopilot history snapshots when background saves arrive late
aterm-agent: the open-work reader is held to three rounds of real done reports
aterm-tempfile, aterm-durable: a test-support feature, so a dependent's --release tests build
aterm-update tests: the persistent-notice fixtures carry the diagnosis stamp … requires
aterm-agent: a blocker's topic is no blocker, and an earlier item's blocker clears no later one
aterm-agent tests: the tap's secret test reads the state root an optimized build resolves too
machines: the plain commands take the defaults and ask nothing
machines: init --passphrase also protects keys an earlier init made without one
aterm-objc: a macOS 27 Swift override spells Bool c where arm64's BOOL is B
chore(vendor): bump vendor/astream to 7066fab and ratchet Trust floors (+1,160 proved across astream-broker, astream-aead, astream-wire)
Confirm signing key protection after interactive passphrase setup
Clarify when optimized builds include durable test support
grid: a primary rows flap over a blank tail hands the trimmed rows back (S2R-F4)
specs: state the trim hand-back in the rows-only grow contracts (S2R-F4)
render: a column flap that cut drawn cells is debt as moved rows are (S2R-F3)
grid: a primary rows flap hands back whichever edge it moved, in either order (S2R-F4)
grid, gui: the hand-back's lint and serde corpus answers after verify
WIP (not compiled to green, not reviewed): S2R-F4 through width changes, ring-bound reveals and redraws from home
grid: finish the split resize: freed rows refill the rows step, the offloaded pass keeps its height
grid: the hand-back tests' lint answers after verify; the split's doc wraps
grid, gui: the split refills the rows its demoted lines take at the new width; the cut rides its own key
harness: a relaunched codex-alab's crash is judged by its own copy, never the crashed one's
harness: a relaunched codex-alab that runs on is never matched to the crashed one's snapshot
Use the current atomic update API for snapshot generations
aterm-slog: the words, kinds and keys the remaining marks and the transcript source need
aterm-slog: an exact amend refines a held outcome and a step need's confidence; brief reads them; the clause names its row
aterm-models-session, aterm-models, aterm-slog: SessionLogFold, bound to the real Fold
aterm-slog, aterm-models-session: the transcript joins the turn tracker
aterm-phase: the transcript's key anchors and newer\_than, checked by the store canary; the canary spawns through spawnfd
aterm-agent: the step fold — tool calls, turn ends and walls from the transcript, no text kept
aterm-lab: a person's quit as the display-gone rows' control; the oracle's mid-resize row must reach the scope
aterm-window, aterm-x11, aterm-gui: only a dead display connection ends aterm-gui as a logout
style: trustfmt the ATERM-KI-1016-1 done-report fixes
chore(tippy): the TAIL\_BYTES Finished read is a test's alone; a test's case tuple is named
style: trustfmt the KR-DONE-1 test
style(harness): the ledger cut's row type named, as tippy asks (ATERM-KI-1016-1, follow-6)
style(phase): trustfmt over button\_row (…)
style: trustfmt over relaunch-1's carry code (ATERM-KI-1016-1, relaunch-1 LC-4)
style: trustfmt the KR-1..KR-3 test lines (ATERM-KI-1016-1 relaunch lane)
style: trustfmt the at\_background tape form the done merge added
disk: one truth for the verb's warning; small volumes; atpkg-gc rows as atpkg keeps them
sysprobe: volumes (the mount table, one volume's free space); the disk path reads it
disk: the room meter, fed by the watch and persisted; room= reported, read by no line
disk: lines from the room; the tier planner; the gone rule for nested workspaces; fences, pass lock, private roots
models: DiskReclaimPass, bound to the real pass with a negative control
disk: tier 3, whole idle build directories of live checkouts, report-only
disk: tier 3 judges the checkout above the build directory, never $HOME
disk: the board, and status disk= disk\_free\_mb= disk\_room\_mb= disk\_age\_ms=
ctl: await sys — agents wait for free space; the watch adopts their demand
lab: disk-lane, the disk awareness live lane on a scratch APFS image
disk: tier 3 on — whole idle build directories are emptied by default
disk: the board lock is one census identity; trustfmt the branch
disk: the branch's tippy findings
disk: the review's findings — tier 3 fenced, await sys honest
disk: the board knows the watch runs from the host's start
aterm-gui: the A/B snapshot's guarded write is write\_if\_newer, not a second write\_own
aterm-verify: verify browser runs both web modules on ANGLE SwiftShader beside Metal
Capture the lock refusal on its real output channel
Preserve existing homes in private lab instances
Keep build directories when this process cannot be placed
Keep disk waits bound to the measured volume
Preserve custom files that only match a cargo artifact size
Describe concurrent disk readings precisely
Keep installed builds when link placement is uncertain
Retain the mount table for the remaining link fixture controls
Preserve recovery records when inputs or cross-instance ownership are unknown
verify: take trustfmt and targo-tippy from the managed Trust build when the toolchain lacks them
codex OSC 7501: a program-state turn ledger on the timeline, and fx celebrate on=done
r5 review: the formatter test runs under verify, borrowed builds are leased, contracts say what the code does
aterm-gui: a development seam runs the package lane in a headless instance
first run: the update never waits for the login shell, runs unclamped, and checks trust ahead
atpkg tests: the resolve-ahead test fails, never hangs, when the check starts late
aterm-gui: the first-run QoS note quotes the final typing measurement
first run: only the first install a person waits on runs unclamped and skips the login PATH
aterm-gui: the headless package lane seam needs a scratch HOME as well as a private state root
aterm-gui: reflow the package lane's child\_path doc
serde corpus: record v0.106.0's shipped-state answers
Replay queued human input before activating carried workers
Bound standing-ledger work and resolve headless home identity
Lease the physical Trust build behind borrowed tool shims
aterm-agent: the legacy-journal test imports LimitTry from turn\_end, where it is public
aterm-window: X11's poll failure carries its error, no sync on a lost display, a swallowed X error on stderr
aterm-gui, aterm-pty: a new tab waits for its fork and nothing else
aterm-gui: a remade identity is primed at once, a held sweep arms no past wake
aterm-gui: the A/B snapshot's write is install\_own, so the lock census reads no re-entrant lock
aterm-gui: a spawn run inline in the loop's turn waits for no park
vendor/astream: bump to 65566fd and ratchet astream-broker (1318) and astream-cap (528) floors
Reserve predecessor-ledger expansion before assembling it
LAG-6: the rc's DEBUG trap without a fork, the first prompt's Ctrl-C, the first frames' shaders
LAG-6: fish gets a WARM spare (sweep #22)
LAG-6 review: the bash hand-over only ahead of a fresh load; a fish spare's scan from its spawn; stale .trap files swept
LAG-6 review: the handed-over DEBUG trap's read is no failed command to a .bashrc's ERR trap or set -e
Retire edge-token files inline after exit release
vendor/astream: bump to 0cc0484 (4768 proved, 0 failed across workspace)
aterm-gui: the forward relay borrows its two ends and hangs both up on every way out
aterm-gui, aterm-pty: the PTY census counts the spawn kits; the identity test waits for its prime
FDA-1: an update from 0.105.0 brings the Full Disk Access page, never the folder dialogs
aterm help permissions: a command run from inside a protected folder, not a bare cd
aterm-gui: re-record the shipped-state serde corpus for v0.106.0's producer fixtures
aterm-agent: gate disk\_idle's tests to Unix, where their fixtures' calls exist
aterm-agent: the step fold reads main's newer rules — a peer's message is a prompt; the tap binds by the open file's identity
agy and Muse Code: their own background work reads as Claude Code's, so the harness waits through it
agy and Muse Code background work: hard as Claude Code's shell, the remembered limit kept, guards tested
turn\_end\_loop\_tests: the question table's type left to inference (tippy's type\_complexity)
agy and Muse Code background work that never ends climbs the stuck canary; the hard rule's guards tested
aterm-gui, aterm-primer: a forgotten identity stays forgotten under a racing prime
aterm-lab: a GPU row of the Linux proof fails when its session drew on the CPU
machines: name every Mac for what it is, by default
machines: say a Mac's hardware once, and keep its NetBIOS name
harness: hold the codex-alab relaunch lease to the relaunched process's first idle
harness: end the codex-alab relaunch hold once the relaunched process is up; an unread start is no end
aterm-gui: an inherited identity's admission makes nothing a forget took; a named one's made is its create's answer
aterm-gui: hold the pointer and menu-posted input for a spawn, drop held input past its hold, judge a network home before the PTY chdirs into it
aterm-gui, aterm-primer: a re-prime never remakes an identity removed under it
aterm-gui: identities forget moves the identity out before removing it
aterm-gui: held input waits for the spawn that was newest when it was typed; no held strip press replays onto a moved chip
aterm-census: the protected-folder guard reads /System/Volumes/\<volume\> as macOS's own mount, not /Volumes
release: no proof count gates a Trust seal's publish; delete the D27 candidate gate
atpkg doctor: name a \[trust\] key the installed Trust retired, not "could not ask"
aterm-release: a Trust-main log's memory census is absent, never a zero
atpkg-publish: the trust cut ALAB-SYNC.md prints is CUT §3.9's, gates and first step included
aterm-release: delete the lane's memory guard and ship trust run --guard
aterm-release: a run whose log names no ceiling records none, never RAM / 8
atpkg-publish: the sysroot bundles are the bundle lane, and the seal-line audit is P5a's
aterm-release: delete trust\_lane::Outcome::detail, whose last caller is gone
vendor(astream): advance to fce04bd (term/broker/wire const fn verification & floor raises)
aterm-gui: transcript steps reach the session log
agy and Muse Code's stall ladder names their agent and work, not Claude's title; moved words after a rung tested
aterm-core, aterm-gui: the sweep's marks — integration, status, ctx, goal, interrupted, notify, progress, bell, render; the launch card's amend
aterm-gui: cwd, title, modes and in-doubt marks
aterm-gui-fabric, aterm-gui: mail, inbox-seen, post, post-landed and hold marks through one typed fabric hook
aterm-gui: meta and story marks; escalated derived by aterm
aterm-agent, aterm-gui: the harness's acts and the usage tap are marks
aterm-gui: the clause in the tooltip and menu, behind \[session\_log\] clause (off)
aterm: the session log's transcript steps, end to end on a headless aterm
aterm-dbus, aterm-lab: lane-bus seat makes its pointer before its keyboard
aterm-lab: the baseline's ibus leaves the X keymap alone, so XIM's dead key keeps its keycode
machines: name the internal disk, find a Mac whose rename's report was lost, map . and \_
machines: keep an owner's .local DNS name, find a Mac whose old name was taken, 960GB is not 1TB
chore(vendor): bump astream to 3b0ee72 (astream-broker 1323-\>1374 proved)
aterm-lab: XIM's letter held until it composed, its window focused once viewable
aterm-dbus: lane-bus's PARK says every pointer session aims from the corner
aterm-uds: a child held to its progress, not one deadline; install\_sh batches time a call, not the batch
install.sh: the head is read from every redirect the updater reads; the head differential keeps only the rows that test something
install.sh: split a release tag by word splitting, not a here-string per parse
aterm-link: the live-record-behind-a-backlog rule pinned at the engine; the world test makes its premise and shrinks to one page
aterm machines: enroll many Macs with one password; plan/apply --only
aterm machines: review of enroll-many and --only; fix what it found
trust floors: aterm-spec 151/1129 on the 36 GiB host, as on the 128 GiB one
aterm-spec: skip the two bodies the sealed prover always times out on, so the floor sees regressions again
trust floors: aterm-spec 151/982 with nothing out of time, 0.9 GiB, 199 s
aterm-machines: zero-touch macOS LAN fleet discovery, auto-claim and LaunchAgent
aterm-machines, aterm-gui: Fleet Tab Control Panel (/tabs & machines tabs) with live AI CLI status
aterm machines: enroll sets a new controller up itself, as the other verbs do
gates: the lazy-init census reads each line once; dead flock rows go
Fix the identity-spawn flake and run S2R-F4's two ignored repros
aterm-grid: fix two regressions in the bottom-push hand-back
aterm-machines: the relay's close test watches its own listener, not the port space
aterm-verify: the recording runner's --config goes before the subcommand
aterm-gui: await inbox topic=\<t\>, the wait a session runs to be pushed to by a channel
aterm-primer: the channel recipe reads everything a wake brought, and the help says what latches
harness: an agent parented by its terminal's owner is no shell job
control: an over-long request line gets an ERR before the drop
aterm-gui: history names who typed each turn, the window harness as by=harness
aterm-net: two aterms prove one fleet secret to each other, the listener first, over ALPN atf/1
task record: task, task mark, await task, EVENT task, carried across the handoff
task record: a closed worker keeps its row, news latches, and a mark waits out the Commit
harness: an aterm tab's own program keeps its snapshot and its release, and relaunches nothing
harness host: a tab's own program is not-relaunchable at the restart fence, and its exit says why
aterm ctl: only send and paste are pointed at their stdin form
turn ledger: the window harness's send and Enter are its turn, by=harness
turn-end loop: the worker's suggestion is typed as the harness's words, under a hand no other lane can move
drive report, drive ledger, the companion: the window harness's own turns are not the manager's
handoff: a turn record the harness pressed crosses to every successor
aterm ctl: the over-long request test fails on a hang instead of hanging
lease: a hand taken here ends with its connection
turn ledger: past half the ring, the harness's records make room among themselves
subscribe events: a turn line names who typed it, by=
spawn agent=claude: a worker is the first job of an ordinary login shell, its task from a file
spawn agent=claude: the task follows the server's GO, and from= is the starter
spawn agent=claude: a worker under another identity keeps its own login, and an unanswered one is undone
harness: a tasked worker's done is published with the report its transcript holds
task record: result \[full\], a turn reopens a done worker, the host marks exited
harness: a done is published as its point is folded in, read by the policy's rule
task record: a turn reopens a done worker only while it still reads done
harness: a done is published once across a sleep, and a check newest is read as one
survey: every session's facts and excerpts in one read, rendered for a model
aterm-net: a fleet listener serves proved LAN streams and reads its key only when private
control: a fleet peer is Scope::Fleet, gated at the top to the verbs the table marks fleet
fleet: [fleet] allow is read without regard to case, as Manual grades it
aterm-net: the fleet listener gives an unproved connection's slot up, and cuts a proved one at 30 s
fleet: a changed or removed fleet.key stops the serving, an address not up yet is retried, and gate refusals are audited
roster: aterm says bye quit|handoff, a will reads away, and a withdrawn address is refused
aterm drive: classify, phase, answer and ledger are the whole CLI
aterm ctl: the worker spawn's head is measured as spawn's
aterm-gui: the merged fleet scope names no turn's typist, and the harness test closes
control verbs: the short catalog's budget is the merged wave's measured 11792 bytes
aterm-gui: a worker is refused under every switch that leaves it unsupervised
aterm-gui: the survey's privacy boundary keeps its corpus tests
aterm-gui: the survey verb's facts are compared with their ages masked
aterm-agent: a worker's result waits for its turn's end row, and result reads a lagged turn again
aterm ctl: turn settle=submitted answers at the verified submit, and a worker's follow-up uses it
aterm-agent: the result waits for the turn the done edge read, a notification's too
aterm-verify: verify release is 13 checks; the sealed rung is gone
aterm-link: the fabric is one machine's bus; the sealed transport, mint-for and join are gone
aterm-link: two nodes' routing rules are tested again, on the plaintext fleet
network: the fleet is the only network door; \[net\], dial and the drive are gone
harness: a worker's check and answers skip the short back-off, and its marker ends the task over a running shell
aterm-gui: a worker that never shows its composer is stalled why=startup
aterm-agent: the transcript resolver's tests read a reaped pid
harness: a done over a shell survives the agent's own wake, and a recorded done is never taken on at a wall
aterm-gui: the startup deadline judges only a record its starter left, marks it in-process over the record it read, and sets its attention first
harness: a seed refused with an act of the loop's owed reads nothing into the point
aterm-agent: the approval policy reads a manager's worker verbs, and drive ledger without --out
aterm-primer: the primer (v18), the skills and aterm help teach workers and the survey
aterm ctl: a spawn's cwd= with a space goes quoted, as the server reads it
aterm-primer: managers wait on workers past a rev, and spawn them without cwd=
workers: a quit removes their task files, and the trusted folder is absolute and bounded
harness: a tab's own Codex keeps its snapshot, pid 0 is never alive, and its remedy names a new tab
roster: a quit's withdrawal walks past a refused row, and the handoff's bye is said once per attempt
lease, history, link: the help says what the code does, and a connection's end is tested past the slot
aterm-agent: what the drive cut left unreachable is gone, and §7 keeps the rest by name
once\_cell: the linux cell's parents are the measured set, ahash gone
verify: the change cone names a member whose name the lock shares by its spec
aterm-agent: the engine test's request filter is formatted
aterm-gui: the config serde corpus records no network drive
aterm-types: the short catalog's budget is the measured 11748 bytes
aterm-primer: v19 is main's v18 and the workers' v18 together, in 2,700 bytes
aterm-cli: the agent brief is 97 lines with both the survey line and the follow-up recipe
aterm-link: the subject-budget remedy re-runs the root's own on
aterm-link: the b7 resolution's tests, as trustfmt writes them
aterm-link tests: a refused on keeps the root's own cap, not another host's
aterm-link tests: a person's mint-for is no default-build special case
aterm-messages: Terminal and Removed share one CONFIG arm
aterm help workers: the follow-up is settle=submitted, and ERR unsupervised names its switch
aterm-gui: the startup deadline neither marks nor badges an Off worker
aterm-link: mint-for's wide-cap warning names a real remedy, and its test is back
docs, specs: what the wave-3 merges left naming dial and removed loops
aterm-uds: one host-name answer for every reader of the machine's name
aterm-net: a fleet's membership — the join code, the node id, the book and the join
aterm fleet init|join|peers|leave: a machine's membership in its fleet
aterm fleet join: a code anywhere on the command line is refused, and an issuer joins nothing
aterm help fleet: the front door describes membership, and only reads that exist
aterm-uds: one careful file writer and one aterm.toml writer, shared by fabric and fleet
aterm-link: enable.rs back in its own edition's format
aterm ctl survey --fleet | --host: every fleet peer's sessions, each within one deadline
survey: no fleet key leaves whole, a branch is kept, and a peer's reply fits what it reads
aterm ctl survey --fleet: the reply is under the deadline's watchdog, and each reason names its stage
aterm help fleet: the operator's commands keep a section on the page
aterm-net: fleet\_member's slots import in trustfmt's order
aterm-uds: the host-name test spawns uname through spawnfd
survey: redaction judges logical lines and bare words, and the user title is content
fleet: one member never fills a listener, and what a read says is the node it read
fleet texts: init on one machine, join on each other, and what each level and command does
aterm-lab: workers proves a manager Claude Code runs three real Claude Code workers
aterm-link: a fabric root is a Unix socket's folder, and a new node id names its bridge's relaunch
aterm-verify: a cone member named by its spec is the package its name says
teaching: a later wait names revs, one reading of a taught command, and no page names a removed path
aterm-agent tests: no assertion that a post never happened
fabric: a new node id's remedy relaunches each aterm, and the bus reads as one machine's
aterm-agent: the done edge's turn is the one that said done, and a turn with no end row stops at the next
aterm-gui: the startup stall's attention goes when another mark ends the stall
aterm-gui: a turn into Claude Code is submitted when its composer takes the line, and names the task rev its Enter found
aterm-agent: the done edge's turn is the one its point showed, by the rows' stamps
aterm-gui: the composer verify waits for the echo, reads no placeholder as text, and judges the screen at the window's close
aterm-gui: a quit leaves the parked predecessor's workers their task files
aterm-agent tests: a seed read served after the loop acted reads nothing into the point
aterm-agent: the result is cut at the read that decided the done, a carry-on's answer included
aterm-ctl: a plain spawn's request line is built and tested by its forwarded verb
aterm-ctl: one rule names a taught verb nothing serves, for the primer, the skills and the workers page
aterm-gui tests: a worker's folder read late or with the cap full trusts nothing
aterm-lab: fleet-sim brings up thirty fleet machines on one Mac and reads them
fleet-sim: the review's findings — the reader's limit, the client's deadline, interrupts, the record, real refusals
survey: a peer's header keeps its state counts and its reply cap's note
fleet-sim: the record keeps its hand-written notes, and says the clean read's measured wall
harness: the state root is aterm\_types::dirs::state\_dir, not the operator's wrapper
update handoff: the Commit admits on its own facts, with no resident operator to quiesce
operator: the embedded operator leaves the window, aterm ctl and aterm.toml; Start Operator starts a worker
spawn: Spawned::sid is compiled where its one caller is
sink: the epoch-conditional immediate write leaves with the operator that used it
status item: Start Operator is grey for what a worker's spawn would refuse
status item: the Start refusal test names its case type
operator: the durable queue and its five models leave aterm-agent and aterm-spec; aterm fleet keeps none of its old modes
aterm fleet: the membership modes answer "not built yet", and the dispatcher's exit codes are tested
aterm fleet: the dispatcher's table is a pure route, and no test runs a membership mode
operator removal: the replacement is named for every platform, and two leftovers are corrected
man: aterm drive is the window harness's readers, as its help says
aterm-gui: the removed operator's entry passes the door, and the config corpus records no \[operator\]
Start Operator: its brief waits as the help teaches, and its grey row holds every gate
removed features: each entry's step is the deletion that ends it, and the operator's verbs name their replacement
aterm fleet: the issuer's leave says its fleet went, a join again keeps its port, and a rotated secret's row keeps its remedy
harness, survey, spawn: the worker's per-agent gates are exhaustive matches
aterm-link: aterm fabric help and aterm help fabric say the bus is one machine's
aterm-agent: the login and renew waits stand aside one at a time
aterm-lab: workers reads the await's output where the manager's conversation writes it, and sees every rev
teaching: the spawn help's identity clause parses, and a long follow-up's limit reads the same everywhere
aterm-agent: a login or renew run holds the stand-aside lock from its spawn, and its test waits on the ignore
aterm-lab: workers gives the manager a temp root in the run's scratch and reads the await's output only there
aterm-mac: the Info.plist says why aterm asks for the local network
teaching: survey --fleet reads the peers this machine knows, the whole fleet only on the issuer
fleet: a peer that has read its connection's end dials again at once
survey: the read says it is data, an agent at a box reads asking, attention is shown, said drops the done token
fleet-sim: every live listener swept, the hostile words across the hop, no vacuous excerpt pass
fleet-sim: the stopped machine is continued however the fault phase ends
fleet: the relay's order is pinned by a test that fails on the old order
survey: every agent says what it was asked and last said, and a cut names the reader's budget
fleet-sim: the hostile words are said at a box, and a cut read is judged by the client's rank
task: a follow-up's turn opens the done its Enter found, even when that done was marked again
harness: an agent that ran as its tab's own program is to be started again in a new tab
harness: a started worker held where nothing moves is stalled why=held, and its manager's await answers
harness: the held deadline counts none of the harness's own waits, and a held worker that moves reads working why=moved
harness: the held deadline waits out a driver's hand, looks again within 10 s, and a loop's restart keeps its attention
harness: a re-grid is no move of a held worker's, and a hand defers the held deadline only at a box
aterm-gui: the held read's tuple on one line, as trustfmt has it
aterm fleet join: register first, then write the key and \[fleet\]
fleet join: the issuer names itself by its join code's host, and one that names no host records no one
fleet live lane: pin structure, not the binary's sentences
survey --sid: a session a peer's reply cap may have left out says so
survey excerpts: the cap never ends inside a word, and a task head is redacted before it is capped
survey redaction: uppercase 40-hex reads as its short form, and an uppercase-and-digit token is a credential
survey: an idle shell's line names its place once
fleet listener: a served connection is a Served, whose two ends free its slot before the peer hears the end
aterm-net: serve's doc reflowed, and the tls module doc names answer
fleet live lane: the CHECK column is the last non-empty cell
fleet live lane: the issuer is headed by its join code's host, and a refusal is read past its program prefix
aterm-gui: the operator's menu header drops its agent's status glyph
Start Operator: a start that does not start frees Start and says why
harness, atpkg: the stand-aside says the signal window between spawn and ignore
harness: a re-grid's verdict is settled like its text, and the settings panel waits out a hand
fleet join and the held deadline: review fixes (fleet.1-m2, the settings panel's hold)
fleet listener: a proved connection's share goes as its exchange ends, not as its thread does
supervise: the loop's mail lane goes, the last of the manager-mail removal
fleet listener: a teardown still counts against its address's share; a proof past it waits for one
fleet-sim: each loopback registration is taken out again, since a join the issuer does not record writes nothing
fleet listener: every cut and hang-up shuts each half on its own, so a member that sent its FIN and reads nothing cannot keep a slot
fleet listener: a relay whose peer fails keeps its hold through the line its control server serves, and an answer's stream cannot end the connection
ctl and server: an @ that names nothing is a usage error, never the front session
survey: excerpts use the budget — whole while the read fits, a report's end kept when cut
help workers: the survey's excerpts are whole while the read fits
spawn and workers help: the folder-trust Yes is Claude Code's, and it persists
fleet issuer: a join's log line names the member by its fleet address and node
headless: SIGTERM, SIGINT and SIGHUP run the Quit verb's quit, then die of the signal
aterm\_suite: the quit-signal lane's module in trustfmt's order
subscribe: the roster readers' doc does not open a line with *
headless quit signal: a cold exec never swallows it, and no control socket is needed
aterm ctl --help: exit 75 after bye quit comes at once
survey: a finished turn's said= is capped keeping its end, so a report past 400 bytes keeps its result
survey tests: the narrowing width is the widest that fits; no closing-line prose pinned
fleet-sim: long reports on idle and busy sessions, so thirty machines exercise the narrowing
fleet-sim: session\_plan tests parity with is\_multiple\_of
SPECS: drop the Smart Titles rows and the relay-turn row that name deleted code
messages: the network drive's removed-feature entry names the credentials it left
aterm-spec: retire the ChannelBind model, which nothing binds
aterm-net: delete tls::relay, the network drive's half-close relay
aterm-link: the bus is one machine's, so the plaintext --tcp wire goes
comments: no removed drive verb is described as present
supervise: delete the loop options only removed drive verbs reached
comments: the last docs that taught removed drive verbs and flags as live
messages: the network drive's leftovers name each folder once, over both lines
SPECS: the wait classifier's row no longer lists the removed dial
aterm-gui: the old-fish test pre-runs its stand-ins and the fact-line test stops pinning prose
aterm-agent: a task the done check ended returns the reply's own words after the report
aterm-gui: a worker's result files go with its session, as its task file does
aterm-gui: a done over a deadline's stall takes the stall's attention down in the same rev
aterm-gui: the startup deadline skips the harness's own waits, as the held deadline does
aterm-ctl: await inbox is re-armed past the server's bound, and the channel recipe says what it needs
aterm-primer, aterm-cli: driving a Claude Code peer by hand fits Claude Code's 2-minute Bash, and the lease recipe works
docs, help: the stall's surfaces, the security scopes, ctl --help's "fleet" and help conn say what is true now
aterm-agent: the done check's reply is read as the marker's turn is, and a reply not yet ended on a done is the lag
aterm-gui: the startup deadline counts a driver's hold from the last look that saw the hand
aterm-gui: the done-over-stall test asserts the held text it raised, not its wording
aterm-gui, aterm-ctl: a wait on a Claude Code peer's turn answers past the turn's Enter, and is re-armed to its own timeout
fleet tests: a refused host is COULD NOT RUN, no read holds a latency budget, no test asks the network's resolver
fleet book: no registration evicts or moves a member past its address's share, and one machine is read once
fleet: a machine names itself to its LAN by its Bonjour name, not the name DHCP gave the kernel
fleet: rotate keeps the roster, and init, join and the help say what the owner does next
fleet: a sandbox's refusal and an address another node holds say their remedy inside a survey row
fleet: a join's advice is chosen by its failure's kind, and a read keeps the answer it checked for a node
fleet: peers --timeout widens the check, and the live lane gives the real issuer a hang detector and asks no resolver
aterm-uds: a Mac's LAN name is the HostName an administrator set, and the Bonjour name only when none is
fleet tests: the survey read asks the peers that must answer at the hang detector
fleet book: record's doc and the design say the per-address share is a bound on a secret holder, not a refusal
aterm\_suite: the task-record, turn-submit and reply-grammar lanes refuse as COULD NOT RUN when the headless boot is refused
fleet, aterm-uds: trustfmt's layout for this round's new tests and the CFString read
fleet: an unreached peer's reason by its kind, its remedy within its row
survey: the redaction finds a fleet join code wherever it sits
survey: a role is redacted, the header names the LAN name and the instances
survey: a tight budget keeps what most needs reading, and says what it cut
fleet-sim: the thirty-machine proof runs on the end use's load
survey: render\_within's doc says the budget is used to within one line
survey, fleet: name the fill order's and the host names' types; format
survey: a join code reaches the redaction whole, across lines and caps
survey: facts carry a role only as a label word
survey: the read's closing notes are held to its budget
survey tests: judge the facts note by whom it names, and _ words
fleet: every reason a peer's row can give keeps its cause and remedy
lab: fleet-sim's usage says the five sessions a machine runs
survey tests: say the closing-line bound as tippy reads it
excerpt: a cut on a join code's edge goes past the whole code
fleet: a peer that broke off its answer is said by the error's kind
survey tests: the budget is used to the unit, and no remedy prose pinned
lab: the judge holds the budget to one excerpt line, and says what it counts
aterm-agent: a task's end is journaled after its point's line, as main's readers read it
aterm-gui: a Codex's final exit is told to the session's task record
aterm-verify, aterm-ctl: merge follow-ups for spec\_of and the ls help order
done-check model: the open-items challenge goes ahead of the back-off
aterm tests: the live worker record reads task\_state=; drive's own client is dialled by phase
aterm-agent, aterm-gui: a worker carries its manager's resolved Claude home and HOME
aterm-uds, aterm-gui: one kernel host-name read; the moved writer's flush under the chosen-flush rule
aterm-agent: main's agy survey dismissal test is back
aterm-gui: the survey reads a non-Claude agent's last rows
aterm-gui: the Windows and Linux test cells: each test-only item carries its callers' cfg
docs, help: drive's tape and replay, OPERATOR.md's live rules, doctor's retired rows, stale lock notes
aterm tests: a hosted run's tape replays offline in a changed world
linux: a hung share is judged non-local, the zone follows a change, and the touched crates' tests run natively on the lane
linux review: one mount-table reader, Windows keeps atpkg's warm, a lane-arm busy test
chore(vendor): bump astream to 03204e3 (+245 proved in digest/cap/broker)
trust floors: aterm-sysprobe 61/289, re-measured after main's volumes module
atpkg: the seat test lets the first session's last GET end before it goes
aterm-gui: the meta writer's change is MetaChange::written\_by, not of
session log 3B: fix the review's twenty findings as classes
session log 3B: every vendor turn's steps follow its Prompt
session log 3B: a running turn the bind did not read is no new one
session log 3B: say what brief, the classifier and the sizes do now
aterm-link: the sealed feature seals on ring; the RustCrypto AEAD tree leaves the lock
trust floors: astream-aead 413/476 on ring with a first-party HChaCha20
aterm tests: a worker's stand-in claude leads its login shell's PATH, past path\_helper
aterm-gui tests: the geometry rig takes a turn's momentum read before it reads the lease
aterm-phase: an unnumbered option is its whole label, wrapped or described
aterm-phase: an answer kept for good is read from its rows, never from the join alone
aterm-phase: two DERIVED frames with the first MCP option off the screen
aterm-phase: a half-drawn block's last rows keep a kept answer's first words
aterm-agent: a box drawn as one row has no anchor, not a panic
aterm-phase: a DERIVED two-server frame pins that the widest row proves no wrap
aterm-phase, aterm-agent: say only what the narrow-pane reader does, and pin the Chrome offer's Not now
aterm-phase SPECS: a label above takes in a kept answer's first row only where the two spell a kept answer or its first words
aterm-phase: join an unnumbered label at either edge it may be drawn to
aterm-agent tests: drop two helpers main left with no caller; format the join
aterm-phase docs: say the unnumbered join rule the right way round; name the kept answers; count SPECS truly
aterm-phase: six captures of the MCP server dialog at 21 to 34 columns
aterm-phase: under a full label row, the next row has one cell less
aterm-phase: an option opening lowercase under another reads no role
aterm-phase, aterm-agent: the no-capital rule only takes roles away, and tests what the join tests
aterm-phase, aterm-agent: the no-capital rule keeps every standing role, and no yes is taken by its label where it fires
aterm-agent, aterm-phase: the yes test holds the box … took by its label; its history said true
chore(vendor): bump astream to 546fdc3 (+741 proved, -37 unknown in wire/broker)
aterm-agent tests: the gap tests call dismissing() and auto(max) as main now spells them
aterm-gui: a demo terminal scene for the Themes page
aterm-gui: preview community pack themes without writing a file
native semantics: list box and list box option roles
aterm-gui: Settings \> Themes becomes a chooser beside a live demo
aterm-gui: the theme slab fits its hues, and a narrow Yours row keeps its name
aterm-gui: an elided label ends on its last word
aterm-gui: the Themes demo opens on its settled frame and fills its window
aterm-gui: the Customize sheet shows the colours it overrides
aterm-gui: the Themes chooser keeps one edge for its words and its footer on its floor
aterm-gui: the Themes no-match line starts on the name column
aterm-gui: a font candidate seals its cascade and keeps the bundled symbol face
aterm-gui: act scrolls an off-screen Settings row into view before pressing it
aterm-gui: the Themes strip keeps its name on the buttons' line in every state
aterm-gui: the palette editor's buttons say Close and Reset colour in their names
aterm-gui: keys on the Themes Community disclosure move the highlight
aterm-gui: the Themes chooser's words start where its buttons' labels do
aterm-gui: the Customize sheet keeps the chooser's 32pt rhythm
aterm-gui: the Themes chooser's names wear the primary ink
aterm-gui: one ✓ in the Themes chooser while the theme follows the system
aterm-gui: the Themes filter clears from a ✕ at its own end
aterm-gui: every theme the Themes list holds is in the tree
aterm-gui: a listed row the list's edge cuts away whole stays in the tree
aterm-gui: the Customize sheet's colour fields keep one edge while it scrolls
aterm-gui: trying away from a typography theme counts the type Keep drops
aterm-gui: a save's select announces the saved theme, and arrows keep the highlight's row
aterm-gui: Return in the Themes filter keeps only a trial the filter lists
aterm-gui: the community pack stands in only for a name the themes folder lacks
aterm-gui: a Themes option is the list box's child and the row's only node
aterm-gui, aterm-a11y: a Themes row off its screen is listed, not showing, and owns no point
aterm-gui: Keep from the keyboard lands on the kept row
aterm-gui: the Themes list is one Tab stop
aterm-gui: the Themes demo draws its settled frame when it comes to rest
aterm-gui: a theme-demo tick repaints only the demo grid
aterm-gui: showcase tests check structure, not retired keys or wording
aterm-gui SPECS: the theme rows describe the chooser, not the gallery
Theme docs describe the chooser: list, live demo, strip, Community
aterm-gui: Themes comments name the chooser, rows and demo
aterm-gui: RevealControl exists where a reader can send it; tippy clean
aterm tests: a stand-in is what the tab's login shell runs, or the boot is COULD NOT RUN
aterm tests: the pin's probe fails red when the pin breaks, not COULD NOT RUN
aterm tests: boot\_with's pin and guard replace stand\_ins\_lead\_login\_path
aterm tests: standin\_path's environ hands its launch pairs, naming no Command
chore(windows): Windows clippy is clean in the campaign's code; its files are rustfmt-clean
colour: blue text 4.5:1 on Windows again, One Dark green/yellow/cyan, theme ink on a flip, faint as an alpha blend
kitty: an image placed with both c= and r= fills its box
render(windows): Claude Code's spinner frames are drawn from the cell, solid and even
colour: faint text recedes as an alpha blend on Windows only; macOS and Linux keep theirs
Fix forward main's lint and format reds
chore(vendor): bump astream to b38060d (+79 proved, -4 unknown in digest/cap/broker)
agy: a relaunch-on-exit and restore lane (no live upgrade)
agy-relaunch: the agy lane, live; the relaunch checks' shared reads
agy lane review: lockless openers, a stopped relaunch, the restart's predicate, remedies that run
agy lane re-review: stop statuses by libc in tests, fish keeps the restart, the new paths tested
agy restart predicate: ask the relaunch's worst line by dialect, heal included
agy lane: the Muse lane's final carry shapes, tested for agy; its fence over agy's own work
Gemini CLI: a relaunch-on-exit and restore lane (no live upgrade)
Gemini CLI lane: the live lab gemini-relaunch check, its design notes and changelog
aterm-agent: a tab's own agy keeps its snapshot and is relaunched by nothing
Gemini CLI lane: the review's fixes (a switch a summary hides, a late header, an unwitnessed relaunch)
lab agy-relaunch: phase 6 kills the agy resumed by hand once the journal names it
Gemini CLI lane tests: tell's remedy and the unwitnessed relaunch's record
aterm-agent tests: the witness test holds a tab's own agy's two snapshot guards
trust floors: raise nine rows to what the sessions-as-subagents landing proves
aterm-gui: the disk board's first reading runs beside the host's start, not on it
verify(durable, release): add Flush codecs (+109 proved) and ratchet floors for astream-effects/sys/term + aterm-durable
aterm-gui: the title mark fingerprints the title as the tab shows it
aterm-gui: the carry's observed tokens take their caller's Unix gate
aterm-gui: the meta arm's test door builds wherever the arm does
aterm-gui: a tab from a held pane, and a parked spare asked for another folder, adopt the warm spare
aterm-gui: a retargeted spare is judged in the factory's folder and never lands on a share
atpkg: a fresh install guesses its first discovery round from the run its release cut saw, and the first-round link probe is counted in curl processes
atpkg: a discovery hint at or below the store's floor is no hint
colour: on Windows a label on a lighter cell takes the theme's ink, not a mud grey
colour: on Windows bright green, yellow, magenta and cyan are their normals, lighter
render(windows): Claude Code's ✶ is a six-pointed star, and from 200% the font's own spinner frames stay
atpkg: the link-probe process test reads the held-down request's error class, not curl's words
aterm-gui: the retarget's pure rule is compiled where a retarget can run
aterm-gui: the attention sentinel is a plain command, not an auth header
sysprobe, survey: test paths and branch names use a made-up user
verify(bits, buffer, cap, digest, observe): raise 5 foundational floors past 100+ proved (+607 proved) and bump vendor/astream to 6f46ff2
sysprobe: the /private test path names no Claude Code scratch dir
aterm-gui: the two red unit tests find their own fixtures, and a relaunch test awaits the note it reads
aterm-update install\_sh: the hang detector times the source, each step and each tag, never a corpus
aterm-gui: the sibling-dial test says why its two pids are free
aterm-uds test\_binary: the root's housekeeping is compiled in debug builds only, so a release build of aterm-uds has no dead code
aterm-gui: one proof stand-in for every test that proves a claim, so the session log's new test reads no \~/.codex
primer: the session log's reading contract in the two skills (5A-1)
aterm-types, aterm-cli: ctl help log says what the log keeps now (5A-2)
aterm-slog: the .seq replay corpus and its runner (5B-1)
aterm-gui, aterm-agent: the corpus's screens and transcript slices are what the real readers read (5B-2)
aterm-slog: the hand sequences in the corpus (5B-3)
aterm-gui: goldens for timeline, events and exits (5B-5)
aterm-gui: where the old stores and the log overlap, they agree (5B-6)
aterm: mail dir=in end to end through a bridge (5B-7)
primer: fold the step-kind check into its match guard (5A-1 follow-up)
aterm-gui, aterm: the design anchors 5B-6 and 5B-7 cite, as T20 corrects them
aterm-slog: the task kind and its words (5C-1)
aterm-gui: codex-alab's acts are act marks (5C-2)
aterm-gui: a worker's task moves are task marks (5C-3)
aterm-gui: the overlap table names its exact pairs (5C-4)
aterm-slog, aterm-models-session, aterm-gui: an approval step closes by the input bound to it
aterm-gui, aterm-types: key and send take act=, checked before a byte
aterm-agent: the harness says what its key means
aterm-gui: a person's first input after delivered mail is a human mark
aterm-slog, aterm-models-session: the heuristic mail -\> turn link, in the fold, with a law
aterm: the live fence test reads the engine's act= word (5D-3 follow-up)
aterm-gui: InputAct's constructor takes a name the lock census can tell apart (5D-2 follow-up)
aterm-slog, aterm-models-session: a person's key takes the lead; an orphaned act is named; at applies to an expect; a carried link stays heuristic
aterm-agent, aterm-slog: the real-row corpus replays as the real reader hands it on (5B-2)
aterm-gui: the wire goldens write every row through its production writer (5B-5)
aterm-gui: harness-act is a named difference for its holder, not an exact pair (5B-6, 5C-4)
aterm, aterm-gui: B7 asserts presence; its negative control is in process (5B-7)
aterm-gui: a person's count is delivered once, and only a gesture that reached the program dismisses or answers (5D-1, 5D-4)
aterm-gui: acted input marks spend their author's mark tokens (5D-2)
aterm-slog, aterm-gui: an acted mark's dropped= count is its own bucket's (5D-2)
aterm-gui, aterm-slog, aterm-core: one person's gesture, one mark; a gesture that reached no program answers no mail (5D-1, 5D-4)
aterm-gui, aterm-core, aterm-slog: a wheel the seam swallows reaches no program; a new slot says no other's count (5D-1, 5D-2, 5D-4)
aterm-types, aterm-cli, aterm-gui: ctl help says what the input and human marks carry; Phase 5's user-facing notes (5A-2, 5D-2, 5D-4, 5C-2)
colour: on Windows each bright stands 1.5:1 above its normal, so Yellow and DarkYellow are two colours
needs S1: the need words and a typed attention kind
needs S2: one need classifier, published once on the session's timeline
needs S3: the task wake and a coalesced menu-bar glance
needs: the wall classifier takes the agent it reads, with no expect
needs S1-S2 fix: the outage entry swept, the reset on the wall clock, every entry's move news
needs S3 fix: an operator act meets the election as it stands, and the publication's cost is booked
survey live lane: the need test names its tabs by role and says what pins the clear's wake
needs: a wall another supervisor's live claim retries is that supervisor's
harness: Claude Code's own auto-continue is a wait whatever resume\_limits says
event loop: a need recheck the status sweep stores joins that turn's timer
survey: the row's word and its attention excerpt follow the published need
help and docs: needs= and attention say what the classifier does
fmt: the live suite's module list in trustfmt's order
subscribe: the roster readers' doc keeps EVENT * bye quit on one line
needs: a stall on an identified agent is the stall's need, stopped or frozen
needs: only the supervisor loop's wait, under a live claim, waits a wall out; a hold parks this host's harness too
aterm-agent SPECS: the escalation badge's kind=wait is Claude Code's own continue, whatever resume\_limits says
help, the outage entry and doc comments say what the classifier does
survey live lane: a stalled task and a stopped agent are needs on the wire
presence: the needs border, its pill and the tab marks read the published verdict; the presence row goes (S8)
presence: the in-grid strip carries the needs pill where a window has no titlebar strip (S8)
manual: the choice chime, the band flash and the band toggle are gone (S8)
presence: who drives — the Team chip, the strip marks and the hover's line (S9)
render: compose\_band loses the row above the band, which only the presence row filled (S8)
presence: a tab's need mark wears the border's tone in the in-grid strip (S8)
presence: a tab's own indicator is a quiet note, never a need mark (S8 fix)
presence: a pill's age moves nothing but the pill (S8 fix)
presence: the pill names a session as its strip does and lands on its pane (S8 fix)
presence: a done task is seen only where someone looks; a hold is said on the hover (S8/S9 fix)
cleanup: the deleted presence row's last names; the S8/S9 Built notes say what was built (S8 fix)
presence: which done the owner saw crosses a seamless update (S8 fix)
presence: the pill's Restart is a frozen program's, and its clicks land in the window clicked (S8 fix)
presence: a pill's age tick on glass re-presents no frame (S8 fix)
presence: the tab's own note is a dash, never the done dot (S8 fix)
presence: the Team chip promises only the clicks it performs (S9 fix)
cleanup: docs say the built pill, marks and team; the deleted row's last names go; the catalog cap is measured (S8/S9 fix)
presence: the pill speaks no age, shows its sentence on hover, and resumes a stopped job (S8 fix)
presence: the pill's wake is one App method a boundary test drives; the source count goes (S8 fix)
presence: a done is seen in every pane on show and the real park carries it; the chip and a rename land where they should (S8/S9 fix)
presence: the retired Presence Band row fails closed in the palette and on invoke (S8 fix)
cleanup: comments and docs say the built border, pill and marks; the Built notes record this round (S8/S9 fix)
person hold: Take Over / Hand Back on a slot no socket can name (design S5)
overview: the Connection Map becomes the Overview of every session (design S6)
overview: Stop Worker re-reads the task when it acts (design S6)
agents menu: the Fabric menu becomes Agents, with its tab-menu and palette rows (design S7, S12 menu side)
person hold: a control client cannot stop a held tab's worker or open a card under a hold (design S5, S6)
person hold: the long-hold entry is stated at the first look and the resume settle (design S5)
agents menu, tab menus, overview: read the sessions where they change, not on every wait, tab or frame (design S6, S7)
overview, agents: the card names this aterm, the retired band names its off switch, stale words go (design S6, S7, S12)
stop worker: a control client's refusal reaches no glass, and only the hand that armed a stop confirms it (design S6, S7)
person hold: the long hold counts on the wall clock and walks the holds only where they can have moved (design S5)
person hold: fabric off, its remedies and the agents' halt words name the person's slot (design S5, scenario 8)
overview, conn card: SPECS name the code that stands; the card's menu origin and stale words go (design S6, S12)
agents rows: a tab is named as the strip names it (design S6, S7, §3)
stop worker: a tab with only its shell in front is refused, not "stopped" (design S6, S7)
stop worker: a control client's tab-menu Stop is the signal verb's act, with no card (design S7, §1)
overview: the card says what t and ⌫ do for the person reading it, and counts held workers (design S6)
agents menu: Hand Back's tip says only the person's hold lifts; the live-bits slot exists only with a native menu (design S5, S7)
person hold: hwkey cannot press a card's rows, and a script's tab-menu chord opens none under a hold (design S5)
connected spawn: no menu caller is left, so its surface and the menu's first-use notice go (design S12)
person hold: a standing long hold's entry says its refusals, manager and other holds as they move (design S5)
person hold: a crash is not a Hand Back, and an update restarts the 30 minutes, said where they are read (design S5)
status item: the local glance replaces the operator glance (S4)
desktop notices default on, needs only (S4)
SPECS and comments follow the S4 status item
status item: the held section states the app-verb halt (S4)
status item: the fleet glance (S10)
status item: an open menu's clicks resolve against the glance it was painted from
fleet glance: dial a peer by the name the book knows it by
fleet glance: a standing need is one notice across a stale read or a silent Mac
status item: a sibling's needs count only from a young scan, on a cadence
status item: the red title keeps the bar's font; review minors
status item: Notify Me says whose banner a notice arrives as
status item: a read it opens raises its window
desktop notices default on only where the banner is aterm's own
status item: a seamless update carries what the owner was told and has seen
status item: the review's minors — order, labels, ages, the issuer line, docs
comment: the notice switch's boot line reads as one sentence
status item: the Linux and Windows cells build again
status item: Go and a raise land on the needy pane, not beside it
desktop notices: on by default, needs only, as the lead ruled
status item: a carried told need is adopted by its word, not its kind
fleet glance: a content peer's need says what it is; a freeze dates only an agent
fleet glance: a seamless update carries the fleet needs the herald told
status item: a To look at line raises the window it opens Messages in
status item: the hold line names sudo's password sheet; two doc fixes
fleet: the issuer serves its book of peers, so a member's survey --fleet reads the whole fleet
fleet live lane: a member's survey --fleet reaches a member only the issuer's book names
fleet book: the copy in a file of its own, members read before the issuer's survey, only the issuer's refusal counts
fleet live lane: the book over the real listeners, and the copy in its own file
fleet book: a test for the deadline of its own past the first AT\_ONCE dials
fleet book: the issuer is surveyed where its book answered, a book the deadline cut short is its row, and a member never reads itself
fleet peers: a person's \[\[fleet.peers\]\] entry stands for a copy at its place, and the survey's closing line is tested
aterm ctl survey: the read is a pure read\_survey, and the fleet client's closing line is tested
fleet live lane: the book's member is read at the longest --timeout, apart from the silent port
fleet issuer: a lost node id names the remedy that works, on the issuer
fleet book: the issuer is surveyed where a failed book proved itself, and the seat's rule has no clock
fleet read: the line short of the issuer's book says whether a copy was read
fleet tests: leave's removal of the issuer-book copy is checked on a member that holds one
fleet live lane: the book's reach is read in process under the hang detector, and the CLI read's budget is stated
team: a manager's workers are listed in the order they were made
owner surfaces: the fold's last cross-track stubs are wired, each with a test
menu: a test binary keeps each published menu bit per thread; MENU\_STATICS goes
cleanup: the retired band and operator election leave docs and samples; an unconfirmed needs-switch save fits the title rule
owner surfaces S12: the connection card and the drag-to-connect gesture go
owner surfaces S13: teach the needs, Take Over and the opt-in; one CHANGELOG entry per change
status item: Hand Back All builds for its test off macOS too
SPECS: the herald row says what a notice with alerts off does, not a ⚠ title
owner surfaces: the You hold row says what the hold refused; one cost sentence
owner surfaces: one name for a local session on every surface
owner surfaces: Next That Needs You walks the needs in ❯'s order
owner surfaces: the Overview's title counts another aterm's sessions
owner surfaces: a stall's need says the person's words, not an agent's command
owner surfaces: a press on a tab's marks selects the tab
owner surfaces: say notices are off until Notify Me, and drop deleted surfaces from comments
aterm-gui: the merge's two crossed intents meet in one body
aterm-gui: the linux-arm cell compiles clean with the status item and Team chip
aterm-gui: the Team chip's manager mark passes as itself (tippy)
aterm-gui: the needs border keeps a test of the idle law
presence: a background codex that finished its turn wears the tab's done dot
aterm-gui-fabric: the Autopilot menu does not open under a hold
aterm-gui: the Team chip is a node of the accessibility tree
aterm-gui: the Agents namer keeps the person's title whole
aterm-gui: controls overview says task\_state= for the worker's task
aterm-gui: main's test prunes and dead-code deletions stand
aterm-gui: set\_tab\_strip\_rows' StripRise anchor takes main's form
presence: a tab named only by its number is named once on the pill
messages: the API outage's count is shown as tabs join it
aterm-gui: a worker's line follows its starter's terminal before the sweep names it
aterm-gui: Hand Back lifts a client's hold where no person's stands
aterm-gui: a need's words say what to do when its pill offers no act
aterm-gui: the operator family and the band's doc comments go
render(windows): Claude Code's spinner keeps one weight at 200%, its ✻ untouched
aterm-pty: a spawned shell runs in the UI tier, not the squashed legacy band
aterm-gui: a tab's fork waits for the park at the fork; the spare gate counts no orphan an older launcher left
aterm-update: the stage holds its start probe at the exec while the gate runs
aterm-uds: a child started stopped dies unrun with its holder, SIGHUP at its default
aterm-update: a refused stage kills its held probe before it removes the bundle
aterm-uds: start\_suspended says the first-exec assessment runs while the child is stopped
aterm-uds: the control-dir test expects a Linux desktop's own runtime folder as the person's
Muse Code gets the live upgrade's quiet flow
lab muse-upgrade: resolve the swapped current link, report the held looks
Muse quiet upgrade: the review's fixes, each guard pinned by a test
Muse quiet upgrade: the final live run on the merged code, and a comment reflowed
Muse quiet upgrade: the activation wake's per-agent wiring and a new worker's count, each pinned by a test
aterm-gui: the spare gate reads the shell's pid version the moment its spawn returns
aterm tests: L7's spare checks print the metrics line with them
aterm-gui: the shell-version read says how far ahead of the rc it is
trust: raise 6 foundational crates past 100+ proved (+692 proved) & sync astream 532fbeb
aterm: cold start — the session-0 spawn's kit, the word lexicon and the script address leave the boot's path; chained fixups
aterm-shell-integration SPECS: the address's hash half is FNV-1a/64 now
aterm build.rs: the Windows banner's doc comment goes back on report
aterm-gui: session 0's provision is made ahead on an update relaunch that withholds -e
aterm: the start-up entry quotes both measurement runs; shell\_body names the folder hash
aterm-shell-integration: a running command's title is its whole line, and the tab end-cuts a title the shell cut
aterm-shell-integration: bash repairs the tty after a command that ran a second, whatever its status
LAG-9: fish's start record costs nothing measurable (sweep #11)
aterm-shell-integration: the fish script says it needs fish 3.4, as it does
aterm-shell-integration: a live test shell let go of is killed and reaped
atpkg: a waiting pending stub wakes on Linux (inotify) and Windows (change notification)
aterm-render on the Linux lane: the emoji gate poses its case, and the suite is green
Raise Trust floors past 100 proved on 8 crates and sync vendor/astream (983a836)
aterm-render: vf\_bold\_gid\_raster's doc names its Linux caller
atpkg: a waiting stub takes its inotify watches off before it execs or exits
Keep saved DEBUG traps until their owning session discards them
trust: raise 9 more crate floors above 100 proved obligations (+1149 proved)
Release shader warm waiters when either lane fails
Keep Fish on visible cold startup until all startup files are tracked
Refuse oversized complete fleet replies before parsing success
Require a written restart claim before signaling Muse
aterm-gui: the tray's East Asian face store is CJK\_STORE, so the lazy-init census sees no self-reentry
Fence worker startup input against the live prompt and person takeover
Bound outstanding fleet resolver work across the process
Keep worker task-file cancellation sticky across the spawner
trust: raise 10 more crate floors above 100 proved obligations (+1134 proved)
aterm-gui: the spare backstop classifies WorkerLaunch, so aterm-gui builds again
Order tab-input replay by its fresh booking identity
Bound CLI child output collection after direct-child exit
Return from interrupted child polls once their deadline expires
trust: raise 10 more crate floors above 100 proved obligations (+1057 proved)
aterm-gui tests on Linux: six reds on the lane pass, each for the platform reason it failed
fabric: \[fabric\] command may be an argv array, so the dev app's spaced path runs the bus
fabric: on never writes an argv array; a spaced aterm path runs through a link in the root
find: keep cell geometry when routed advances break bounded scans
windows control auth: the owner check is proved across an elevation on SDDL descriptors, with no UAC
aterm tests: the survey's stopped-agent leg runs where aterm can read queued input
gui,machines: discover Bonjour LAN computers in Tab Control Panel and aterm machines tabs
Sync vendor/astream (8603b58) and eliminate 34 unproved obligations (+388 proved) across 11 crates
aterm-gui: the story overlap test tells main's one told word (land, 5B-6, T17)
aterm-gui: a task mark's log wake posts no need verdict (land, 5C-3, T21)
aterm-gui-timing, aterm-observe: the proved byte helpers expect clippy's argument count (land)
aterm-cli, aterm-gui: aterm help says where a self-claim act mark lands (land, 5C-2, T24, T38)
aterm-gui: the help test checks the limiter's numbers, not its sentences (land, 5A-2, T38)
aterm-gui: a test guards the task mark's split of waiter wake and need verdict (land, 5C-3, T21)
aterm-census: slog-inert names the PTY writers' twins and fails on a dead needle (land; phase 3A ruling R5, design §7.4)
aterm-census: pin slog-inert's dead-needle check skipping \*\_tests.rs files (land; phase 3A ruling R5, design §7.4)
machines: the LAN daemon answers a beacon and nothing else; launchd no longer loops on it
machines: no LAN daemon; follow a moved IP to its .local name, retire the old LaunchAgent
aterm-window: recorded.rs as its crate's rustfmt.toml formats it
machines: retiring the old LaunchAgent takes only what the job made, and starts nothing
trust: bump vendor/astream and eliminate 60 unproved obligations across 9 crates (+96 proved)
docs+test(supervise): a transcript limit row that names no reset holds the host's steps until the conversation moves (ATERM-KI-1016-1 limits-2)
docs+test(supervise): a restart's lease refuses the supervisor's limit-menu press too, retried (ATERM-KI-1016-1 limits-4)
docs+test(supervise): a bucket notice nothing dates is read by the fallback's latch alone (ATERM-KI-1016-1 limits-6)
docs+test(manual): a person's prompt moves a limit row's hold only once the model answers it (ATERM-KI-1016-1 limits-2)
turn end: a draft over a menu the screen cannot read is told once, never pressed (screens-2)
approval: the Edit tool's own box is the levels' where the screen and the transcript both name its call (screens-3)
box head: a box taller than the pane is held, the owner told, wherever its head is not read whole within 400 rows (screens-1)
approval: the Edit tool's box is its message's queued run's top, past the agent's text (screens-3 review)
manual: the boxes paragraph's tall-box sentence rewrapped to the page (screens-1 review)
decide(harness): an agent the upgrade ended is said down in a tab Off set aside (lifecycle-1)
decide(harness): a driver's writes under its lease are no person's keys; what it left holds the line (lifecycle-2, LC-7)
decide(restore): a held tab reopens held, its agent the holder's; a lift no image carries comes back (lifecycle-3, LC-8)
manual: two lines the done and limits lanes added rewrapped to their paragraphs' width
aterm-gui: session 0's shell is forked before the event loop is built
aterm-shell-integration: the script folder is named with FxHasher, not FNV-1a/64
aterm-gui: session\_log's attribution tests are unix tests, as their handles are
aterm-update-core: a silently dead download is given up in \~14 s and continued in-call
aterm-update-core: a link that keeps moving is continued past sixteen hiccups; bytes already at download\_to's dest are never continued
aterm-update-core: a resumable attempt probes an idle connection every 2 s, not 5
atpkg: a release row naming the dmg lane is refused as an https one is
atpkg: the dmg lane's post-copy vet refusal is tested through the stage
aterm-agent: a probe run counts a hundred steps, not three hundred
LAG-11 review: say why the script folder may persist an FxHasher name, and quote the idle band
LAG-12: no work interval for the idle slow clock (warm-spare design D6)
spare: fish tabs get their warm spare back over the startup roots fish reports (R7)
spare: the generation stamps path\_helper's PATH list and fish's themes folder
vendor(astream): advance submodule to 72a46fb (+702 proved / -74 unknown in astream, unlock BrokerLog on drop)
LAG-12: D6 carries the four-round result: the interval made the shell's first prompt later
LAG-12 review: D6 measured in aterm.app's own coalition too
aterm-gui: a stream that stalls under a frame keeps its output holds
aterm-gui: say why a stream's quiet window is one frame, and whose 0.38 ms
grid: a shrink under owed pushed rows pushes the blank row a push left, never trims it (S2R-F4 corner b)
grid: a width change lays the rows out where the hand-back puts them (S2R-F4 corner a)
cast drift: each recording replays under the resize law its header names (S2R-F4 corner c)
aterm-slog: the instance's node log (5J-1)
aterm-gui, aterm-gui-fabric: start, link and config records (5J-2)
aterm-gui, aterm-types: log n reads the node log (5J-3)
aterm-gui: await log takes a list of predicates (5F-1)
aterm-agent, aterm-gui: the hosted lanes say they relaunched (5F-2)
aterm-slog: a turn's close restates its ledger= (5F-4a)
aterm-agent: drive ledger --source log, beside the old path (5F-4)
aterm-ctl: survey --brief, the local brief (5F-6)
aterm-ctl: the survey walk dials one instance at a time (5F-6)
aterm-lab: lab reduce, a key-only reducer (5H-1)
aterm-agent: measured builds are a committed set (5H-2a)
aterm-agent: a lab-read reduction makes its build exact (5H-2b)
aterm-gui: the transcript apply's hold is a metric (5H-3)
aterm-gui: a read with no new rows books its one hold (5H-3)
aterm-lab: format the reducer's dead-code expectation (5H-1)
aterm-ctl: a since-less await log list is asked again only when all need (5F-1)
aterm-ctl: survey --brief briefs an instance that refuses log n (5F-6)
aterm-agent: drive ledger --source log names a turn no exchange opened (5F-4)
aterm-lab: lab reduce keeps no key or stamp tail anyone wrote (5H-1)
aterm-lab: lab reduce frees every place a tool's names sit (5H-1)
aterm-lab: lab reduce frees a call's second input copy and every tool schema (5H-1)
aterm-core SPECS: the flap identity holds through the bottom-push and rewrap corners
cast drift: name the law test's corner tuple (tippy type\_complexity)
shell-integration: an in-place upgrade takes off the old \~/.aterm/bin entry
codesign: a dangling symlink and a later-line fault stay verdicts
update: codesign's own progress lines and a quoted refusal key never make a verdict pass (r8 #37, review)
aterm-update: no decision reads floor/failed/quarantine ledgers permissively
update: judge the appcast sig after the roster observation; one filing per stage state across the park
update: a codesign refusal is a moment only on the verified path's own line; ditto's words are quoted (r8 #37, third review)
update: gates read quarantine records strictly; codesign never waits on a FIFO; test the yank and authority call sites
trust: raise aterm-agent's floor to 4509/25102 and correct aterm-cli's total to 1005
aterm-gui: Settings' rail grows to its widest name in the face it is drawn in
aterm-gui: crash-journal tests date their panic reports after the run armed
Linux lane: web2, the worktree's git, Trust's absence and Rosetta's limits decided
aterm-objc tests: the SDK declaration parser passes over a pub const fn
aterm-gui: the rail test judges 1.25x, where full names overran it first
vendor(astream): bump to 4db9781 (+229 proved / -194 unknown obligations in astream-broker)
resize hand-back: a line's head comes onto the screen before a width change; pushes cut seams, never splice
resize hand-back: the window's top is a cell, so a zoom flap over a line the screen's top cuts comes back
update: the day-long digest line names no platform (ATERM-KI-1015-2)
manual: Linux update checks wait while a build is on trial, as the product's rule (ATERM-KI-1015-2)
input: an xkb chord under Caps Lock takes Shift's capital (ATERM-KI-1015-9, the X11/Wayland case)
style(gui): trustfmt the xkb chord test and the fork-lane descriptor test
The parent installs an update before LaunchServices launches its successor, so that successor never re-execs
Review fixes for the parent-swaps-first handoff: withdraw a dead successor's stale-record entry, and correct the lane prose
A fresh window ends the stale-record entry, and the last premises say who swaps
Every window measures its own LaunchServices record and says when it is stale
spec(gui): mh-health-latch-heal names the queued owed row's patience restart (ATERM-KI-1015-2, U37 review)
aterm-gui: the toolbar drive's state count is the groups' own
aterm-gui: objc\_ime\_drive's Option-as-Alt stage gets a control that composes
aterm-gui: the toolbar drive reads a click made without activation as not measured
aterm-verify: the objc exit contract names both weaker passes and the toolbar's activation 2
aterm-gui: objc\_ime\_drive judges only the key it sends
aterm-window: replace\_event's doc cites the dead-key measurement
primer: drop ATERM-TASK-DONE from the CLAUDE.md/AGENTS.md section (v28)
harness card: a cuter kitty, and the rainbow meets its haunch
harness card: the border stands in the card's air
claude\_footer: read a new Claude Code's registry row on a 100 ms ladder, so the harness card is decorated at load
harness card: the resolver's pass is tested as run calls it, the two-row kitty's mouth stands on its chin, and the docs say what was measured
claude\_card: the air comment names agy's four-row card
aterm-gui: main builds again after …
aterm-core, aterm-render, aterm-gpu: tippy passes again after …
aterm-lab, aterm-agent: the lab's Codex 0.163.0 rollouts, reduced (5G lab run; T9, T33)
aterm-phase: Codex's rollout keys, from a committed rollout (5G-1; T9)
aterm-agent: a Codex rollout step fold (5G-2; T9, T33, S6)
A macOS window launch keeps its image and leaves a ready update for its own window
Window launch keeps its image: press-only never escapes, one boot router, waits said true
Window launch keeps its image: the bar waits for a terminal too, recheck fixes
Recheck lab instance custody after crash preparation waits
Preserve post-shell PATH directories with backdated modification times
aterm-gui: the warm spare on Linux, both tiers, with a /proc escape scan
aterm-gui: the Linux scan's tick rate reads c\_ulong as the codebase does on LP64
aterm-gui: the Linux scan declares getauxval itself, so x86\_64 Linux builds
aterm\_suite: the turn-submit stand-in draws its draft when the Enter comes with it
aterm-gui: the Linux scan judges a live thread group whose leader exited, and a parked spawn looks for the system files again
aterm-gui: rewrap the /proc stat parser's doc comment
Share the argv0 alias list and deny the amacs editor hint per hop
Name build.ps1's prose alias lists and drop a repeated EDITOR assert
Harden account source curl configuration and protocols
Preserve unknown Linux proc reads before warm promotion

_Truncated to fit GitHub's release-body limit — the complete note is release-notes/v0.107.0.md in this release's source tree._

v0.106.02026-10-18

aterm v0.106.0

2026-10-18 · 2388 changes since v0.105.0

Features

windows: the macOS readline keys at the PowerShell prompt
gui: Alt+arrows reach the program without a pane that way; palette readline keys
windows: Iosevka Term Semibold at 17 px on a 1.1 line is the default face
harness: one reading folds today and 7 days, with a tally per session (§10.3, slice 2a)
harness: Settings ▸ Harness per session — today in STATUS, a day and Show per row, the pane named (§10.3, slice 2b)
autopilot: under Cruise the chip says when the work is done (§10.2, slice 1b)
autopilot: one voice, one clock — face clocks name their day, AgentOff, the records (§10.2, slice 1c)
harness card: the kitty rides in (design §10.6, slice 5b)

Fixes

root-cause fixes across font autohinting, ligature shaping, overlay scrubbing, and AI review
forge: measure shipped browser roots independently
clear imported test lint and narrow compaction claims
release: require cancellable keeper connections
agent: report skipped Codex usage records as partial
render: admit sealed font mappings only on macOS
aterm-agent: drop an unused mut that turned main's lint red (…)
revoke dead sources on retained session logs
slog: preserve legal pinned carries and Host serialization
gui: retire Claude light presentation on Codex chips
effects: scope owed erase admission to Rainbow Kitty
gui: preserve validated handoff resume lines in initial publication
gui: retain revocable authority across session retirement
redistribute log memory around retained minimums
gui: share live chip admission and rename settlement with readers
gui: remove unused accessibility projection imports
harness: require a measurement before releasing disk holds
atpkg: record staged cache removals before deleting bytes
slog: retain autocompact prompts in the wire vocabulary
slog: reconcile parallel autocompact vocabulary repairs
harness: require a person count before autocompact keys
harness: construct escalation in its existing public form
supervise: require elapsed eligible idle observations before memory restart
agent: require generation and person proof for option-choosing digits
link: close owned subscriptions when Bridge drops
supervise: enumerate programs for the focus person fence
gui: keep unknown spare gate state cold and preserve staging entries
relaunch: LC-2..LC-7 and LC-9 of ATERM-KI-1015-1 — the restart offers what its relaunch carries, a crash moves only onto a proved build, a person's restarts are no crashes, a held upgrade carry is waited out
relaunch: LC-4 measured live — the relaunch's mark has its own attention owner and is whole or none
relaunch: tippy — told\_home answers a ToldHome, and the loop's attention owner is the tests' name only
relaunch: a relaunch mark no ask of this host's keeps is unset as an agent runs
relaunch: carried\_through\_hand matches the agent exhaustively, and leaves seen\_gone its doc
relaunch: a failing relaunch's mark ends with its trying, and names no command where running it here is no remedy
upgrade-status: a tab's leader answers only a fresh restart's agent-down row, and is read only for it
build-start: a crash's probe holds the upgrade only by what it found failing; LC-7's renewal tested
gui: refuse incomplete spare scans and missing shell posture
site: preserve immutable assets and atomically publish the engine
ai: refuse unproven inherited review permissions
windows: aterm-gui compiles for Windows again — two cfg(windows) paths missed today's moves
windows: Ctrl+H deletes one character behind ConPTY, not a word
core: defer journal cuts that would swallow parser state
agent: bind inherited Codex permissions to the observed process birth
retain required-feature lint for versioned package selections
record vendor choices without overwriting existing files
report errors restoring kept ALab commands
base reds: census items after its test module; forge and png drop pinned counts
sink: a guarded write the kernel takes in part is delivered whole
harness: the rate-limit nudge is decided on Codex's records read at the box
harness: a Codex text drawn as its paste placeholder is submitted
phase: a Codex draft over the warnings indicator is still the composer
harness: the Codex switch puts back a thread that ran its model's default effort
harness: the paste-placeholder read-back names every program in one match
harness: no carry-on typed into a task done under Land after a restart
harness: a reply a wall cut never said done; a Codex is adopted once
autopilot: the chip's title offers its menu, and the open menu is in the accessibility tree
autopilot-menu: a reader's click names the rows it heard; the chip's node opens the menu
autopilot: the hovered title gives up its trail, then its menu line, before v1's words
the resident cat sits beside Codex's chips (D4); a quiet desktop wakes nothing it does not need (D5)
the chrome cache keeps no unread stamp; the idle bar names what stays (the harness's per-step look)
the review of … — tests on the shipped paths, menu ages read where shown, a bare commit holds
harness: a done report is respected — the check's own words, done by family, a carry-on's done, a reversible check
harness: an idle report never ends the task at the check; done words read in their clause; a release's answer is a carry-on's
harness: read the status row as its line, the vendor's retry rows whole, and the wait Claude Code carries (SM-3, SM-4, BG-1)
harness: an empty queue and the check's echoed words never end the task at the check; their real work there is progress
harness: a token quoted from a report the worker passed on is not its done
harness: the lane's review findings — the carried wait read on its line and overruled by the transcript, the status row's other readers on their line (SM-3, BG-1)
phase: a box title, the plan question and a held message's label Ink wrapped are read as lines
phase: a rating card whose options Ink wrapped is still the card
harness: Enter must send what the composer shows: no draft is submitted over the slash menu's other entry
phase: a Select row that opens with a capital is never the rest of the label above it
harness: a turn that ended on Claude Code's own error row is never an ordinary idle point
harness: a confirmed API Error the screen cannot name takes the kind its notice is typed as
harness: a /resume'd conversation's old auto-continue ends no armed limit (KI W1, LIM-3)
harness: the transcript names which limit a generic footer does not (KI W3, LIM-4)
harness: a limit only the transcript shows holds the relaunch's carry-on (LIM-1, KI LC-10)
harness: a countdown a relaunched process redraws goes on by nobody (KI W4, LIM-5)
harness: the books' read places a transcript limit only where the screen reads no wall (LIM-1)
harness: a move outlives the relaunch records written over it (LIM-1 review)
harness: the review's minors on the transcript's limit read (LIM-1, LIM-4)
harness: a limit only the transcript names takes its row's type there too
harness: no agent is moved onto a build no probe here proved to start (LC-5)
harness: a relaunch is promised only where its line carries the agent's Claude home (LC-3)
harness: a tab the owner held stays held across a quit or crash, its agent not relaunched (LC-8)
test: the limits lane's standing-limit Snapshot names home\_carried (LC-3's field)
harness: the transcript's limit read keys whom the host answered for (LIM-1 re-review)
phase: a plan approval's label Ink wrapped is its label, so full power never presses auto mode for it
harness: the review of … — an open notice is read until it closes, a stale one names nothing, a 413 that says Run /compact is a full context
harness: a first probe's pass blinds no build and a probe out of time fails none (review of LC-5)
harness: the owner's hold rides its tab's leaf, goes back by the hold's own path, and its end is journaled (review of LC-8)
harness: a carried wait the transcript ended is one point at every read (review F1, XT-1)
harness: a carry-on answered in seconds that says done gets the check (review F2, DOCS-4)
harness: a done phrase beside a wait on the worker's own work is no done word (review F4)
harness: what the harness typed is keyed to the conversation, not the tab (review XREV-LC-1)
harness: every restart looks at what did not come back, and the owner hears of a loss (review XREV-LC-2)
phase: a status glyph a narrow pane wrapped away from its text is the status row (review screen F1)
phase: a status line's join never loses the row's own busy reading (review screen F2)
harness: a retry's wall whose notice a look drew under keeps its rung (review F3)
harness: the host's step reads the point's wall as its decision did (review XT-2)
harness: a moved agent's finish and limit are read where it writes now (review XT-3)
harness: a layout that outlives its agent reads the agent's own record as it is taken (LC-1)
harness: the review's minors on LC-1 — the residual as the code gives it, the ring that a shell-held tab repeats, the handoff carry pinned (review of LC-1)
phase: a multi-select text drawn against its checkbox reads whole (ATERM-KI-1015-1 F2, the reader's half)
harness: a question dialog's memory goes only at a look that reads the composer (ATERM-KI-1015-1 F4, hardened)
harness: an Edit's own box under a Bash rule or hook is the levels' where the agent's transcript proves it (ATERM-KI-1015-1 F1, the over-hold)
harness: a proved call proves one mount of its box, no read where the level presses nothing, and the docs say what holds a file box (review of …)
harness: an agent back in its tab lowers agent-down, whatever conversation it holds (ATERM-KI-1015-1 LC-2)
harness: a tab's upgrade= names its own row — a restart in flight, its live conversation, else its newest record (ATERM-KI-1015-1 LC-9)
harness: the review of LC-2/LC-9 — a move down stays its tab's row, a word lands on the row shown, an answer replaces no other conversation's row
test: LC-1's handoff test's restored-relaunch stub takes the cross-lane review's fourth argument
harness: the crash back-off counts crashes; an exit someone asked for neither climbs nor waits it (LC-6)
harness: a hand on a restart's tab is waited out uncounted and stops its clock, in every carrier (LC-7)
harness: the relaunch carries an agent's own HOME, every told line carries its Claude home, and a Cannot word ends only when its conversation is held again (LC-4)
harness: the review of the relaunch-pacing lane — a lost word ends with its tab and one word per tab, a misses-only crash streak gets a healthy clock, a held line asks after a person's keys (LC-4, LC-6, LC-7)
test: the live upgrade fake answers the build-start probe as Claude Code does, never as an agent launch (LC-5's four live reds)
harness: a done word beside a list line, a stop for a person or once more is the end (review RR-DEC-1)
harness: a repaint of the handed point keeps its decided wall for the host's gate (review RR-DEC-2)
harness: the host's step waits where a retry's wall left the screen, as the policy does (review RR-DEC-3)
phase: a bare status glyph's text laid out as two columns is read column by column (review RR-LC-1)
gui: the line of what a restart lost ends when its tab closes (review RR-LC-2)
harness: a cold restore notes the tab it reopened from whatever it does next (review RR-LC-3)
harness: an earlier tab's loop turns count only until the conversation left it (review RR-LC-4)
harness: the Cloud gateway's sign-in is the lost login, never the server's error retried (review R1)
harness: a limit's wait ends under its notice only in the conversation that holds its row (review R2)
harness: a move hides the limit it left only from an agent under the move's target (review R4)
harness: a restored landing's adopted agent the record says died is relaunched again (review R5)
harness: a relaunch reads a moved agent's finish where it last wrote it (review RR-LC-5)
harness: a stop until your review or until the owner's sign-off is a stop for a person
harness: a done phrase is a done word only as whole words outside code (review RR3-TE-1)
harness: a list its sentence introduces, and a hyphenated noun, stay in the done phrase's sentence (review RR3-TE-3)
harness: a move to the default login is met by an unset login variable under the default home (review RR3-R4-1)
harness: a moved agent's .writes note goes once it names no transcript (review RR3-LC5-CLEAN)
harness: a relaunch into a done report in words asks the done check, never keep going (live lab LIVE-RL-1)
harness: a relaunch the tab's loop resumed first is carried on with nothing (live lab LIVE-RL-2)
harness: a person's own exchange stays theirs past the loop that left it (review RR3-TE-2)
harness: a relaunch after the done check answered with an idle report carries on as the policy would (live lab LIVE-RL-1, follow-up)
harness: a done report that says completed is a done word again
harness: a look at a done tab takes no done report back (review RR4-RL-1)
harness: a done check never answered takes no done report back (review RR4-RL-4)
harness: the upgrade notice's READY takes no done report back (review RR4-RL-2)
harness: a relaunch's done check after an irreversible act says to approve none (review RR4-RL-3)
harness: a restart's carry-on that asks the done check is the check to the record (review RR4-RL-5, record side)
harness: the loop reads the restart's done check as the check (live lab LIVE-RL-3, review RR4-RL-5 live side)
harness: at the done check the record's closed answer overrules a done word drawn from code (review RR4-TE-1)
harness: a person's exchange is left under its answer's key, the transcript's lag read out (review RR4-TE-3)
harness: a person's exchange at a wall stays theirs in a new loop (review RR4-TE-2)
phase: a busy status row takes the rest of a parenthesis it left open
phase: an unticked free-text box drawn with no space reads unticked
phase: a limit quoted under a tool's call names no bucket over the generic footer (merge review F2)
harness: a person's exchange at a wall carries its work into a new loop (merge review F3, MAIN-SURVIVE-1, XR-2)
harness: a left exchange's key is read as far back as the finish, past an idle compaction (merge review XR-1)
restore: the owner's hold is captured beside a fleet hold (LC-8 on main's two-slot Holds)
harness: a limit's end types no keep going into a done report (the act)
harness: a limit's end types no keep going into a done report (the record)
harness: a limit's end types no keep going into a done report under a background shell (D1)
harness: a limit's end types no keep going into a done report, and the done check in its place is the limit's retry (D2)
harness: a limit's end types no keep going into a done report, nor into a question naming an irreversible act (D4)
harness: under Land a limit's end gets Land's own act, not Cruise's done check
restore: a tab the cold drain still owes keeps its own agent and hold through a quit (RV-SURV-1)
restore: a restart inside the cold drain keeps the landed tabs' agents not yet handed (F1)
harness: under Autopilot Land a relaunch's carry-on types nothing of Cruise's (F2)
harness: Land's instruction and nudge are the done check to the record (XM-LAND-RECORD)
harness: a wall's retry delivers the check it cut again, to the record too (M5-R1)
supervise: a carried wait's break reads the owner's Off before the host step (XM-OFF-CARRIED-BREAK)
phase: a retry head that fills its column is still read by its columns (M7-RV-1)
harness: a successor loop works a limit from the act typed in its place, never keep going into it at once
harness: a successor at a model bucket's open wall waits on its reset beside the usage act it takes up (D1)
harness: the limit's try names its limit in the ledger, and a successor works that limit from it (D2)
harness: the limit's try carries the wall's attempts, and a successor resumes on that rung (D3)
harness: an act at a track only a seed made is no limit's try until its limit is read (D4)
harness: the wall a loop's own try meets again is written again for a loop that follows (V2-1)
harness: a limit's try names the entitlement ladder it was on, and a successor's seed stands until that ladder's next rung (V2-2)
png: the corpus test's floor is the 20 PNGs the repository tracks now
harness: a roster read a worker's own step ran through hands no exit
harness: a step that panics is over all the same
supervise: a task the done check ended is journalled as the check's end, not as ATERM-TASK-DONE (F2)
harness: a relaunch's last step is settled where its loop takes a point itself (F1)
harness: a settled relaunch keeps its restore look open for its whole window (F1-V1)
harness: a relaunch's last step a settle missed is settled again by the host, off the loop's points (F1-R2)
harness: a bucket's notice a cancel left answers the loop's own try, as a window's does (V21-1)
harness: a wall that was written has its end written, an act typed since or not (V21-3)
harness: a limit's try names the ladder its decision used: a countdown's is the short one (V22-B)
harness: a limit's try ends with the episode the worker's work ended, for a loop that follows too (V22-A)
harness: the bucket the fallback's relaunch left is no wall of the relaunched session (V21-2)
harness: a try met again is read from the ledger's wall row after it, open or closed since (B-1)
harness: a turn asked on the fallback with no act of the loop's is written for a loop that follows (A1)
harness: a bucket's notice the transcript wrote after the fallback's relaunch is the wall (A2)
harness: a limit's track the policy drops with no work row ends its try for a loop that follows (B5-1)
harness: a wall read inside a try's take window is no try met again where the try is taken (B5-2)
harness: a bucket its rateLimitType named is that bucket when read back from the ledger (B5-3)
harness: the fallback's relaunch is made at its run's first ask, for the policy and the row (A-2, C-S2)
harness: a settle again is its worker's, bounded where it fires and caught on the host; an open task's restore line is never decided off the point (F1-R3)
harness: a relaunch's last step is settled at its loop's own withheld points, with no timer on the host thread (F1-R4-S1, F1-R4-A1)
harness: a tab's act on the GUI host's own thread is caught, its fault that tab's alone (the note behind, the follow, a closed tab's forget)
harness: a wait's first quiet ask is a point's, whenever its host begins wanting one (F1-R5-A1)
harness: a mark's step down that panics on the GUI host thread is that tab's alone (F1-R5-G1)
harness: a wall's ledger row names the kind the loop read, and a loop that follows reads it back (R5-1)
harness: a live turn that takes a wall's retry met inside its take window says so with no memory standing (M7-2)
harness: a try met again is seeded from the wall that met it, its time and its ladder (M7-3, R5-2)
harness: a seed's try whose own turn a successor saw run is answered where that turn ends (R5-2)
harness: a limit's try still inside its take window is awaited by a loop that follows (M7-1)
harness: a restart of another kind begins a run of its own, its first ask its own (R5-3)
harness: a fallback's relaunch in flight when its loop ends is made at its run's first ask for a loop that follows (M7-4)
harness: a done check a loop before this one asked is answered for this one (M7-5)
harness: a point the host passed over waits a step; no act nobody's tab owns unwinds what runs it (F1-R6-A1, -H1, -H2)
harness: a point a step left standing waits a step, save one follow-up; one restored tab's panic is that tab's; a view that panicked is asked again in a while (F1-R7-B1, V-1..V-5)
restore: a landed held tab keeps its agent through a restart inside the drain; a closed queue keeps a panicked step's attempt
harness: the open-items challenge is the done check's kin in the record, a successor's seed, a limit's place and its words (MG7-A1..A6)
restore: a landed held tab's leaf carries the holds the restore could not put back (GUI-M7-1); the held tab's earlier-tab note tested through the App (GUI-M7-2)
harness: the follow-ups a point goes back to the host for are counted, not once (F1-R8-L1)
harness: a restored step that panicked ends by what it knows; every restored row names every tab said; the queue is let go only once its row is said; a Codex is said as Codex (F1-R8-G1..G5)
upgrade: one record whose read panics is an unreadable record, never the whole look's fault (F1-R8-G6)
merge: the LC-5 and LC-3 tests of both lanes held to the merged rules (8 aterm-agent reds, 1 aterm-gui red of …)
merge8: the upgrade lane's LC-5 said and tested as main's policy; LC-2's Codex holder said (MG8-A1..A5, DOC-1)
merge8: the GUI host's words end with what they say; the disk resume keeps a continuation's gates (GUI-1..GUI-6)
merge8: the live upgrade tests pin main's unprobed first move (2 aterm reds the merge left)
harness: a word that moved keeps the point's follow-up count (F1-R9-L1, -L2)
harness: a typed restored line whose step panicked is stepped again; the restored row has one line per agent, drops tabs an agent holds again, and is said only for a miss (F1-R9-G1..G6, -L3)
harness: a loop that follows takes up the take window, Off, the task's end, the Land episode and the short streak from the ledger (RS7-1..7)
harness: a record is no read of a try, a try aged out ends no wall, a late first read opens the window a successor awaits (RS8-R1, RS8-R2, RS8-F4)
harness: the point a loop judged is recorded, and a loop that follows takes up its streak, its time and the answer judged there (RS8-R3, RS8-R4, RS8-F1, RS8-F2, RS8-F3)
harness: a turn read running is recorded, every point's time too, a person's exchange after the task's end is left in the ledger, and the cut keeps what the readers read of a run of records (RS9-R1, RS9-F1..F5)
merge9: a challenge whose answer ended the task seeds no challenged job
merge9: main's landed-restart control re-fit to the ledger's land episode; a landing spent is restated spent
merge9: the restored row's single-agent words decide Claude by an exhaustive match (census agent-gate)
merge9: the box-call proof tests run on a host that fences a digit by the person count
merge9: a landing a later point or turn followed seeds nothing; the seed matrix journals its lines (MG9-S1, MG9-S2)
merge9: a loop that follows knows the job was challenged past the challenge's answer (MG9-S3)
merge10: a Land relaunch mid-work types nothing of Cruise's, in main's lab and prose too
merge10: a loop that follows holds a person's Esc from the point its record marks (RS9-F2 over main's …)
harness: a turn after a landing is never read as the landing on a restart
autopilot: read a landing's point by its words, not its seq, across a restart
autopilot: the rule's title fits beside the facts as they fall; the land\_at offer names its day; agent titles lose their spinner frame
autopilot: an open menu or page turns its land\_at offer at the minute; every snapshot of a session's name drops the spinner frame
tape: preserve excessive Instant-shaped text as literals
tape: escape active Unicode in text output
tape: bound file input on an admitted regular handle
link: admit the opened acked file before appending
gui: bind modifier anchors to the modifier handler
link: transfer owned inherited descriptors across safe APIs
retain literal hyphens in Codex tape observations
require complete observations before cleanup passes
harness: judge a multi-select text's fit from the layout Claude Code measures (ATERM-KI-1015-1 F2 closed)
phase: a zone cut inside a multi-select's free-text row is the dialog with its head off the screen (ATERM-KI-1015-1 F2)
phase: a multi-select cut at its focused Submit or its divider is the dialog with its head off the screen (ATERM-KI-1015-1 F2 review)
core: discard pending host resync requests when opting off
gui: record control input from accepted delivery receipts
gui: complete input receipt debug and test call sites
machines: retain lock cleanup through failed login waits
crash-journal: a tab's word about typing is journaled at once, never after the write throttle
crash-journal: a word about typing is captured on its loop turn, once a turn (review OW-P1)
relaunch: an adopted row under Land promises no continuation (lab finding B)
upgrade: a local command's output in a system row starts no task (2.1.302's /clear)
relaunch: an adopted row ranks nothing owed before Land, as the carry-on does (review RV2-REL-1)
harness card: hold the card through Claude Code's fullscreen entrance instead of blinking
phase, docs: pin launch\_card\_words's banner clause; the docs say the card is held once it is on
restore: reject history frames with mismatched line counts
spare: read again a record whose parent the escape scan dropped
spare: no escape from a process gone since its read or started by launchd
spare: an orphan of a session older than the shell is no escape
harness page: the review of v3/stats-fold — midnight without land\_at, the landing's doors and its letting go, rows that keep their place, Show's fence
autopilot-menu: an open menu card is on top of the caret and the pet (surfaces-F3)
autopilot-menu: a row never moves under a still pointer to another choice (lifecycle-1)
ctl: help open lists every aux target it opens, from the one roster (surfaces-F6)
autopilot-menu: the press guard holds on a Mac click (review of lifecycle-1)
render: a menu card takes back its cells from a selection, a meter and a jittered sparkle (review of surfaces-F3)
ctl: the GUI targets are one table, not a roster and an enum (review of surfaces-F6)
autopilot: the wire's meta wake indexes the timer before it publishes Settings ▸ Harness (§10.2, slice 1a)
autopilot: Land's amber clears the text floor on every built-in theme (surfaces hunt F2)
autopilot: a face clock that moves under its face repaints the title being read (§10.2, slice 1c follow-up)
harness card: the kitty rides once, the rim keeps off the trail and the toes' gaps (review of 5a, 5b)
harness card: the burst stays whole under the quad cap (5b's busiest frame)
windows: aterm-uds's ownerlock module exists on every platform
windows: gate Unix-only items so the Windows build is warning-free
gui: refresh timed card when its weekday changes
input: retire native page gestures when the front changes
wayland: construct read guards only for announced reads
wayland: keep clipboard pipe workers nonblocking
wayland: retain globals through surviving windows and cursor requests
wayland: preserve display admission in the new live read fixture
_2 further changes are not itemized in these notes._

Performance

harness: a decision's lag re-reads ask the file again, never the agent (review XT-4)
harness: the wall's exchange row is keyed once per screen (review RR4-TE-2 follow-up)
footer: keep each pane's fitted chip block and its unchanged rows' reads

Refactors

harness: approvals::usage\_attempt is the one reader of a limit's try (C-S1)
gui: remove superseded plain input wrappers

Tests

agent: detach stand-in upgrade holders from the test runner's controlling terminal
agent: cover each Codex usage loss independently
select an explicitly conserved headless executable
release: own keeper fixture directories exclusively
aterm-phase: classify the 0.163.0 lab captures in the Codex chips' corpus
codex chips: a status row of the model alone is a refusal; the design names 0.163.0's refusals
revoke a closing sources grant on its retained log
slog: cover carried pinned paths and persisted field tiers
gui: retain pointer hover across Claude to Codex switch
effects: keep delayed erase licence scoped to Rainbow Kitty
handoff: v0.105.0's producer fixtures, written by its own cut
retain carried Codex resume line through successor publication
require live-copy authority outside restored publication
gui: fence reader chip clicks by chrome and rename custody
gui: require the reader action to focus Settings
gui: match the complete Settings view target tuple
gui: keep disk holds when recovery cannot be measured
atpkg: require write-ahead intent for staged cache bytes
slog: exercise the autocompact prompt vocabulary
harness: bind Muse focus keys to a person and question
harness: keep the Muse count across generation retries
harness: read addressed Muse key request fences
harness: require person fences for autocompact keys
harness: put autocompact fixture outside person grace
harness: publish recent input age after the raced key
supervise: bind standing-idle observations to elapsed time and eligibility
agent: exercise digit guards through watched and controlled Gemini prompts
agent: reject every weaker digit request after missing generation proof
agent: label digit custody assertions separately from admission controls
agent: use explicit current-host digit stamps and retire unsafe fallback expectations
agent: judge digit refusal by outcome and preserved guards
agent: state current-host custody in approval policy fixtures
agent: borrow the owned expected digit wire strings
agent: include current-host verdict wait in the watch trace
agent: make program approval premises and missing counts explicit
link: require reader shutdown on a live Bridge drop
fabric: give Fleet exclusive scratch ownership
link: retain an inbox refusal that published no verdict across reconnect
gui: expose untrusted spare gate cache admission and staging writes
r20-relaunch: reproductions of LC-2..LC-7 and LC-9 of ATERM-KI-1015-1, ignored
r20-relaunch: looks\_put\_off on every platform — the LC-7 test is shared (gate cells-foreign: win and linux-arm test targets)
harness: the restored landing's crash test waits for the look's verdict, not for a still\_wanted count
r20-relaunch: the lane's two Snapshot literals name stored\_login, which main's usage tap added
relaunch: main's CODEX\_HOME carry test asks carries\_restart with the user's home
r20-relaunch review: reproductions of the review's majors and minors, ignored
relaunch: LC-5's crash-path test pays its stand-in's first-exec assessment before the bounded reads
gui: refuse unknown spare scan and shell posture evidence
phase: own the Gemini bundle fixture exclusively
site: preserve unrelated bytes across engine publication
the merged restore leaves carry B's land\_at and main's sid/lineage
gui: exercise launch marker and temporary-file custody
ai: keep unknown ancestry and argument data from granting yolo
core: require lossless journal keyframe cuts
observe completed warm-spare samples and own rc barriers
agent: fifteen digit and question tests read the person fence
agent: the Codex no-count note test is named for what it now asserts
agent: give the loop, stall and autopilot tests a current host's digit stamps
agent: require process birth for inherited Codex permission floors
retain required-feature lint for versioned package scopes
preserve a private file behind a vendor choice link
count errors restoring kept ALab commands
agent: the Codex upgrade-drive tests read the TUI's birth from their own kernel
gui: cover refused theme work and superseded tab trials
gui: cover launch-pinned specimen size across scale drafts
agent: give the permission-setting fixture an exclusive directory
delete the timing-bound and vendor-census tests (L53, X3, L10)
the last environment skips in aterm and aterm-agent end COULD NOT RUN (OF-30)
no source-text scans in aterm and aterm-phase (HYG-3, OF-49)
keep broker option values opaque when reading durability
reject malformed journal bounds and end markers through readers
exercise journal retirement and read-only admission through owned fixtures
harness: the nudge freshness test fences its digit as a current host does
harness: the nudge freshness test's rollout opens with its session\_meta
harness: the carried-done ledger check compares against a slice of the outcome (tippy cloned\_ref\_to\_slice\_refs)
parser, core: reproduce ATERM-KI-1015-8's broken-off DCS (ignored)
core: reproduce ATERM-KI-1015-8's late OSC 7 (ignored)
shell-integration: reproduce ATERM-KI-1015-3's unmanaged \~/.aterm/bin (ignored)
core: reproduce the OSC 7 hold's lost reports (ignored)
SKIP-and-return sites end COULD NOT RUN or load the checked-in face (OF-30)
the AltScreen Tier-1 reads both screens and each mutant admits its control; Tier-0 never drops a verdict
the context-menu card is the composed model with its timeline aged as it opens
harness: a restored landing's crash comes after the look that kept its attempt
gui: the restored relaunch's told list is a named type (tippy type\_complexity)
harness: a multi-select text that moves against its checkbox is submitted by its button, at the run's level (review of …)
harness: the missed-frame tests hold their premise, a look that took the frame (review of …)
gui: a worker winding down is stopped once, counted by its cuts alone
loop: the relaunched countdown is drawn as Claude Code draws a live one
corpus: re-record the three serde answers our side's fields moved
gui: the park test's unlanded queue says no row into another test's read
harness: the merge's two turn-end compositions, each with its control
restore: the serde corpus answers for the merged AgentRestore's thirteen fields
harness: a limit's end types no keep going into a done report — pin the clauses no test held (D3)
harness: a limit's end types no keep going into a done report — its loop tests assert structure, not the wait's words (D5)
turn-end: Land lands on the worker's own word, as the check ends on it (M5-R2)
harness: a land act typed in a limit's place is the try a successor backs off from
gui: a restored queue's row is read by the test whose queue says it
agent: a busy sink's tries are asserted by their order, not counted against the clock
harness: the stamp boundary of Worker::stepping\_since, and the exit a step leaves across the held pass
harness: the end of a written wall is pinned where no WALL\_WORKED row stands in for it (A3, B-2)
harness: the loop's switch seed is one Session method its tests run (A-1)
harness: a loop that follows types as the first loop at every handoff, the seed matrix (the whole class)
two of our tests re-fitted to main's shapes after the merge of …
harness: the record's challenge test passes tippy (cloned\_ref\_to\_slice\_refs)
merge9: the open-items challenge's record arms of done\_check\_owed, compared whole (MG9-S4)
autopilot: name the controls of the landed-seed loop tests
cover recorder text and append-file admission regressions
harness: cover provenance, evidence and approval ownership
distinguish absent observations and literal Codex text
harness: reproduce a multi-select text given up at widths where it keeps its rows (ATERM-KI-1015-1 F2)
phase: reproduce a tail cut inside a multi-select's free-text row read with its head on the screen (ATERM-KI-1015-1 F2)
harness: reproduce a multi-select read head-on-screen when the tail is cut at its focused Submit (ATERM-KI-1015-1 F2 review)
harness: pin the multi-select fit above 160 columns, where the row stops overflowing the pane (ATERM-KI-1015-1 F2 review)
harness: drop two helpers whose tests … retired
reproduce a pending alternate-screen request after opting off
reproduce ATERM-KI-1015-2's update and handoff leads (ignored until fixed)
linux: return the reporter's notices without a let binding
reproduce the review of ATERM-KI-1015-2's fixes (ignored until fixed)
reproduce the second review of ATERM-KI-1015-2's fixes (ignored until fixed)
hold the multi-select read-back and its cuts to every swept width
gui: expose an input mark from a refused turn delivery
machines: expose lost relay cleanup and incomplete lock facts
machines: use a minute detector for eventual lock readback
seam tests for the switched sites that had none
the install lane's own call sites record their tier, on and off the install device
restore: match the malformed-frame error without Line equality
harness stats: the one-pass fixture's untouched-today journal holds a bad line too
autopilot-menu: a pointer still over a menu closed and opened again by the keyboard
footer cache: pin the refusal's reason in the fit key and every clause of the stamp lane
footer cache: hold the stamp lane's no-lane clause and the spacer run's ground
footer cache: the fit tests build v3's title reading and task stamp

Docs

the engine owns the reported colour scheme
the community theme pack
the chrome keys and the chrome tokens
describe SGR 2's readable floor wherever faint\_opacity is documented
theme typography shipped (DTP status, ATERM\_DESIGN §8.5, GUIDE, TEMPLATE)
program colours are allowed by default, session-scoped and reset by Reset Terminal
the session log's Phase 2A as built, and the claims it proved wrong
state font mapping admission by platform
forge: describe package source inventory accurately
align explicit Trust verdict guidance with release policy
measure Gemini CLI and agy in the lab; agy's reader, the truth of its Error ID
supervise: retain the working-directory helper documentation
r20-relaunch: the lane's rulings and limits in main's handoff, its runs in the lab record, the specs kept true
the derived palette and per-session themes
Keep colours only is withheld for a theme that sets font\_weight
session log Phase 2B as built; D3 stays open and the journal ships off
manual: machines verbs as wired
current verify commands for the retired xtask ones; no dated phrasing
Windowed's rustdoc is its own; the debug-assertions coupling is written down
the carry rows and the distribution audit say what the DCS and PATH fixes made true
WP.8's audit notes back in order; the GPU web module is described as it now draws
no deleted binary, law kind or ported spec is named; each note states the current rule
harness: drive --help, the AUDIT's upgrade and resume\_limits rows, and the auto-resume grace say what the code does (review DOCS-1, -2, -3, -5)
harness: the quiet upgrade's "types nothing" names its one line (review RR-LC-6)
harness: links to the met try name UsageAttempt::met\_ms
comments: two merged comments rewrapped to main's 100 columns (GUI-M7-4)
merge9: the older-tape test's comment rewrapped to 100 columns (MG9-MAIN-1)
autopilot: the landed seed's ledger rule and its mark hold together
tcc: S4 — a held grant covers removable volumes on macOS 26.6.2 and 27.0
the prose A11Y.4 made false: aterm-dbus's consumer, who holds rustix 1.1.4, indexmap and serde
session log Phase 3A as built; the skills learn the log, the supervise wait stays
cite the lab run for the cut at Submit; say the multi-select fit needs a new sweep per build
ATERM-KI-1015-2 and the specs say what the review of its fixes left
what still named sctk-adwaita, tiny-skia or Linux's ttf-parser says LW.5 took them out
crash-journal: the Lane's header says the word-about-typing exception in one wrapped paragraph
the prose the A11Y.5 review found stale, and the changelog's paragraph fix
the switched sites' comments say ordered where they said durable
the tape's end flush and the video members say flushed where they said durable
the yank test has its doc back; pinned\_dir no longer names the network-drive token
rule 1 amended, and every shipped word says a vendor codex is shown, never supervised (retire C6)
the pane word's example after the codex-lane retirement
harness card: a card at rest is up to three pieces more, not "no more"; the manual's paragraph reflowed
KI-1015-9 and its SPECS rows record the two edges review 4 probed
the session log's Phase 4 as built; aterm fabric brief and \[fabric\] log in the man page
input: state when a page gesture retires

Other

aterm-core: report the colour scheme of the background on screen
aterm-gui: the projection carries the scheme baseline; status says scheme\_from
aterm-wasm: format facade\_api.rs at its crate's edition (2021)
aterm-types: built-in ports name their source; the theme-file cap moves here
aterm-verify: a folder literal seeds its consumer
aterm-theme-pack: a vendored, permissively licensed community theme pack
aterm theme pack | install: list, print and install the community pack
Settings \> Themes: Get More adds a community pack theme and tries it
aterm-release: aterm-theme-pack's trust memory row
Settings \> Themes: Get More joins the toolbar where the row has room
contrib/themes/pack: Get More is a chip and a footer button
aterm-link: read the deleted script's shell job for the broker it runs
fabric doctor/off read the root of the fabric the report is about; fabric\_cli sealed from $HOME
ink: dark/light is the WCAG pole (black text out-contrasts white), not luma \> 150
aterm-messages: chrome tokens, the one source of the chrome's shared colours
Theme files author chrome colours: accent, active tab, border, search match
aterm-gui: chrome keys in aterm.toml, ChromePalette and the chrome surfaces
aterm-gui: the tab strip, band, presence and pane headers draw the tokens
aterm-gui: native roles take the chrome tokens; settings::Roles is NativeRoles
aterm-gui: chrome over the grid takes one palette (chrome-8), find's tint is a token
aterm-gui: split dividers are the seam token and follow High Contrast (chrome-11)
aterm-gui: rain and the drop/upgrade rims wear the chrome accent; reach tests
aterm-wasm: format messages\_api.rs at its own edition (2021)
aterm-png: the corpus floor is the 20 tracked .png files
aterm-release: aterm-messages trust row re-measured (1005/4329)
aterm-core: SGR 2 keeps a readable floor on palette colours
themes: typography in theme files (DTP Stage 1: format, package, resolver)
themes: theme typography applies live (DTP Stages 2-3) and shows everywhere
settings: the theme picker's file rows name the type settings and skipped keys
aterm-core: closing the palette gate drops a program's palette; a manual reset puts program colours back
aterm-gui: programs may set the palette by default; colors shows what they set
aterm-types: the short catalog budget takes the colors row's growth
aterm-gui: the palette-refusal test's prepared generation names its reason
aterm-verify: a headless WebGL2 browser lane (verify browser, verify fetch-browser)
LAG-4: the proxy queue's lock lends its waiter's priority; a request's identity is checked on the spawner
LAG-4 review: the proxy queue's note carries the reviewer's re-run too
Test mode-12 cursor policy behind explicit console-host admission
Test mode-12 behavior after console-host posture is revoked
Preserve cursor style during active console-host mode
aterm-gui: test that a carried exit someone saw writes mark - seen
aterm-slog: look field keys up by match, not by scanning the table
aterm-slog: level-aware eviction, a node index and exact gaps across holes
session log: seq is never reused across a seamless update (log\_seq, the timeline's reserve)
aterm-slog: the fold snapshot, the tracker's carry and the Log carry codec
aterm-gui: carry the session log across a seamless update
aterm-gui: crash adoptions take an epoch above the keeper tag's
aterm-gui: hold every session log together under a 64 MiB cap
aterm-gui: log and brief answer a closed session from the closed index
aterm-gui: a restored session names its predecessor and its lineage
aterm-gui: put back the line continuations in the control carry's WARN
session log: a seq no log reaches is never continued
session log: a carry's sender writes only lines its receiver reads
aterm-slog: where an append hangs never depends on what was evicted
aterm-slog: the ring conformance drives every eviction and binds the half rule
aterm-gui: a carried block cursor must fit the engine the successor adopted
session log: the export encodes a session's log once, and only what crosses
aterm-gui: test that a crash recovery takes the keeper tag's log epoch
aterm-gui: test the session log's carry where it meets the product
session log: a closed session's summary is at most a kilobyte
aterm-gui: a close builds only the closed-index entry anyone will read
aterm-gui: a closed session's read grants stay revocable, one table each
aterm-gui: the log memory cap is reached in one pass from far over it
aterm-slog: find the newest wall open from the back in the carry test
aterm-gui: an ambiguous closed sid's revoke is refused as a live one's
aterm-gui: revoke a closed session's grant through the revoke verb itself
aterm-slog: bind the amend's re-index of its closed ancestors
aterm-gui: pin the revoke verb's route to the closed sessions' grants
aterm-gui: the app's last close is shown to link nothing for a live log
aterm-gui: a window's close ranks its skeletons by closes, not views
Keep effects conformance anchors in the unit-test build
Test bounded Claude compact-state admission with private files
Bound Claude compact-state reads before choosing defaults
Keep compact-default checks behavioral and qualify estimates
aterm: prune and correct comments
aterm-agent: prune and correct comments
aterm-core: prune and correct comments
aterm-forge: prune and correct comments
aterm-gpu: prune and correct comments
aterm-grid: prune and correct comments
aterm-gui: prune and correct comments
aterm-keeper: prune and correct comments
aterm-pty: prune and correct comments
aterm-release: prune and correct comments
aterm-render: prune and correct comments
aterm-spec: prune and correct comments
aterm-types: prune and correct comments
aterm-uds: prune and correct comments
aterm-update-core: prune and correct comments
aterm-verify: prune and correct comments
atpkg: prune and correct comments
Describe current restart and mapped-font contracts
Test person-count continuity throughout Codex note entry
Format Codex note person-count regressions
Require a current person count for every Codex note key
Keep the Codex context fixture in an exclusive temporary home
Admit only regular nonblocking Codex rollout reads
Format the rollout reader positive control
Test refusal of a relative Codex home whose resolved path is not UTF8
Refuse a resume line when its resolved Codex home is not UTF-8
aterm-verify: drop the browser lane's tautological and prose tests
harness: Autopilot v2 slice D — Codex chips on the blank row over Codex's status row (design §9.5, §9.6.4)
harness: Codex chips — chips\_for names main's new agents (Agy, Muse) as having no chips
harness: Codex chips — no mode light after Claude Code, no per-frame allocation, one frame per goal hold
Promote memory-bound scrollback floods without splitting open cuts
Keep pressure promotion within its remaining owed rows
Format scrollback pressure test module
Test pressure drain after a real history erase and refill
Recheck the pressure floor after interleaved history changes
rainbow: a torn echo's print anchor is withheld with its hidden caret
rainbow: the hand rides its line when the composer box moves under its echo
rainbow: a Backspace's echo keeps byte order (the owner's the▯subtrees)
harness: answer Claude Code's autocompact offer at 400k
harness: bound the autocompact offer's stepper
disk watch: reclaim a removed workspace's build cache, a reserve against ENOSPC, volume-share thresholds
disk watch: read ENOSPC off a supervised Claude Code's screen, free space, resume it once
disk watch: write-ahead sweep, rate-limited pass not look, capped shares, withheld not owned
aterm-win32-oracle: the windows-sys 0.52 oracle is the oracle-052 verb, not run.sh
aterm-verify: wasm-glue's second row is the wasm-bindgen oracle, not oracle.sh
aterm-win32-oracle: the clean before each oracle build is --locked too
aterm-verify: format the wasm-glue oracle row's tests
harness host test: wait for both workers' runs before the program leaves
aterm-gui: the disk tick covers every Codex session, supervised or not
aterm-agent, aterm-gui: the watch-only worker's remedies find their idle point in codex-alab's own record
aterm-agent, aterm-gui: a codex-alab comes back on its validated line after aterm's own crash or a seamless update
aterm-agent, aterm-gui: under a person's hold the self-claim's watch-only worker stands and types nothing
spec(kitty): the listener model knows a glued run's guess waits for Enter or the name
harness: Autopilot v2 slice A — the act ticker, and the chips' voice (design §9.2, §9.6.1)
harness: slice A review fixes — the page hears every act, a dialog's label is seen, a run of one act is bounded
harness: a label's end wakes the loop once — the glass expires before its deadline is folded
atpkg: the sandboxed-stub test denies the start-time read, not process-info-setcontrol
aterm-gui: the Codex disk-tick test reads the watch's look with no session
supervisor: a force-push is destructive however it is spelled
ship cut: moving the cut tree removes what a departed directory ignored
Enforce session-log carry bounds and preserve settle age
Exercise closed-log reads and revocation over the control wire
Carry retained echo probes with a proven hand-line move
Bound browser requests and isolate concurrent fetch scratch
Clarify harness glass retention and reread freshness
Recognize reordered force-push flags in turn-end questions
Compare Wasm oracle declarations within their owning classes
aterm-uds: Command::disclaim\_responsibility, a child that is its own responsible process
devtools panel: measured with a hand in a macOS 27 VM; hover, the password window, a grant that applies at once
render: the translucency contrast floor lives in aterm-render
core: Terminal::rebase\_colors, the colour half of apply\_config
types: one shared draw of a selector's built-in side
web: named themes, splits, registered themes, and the shared floor at the boundary
aterm-release: aterm-wasm's trust row re-measured after theme\_api (142/714)
aterm-release: aterm-gpu-web's trust row re-measured after theme\_api (128/593)
aterm-gui: the Themes toolbar puts its chips on their own row at any width
aterm-gui: a sub-page's rail row is listed, selected, under its parent
aterm-gui: record the serde corpus answers for v0.105.0's handoff fixtures
aterm-release: aterm-wasm and aterm-gpu-web trust rows re-measured on the merged tree
aterm-phase: read Muse Code 1.4.10's boxes, question and walls
harness: supervise Muse Code end to end; prime it; say so
aterm-phase: read Muse Code's question and file box in a narrow tab
Keep the shell-hook advice test true now that Muse Code is supervised
aterm-phase, aterm-agent: read agy's lab captures — its API walls, its survey, its first run
aterm-agent, aterm-phase: agy's survey and first run are pressed by no level and typed into at no point, by any name
aterm-phase: read Gemini CLI — grammar, reader, anchors, sniff, canary
aterm-agent, aterm-gui: answer every Program arm for Gemini CLI
aterm-phase: Gemini CLI's box span opens on its title; read its redirection warning
harness: supervise Gemini CLI end to end; strip GEMINI\_\*; say so
aterm-phase: read Gemini CLI in a narrow pane, under a wrapped error notice, and after a refused box
aterm-agent, aterm-gui: keep other agents' lost-login wording; hold a refused Gemini CLI box
merge fixups: check all six Harness card rows; say only what was measured of Gemini CLI's usage
Describe the reserve path admission boundary accurately
Release disk episode state before host callbacks and I/O
Publish resolved policy on same-text config refresh
Preserve files exposed by moving the release cut tree
Refuse checkout over ignored cut-tree work
Keep cut-tree refusal guidance non-destructive
Keep cut preservation contracts focused on retained work
Preserve autocompact prompt and need words in session logs
aterm-agent, aterm-gui: the review of retire-prereqs-20261016 fixed (handed line, stall alone, a standing idle point, a lease uncounted)
aterm-agent, aterm-gui: the review fix's tests formatted and the flicker's parity spelled is\_multiple\_of
serde corpus: record v0.105.0's shipped-state answers
census: register disk\_episode as a guard helper of DISK\_EPISODE
Exercise disk recovery scenarios within one state-owning fixture
Require person metadata before Muse focus answers
aterm-verify: delete the verify trust check
stardust: a light star's body is steady on the size clock; only its tips twinkle
Remove duplicate session-log vocabulary entries
Record final audit evidence and code-signing availability limit
aterm-verify: cells leaves the release set; provision stops asking for the foreign std
aterm-verify: the pure-guards test decides by finish order, not by a timer
Fence Muse focus attempts on their original person and question
aterm-agent: the Muse fences ask Program by an exhaustive match
aterm-gpu-web: synchronous GPU init; wasm-bindgen-futures leaves
aterm-grid/core: a colour stored beside extras is never shadowed by stale RGB-ring bytes
approval\_loop: is\_muse names Gemini CLI too (…'s exhaustive match met Program::Gemini)
aterm-release: ship site builds the /terminal engine itself
aterm-release: the engine's rustflags outrank every other source, as the script's did
aterm-gui: a new tab adopts a warm spare shell spawned ahead
aterm-gui: the spare's wake classification lives beside it; the model's structural laws get a mutant
aterm-gui: no QoS lift around the spare's fork; the bind reopens the gate
aterm-gui: an update retires the spare, tested; the design records what was measured
aterm-gui: test the update gate on adoption; drop a racy FIFO unit test
aterm-gui: review of the warm spare: run waits for a fresh stamp; no main-thread stat
aterm-gui: the rc generation's moves are pinned; the spare's validator comment sits beside its code
aterm-gui: the spare conformance rig is not a new
aterm-lab: the Linux runtime lane (lab linux, verify linux)
aterm-uds, aterm-pty: three tests that only held on Darwin now hold on Linux
aterm-verify: the linux check's NOT RUN is COULD NOT RUN, exit 3, never a pass
aterm-link: route a bare @s-\<sid\> from a live presence view, not a walk per post
aterm-link: row faces scan in pages of 4096; post faces keep 256, by name
aterm-link: confirm a presence-view route with one bounded read
two\_nodes\_sealed: a second bare post across the sealed wire
aterm-link: trustfmt the presence view, its bridge test and the sealed test
aterm-link: name the presence view by path in bridge.rs
aterm-link: the crate doc says what the presence view costs per post
aterm-link: reserve producer sequences 64 at a time
aterm-link: pipeline fire-and-forget publishes, commit the inbox per burst
aterm-link: prove the burst commit, the one-record refusal and pipelining
fabric\_world: a kill before the inbox burst's commit loses and doubles nothing
aterm-link: name the settled-ack pair (tippy type-complexity)
aterm-link: the bridge's module header says what is pipelined and batched
Fix reconnect custody of uncommitted inbox refusals
aterm-predict: the reconciled-view safety theorem, and the two defects it found
aterm-spec: the visibility model states attributable proof, bound to the code
aterm-predict: the safety theorem's world passes tippy -D warnings
aterm-wasm: the web predict seam declines a key typed behind a submit in flight
aterm-predict: the safety theorem's header describes the world it runs
Test returning session custody of in-flight echoes
Preserve pending echo debt with a session estimate
Preserve unowned spare files and remove a timing-dependent check
aterm-verify: a stock toolchain's drivers get its lib on the loader path, past taskpolicy too
Keep escape-scan fixture cleanup within its owned process tree
Expose startup control peer loss before binary and subscription dispatch
Scope startup control attribution to each direct serving connection
harness: Autopilot v2 slice C — the landing's ends (design §9.4, §9.6.3)
harness: slice C review — one record a landing's end, landed restated across a loop restart, a landing at its last nudge never spent
File access on a new Mac, by default: Full Disk Access at launch, then the folders
File access at launch: a second review's fixes
File access at launch: a third review's fixes
File access at launch: a fourth review's fixes
File access at launch: a fifth review's fixes
File access at launch: a sixth review's fixes
aterm-grid/core: serialize() replays every rendition the SGR decoder stores
File access at launch: a seventh review's fixes
aterm-gui: the seal island cites Trust's review 14 on trust main (…)
harness: Autopilot v2 slice B — Cruise until a time, then Land, and the Autopilot menu (design §9.3, §9.6.2)
harness: the Autopilot menu in a capture, open autopilot-menu, and a controller's keys
harness: the SESSIONS row's Timer disclosure sits beside its mode buttons
harness: slice B's tests take the record with rfind (the lint's double-ended-iterator rule)
harness: slice B review fixes — the menu's cancel is a compare-and-set and an open menu follows its session; the Commit's rebuild rides the park; the timer folds after its fire
harness: a timer arms by its session's own posture — tests for the merge's rule
harness: the same instant indexed again is no move — no footer wake per meta write
harness: the settings' text list holds main's autocompact\_offer and B's land\_at (36 keys)
spare: the backstop classifies B's WallMoved (a window-wide wake, no session)
aterm-render: prove correction-gate, trim the test part it subsumes
aterm-shell-integration: a warm zsh spare stamps its history file again
aterm tests: L5 waits for the spare gate's backoff, which the spare thread decides
aterm-phase: the Gemini bundle test that makes a symlink is unix-only
aterm-phase: an agy box whose options quote a multi-line command is read
aterm-phase: an answer agy saves is kept, whatever its words
aterm-phase: fixes from agy 1.4.0's own review of its reader (dogfood)
muse: Meta's installer's muse-bin-\<version\> is Muse Code; MUSE\_ is stripped
muse: its prompt hint is no draft; the mail nudge types only into an empty composer
aterm-phase: Muse Code's screens main's reader missed, from the dogfood branch
Refuse unknown launch markers and preserve temporary-file ownership
Create owned roots for private headless fixtures
aterm-gpu-web: the render-tick reflow pump decrements through a local, so Trust proves it again
ai: reviews on at the asker's own permissions; the fleet document from a signed URL; every choice in Settings
predict: an armed guess's echo debt is custody, not an RTT sample
update: a predecessor this build cannot verify no longer holds its trial
update: a verdict settles a trial only when it is one; name the model's gap
aterm-gui: an unset theme is the dark Default again; Follow system is a choice
aterm-gui: a written Default pair offers the theme's Reset; review fixes
aterm-types: themes may derive the 256-colour palette (palette\_generate)
aterm-gui: palette\_generate config and introspection; per-session themes
aterm-wasm: the theme projection test reads slots 16-255 off the shared projection
aterm-wasm: theme\_api.rs back in its crate's 2021 import order
aterm-gui: a Choose Tab Theme trial answers only to the window that opened it
aterm-gui: a layout captured mid Choose Tab Theme writes the tab's prior theme
aterm-gui: a split's inherited theme is decided once, at booking
aterm-core: opening the palette gate re-arms the refusal report
aterm-core: a 2031 push a program provokes passes the program-reply gates
aterm-wasm, aterm-gpu-web: set\_theme hands the reported scheme back to the host
aterm-types: a newer-schema theme's skipped key names are recorded escaped
aterm-gui: Settings ▸ Themes trial bar, toolbar, save row and pack cards say what they do
CHANGELOG, contrib/themes/README, aterm-themes skill: say what themes carry now
aterm-verify: a bare ../ literal no longer seeds its crate into every cone
aterm-gui: disposition\_appearance drops its test-local predicate
aterm-link: Role::of refuses with a typed RoleError; fabric tests stop pinning prose
aterm-link: enable.rs back in its crate's 2021 format
aterm-messages: the chrome floors are the theme checker's constants
aterm-theme-pack: port licences derive from the built-ins; build.rs refuses stray files
SPECS: find's match tint is ChromeTokens::search\_match; the chrome-token tests have specs
aterm-gui: drop semantic\_keys, unused since the typography tests read TrialTypography
harness limits: a window's placed reset is taken only for the wall words it placed
codex relaunch: carry the thread's model, and judge the sandbox by the first launch
codex relaunch: judge the launch's -m by the thread's newest model setting, a /model choice since its last turn included
Read Codex's warning cell and slash popup as Codex's own in a report
Never report a Codex reply whose head never reached the terminal as whole
Say reply-head-missing for a tall Codex reply under an archived status row
codex reader: a box in a narrow pane is read whole
supervise: a Codex note taller than its notes field is entered on its tail
Read every Codex limit family by login, pick the window a fork cannot fake, and read paginated forks whole
End a 0.163.0 legacy fork's copy at its own settings line, and test Codex's limit end
aterm-slog: the box vocabulary names autocompact-offer
codex chips corpus: classify batch 3's 0.163.0 captures
aterm-slog: drop the duplicate autocompact-offer main already lists
File access at launch: an eighth review's fixes
File access at launch: a ninth review's fixes
lint(ai): rely on Result for permission resolution must-use
Own the theme catalog fixture directory exclusively
trust: aterm-phase's floor rises to 810/4577 (was 582/2977)
Test mixed Autopilot activation and timer cancellation without a local face
Compose the real footer before exercising mixed-pane chip input
Preserve Autopilot menu intent and raw timer cancellation
privacy: read Full Disk Access again on macOS 27, and say which tab drew an uncovered dialog
Publish atomic replacements from exclusive owned stages
aterm-release: aterm-core and aterm-spec fit a 36 GiB host's verifier ceiling
supervise: clocks and sleeps through one injected door (Fx), no behaviour change
aterm-census: the supervise-fx guard keeps clock reads on the loop's door
aterm-gui: the host's ledger row hands its own stamp to Ledger::write
Exercise reviewer credential and saved-login custody
Keep reviewer outcomes bound to the stored login
Fix credential filter module and iterator types
spare: a zombie leaves the escape scan whole, so warm spares warm again
aterm-core: DEC 2048 reports the measured cell box, and reports its changes
aterm-core: serialize() keeps a deferred wrap, so a replay wraps where the source would
aterm-predict: guesses measure glyphs as the grid writes them under ambiguous\_width = "wide"
aterm-core/gui: paste and IME commits are priced with the grid's own column walk
aterm-grid/core: a glyph past a double-width row's half wraps first on every writer
Keep observer ancestry reads on its injected instance probe
Hand Claude Code's MCP server dialog to a person at every level
Clear the two reds main brought into the change cone's verify
Keep every MCP dialog answer, the Chrome setup's consent and Esc out of reach
Fix forward: main's unused mut in a self-claim relaunch test
Match the vendor's kept answers as whole labels; read a half-drawn box as unread
Fix forward: main's four question tests read a host's person count
Format the vendor-answer question control
Fix forward: the live fence test reads a digit's person count
supervise: rebuild a policy from its own texts (SupervisorConfig::rebuild)
supervise: SessionSetup and a tape's header (Header::capture/encode/decode)
supervise/tape: trustfmt the new files; is\_multiple\_of; no reassign-after-default
Test remapped tape file-path confinement through the public codec
Reject file paths outside remapped tape roots
Test literal position-shaped MCP server names through the full parser
Preserve literal position-shaped suffixes in MCP server names
Exercise unknown composer evidence before task and watch input
Refuse input when composer cell evidence is unknown
Collapse the optional cell-link refusal condition
export: astream's root names no member; a test quotes no forbidden word
aterm-spec: the CrashRestoreJournal model and its Tier-0
aterm-core: the crash-restore journal's engine accessors
aterm-grid: a wide half ICH/DCH/ECH or a column shift blanks gets the erase background's ring bytes
Cargo.lock: aterm-theme-pack follows the workspace to 0.106.0
aterm-gui: a non-finite line\_height or font\_size\_scale sets nothing
aterm-gui: Settings names a kept themes-folder theme by its name
aterm-gui: the Themes stage badge names a folder theme by its name
aterm-census: a tests\_\<topic\>.rs file is a test file
aterm-census: a tests\_\*.rs part of a test module is a test file
Admit only regular files in the newest Codex model-setting reader
Keep PowerShell test homes and profile state inside exclusive fixtures
aterm-types: modifyOtherKeys reports the shifted keysym, as xterm does
aterm-types: the wasm DOM encoder reports a shifted key's unshifted kitty code
aterm-core: RIS and DECSTR return DEC 1007 to the host's alternate scroll
aterm-core: the DECRQSS DECSCL report says 7-bit C1 as 1, not 2
aterm-gui: writing display\_font retires its game\_font spelling
aterm-gui: \[fabric\] receipts and presence are known config keys
aterm-core: the title stack saves and restores slot by slot, as xterm's does
aterm-core: XTSMGRAPHICS advertises only a sixel geometry the DCS path places
provision: the audit asks the build's rustup-shim question
aterm-pty: the recycled-pid teardown test's bystander is born after the shell
rustix: the differential holds from\_io\_error's range and leading slashes
aterm-verify: the change cone names a member the lock shares by name@version
aterm-gui: the crash rule's test counts one relaunch, judged by its own signs
supervise: the ride-out's virtual clock stands a day behind, so a bypassing read fails it
supervise/tape: a later build reads an older tape; relative files are rooted; one setup shape in every build
supervise/tape: the relative-path test builds its setup in one binding
atpkg: codex-alab becomes the managed codex where the signed index pins it (managed-codex B1-B10)
atpkg: trustfmt the managed-codex files
atpkg-publish: codex-alab gets a package row, pack-package, and an index that switches codex only on an explicit, verified pin (managed-codex C1-C3)
atpkg: a dev-linked codex on ALab's channel says unlink returns it to the codex-alab build
atpkg: a rollback onto an ALab codex build names codex-alab's channel, not OpenAI's latest
aterm-shell-integration: spell the test gate on the PowerShell ConPTY helper for the censuses
atpkg: an ALab codex is revoked by its floor and yank, never revived from the vendor, and its live upgrade fires
aterm-spec: SuperviseTapeRecovery, the harness tape's recovery (model 1)
supervise/tape: the tape format — records, per-key delta, frames, torn-tail recovery
supervise/tape: trustfmt the tape files; the bind's docs say what it holds
aterm-slog: the journal's lines, the reader's view, and the writer's wake
aterm-spec: the SessionLogJournal model of the reader's view
aterm-gui: the session journal, built and off by default
aterm-gui: the journal's version skew and every torn-write offset, tested
session journal: close the review's classes (bounds, snaps, rollback, ring, quit)
session journal: no #fin over an unfinished drain, reply epochs keyed by head, no decode in the index
aterm-gui: bind the journal fallback to main's revocable closed grants
session journal: a reply hands out the journal's cursor; one it never numbered is reset
aterm-phase: Claude Code 2.1.302's idle notice, with its · hint, is still housekeeping
aterm-gui: the escape scan skips a pid that is exiting or was reaped mid-scan
aterm tests: L8 waits for the retired spare's PTY to drop
Fix forward: 23 engine tests run their boxes on a current host
aterm-agent SPECS: drop the row of the deleted fallback-press survey test
aterm-agent: drop the stray-1 backspace the removed fallback press left behind
Exercise saved empty title slots across every checkpoint projection
Preserve saved empty title slots through terminal checkpoints
Read icon titles through the public checkpoint API in the handoff test
aterm-restore: the crash-restore journal, headless
aterm-restore: Tier-1 of CrashRestoreJournal over every death point
aterm-restore: engine conformance, screen half, and the K7 regrid rule
aterm-restore: the resize unit test follows the regrid rule
verify perf: the crash-restore lane, and a tail tap that copies once
aterm-census: aterm-restore is an engine crate
aterm-restore: a floor that evicted the whole tail reads as an overflow
test journal counter prefix frame and resize admission boundaries
format the frozen journal boundary regression fixtures
type the upstream panic-free fixture loop counters
bound journal admission before replay and allocation
Move legacy history serializer import into its tests
Document the shared chrome floor dependency accurately
test owned theme publication and keep pack fixtures exclusive
Validate theme pack ids and exclusively own atomic staging
Return the atomic publication result directly
Align supervisor look documentation with the removed unreachable fallback
aterm-phase: keep a banned word out of the 2.1.302 idle-compaction fixture
verify fmt: hold a new source before it is staged
harness: hold a person's Esc from the read that shows it
drive phase: say what Esc does, from the reader
harness journal: an event's summary joins the reply's wrapped rows
drive phase: agy's trust box says exit esc, its terms screen cancel esc
verify fmt: a new source where a manifest declares a target is held too
watch help: an event's summary is the worker's last line, joined
Muse Code's network box, notes, several questions and review; CHOSE for every agent's question
Muse Code: the panel's pointer is no part of a reply; review fixes
Read Gemini CLI's YOLO, shell mode, hidden details and new boxes; map agy's measured statuses
Read a Gemini CLI box kept over its open composer; take a daily quota beside a per-minute one as agy's spend wall
muse tests: format the review test the d1-muse merge wrote
question policy: a Muse Code note open under the recommended word is a person's
question policy: a Codex note open under the recommended word is a person's too
turn\_end\_loop test: a box read clears the Esc read, whatever the fences let the policy press
codex reader: a question too narrow for its labels is never misread
codex relaunch: carry a settings-only permission choice; tell what it carries
aterm-render: a specimen's cell width, beside its height
aterm-gui: the color sample fits its tile at every theme type size
aterm-gui: the escape-scan tests judge their own fixture's processes
aterm-census: SPECS names the tests\_\<topic\>.rs test-file rule
aterm-gui: SPECS rows for the phase-2 Themes and rail tests
aterm: the forged-subject test waits for its refusals' ev records
aterm-gui: an incomplete escape scan is taken again before it reads Unknown
fabric\_world: topic\_gap makes the GAP's hole by construction, not by racing a stopped bridge
machines: design v2 and the aterm-machines skeleton
machines: controller contracts and streaming port operations
machines: the controller's command layer and starter files
machines: person steps, per-user GitHub access, key registration, the screen flow
machines: review fixes for person probes, git reads, key revocation
machines: the controller core (inventory, ssh, discovery) and the aterm machines verb
machines: review fixes for the controller core (deadline kills, scan tri-state, terminal-safe names)
machines: the trust core, the root agent and enrollment (design §3, §4)
machines: review fixes for the trust core (run lock, floors, tri-state)
machines: host facts and the root-level system families
machines: review fixes for the system families
machines: the preference engine and the families on it (prefs)
machines(prefs): review fixes — unreadable domains, root owner/mode race, wide integers
machines: pinned-artifact installs for apps, Homebrew and aterm (design §8)
machines: harden pinned-artifact installs after review (design §8, §4.4)
machines: one env field with masked secrets; defaulted set\_owner\_and\_mode
machines: wire every verb; batch signing; agent upgrade before apply
machines agent: exec rows carry status/stdout/stderr apart; inbox copies removed; install refuses an enrolled Mac
machines agent: review fixes for exec rows, inbox copies and the self-account env
machines: Screen Sharing through the forced command; the fleet key forwards nothing
machines: screen checks the host greets before the viewer opens; Nagle off on both relay legs
machines: Homebrew's release asset is Homebrew.pkg (same bytes, ……)
machines: hello hashes the agent file bin/aterm names; plan names builds, not two equal versions
machines: a plan reads an item waiting on a planned prerequisite as planned
machines: a Gatekeeper rejection on an App Store only Mac says so
machines: checking for updates reads softwareupdate --schedule; NetBIOS names compare without case; upgrade rows name builds
machines: enroll refuses a Mac whose hardware UUID is already enrolled
machines: Homebrew's install ends with its portable Ruby fetched
machines: Mac Analytics writes its consent version too
machines: person flows judge the admin's session by launchctl's exit status
machines: agent-side review fixes #9 #15 #16 #21 #23 #24
machines: review of the agent-side fixes: #21's unrelated blocks, #15's item pins
machines: controller fixes from the review (contact errors, refusals, signers, GitHub keys)
machines: review of the controller fixes (Local Network wall, signers, docs)
Cargo.lock: aterm-machines at the workspace's 0.106.0
machines: greet a host again after its agent upgrade, so status shows the build it runs
trust: aterm-machines floor 858 -\> 903 (ship trust run --update-ratchet)
Answer the folder-trust dialog of a launch the server witnesses
launch\_witness: format the module trustfmt flagged
launch\_witness: say that a controller's line after the person's Enter reads as theirs
aterm-slog: drop the autocompact words a merge listed twice
launch witness: controls that bite, a true scope, Caps Lock plain
Fix forward: main's digit-proof reds and a bridge test's lock race
spare: a process gone since the listing leaves the escape scan whole
Fix forward: a PowerShell test the censuses read as shipped; spare waits
launch witness: the shells it covers on any host; a gone pid's test
control: the push loop's peer probe peeks without waiting
SPECS: subscription-peer-liveness states that the probe never parks
control: the push probe's doc carries the measured numbers and says plainly why its no-wait is a per-call flag
Settle refused font work and retain theme preview custody
subscribe: the push loop's probe contract is 'never wait', not 'tightly bounded'
Own fabric hold scratch directories through exclusive temporary guards
Describe the specimen fit search and clipped minimum accurately
candidate gate: answer the publisher's question in-process (B18/L34)
trust judge: drop the bash-era decisions and plan fields; facts format 7 (TR10/L21)
trust lane: commit the cost-history seed, crates/aterm-release/trust/costs.tsv (L26)
release cutter: the interrupt module is src/interrupt.rs (SITE-5, part 1)
ship site: a typed site::Failure — Interrupted, Refused, Child (SITE-5, part 2)
ship site: a live site that cannot be fetched is LiveUnchecked, never Synced (SITE-2)
ship site: stop reading a step's output 5 s after the child exits (SITE-3)
ship site: an interrupted sync's own files are put back from HEAD (SITE-4)
release tests: read publish/config.sh at run time (SITE-6)
ship check: drive the wasm32 gate with a stub rustup (EX11)
ship tap deploy: the Homebrew tap deploy is a ship verb, not a script (L87/OF-68)
release fixtures: the generator shares verify release's compile (OF-52, generator half)
release cutter: no test reads this crate's source as text (HYG-3/OF-49)
release cutter: doc comments on their own items; names of moved and deleted items
release fixtures: the generator compiles in its own target directory again (OF-52, generator half)
candidate gate: one receipts store, one tree\_root check; the lapsed-roster test drives the publish (B18 review)
trust lane: a cost row keeps when it was measured; --update-ratchet's seed rewrite is tested; facts key 5 (L26 review)
ship site: the drain is a parameter of streamed; its test takes 0.1 s, not 5 (SITE-3 review)
ship site: a refusal carries its kind; the end-to-end tests assert it (SITE-5/SITE-4 review)
ship tap deploy: commit only what it wrote; refuse a tap index already staged (L87 review)
release cutter: gh\_raw refuses a name-based download; the build test reads build\_one's command (HYG-3 review)
docs, atpkg-publish SPECS: the candidate gate is answered in-process (B18 follow-through)
forge: one ratchet; budget returns the resolver's notes into its report
census: derive the vendored-fork review from vendor/forge.toml
census guards: tighten four rules, add std-command, retire watch-hands, type shared-application
aterm-http TLS fixtures: mint.sh becomes PROVENANCE.md
retire the two hand-run stock oracles: wasm-abi toy and windows-sys 0.52
aterm-bidi: gen.py and subset.py become examples/gen\_tables.rs
aterm-effects art: the five Python rigs become examples/art\_rig.rs
census: scripts floor at the post-wave count; SPECS follow the guard changes
docs and comments: current commands, the type that replaced each guard, AGENTS.md
census shared-application: a Windowed proof fetched before the send holds it
lint: the three ported generators pass targo-tippy -D warnings
census shared-application: name a stale row by the proof that holds it
census guards: the Windowed proof holds a send only when answered for; tests own their list
forge budget: a missing armed row is RED, restoring OF-42's coverage
atpkg-publish: one tag(), manifest\_name() and sig\_name() (D18)
atpkg-publish: an unreadable channel is COULD NOT RUN under lane --dry-run (L38)
atpkg-publish: elect the signing roster once per run, not once per pack (A9)
atpkg-publish: lease the hello sysroot when it is a store build (A16)
atpkg-publish: a keyless builder reads the channel head anonymously (D17)
atpkg: the cargo stub runs lane-free queries on targo, quietly (BLD-3)
atpkg: the two SKIP-and-return tests no longer pass silently (OF-30)
atpkg: atpkg\_suite's header names only what it pins (L68)
install.sh: the embedded verifier refuses what the updater refuses (INST-2, L42)
atpkg: pack-time relocation and the LINEAGE stamp/tree scan move to the producer (A8, L32)
atpkg: one declarative verb table drives dispatch; the source scans go (HYG-3, OF-49)
install.sh hands post-placement work to the installed binary (OF-38, INST-4)
atpkg: the cache's system-shape test runs everywhere; SPECS records the scans' removal (OF-30, HYG-3)
atpkg: shell-setup asks its resolved binary for completions; the sweep reads a desktop entry as install.sh did
atpkg-publish: the hello sysroot's lease refusal is one sentence again; its fail-closed arm is tested (A16)
atpkg: the arity edge runs over a scratch HOME only, never in-process
atpkg: shell-setup writes the Linux desktop entry; install.sh's copy and its cross-file pin go
atpkg: ops::managed is the one door past a shim, so no door exports half of it
atpkg: the toolset verb's change of mind is held by behaviour, not a scan
atpkg: the bundle resolve check sniffs a symlinked bin through to its object
atpkg, atpkg-publish: no text names a deleted scan or verb; SPECS state the current facts
atpkg-publish: a group dry run asks the candidate gate
candidate gate: hash the committed retraction ledger in memory
aterm-gpu: no self dev-dependency; the wgpu oracle is its own lane
winit: the synthetic key event is a test/debug seam, not a feature
winit: retire the aterm-test-key-event feature to an inert row
aterm-cg: CoreGraphics leaves aterm-objc's cg feature for its own crate
aterm-objc tests: adversary files folded by subject; the re-exec family is one binary
checked\_msg: every debug-build ObjC send is prototype-checked, cached per class
aterm-gui: a Windowed proof gates every +sharedApplication send
objc\_live\_class\_audit: name the command that runs it
raster\_accuracy\_survey: spell its run lines with targo and opt-test
gpu/render tests: no SKIP half passes; each ends in could\_not\_run
aterm-gpu: one raster\_changed door drops the atlas; the source scan goes
aterm-gpu: pipeline\_table builds every wgpu pipeline; no test reads source
X3: the two hidden #\[ignore\] measurements are \[\[bench\]\] targets
aterm-render: the two process-reading tests join the suite; 6 binaries become 4
aterm-render: a checked-in variable mono face; portable\_bold stops borrowing one
gpu\_matches\_cpu: record why a primary face's long arrows are not condensed
aterm-objc: doc citations follow the adversary tests to their subject files
aterm-objc send.rs: restore the licence header the checked\_msg rewrite dropped
first\_frame\_compile bench: the warm thread is the bench's, not the library's
objc examples: two checked sends that would panic in verify appkit
aterm-gpu: three Metal-only tests return to the default lane
gpu tests: one run per parity body; the last SKIP half ends COULD NOT RUN
aterm-gpu: the monitor-change upgrade's order is driven, not scanned
winit\_seam: the three source scans go; the table names files, not lines
SPECS: the package's citations follow the tests to where they live now
trust floors: the new aterm-cg crate gets its row (1 of 20 proved)
aterm-cg: a default member with a workspace row; its edges inherit it
aterm-gui: main's password-sheet sends go through checked\_msg
shared-application: the Windowed proof holds seven sends; their rows go
aterm-render: coretext\_answers\_the\_emoji\_lines ends COULD NOT RUN
NOTICE, road-to-zero: the variable Cascadia Mono fixture and aterm-cg
aterm-release hooks test: the export fixture's relocate.rs is atpkg-publish's
agent: one Timings value for the upgrade, relaunch and supervisor waits (P2)
disk watch: retire the cells cache discovery (FOLD-4, L72)
headless: --ready-fd, the instance's own word that its control socket listens (LAB-6)
live suites: one boot that waits on --ready-fd and refuses as COULD NOT RUN (HAR-4, OF-30, P5)
live suites: the headless control-socket smoke as a plain test (OF-08)
live suites: nothing typed is judged at the host's own record, not after a quiet window (HAR-5, OF-53)
fixture: the owner's bash box names the lab's capture verb (OF-65)
fixtures: the Claude Code 2.1.301 footers, read by a test (LAB-3, L46)
drive, fleet: the control client is this build's own ctl verb (LAB-5)
upgrade watch: no hands by its connection, not by a census of its call graph (GC11)
conformance\_login\_wall: the Env literal loses the retired cells root (FOLD-4)
host\_live: the last quiet windows become journal orders, or go (HAR-5, OF-53)
supervise\_turn\_end: the task's line in one feed-bin frame, never a draft the loop reads
upgrade watch: every connection a dry run makes is read-only, pinned by a test (GC11)
SPECS: name the live functions, drop dated history, and map the new tests
comments: state the rule, not its history
host\_live: drop the near-vacuous negative controls instead of calling them an order
timings: the fast-timers seam has one name, aterm-types' deny-listed one
lifeline: restore the line continuation in the --ready-fd close-on-exec error
headless\_boot: an environment refusal is said at once, not after a minute
fixture: the bypass rm box names no recorder, because none exists (OF-65)
relaunch: ShellBack is built only on a clock, never on zero durations
supervise: the hosted-claim test keeps the production clock and pins ttl=90000
supervise tests: a run that must type nothing more ends at the loop's own word that nothing is due (P2)
supervise tests: tails sized to the clock the tests run, and runs that end at their act (P2)
harness tests: the control-fixture gate follows the descriptor limit (P2)
timings: one real-clock test per family, live and unit (P2)
docs, specs: the upgrade watch's read-only connection and the by-construction Program list, as merged
Cargo.toml: \[profile.test\] debug = false
aterm-toolchain: one std-only crate for the toolchain, rustup, the build cache rule and the lease
aterm-libc-oracle: a missing union.json could not run (exit 3); a malformed one stays a finding
aterm-verify: neutral names for the libtest refusal fixtures
verify perf arena: every ctl call is bounded by its verb's timeout plus a minute
verify cone: read the root manifest and the lock table by table before widening; publish/ selects aterm-release
verify test run: three times the cores for a binary whose tests mostly wait
verify exec: the libc crate's declarations, starred env removals, a pure TIMEOUT test
aterm-verify: one build cache with plain targo, no driver lane, the release's feature builds
\[profile.opt-test\]; rust-analyzer runnables name targo's lane
verify test children: --tests alone; recorded binaries matched by file name
docs/PROCESS.md, aterm-verify SPECS.md: the engine as it now runs; store-current scope follows the move
verify exec: drop Capture::Append, which only the headless smoke used
verify doctests: keep them beside the test run (measured against after it)
aterm-toolchain: Homebrew's rustup keg is an input; the store layout's names in one place
verify doctests: a scan that fails wide, so no doctest is dropped
verify feature builds: compile beside the test run, test after it; the oracle keyed on its suites
verify: what it builds to drive, it builds under the test profile
verify trust: the clone's cost rows over the seed's, library by library
aterm-verify: SPECS rows follow the tests; no pin tests or history comments
verify feature builds: the gpu oracle's suite, then the checkers', never both at once
verify doctests: the scan's doc names the manifest-dir include it follows
verify gpu-oracle: a suite's tests are its binary's or its module's
verify: a selection holding aterm-gpu tests and lints its wgpu-oracle arm
verify-engine follow-through: stale references in merged packages' files
trust floors: the new aterm-toolchain crate gets its row (55 of 301 proved)
census headless-lifeline: an anchor, not a count, proves the read reached the tree
aterm-gui: delete the two timing-flaky harness host tests (L53)
aterm-gui: delete consent\_observer's source scans and seamless\_tests' include\_str half (GL10/L19)
aterm-gui: delete every\_dispatched\_verb\_is\_in\_the\_table (HYG-4)
aterm-control/aterm-gui: the conformance seam is a debug build's, not a feature's (OF-09/OF-24)
aterm-gui: control\_privacy reads the dev mark with aterm\_update's reader; names the census guard (DEV-3, GC4)
aterm-gui: lib.rs's clean island compiles under cfg(clean\_islands) (L55)
aterm-gui: SKIP-and-return test sites end in could\_not\_run (OF-30)
aterm-gui: delete the ignored visual captures and the two exhaustive sweeps (X3)
aterm-gui: one timing value for the fabric waits and the harness cadences; fence waits awaited, not slept (P5, HAR-6)
aterm-gui: every lane thread is made by qos::spawn\_lane\_thread; atpkg children by qos::atpkg\_command (HYG-3)
aterm-gui: trail\_audio's queue teardown lives in a private module that alone names AudioQueueDispose (HYG-3)
aterm-gui: the terminal present takes its visuals from host\_visual\_state; wysiwyg\_gates deleted (HYG-3)
aterm-gui: delete the remaining source-text pins (HYG-3/OF-49)
aterm-gui: extract the document models and the access card below the window (P9/OF-55)
aterm-gui: extract the tab model below the window (P9/OF-55)
aterm-gui: footer\_pass\_cost\_probe is a \[\[bench\]\], not an ignored test (X3)
aterm-gui: the document tests' root-authority mint stays in aterm-gui (launcher-mint guard)
aterm-gui: drop the test-fixtures and aterm-test-key-event dev-dependency feature requests (OF-24)
census: the main-loop walk covers aterm-gui's split-out crates
aterm-gui: extract the fabric endpoint below the window (P9/OF-55)
aterm-gui: the restart act's grace and look cadence read the one timing value (P5)
aterm-gui: the listener watchdog's pace is a value a test can shorten (P5)
aterm-gui: turn\_submit\_verification\_rows waits a short submit window, not the 2 s default (P5)
aterm-gui split crates: the debug-build seams compile for the foreign cells
aterm-gui: a\_connected\_tab\_is\_connected\_as\_it\_lands is unix's, as its booking is
aterm-gui: the host's turn-end answers wait through the one timing value
aterm-gui: one real-clock test per timer family; the stamp test's margin back
census: every GUI fence reads aterm-gui's split-out crates
aterm-gui SPECS: citations follow the files the split moved
aterm-gui: image is shown never to photograph the window
aterm-gui and its split crates: docs say what the code does
messages: the persistent-hold fixtures compile in test and debug builds, not by feature (OF-24)
workspace: the aterm-gui split crates get their rows; the fast-timers seam has one name
winit: delete the inert aterm-test-key-event row
aterm-gui: the devtools helper drive holds the Windowed proof; its shared-application site row goes
gui-split follow-through: the footer bench measures a hovered chip; stale references after the split
census lock-order: the synthetic fixture mirrors the disk\_episode guard helper
aterm-gui-tabs, aterm-gui-fabric: the serde rows ask for the derive
trust floors: the five aterm-gui split crates get their rows
aterm tests: the warm-spare live suite boots through boot\_with
aterm tests: the warm-spare suite's L8 and L11 decide by state, not by a race
aterm-gui tests: IME composition takes no RTT sample, judged against an unmeasured twin
aterm tests: the live fenced press carries the person fence first
aterm-shell-integration: the PowerShell key test is a \_tests.rs file
Review fixes: the fd-leak detector, two stale mentions, AGENTS.md's interim models line
aterm-restore: the journal's Tier-1 conformance is a \_tests.rs file
aterm-agent: drive's prompt is sent after --, so its text is never read as send's options
aterm-agent: drive await keeps a caller's own timeout=\<ms\>
aterm-core: row guards and row watchers read the live screen, not the scrolled view
aterm-grid: a row a taller window brings back from history keeps its images and spacer colours
aterm-gui: screen never sends a line past the reply-line cap its client enforces
aterm-grid/core: a colour-blanked early-wrap hole is no text on screen or in the ring either
aterm-link: an inbox record's commit waits for its own verdict, and an exit hands it over
aterm-link: a keepalive is not held back by an ack owed a whole interval
aterm-link: ack\_halt says what pipelining did to its bookkeeping
aterm-link: delete Slot::note\_published; Link::peak is test-only
aterm-link: the presence view dials off the loop, and a confirmation is a mark
aterm-link: a view confirmation's heard head counts the acks just owed
aterm link broker --durability strict|relaxed, safe across a power loss
aterm fabric on --durability; status and doctor say the tier in force
aterm-link: a relaxed power loss is a log change to the bridge and the notifier
aterm help fabric: the broker's --durability, and what relaxed costs
fabric\_world: the report reads the broker's durability off its process
aterm fabric: the tier row is acks, so BROKER's columns do not move
aterm link broker: the relaxed mark under the log's lock, and a clean stop that retires it
aterm-link notify: prune old logs' stores, and say what a renewed log costs
aterm fabric on --service none: keep the hand-run broker's tier
fabric durability: the help, manual, CHANGELOG and second-host doc say what relaxed costs
aterm-core: one ghost painter that changes only the guess's own cell
aterm-predict: exact owed-echo attribution, and a theorem whose clauses can fail
aterm-core: a refused extended colour consumes what xterm consumes
aterm-core: a stray ?1049l restores the cursor, as xterm does
aterm-grid: DECSEL/DECSED erase with the BCE background, as xterm does
aterm-grid: a reverse index resets the pending wrap and scrolls a one-row screen
aterm-core: a 47/1047 switch carries the BCE background to the buffer it swaps in
aterm-conformance: a differential VT oracle against astream-term, in the test lane
aterm-release: the public export carries the astream crates members dev-depend on
forge, vendor/README-astream: astream-term is the sixth astream crate aterm resolves
aterm-conformance: SPECS.md counts the oracle outside its spec-sample recount
aterm-grid: name the selective-erase test's case type (clippy type\_complexity)
aterm-conformance: vt\_oracle doc fixes (a stale test name, a wrong projection example)
aterm-grid: the margined LF clears the wrap; a one-row screen's margined scrolls blank it
aterm-core: a stray ?1049l moves nothing again
aterm-conformance: excluded oracle cases still check aterm; the shrinker stays in the subset
aterm-grid: the margin-arm table is a struct (tippy type\_complexity)
fabric\_bench: measure the fabric over the real stack (latency, burst, attach, records)
verify perf fabric: a MEASURED lane for the fabric bench, with a yardstick
fabric\_bench: name the idle bridge and the yardstick in the phases' module note
fabric bench: review fixes — exactly-once burst, quota-safe window, honest attach
fabric\_bench: name every check the bench makes in its module note
vendor/astream: 4e91e82, astream main with the term oracle fixes; the 30 astream exclusions go
fabric\_world: a forged subject's verdicts are waited for on ev, not read once
Fix merged performance lane array length
Keep the legacy role fixture explicit about strict durability
Read bounded process argv and share broker option parsing
Remove redundant conversion in pure running-argv fixture
supervise/tape: the reader bounds what a forged tape costs; a damaged magic is its own move
supervise/tape: the delta's docs and tests say what the table does
forge OB-1: the astream crates checked are read from the graph, not a list
supervise/tape: the reader's bound docs say only what holds
linux: a Linux host can type-check the mac-arm cell, and an island comment any Trust lexes
install.sh: judge the signed Linux candidate by its --version identity line
install.sh: Linux skip lines name remedies that exist on Linux
ship site: alab.systems serves install.sh and offers it as Linux's one command
install.sh: match a channel slug in the C locale
aterm-update, install.sh: a Linux install path under Ubuntu's umask 002
aterm-update: a test's replacement candidate gets the mode a writer gives it
aterm-agent: disk-discovery fixtures make Claude Code's temp root 0700
atpkg: the Linux store stays put whatever $XDG\_DATA\_HOME says
install.sh: the store-path pre-flight is a function its tests call
aterm-update: ancestry's module doc names what the private-group rule cannot see
aterm-pty: strip other terminals' identity variables from the shell's environment
aterm: carry the Linux app icon and the man page in the binary, and set the X11 window icon
aterm-window, aterm-gui: consume the launcher's startup token and end its launch sequence
aterm-window: draw the Wayland frame before Resized, so a fullscreen round trip keeps the window's size
aterm-gpu: name an adapter that cannot present to the window, and log the CPU fallback
aterm-pty: keep the outer terminal's identity in a session that does not claim the terminal
publish: export man/, which aterm-gui embeds
aterm-update: the piped-install test proves a foreign BIN\_DIR aterm never runs
aterm-gpu: tell the two surface-format refusals apart without pinning their wording
keybinding: a shortcut on a non-Latin layout matches its US key
aterm-gui: ignore a key that was already down when the window took focus
aterm-gui: a middle press on the tab strip closes the chip, never pastes
aterm-gui: Shift+drag selects over a mouse-tracking program off macOS
aterm-gui: Alt+arrow reaches the program when no pane can take focus
aterm-window: one X11 wheel notch from a valuator-less pointer is one step
keybinding: Shift+Insert pastes the PRIMARY selection on Linux
aterm-gui: a busy tab or pane asks before Ctrl+Shift+W closes it
aterm-gui: Linux asks a busy close in the window, not the titlebar
aterm-gui: the confirmed tab/pane close replays build on Windows
aterm-gui: a confirmed tab or pane close takes the question's attribution
aterm-gui: the focus-replayed key press filter is a tested predicate
aterm-gui: say the close banner asks off macOS, and retire stale specs
aterm-render: admit a font installed as a symlink as the file it names
aterm-render: draw a script no list names from the installed face that covers it
aterm-render: font\_family = "monospace" means the default face
aterm-gui: --show-face and --show-config name the default face
aterm-render, aterm-gui: trustfmt the generic-monospace and show-face changes
aterm-render: search the XDG font roots, and only this OS's roots
aterm-render: a curly underline waves however low the font puts its underline
aterm-render: an emoji-presentation scalar draws in colour over a text face's outline
aterm-gui: GNOME's Cantarell backs the Linux UI face ladder ahead of DejaVu Sans
aterm-gui: size a Top Settings choice for the default it paints; "Match terminal"
aterm-render: the supplement shadow-law test counts CJK punctuation foreign only to a non-CJK face
aterm-render: the script supplement asks for Noto Mongolian and Yi by name before any cmap pass
aterm-gui: Windows says "Match system" for automatic window appearance
atpkg: an unserved ALab toolset is a note off macOS, not a doctor PROBLEM
atpkg: no Trust signpost where Trust has no build for the target
aterm-gui: deliver desktop notifications on Linux over org.freedesktop.Notifications
aterm: an answer into a closed pipe ends cleanly instead of panicking
aterm-agent: drive and fleet run this image's own ctl, not an aterm-ctl file
aterm-cli: say "session started" only once the shell has spawned
atpkg: a command nothing runs is answered by the program that ships it
atpkg: pkg which trust names p11-kit's trust unrelated with no index or behind a stub
aterm: macOS consent guidance stays on macOS; ctl privacy says there is none elsewhere
aterm-ctl, aterm-uds: judge a graph entry's writer on Linux too
aterm-ctl: the Linux-only placement slack is compiled only on Linux
aterm-ctl: a long-lived client places each judgement's births by its own clocks
aterm-uds: say what else reads None from the Linux exe link
linux: the Linux build of aterm and its libraries prints no warnings or clippy lints
linux: test targets build without dead code, unused imports or clippy lints
aterm-verify: a fleet OS's cells are red on any rustc warning
aterm-gpu: one GPU context at a time, and no Vulkan debug labels
aterm-gui: tests of macOS-only lanes and macOS metrics hold on Linux
aterm-pty: fd-leak probes name descriptors through /dev/fd, which dash reads
aterm-uds: Linux's AF\_UNIX shutdown and signal numbering, in tests and docs
aterm-spec, atpkg: exec a just-written file past ETXTBSY, one helper for all
atpkg: the no-store reroute test cannot run where /etc/passwd lists the account
aterm-shell-integration: the xtrace test reads past bash 5.1's bracketed-paste reset
aterm-render: font tests judge the drawn outline, and end typed without host fonts
aterm-agent: a Read box judges every reading's text before the disk
aterm-agent: harness tests run where zsh is not installed and the state dir is XDG's
aterm-agent: the zsh stand-in lives beside the test binary, never in shared /tmp
aterm-dirfd: the mode\_t cast expectation names exactly the targets it holds on
aterm-verify: say that a cell's warnings are judged by an unpinned rustup rustc
aterm-pty: one Unix shell resolution, with PATH names and the passwd shell
shell: start the Linux shell as Linux terminals do, each startup file once
aterm-gui: run the shell the spawn resolves, and a working one when it cannot
aterm-gui: the Unix --help and starter config describe the Unix shell lookup
aterm doctor: check the shell the spawn resolves
shell-integration: bash reports the command line as typed, not its first part
aterm-uds: without $XDG\_RUNTIME\_DIR, Linux keeps its control dir under XDG state
aterm-gui: the atpkg children's PATH asks a shell Linux has, and no Homebrew
aterm-uds, aterm-ctl: keep the new control-dir fallback in the proof-friendly shape
aterm-gui: the substitute-shell line is text, never a terminal sequence
shell-integration: an array PROMPT\_COMMAND's elements are no typed line
aterm-gui: a substitute shell starts without the broken shell's shell\_args
shell-integration: the bash loader tilde-expands a --rcfile from shell\_args
shell-integration: -o posix and one-dash long options in bash's shell\_args
aterm-pty: the shell's PATH lookup skips relative entries; a large passwd entry fits
aterm-cli: the doctor test no longer says an empty $SHELL is exec'd
linux: the merge with main builds warning-free on Linux
ship linux-build: the Linux release executable carries no debug info
linux: the census, and two tests two fix branches broke between them
aterm-gui: the warm spare's macOS-only askpass and escape-scan items build warning-free on Linux
shell-integration: bash marks reach the terminal, never a redirected stdout
aterm-gui: devtools panel's dead-code expectations hold on rustc 1.96
aterm-slog: the autocompact prompt word is listed once
aterm-gui: the self-claim test's lane service exists only on macOS
aterm-shell-integration: gate the test helper added like its caller
aterm-gui: gate the test helper exit_of like its callers
aterm-render: walk the font table directory with as\_chunks
aterm-render: read\_face\_tables walks table records as fixed chunks
aterm-grapheme: script\_runs exposes the Script table as its runs
aterm-render: the script supplement counts only faces that draw a missing probe
aterm-render: a family resolves to its font file over a symlink alias
aterm-render: only a link to a file beside it ranks behind that file
aterm-render: the script census test takes the embedded DejaVu face
aterm-gui: a Linux wheel notch scrolls VTE's ceil(rows/10) lines
aterm-uds: drive, fleet, link, fabric and keeper answers into a closed pipe end cleanly
aterm-cli, aterm-gui, atpkg: their closed-pipe printers write through aterm\_uds::stdout
atpkg doctor: a local rustup trust where no Trust is published is a note
install.sh: the piped Linux CLI skip names the clone that follows Trust
aterm-uds: a verb's answer a full disk lost exits 1 and says so
aterm-link: an inbox --peek that could not be printed does not say it marked nothing
atpkg doctor: the local-trust note test checks the marker, not the sentence
aterm-verify: a group down to its exited leader reads as empty on Linux
aterm-verify: a /proc entry that cannot be read keeps a group alive
aterm-keeper: the classifier test reads the parent's wait status off Darwin
aterm-cli: the shim tests exec their just-written files past ETXTBSY
aterm-pty: the recycled-pid teardown test's bystander is born after the shell's tick
aterm-verify: a missing node or binaryen names the OS's package off macOS
aterm-lexicon: the dictionary gates read Webster's Second by name, COULD NOT RUN without it
aterm-types, atpkg: a passwd-file dev seam lets the no-store reroute test run on Linux
aterm-gui: tests build on Linux again after the merge with main
aterm-shell-integration: the spare hold's SIGWINCH negative control runs on macOS only
aterm-uds: one user-private-group rule, shared by the updater and every reader
aterm-agent: a fleet document on its owner's private group is read
aterm-gui: the self-claim tests import Mutex and Scope on every platform
trust\_lane: a target root and slots targo trust admits under umask 002
trust\_lane: a check's dep-info is judged by its slot's own clock
aterm-uds: shared\_write in trustfmt's layout
aterm-uds: read the account databases on Linux only
aterm-uds: no private-group exemption for a file with an access ACL
aterm-update: re-export the ACL seam on Linux only
aterm-uds: no private-group exemption past an NFSv4 ACL, a remote filesystem or a failed enumeration
aterm-gui: the self-claim and warm-spare tests' imports build on Linux
aterm-gui: band seam tests read the closing line as underline or rail
aterm-gui: the web band golden is drawn on the web's band base on Linux
aterm-gui: the comet smoothness test checks each band base it ships on
aterm-gui: the resize re-announce test posts the installed words as a row
aterm-gui: Top's Music effects status is the stop after its switch where both do not fit
aterm-gui: Settings tests give macOS-only rows and audio their Linux arms
aterm-gui: a twin's tab label sheds the state the whole strip shares
aterm-gui: the clamped-selection band test collides its pair in one face
aterm-effects: libm-dependent golden folds are pinned per libm
aterm-gui: a cluster's survivor rule measures against its own members
aterm-gui: only a status line keeps with the control above it in a split card
aterm-gui: macOS-only tests' seams and helpers are gated to macOS
aterm-gui: the IME prediction test allows the pending guess's echo debt
aterm-gui: a twin's or cluster member's shed tab ending is whole words
aterm-effects: x86\_64 glibc reports its golden folds instead of asserting aarch64's
install.sh: the Linux verifier's python3 runs isolated
aterm-restore: the generated-input test's rounds are typed
trust: aterm-restore's floor is 171/497
Cargo.lock: aterm-restore at the workspace's 0.106.0
aterm-restore: a clear leaves no byte from before it in the region
aterm-restore: a mark's slice is counted before its append, K6 or not
aterm-restore: a replay that ends inside a swallowed sequence is counted
aterm-core, aterm-restore: no keyframe is cut inside a signed mark
aterm-restore: a death inside a history append keeps the committed run
aterm-restore: only a RESIZE past the keyframe speaks for the host's word
aterm-restore: negative controls the Tier-1 death half alone must reject
aterm-restore: the generated-input test reaches the u64 edges it promises
aterm-restore: the clear settle's floor is the keyframe's own tail\_from
trust: aterm-restore's floor is 180/508 after the R2 review fixes
aterm-agent: idle compaction under Claude Code's own suggestion is no turn
Preserve unseen journal retirements and refuse uncertain read boundaries
Give the replacement journal test a fresh instance identity
Full Disk Access probe: open TCC.db from a child; measure the update handoff (S1-S3, S7)
Exercise owned setup stages and pure machine input boundaries
Preserve owned setup stages and refuse ambiguous integration inputs
aterm-gpu: src/gl, a first-party GLES 3.0 arm, byte-identical to wgpu on Mesa
aterm-gpu: the GL arm draws armed readback frames through encode\_frame
aterm-gpu: bloom, shimmer, the tray card and inline images on the GL arm
aterm-gpu: GL presents, EGL window surfaces and the GL tap ring
aterm-gpu: EGL window surfaces take exactly-RGB888 configs
aterm-gpu: Linux renders on the GL arm; wgpu leaves the shipped Linux graph
aterm-gpu: a lost GL context reaches device\_lost; the arm's facts come from its own device
Compile inert typography construction in benchmark fixtures
Exercise rollback custody and complete result admission before repair
codex reader: the exec and patch boxes in narrow panes are read whole
codex reader: a Reason row that opens $ is still the reason's
census: name the journal's retirement lease apart from the census's guard words
Preserve owned staging, recovery bundles and complete result handoffs
indexmap: the last vendored fork goes back to the registry, at 2.13.0
sink: a discard never splits a frame; the operator's paste is whole too
sink: the drainer holds the spill mutex across its write only where it cannot park
style: trustfmt the memory-banner carry-on loop test
machines: inject screen's opener; dev screen-headless verb; measure Screen Sharing input on 27
machines: the lock screen takes Screen Sharing keys; a relative --controller works
machines: GitHub controller fixtures follow gh 2.92.0's measured output
machines: GitHub controller notes and design doc state exactly what was measured
aterm-predict/gui: the wide ambiguous width is under the theorem; no guess or cursor on a wide glyph's right half
aterm-core: a restored session leaves a dead ?1047 screen where the live one would
aterm-link: the durability hazard list counts the inbox commit owed outside the log
fabric bench: the burst's fence is checked against the log; the README stops calling burst commits deterministic
vendor/astream: 0fafa2e, whose RIS keeps the alternate buffer as xterm's does; the oracle records aterm's difference
trustfmt the wave-1 review fixes
parser: a DCS ends at ST alone; an ESC that does not begin ST cancels it
core: an OSC 7 at the signed shell's idle prompt waits for its next prompt
shell-integration: no integration puts an unmanaged \~/.aterm/bin on PATH
parser: assert\_invariants back under the line cap
core: an OSC 7 waits for the prompt only where the shell's phase is its word
aterm-gui: the cost test pins the lean form a hovered Autopilot chip lays; tippy's needless borrow
control: the push probe's no-wait guard counts the probe's kernel entries, not one read's flags
subscribe: a pass budget gives the push loop back the coalescing window the probe's sleep was
aterm-dbus: lane-bus, the Linux lane's AT-SPI reader and Mutter seat
aterm-lab: the Linux lane records LW.4's baseline, and every proof replays it
aterm-lab, aterm-dbus: trustfmt the baseline and lane-bus
aterm-dbus: lane-bus seat waits on the window's focus, and xdnd drags a file over an X window
aterm-lab: the Linux baseline waits on events, records XDND and text-input-v3, and pins no prose
Reproduce lost person custody across a fenced paste
Retain the original person fence through paste submission
Exercise held cwd restoration and same-face reader timer identity
Preserve timer identity, restored cwd lineage and idle pacing credit
Remove the strain row and its samplers; slim aterm-sysprobe to the shared readers
spare: L5 drives visible runs until the gate opens, not exactly three
trust: aterm-messages measured on the merged tree, 910 of 3954
session journal: build on Windows (errnos behind cfg(unix))
aterm-uds: anonymous shared memory for the crash-restore region
aterm-keeper: companions, the crash-restore region beside each master
aterm-spec: KeeperCompanionCustody, which region the keeper offers
aterm-keeper: Tier-1 of KeeperCompanionCustody over the real core
aterm-census: keeper-no-mmap, the keeper holds regions and maps none
aterm-keeper: the kernel lane carries a crash-restore region across a SIGKILL
aterm-keeper: unit tests of the companion check and the link's re-telling
aterm-keeper, aterm-restore: tippy clean on the change cone
trust: aterm-keeper, aterm-uds and aterm-restore floors after R3
aterm-keeper: the outgoing window never reads again after its successor's Commit
aterm-uds: a region is Send, not Sync, and reads its read-only words by the rule
aterm-keeper: the regions the keeper holds are read from its descriptors
aterm-keeper: clippy.toml rows ban the region API; the census guard keeps the FFI words
aterm-keeper: trustfmt the region rows' expectations
aterm-uds: gate complete.rs's stdout drain for the wasm census
Gate the complete-stdout drain thread off wasm32 for the census
Exercise known birth changes across the keeper EOF grace
Keep known process births distinct during keeper reconnect
Require explicit backing-object custody for shared-memory regions
machines: screen measured at the login window and the lock screen
machines: lint clean again after the owned-staging merge
verify perf fabric: an optimized arm, --profile dev|opt
verify perf fabric: the opt refusal says what cargo plans
verify perf fabric: the opt arm's label holds against rustflags, the binary is the build's, one cache with a shell build
fabric bench: a binary's identity is its length and time, not its inode
fabric bench: profile.rs's dev bullet no longer opens a list with "1)"
fabric bench: a durability knob, so a Relaxed broker shows the ceiling
Read Muse Code's tool-action and Unix-socket boxes, drawn outside the lab's jail
Pin Gemini CLI 0.46.0's screens under its own sandbox
aterm-phase: the drift canary reads the store's version record, never runs the build
aterm-gui tests: a break's notice is once when TYPED, not when its act is asked once
aterm-verify: the browser lane records the GPU module's frames; the wgpu-WebGL module's are committed
aterm-wasm-abi: a JS object crosses by its glue table slot; verify glue provides WebGL2 as aterm\_gl imports
aterm-gpu, aterm-gpu-web: the browser draws on the GL arm over WebGL2; wgpu and wasm-bindgen leave wasm-gpu
aterm-gpu: a canvas device that fails to read its caps drops its context; the glue forgets a deleted pack buffer
aterm-release: raise aterm-wasm-abi's and aterm-gpu-web's Trust floors to what WP.8 proves
Retire WebGL context resources and reject mismatched canvases
Format incoming GPU-web comment and import joins
aterm-gui: the seal island's check-build sentence says what trust … does
aterm-gui: Cmd-click a plain-text path:line opens aterm's own editor at that line
presence: a background codex finishing its turn puts the story dot on its tab
presence: a proven self-claim with resume\_limits on reads a usage wall as note
status: hand\_pid= names the kernel-attested taker of a drive lease
aterm-gui: review fixes for the citation, lease-attestation and codex-turn-end work
uds: one StdCommand alias carries the Command ban's excuse; no fn-wide expects (GL11/L20)
link: forbid(unsafe\_code); the inherited lanes are adopted by aterm-uds, checked (HYG-7/L63)
link: the per-session maps are one PerSession value whose prune destructures every field (HYG-3)
lexicon: the fold tables' ASCII-free rule is a compile-time check, not a source scan (HYG-3)
update: delete the source-text pins of the boot, check and Linux lanes (HYG-3/OF-49)
containment, ctl, digest, gpu-web: delete the remaining source-text pins (HYG-3/OF-49)
web: the message-band and scrollback-tier tests both hosts run are written once (HYG-5)
web: a test the host cannot run ends COULD NOT RUN, never a silent pass (OF-30)
conformance: paint and spin end an undecided take with aterm\_spec::host::could\_not\_run (L05)
Cargo.lock: aterm-spec as the dev-dependency OF-30 and L05 added
uds: the spawn-cost benchmark is a \[\[bench\]\] target, not an ignored test (X3)
effects: delete the ignored exhaustive twin of the busy-status laws (X3)
effects: one integration binary; the exact-allocation pins share it (P13)
islands: bidi, grapheme, rle, search and grid's write.rs on cfg(clean\_islands) (L55)
comments: name the Trust verify lane, not a "strict Trust gate" (L74)
effects: trail\_sound's determinism check names --profile opt-test, which compiles (L67)
effects tests: cite lab ptyrec and the tests' own Ink composer, not repro scripts (SCR-4)
link: the bridge's round runs at test pace under ATERM\_DEV\_FAST\_TIMERS (P5)
http: the fixture-root verifier and the github.com checks end COULD NOT RUN, never SKIP (OF-30)
containment: the scratch-HOME proofs end COULD NOT RUN where no scratch HOME can be made (OF-30)
lexicon: the three dictionary gates end COULD NOT RUN without a system word list (OF-30)
containment: the private-data gating check ends COULD NOT RUN without a HOME (OF-30)
effects tests: the common module's header names one test binary (P13)
lexicon: the fold tables are pattern macros the predicates match inline, back at the Trust floor (HYG-3)
messages: delete the test-fixtures feature; merge with gui-split's … (OF-24)
uds: the spawn-cost numbers cite benches/spawn\_cost.rs, the test they came from is gone
specs: drop the rows of deleted tests and say what holds now, without dates or workflow tags
link: the host-name test ends COULD NOT RUN where the OS cannot be asked; the fast-timer seam says who must pass it
messages: say plainly what the debug-build fixture gate does not catch (OF-24)
containment: PROOF 11's doc says a missing tool ends COULD NOT RUN, not SKIPPED
wasm: the tier-caps wire-contract doc spells targo --unverified test --workspace
comments: "the verify trust lane", without nested parentheses (L74)
fabric: the bridge child runs its instance's fast-timers clock (P5)
comments: name the generators and rigs that replaced the deleted scripts
GL11 over code main added: no fn-wide Command ban excuses
shell-integration: main's new zsh tests end COULD NOT RUN without zsh (OF-30)
--ready-fd: an update successor is not told it; the manual says what it is
aterm-link: the broker's stop signals go through aterm-uds, so the crate stays unsafe-free
spec anchors: a std-only aterm-spec-anchor crate under debug\_assertions, no spec-anchors feature
models: out of aterm-spec into eleven aterm-models-\<domain\> crates and the aterm-models check crate
specs: port the eight hand-written .tla specs to derived models and re-bind their Tier-1 on the interpreter
aterm-core: the fuzzers join core\_suite; four binaries keep the isolation they need

_Truncated to fit GitHub's release-body limit — the complete note is release-notes/v0.106.0.md in this release's source tree._

v0.105.02026-10-16

aterm v0.105.0

2026-10-16 · 2157 changes since v0.104.0

Features

aterm-phase: launch\_card\_place, where the newest launch card sits, for the harness card
kitty: name+command glued in unspaced scripts, a flash that picks the copy that fired, a job chord that trusts no poisoned line, and two trick models
harness: Claude Code autocompacts at 400k tokens — a sixth window default

Fixes

harness: hold a sed box under any Bash ask rule or hook; never type a multi-select text the dialog overdraws; forget a gone dialog's text (ATERM-KI-1015-1 F1, F2, F4)
aterm-phase: read a ticked free-text row drawn [✔] with no space (ATERM-KI-1015-1 F2, the reader's half)
aterm-phase: a box's title and the plan dialog's hint read across the rows Ink wraps them onto (ATERM-KI-1015-1 W2, F3)
aterm-phase: read the status row across the rows Ink wraps it onto (ATERM-KI-1015-1 S2R-F1)
aterm-phase: read the rating card whose question and options a narrow pane wraps (ATERM-KI-1015-1 S2R-F2)
aterm-phase: the vendor's auto-mode notice is nobody's last words (ATERM-KI-1015-1 LC-10)
aterm-phase: bound each narrow-pane join by its grammar (title, status row, vendor notice)
aterm-phase: a generic usage-limit banner is the limit the turn's own notice names (ATERM-KI-1015-1 W3)
aterm-agent: the vendor's continuation ends a limit's wait only under that limit's own notice (ATERM-KI-1015-1 W1)
harness: a countdown Claude Code dropped is a cancelled one, and a cleared conversation ends the limit's wait (ATERM-KI-1015-1 W4)
harness: a model bucket no relaunch moved off is waited on like any limit when its countdown ends (review of ATERM-KI-1015-1 W3)
harness: a countdown's record in a resumed history is no countdown (review of ATERM-KI-1015-1 W4)
harness: a relaunch decided where a bucket's notice left knows the bucket (amendment of ATERM-KI-1015-1 W3)
render, gui, effects: bottom overscroll apron, word-nav hint hold, and kitty caret clearance
enforce live per-agent harness admission in host workers
revoke in-flight restored work across agent off and on
retain Commit exit debt and account rollback when gated
make per-agent revocation supersede an earlier Commit pause
preserve generic admission and bind off-only policy transitions
project per-agent harness admission into the owner herald
keep wall and rekey remedies within agent admission
rotate bounded outbox peeks across sender sessions
distinguish dedup verification failures from refused publishes
make worker revocation sticky through handovers and late landings
stop treating revoked own claims as an answering supervisor
fence revoked restored landings and denied handoff adoption
link: describe login restart from installed job location
link: preserve known fleet identity and refuse uncertain role state
link: resume fleet reads during duties and reset detached say clocks
link: fail attach while in-flight journal fate is uncertain
gui: admit list completions for the current panel only
agent: release model buckets only after a different family choice
link: keep fleet halt authority human-only and honor post delimiters
agent: keep live evidence when restoring a hidden limit
gui: re-read timezone identity beside current offset reads
spec: fail requested checks on every interpreter error
spec: require successful AY solves and nonempty proof inputs
release: attest all local cutter sources before export
render: blank absent scroll aprons only at the live bottom
link: account for a broadcast recipient opting out
link: release departed sessions attributed commit debt
forge: retain unknown requirements in renamed patch scope
windows-sys: fail the oracle when import probes cannot run
harness: a spent landing and Off end the carry; a turn never seen busy is a person's by their hand
harness: a turn nobody saw run is a person's only as the screen draws it; Off's park and lift keep what they judged
harness: a turn no read saw run is never left to a person; the never-seen-busy first-point arm is removed
harness: an Off session's worker is stopped when another program takes its tab
harness: an unseen point after Off never leaves a wall-retried exchange; a wall never costs a land act or the done check its done reply
link: discard log-scoped debt and reject uncertain reset reads
link: keep unreadable directory entries distinct from absent state
link: require the endpoint log clock acknowledgement before attach
link: scope keyed publication offsets to the broker log
link: bind referenced journal recovery to its originating log
theme: fail closed when exclusive publication fails
link: use this publisher identity for journal reference recovery
theme: report lossy cell-background selection text
gui: bind each session clock before registry publication
isolate Trust proof syntax from stock foreign parsers
accounts: keep checked homes after uncertain renewal publication
accounts: propagate required state errors before due renewals
grid: hide inline proof syntax from stock foreign parsers
finish isolating inline proof modules for stock foreign checks
accounts: refuse unknown binding identities instead of restoring old logins
gui: refuse account attribution when login bindings are uncertain
gui: gate renewal advice and commit on the live login policy
agent: name the restart process probe apart from Codex probes
zstd: hold every resolved match to the declared window
atpkg: retain queued requests while wanted installs remain unfinished
atpkg: publish agent reconciles in the executable writer turn
atpkg: retain rider names when reordering the set queue
serde: preserve opaque macro input during receiver replacement
gui: validate inherited identity directories before spawning
gui: persist Default as an explicit palette choice
cli: publish theme exports through the exclusive atomic writer
metrics: publish preparation total before first presentation
gui: keep theme previews owned by their ordered save intent
workspace: retain new macro crates in the default member set
cells: resolve and shim test-target dependencies separately
link: judge reservation witnesses before subject budget admission
reduce feature-row reports using the Cargo package identity
integration: include the WASM export macro in default builds
gui: merge owed restore tabs into their quit-time positions
atpkg: require known archive sizes for download-ahead
keep broadcast cursors behind uncertain refill state
integration: keep appearance reads inside the existing application
wasm-glue: keep metadata names and filenames out of source
font: share an outline expansion budget across recursive work
wasm-abi: check Rust type identity before borrowing handles
complete Settings theme previews by their actual request
font: distinguish exhausted gvar work from existing traversal errors
gui: keep queued theme completion metadata compact
settings: bind Save As cleanup to its admitted values and request
gui: keep pending tab spawns alive through update admission
agent: suppress capacity for unpriced one-hour cache writes
release: preserve per-host Trust memory facts across the merge
publish: own compressor cleanup through scoped work
spend: preserve cursors when transcript discovery is incomplete
harness: revalidate switched-off snapshot claims before clearing
xtask: label keyboard replay digests as input answers
gui: carry theme trials into native page palettes
effects: bound light beam minimum to its available row
gui: name the shared coding agent harness page
verify: resolve the replay font after the tooling move
gui: preserve loaded cursor pack identities in row keys
verify: cancel and reap bounded walks output children
verify: retain output ownership through abandoned result drop
gui: honor Claude admission for usage notes
accounts: reject older credits words before extending an episode
gui: reserve every manual row key before using it
cli: read usage credits only for Claude Code sessions
cli: make the credits reader admission exhaustive
accounts: own terminal signal dispositions across spawn and wait
atpkg: exclusively own a promise temp before publishing it
atpkg: publish a readable plan before retiring its promise
atpkg: bind pending waits to observed pass generations
atpkg: use shared process liveness for promised pass owners
wasm: align band replay with deliberate status ink change
gui: revalidate async connected origins and reserve operator starts
win32-oracle: bootstrap host records without old answers
win32-oracle: require exact recorded struct field sets
gui: restore empty settings without misreading legacy lists
core: express normalized faint endpoints without exact float equality
render: a dark-theme weight nudge cannot re-grid a window at any size
control: a handoff successor no longer stands down when its predecessor's listener closes mid-probe
control: say what disconnects a handoff probe; the held dial stays queued
census: rust\_source\_views sits above the test module, so the workspace tippy gate is green
census: keep the source-view API before the test module
gui: share neutral tab booking fixture across platforms
gui: retire only the input state a Settings save owns
spec: honor compiler-validated integer suffixes
gui: yield gallery title so feedback cannot clip a card
trust: retain the updater proof floor pending attribution
effects, gui: eliminate remaining kitty cursor overlap, wall oscillation, and apron cursor leaks
dbus: include dictionary entries in container depth
trust: include macOS ancestors in the recovery probe
gui: invalidate host cursor overrides before snapshot reuse
dbus: enforce call deadlines and bound deferred messages
dbus: validate unique Hello names and explicit address encoding
wasm: fail the declaration oracle on tool errors
documents: prove clean edits with the exact observed image
dbus: refuse writes when their deadline cannot be installed
documents: reconcile save rebinds against the last exact image
askpass: fence synthetic keys before attaching the secure sheet
askpass: drain earlier keys through the documented nonblocking queue API
askpass: cast the default mode to the Objective-C pointer type
askpass: retire abandoned password requests and their native sheets
askpass: keep secret codecs and wire lines in scrubbed storage
askpass: use bounded secret transport and unbuffered password output
askpass: keep secure-field extraction and replies in scrubbed buffers
askpass: require an owner field click before admitting password keys
census: track password posting permit holds
gui, effects, gpu: scrub overlays past disjoint selection clips, seed pet caret/wall\_side early, and shift glow crowns on sub-row scroll
agent: separate code and blocker scopes in finished reports
restore: a cold restore names the conversation the record names now (LC-1) and a held tab stays the holder's (LC-8)
restore: a held tab's record names a lift the socket takes and its own agent's resume line (LC-8 review)
restore: a fleet hold stays on the live shell the PTY keeper gave back (LC-8 review)
restore: a shell the PTY keeper gave back keeps its own hold; the layout's goes onto a fresh shell alone (LC-8 amend)
harness: a tab's first look owes the settle once its screen has moved (LC-1)
report: keep incomplete searches from certifying a turn
harness: let the newest Codex card own its quota
agent: refuse Codex question fence downgrades
ai: fence the resolved git executable target
ai: retire stale window readings and recheck settings actions
ai: share restrictive fleet discovery with window settings
ai: redact captured review text before display cuts
ai: preserve repository pathname whitespace
preserve explicit empty home on self-claimed relaunches
ai: use the live session factory for Windows sign-in shells
keep holder records readable under Windows locks

Performance

3-pass latency & efficiency audit fixes with inline Clean proofs & ty\_model specs
wave2-3: O(1) ASCII BiDi/grapheme, RLE local compact, AlphaMemo bg LUT, plain-cell style memo, and inline Clean proofs
claude footer: a frame at rest costs the footer nothing; a rebuild reads only what its changed rows can move
render: keep a window's cell box per px; derive it only when an input moves
core: keep faint light ink on its linear fast path

Security

This Mac's status sits under its own row, in plain words
This Mac's status is a stop of its own under its row

Refactors

macros: separate numeric decoding from suffix admission

Tests

harness: reproduce ATERM-KI-1015-1 F1, F2's policy half and F4 (ignored)
handoff: v0.104.0's producer fixtures, written by its own cut
the foreground handback lane as aterm\_suite tests
the render desync lane as aterm\_suite tests
the handback lane asserts its forced miss, 1007 on every count, and a second handback
the nudge give-up test waits for the short and true reads, and the run gap is cast drift's
cover Trust remeasure reuse and source invalidation
aterm-phase: ATERM-KI-1015-1's narrow-pane reads, reproduced on 2.1.300 captures (ignored)
aterm-agent: ATERM-KI-1015-1 W2's decider half, reproduced on the 2.1.300 26-column dialog (ignored)
aterm-phase, aterm-agent: the round-20 review's narrow-pane misreads, reproduced (ignored)
limitpolicy: reproductions of ATERM-KI-1015-1 W1, W3 and W4 (ignored)
limitpolicy: reproduce the review's major on W3's fix — a bucket's ended countdown types into it (ignored)
limitpolicy: reproduce a resumed history's countdown record read as a live countdown (ignored)
limitpolicy: reproduce a relaunch at a left bucket notice that records no model and no return (ignored)
sub-minute budgets become typed outcomes or minute hang detectors
let-chains in the 2024-edition fabric harness, no needless borrow
the live boot refusal speaks through aterm\_spec::host::could\_not\_run
exercise per-agent off during a host upgrade read
project disabled-agent questions through the owner herald
keep disabled-agent walls and integration remedies honest
expose outbox starvation across bounded peeks
publish the wall fixture through the real timeline boundary
keep publication debt after denied dedup verification
exercise stale handover and landing claims across agent revocation
use the real adopted result for the late landing regression
bound fake instance lifetime to its fixture
own fake instance threads for each fixture
retain request log debug formatting
keep disabled own claims out of the herald suppression path
exercise revoked restored landings and denied handoff snapshots
retain instance guards through every client read
preserve UTF-8 control resynchronization on production parser
link: isolate handshake saturation descriptors
link: preserve deployment identity through uncertain role and fleet repairs
link: cover paused fleet duties and shorter-log topic opt-ins
link: keep uncertain in-flight journals pending through recovery
link: avoid cross-log delivery dedup in shorter-log fixture
gui: retain the replacement panel read completion
agent: hold a model bucket after same-family selection
link: cover human-only halts and literal person post text
link: separate signed fixture capability lines
agent: keep live limit evidence through remembered walls
gui: observe a replacement of the local timezone link
agent: seed the measured bucket before composing background work
bind local compaction and ASCII boundaries to derived models
agent: open the direct-session limit ledger before folding
spec: reject interpreter errors in requested model checks
release: attest cutter dependencies and build inputs before export
spec: reject failed AY processes and empty proof walks
render: retain the scroll fallback for a real BiDi incoming row
link: preserve mail after a broadcast opt-out race
link: release only departed sessions inbox commit debt
forge: keep renamed fork requirement checks fail closed
harness host: the review's nits on the restored-landing wait — the negative control states the contract, not the queue's ask order
gui: the kitty-flash tests read the flash's state, not the wall clock — a stalled test thread aged it to Idle
typed tricks: the cat's forgiveness is judged at an instant before the line, not at the wall clock
harness: the Autopilot Off test waits for both runs, not only both workers
update: name the explicit uninstall store without a home-path shape
link: exercise log reset debt, subject reserve and unreadable state
link: retain a listed unreadable topic during log replacement
link: distinguish missing offset directories from dangling entries
link: require an endpoint log transition acknowledgement before attachment
link: keep a recovered key winner distinct across broker logs
link: fence journaled references to the log they answer
link: retain legacy no-reference journal recovery in key regression
theme: exercise unavailable exclusive publication
link: distinguish a remembered log from this publisher identity
gui: cover fabric clocks for sessions registered after attachment
gui: assert the offset lookup metadata frame
accounts: retain a home after partial renewal publication
accounts: refuse due renewal when state cannot be read
gui: exercise login renewal opt-out before advice and commit
gui: change login policy at the account commit boundary
link: require frozen relay fixture sockets to close on drop
gui: retain renewed identities while bindings cannot be read
accounts: refuse uncertain binding identity before actions or writes
agent: inject stable process facts at upgrade restart fences
zstd: fence match distance after a literal prefix
link: bind person inbox snapshots to their head and log
link: name the inbox cursor string type explicitly
agent: change Autopilot during a busy card read
agent: preserve badge waits through refused journal results
link: refuse a known log identity whose head rewound
two-slot hold tests take tippy's slice and rfind forms
harness\_host: the lifecycle conformance sees an eager start and an uncapped fault history
atpkg: keep requested agents queued until their first install finishes
atpkg: reproduce overlapping vendor policy mutations
atpkg: reproduce fresh rider replacing a captured dangling shim
atpkg: release policy schedule at a blocked publication
atpkg: retain rider queue positions when a tuple is bumped
atpkg: isolate the dangling-primary publication fixture
serde: bind opaque type macro input to its wire encoding
gui: preserve identity directory admission before deferred priming
gui: keep an explicit Default choice on a light desktop
cli: preserve symlink targets when replacing theme exports
startup: reconcile live headless preparation with its parent
theme: retain exports whose destination resembles the temporary name
gui: bind pending theme previews to their save completion
cells: separate test-only C oracle override selection
link: retain keyed dedup and uncertain pins at budget admission
link: keep dangling reservation witnesses queued too
link: prepare reservation parents before corrupting pin witnesses
retain feature-row obligation reports under their Cargo identity
gui: retain tab order when quitting during restore
keep broadcast recovery behind uncertain refill floors
atpkg: keep unknown-size archive units off download-ahead
wasm-glue: exercise metadata and JavaScript name boundaries
recover a broadcast floor without its later cursor checkpoint
link: assert recovered floors through their state reader
font: bound acyclic outline expansion with guarded sinks
bind Settings Keep to actual queued theme completion
gui: pass the action identifier as a string slice
wasm-abi: cover class identity and generated local collisions
preserve a later Settings trial across an older Keep completion
settings: preserve Save As drafts and newer intent across completion
settings: bind Save As draft and completion ownership
gui: keep queued tab spawns outside update Commit
font: repeat the fixed charstring byte pair directly
gui: reap uninstalled tab completions before normal Quit
gui: await owned child disappearance after Quit escalation
agent: measure profile allocations without reading padding
agent: retain unpriced streamed cache lifetime evidence
agent: construct streamed usage through mutable object access
spend: retain cursors across incomplete walks and refuse FIFO caches
agent: iterate cache fixture values directly
fabric: execute the offered repair for a quoted log path
fabric: check the doctor remedy instead of raw display escaping
compile portable archive fixtures and scope Unix journal coverage
harness: keep claims created during switched-off snapshot probing
format the executable fabric repair-command fixture
gui: keep theme trials visible over terminal overrides
effects: exercise light beams in one-pixel cells
gui: follow the generic harness heading key
verify: expose output child surviving a bounded walk timeout
gui: distinguish loaded cursor pack punctuation
verify: cover cancelled result destructors launching output
gui: cover Claude admission for usage notes
accounts: reject an older credits notice extending an episode
gui: render manual key suffix collisions on both pages
cli: bind credits diagnostics to the sessions reader
accounts: expose terminal signal overlap and unwind restoration
pkg: contain seed fixture child descriptors
pkg: use spawnfd child and stream types throughout the seed fixture
atpkg: preserve promises when their temp name is occupied
atpkg: distinguish a promised pass from same-second stale failure
atpkg: expose promise retirement before a readable plan
gui: own the cell geometry reload scratch directory
themes: preserve newer sparse drafts and uncarried palette slots
themes: expose fallback Trash redirection and publication collisions
gui: exercise async connected and operator admission at landing
rustix: isolate long shm names and clean up on assertion failure
win32-oracle: expose missing-answer recorder bootstrap
win32-oracle: reject incomplete recorded field sets
gui: cover empty collection Undo and bracket-prefixed legacy lists
render: the dark nudge's advance check is still decided by size; the grid never is
forge: the first-party patch targets are pinned by their list, not a stale count
gui: cover slider default and submitted input ownership
gui: preserve newer keyboard history across a text save
spec: cover compiler-lexed Unicode integer suffixes
spec: keep floating exponents refused with Unicode suffixes
gui: retain shipped handoff consumer-loss controls
render: preserve raster and SDK oracle controls
gui: keep reverted gallery cards reachable whole
dbus: count dictionary entries at the recursion boundary
gui: restore idle cursors after real modal and vi exit
documents: retain dirty state across a content fingerprint collision
dbus: bound calls against private socket peers
dbus: refuse malformed connection identity sources
config: remove editorial rules from the schema suite
documents: track exact saved and refreshed collision baselines
documents: publish the edited journal head before saving
documents: keep a save rebind safe through the next watcher read
askpass: expose synthetic input during sheet attachment
askpass: retain request identity through caller retirement and answer deadline
askpass: reject payload-bearing unknown refusal diagnostics
askpass: expose password-field admission before an owner click
askpass: preserve sudo option and argument boundaries
askpass: preserve the off decision through unknown marker state
construct the native Enter event directly
control: cover reply erasure through actual socket delivery
agent: cover report fences, emphasis, and mixed blockers
agent: keep report items apart across fenced code
restore: reproduce LC-1 and LC-8 of ATERM-KI-1015-1 (ignored)
harness: the restored-landing crash test waits for the landing's look, not a count that moves before it
restore: reproduce the review's LC-8 findings on the held tab's record and the keeper's fleet hold (ignored)
harness: LC-1's /clear through the production wiring: the publish rings, the roster carries the screen
restore: reproduce the layout's hold seeded over the PTY keeper's fresher carry (ignored)
harness: reproduce LC-1's first look at a screen's ring owing no settle (ignored)
report: expose incomplete Codex search certainty
harness: retire quota from older Codex cards
agent: keep Codex question keys generation fenced
font: reject malformed contour and empty-edge expansion before allocation
font: exercise autohint fixed mul-div boundaries
render: run portable hint rasters on macOS
render: expose linear advance to macOS raster tests
update: give SHA fixtures exclusive private directories
lab: isolate Gemini stub fixtures in exclusive temporary directories
ai: cover settings actions after a use policy changes
ai: reject repository git hidden by an outside symlink
ai: preserve unknown fleet review restrictions
ai: retain newer login after stale review completion
ai: retain redaction across review display cuts
ai: keep whitespace repository roots bound to their change
harness: retain self-claimed Codex home identity
keep the scripted home control on its owned lock path
accept either valid environment word spelling
consolidate self-claimed home omission controls
stop the durable-file reader before reporting writer failures
bound the record-lock observer to its readable prefix

Docs

one terminology pass, the merge contract becomes the checks
say "the release set", not "every check"; review fixes
no README names aterm beside a version; astream's floors row moved
the twelve-step release in RELEASING.md
the release's re-asks, the staging tier and the seam; stale step text
host 1's uid is the fleet's root of trust
the cross-host guard, the PTY seam and the unix-only reason name only surfaces that exist
the libc generator's references name aterm-libc-oracle regen
the landed-since note keeps astream out of aterm's workspace; transport.rs has no listener
prune and correct the top-level documents
the fleet broker lives as long as the serving host's login, and the per-role remedies
plan for replacing unit tests with the specs they stand for
keeper: describe sampled metadata without an age guarantee
keep spec audit citations valid across publication boundary
an update re-offers unhandled broadcasts; dropped= counts the rest
theme: describe supported listing alias without a fixed builtin count
harness plugins design puts the agent switches on Settings ▸ Harness
harness plugins design says what the review found it left out
theme docs say what the parser accepts and what is achievable
preserve historical spec context without excluded links
askpass: distinguish implemented relay from planned security gates
fabric: the owner's hold outlives an end nobody chose; seed\_hold carries a cold restore's too
restore: LC-1 and LC-8 leave the KI list; ruling 23 names the lift the socket takes, the keeper's fleet hold and the halt's reach
approve is one level for every agent; say what "safe" leaves to a person
explain partial search and runtime identity boundaries
phase: describe the final option box clamp
font: retain modification attribution beside upstream notices
font: state the oracle coverage guard precisely

Other

build: delete crates/trust-gate, the compile-time refusal of non-Trust compilers
grid, search: delete the build-time model checks
tree: delete dead files nothing runs
lints: crate-level denies become warnings; the lint run enforces them
update-core: the release slugs are constants; delete the manifest-parsing build script
build: the root manifest stops citing profile\_pin.rs
spec: StreamingSearch's docs stop citing aterm-search's build script
update-core: delete the publish slug constants and their pin tests
spec, search: StreamingSearch's Tier-0 runs once, in aterm-spec
comments: drop stale build.rs and merge-gate wording
census: delete OB-17, the standing registries and the closure pins
census: --all runs every census, flags combine, one live-tree test each
tools: delete freeze-safety-gate and temporal-extract
census: typed verdicts and floors; the CLI prints verdicts and reruns
census: synthetic fixtures for the tests that pinned real crates
aterm-release: find the Trust toolchain with atpkg's one discovery
aterm-release: own its clean-tree judge, build-env scrub and memory probe
ship release: step 7 runs verify release, and the release owns its pass record
aterm-release: delete the LAND receipt report
ship cut: the mandatory L0 gate is aterm-census --all in the cut tree
ship provision: audit the stable std the release's cells check needs
ship release: only a FAIL from verify release is a red
aterm-release: drop the last words about gate receipts
ship release: record a pass only for a clone that stayed at R and clean
aterm-release: the clean judge never follows a link at a gitlink, nor GIT\_DIR
ship cut: name the cut tree to the census; quote pasted paths
aterm-release: say verified, not measured, of what a release ships
aterm-cli: help rust names targo --unverified verify, not tools/verify.sh
README: no merge gate; every release runs the checks
aterm-cli: pkg help names no "check run" among the lease holders
atpkg: drop the lease mirror's pin test
aterm-verify: one CLI for every check, run in place
cargo aliases: ship, forge and winsign build under \[profile.gate\]
aterm-verify: leave targo's lane banners out of finding excerpts
aterm-verify: --json names each check under "name"; test the CLI's refusals
aterm-verify: a check with several skipped rows lists each once
aterm-verify: the run says where its log is; an empty cone plans no test compile
aterm-verify: no per-stage start lines on stderr
aterm-verify: the cells check runs the forge matrix once
aterm-verify: no freeze-safety-gate in the cone's fixtures
aterm-verify: a finding's excerpt shows its errors before its warnings
aterm-cli, aterm-conformance: name targo --unverified verify, not tools/verify.sh
aterm-verify: the cells check is the foreign cells, built under the target dir
aterm-verify: a failed test's rerun line sets what its child ran under
aterm-verify: the lint gets \<target\>/verify/tippy; dead memory probe and stale words out
aterm-verify: CLI polish — one hint per usage error, refusals summarized under --json
aterm-verify: the cone lists edits an index flag hides
aterm-verify: drop two tests that pin other crates' source text
verify vocabulary: no merge contract, no tiers, no dated diaries in owned text
aterm-verify: comments state the rule, not the diary
aterm-verify: trustfmt
aterm-verify: a shorter needs column for cells
aterm-verify: an error cargo prints for two targets shows once in a finding
aterm-verify: a cells skip names its cells and the install that fixes it
census: find the checkout without spawning git; .gitignore says what the retired gate left
accounts v2 S0: the account move runs nothing under the login it moves to
accounts v2 S0: delete accounts check; a failed accounts login runs nothing
accounts v2 S0: an account move's relaunch types nothing
accounts v2 S0: a lost login after an account move is waited at, never signed in
accounts v2 S0: the design's S0 row, pointers in the v1 handoff and spec, two comments
accounts v2 S0: a lost login before any turn is the old process's; the login wait's bounds and its alert
accounts v2 S0: a lost login signed back in relaunches its tab; no way back onto a dead login
accounts v2 S0: the accounts login and signed-out texts say what the code does
accounts v2 S0: a lost login with no account left asks the owner on the glass until the move back
accounts v2 S0: a lost login is struck on its own login before any advice for its point
accounts v2 S0: the login back needs a sign-in since it was lost and keeps the canary; no shell for two dead logins; an answered move ends the way back
accounts v2 S0: a told move outlives the window and is told served where it ends; answered once struck; a lost login met at its tell and told off its track; the way back's login resumed under itself
accounts v2 S0: a told move's first point after a relaunch is its start-up; only a told row that says until=served outlives the window; T4's control holds the strike out
accounts v2 S0: a relaunch's start-up is no service for an untold move either; a typed turn ends the start-up
aterm-gui: ATERM\_RESIZE\_RUN\_GAP\_MS, a dev seam for the resize ledger's run gap
aterm-agent: RelayClient::request\_frame, and the live suites type through feed-bin
aterm-verify: the live lanes are aterm\_suite tests, so the live check goes
libc-oracle: the gate in Rust — crates/aterm-libc-oracle
libc-oracle: delete run.sh, symgate.py, negative\_controls.py and the cell-table policing test
aterm-libc-oracle: a full disk is could-not-run, not a finding
aterm-libc-oracle: findings outrank a stop, a stale lock is a finding, a symbol control
aterm-verify: the libc check runs aterm-libc-oracle
aterm-conformance: paint and spin measuring in Rust
Cargo.toml: the paint scanner and PNG inflate at opt-level 2 in dev
aterm-gui: comments cite the Rust measuring rows, not the deleted probes
aterm-conformance: a take has a whole-run budget and says why it missed
aterm-verify: the MEASURE stage runs the ignored rows and refuses an empty take
aterm-verify: the measure check runs the ignored paint and spin rows
aterm-verify: the measure check needs a passed row in each target
aterm: the handback and render-desync lanes refuse as COULD NOT RUN
aterm-conformance: the paint probe states what each capture perturbs
release: --prepare stops PREPARED after the stage; a bare run asks the live world again, then publishes
release(cli): ship release --prepare, its --help, and refused beside --forget or --abandon
release: only a claimed cut is past its prepare — a --prepare after a publish that stopped short of the claim records PREPARED anew
release: the PREPARED engine re-ask — judged by the attestation alone, a missing or rewritten staged commit stages again, handoff/ is data plane, asked once more right before the publish
release: the owner is waited on only by the half that needs the gap closed; the visible half audits once; the re-ask and a dry run's wait say what happened
release: pending\_reask names the PREPARED re-ask (tippy wrong\_self\_convention); trustfmt over the prepare commits
clippy: ban the guard's API rows in clippy.toml; spawnfd children reap themselves
aterm-gui, aterm-gpu: WindowServer doors are private, reached through one choice
aterm-agent: the upgrade record's path is private to its one writer
aterm-gui: aterm's own notification doors are named and the raw ones private
aterm-gui: handoff env names are a type the process environment cannot take
aterm-core, aterm-messages: the engine clocks are clippy rows, not source scans
aterm-time: std's clock on wasm32 is a lint on the browser cells
aterm-uds: Windows kill\_self\_now carries its abort expectation
aterm-forge: forge check enforces deny.toml's \[bans\] and \[sources\] (\[OB-18\])
comments: name the fences that replaced grep\_guard's ported rows
aterm-uds: off Unix spawnfd's Command is a type alias, not a re-export
comments: the DevToolsSecurity runner's fence is the census, not privacy
aterm-core, aterm-messages: the injected-clock rows lose their test blanket and gain elapsed
atpkg: the toolchain probes carry item-level expects, not a module allow
aterm-gui: each notification door takes what only its decider makes
aterm-gui: a handoff name leaves handoff\_env.rs only bound to a value
docs, comments: keep a past run's record as measured; drop a dead negative control
aterm-core: the shared fuzz seed's clock read is allowed, not expected
aterm-census: the source guards, one command with the censuses
aterm-gui: the AppKit menu-bar reader exists only for a windowed launch
tools: retire grep\_guard.sh, its fixtures and license\_check.sh
aterm-census: guards name test code by a path word; the cut says it runs them
aterm-census: a gated item with no trailing comma ends at its block's close
aterm-census: guards restore key-material and store-current, and hold their scopes
comments: say what scans keys now; reflow the reworded lines
aterm-release: the Trust lane is ship trust run, in Rust
aterm-release: the candidate gate is ship trust candidate, in Rust
aterm-release: the replay fixture names no home directory
trust lane: name the Rust lane and its tables where the scripts were named
trust candidate: refuse an --out targo trust refuses; a dry run creates nothing
trust\_oblig: name the reduction's function, not the verb it lost
aterm-forge: the budget's parse error names no other file
trust lane: a run files facts only for HEAD's bytes, hashed raw
trust lane: keep a fork's lockfile, name vanished floors, say why nothing ran
trust lane: the tree test's grandchild leads a session of its own
trust candidate: the guard and the preflight are what the bash gate held
trust lane: the ACL rule, a keeper that ends at once, costs kept on any end
trust lane: test a run a host's memory narrows
aterm-release: ship check is the read-only publication pre-flight
aterm-release: ship check prints a fix line only when a gate names one
aterm-release: an unresolvable cut toolchain is a could-not-run, not a refusal
aterm-release: the export guards judge by cause, on a scratch copy of the engine
Merged tree: the clippy.toml bans and the wasm census hold over main's newer code
aterm-verify: guards, trust, export and cells run the Trust tools
aterm-census: the door guards no type or clippy row can hold
aterm-gui: the harness protocol's model, progress claim and binding on main, read only on the seal lane (temporal P5)
aterm-gui: the seal island's unsafe-impl rule exempts auto traits, as Trust's does
xtask: a cross cell's GREEN line says it was linted for the clippy.toml bans
accounts v2 S3a: the usage tap on the machine's own login, opt-in by \[harness\] usage\_tap
accounts v2 S3a: a silent tap's line ends with its process; a reading not taken is tried again; the tap's promises say what is true
atpkg tests: the assessed programs' directory is canonical
release: the cut reads R's tree-only gates from the release, never re-runs them
pre-promote: ask the running release's own cutter, build none
release: twelve steps — the real stage first, two audits, READY
release: step 4's work and the fixture generator run beside the long ones
release: list the step children's notes from one read\_dir
release: one plan\_print arm for step 4
release: a judge that cannot answer stops a resumed run at step 4 too
release: audit 2 before every fresh cut, the publish skipped or not
release: ask the staging tier again before the publish; stage R again if it moved
release: audit 1 after the candidate, and on every re-exec; withdraw an unjournaled ask
cut: require the guard and census facts; re-ask the two gates that read origin
release: refuse at step 4 an engine with no pre-promote seam
release: one child starts at a time, process-wide
release tests: a cut call is cut <args>, not the audit's cut-gates; trustfmt
aterm-census: the guards read the checkout's scripts; core-signal and devtools-door whole again
verify trust leaves this clone's heavy libraries to the release; cells name each skip's fix
install.sh: follow atpkg's build-dir targo shim to its last-line exec
aterm-agent: the usage tap's mode and symlink checks are unix-only in its tests
aterm-release: step 4's census line says the source guards passed too
atpkg-publish: the producer crate's skeleton, and its design
atpkg-publish: the arch gate and the tar writer, in Rust
atpkg-publish: the lineage receipt switch, read from the trust repo's live main
atpkg-publish: the manifest writer and the signing ceremony
atpkg-publish: the pack's toolchain and its external tools
atpkg-publish: the trust bundle's frozen rustc-dev and rust-src closure
atpkg-publish: pack, the plain-program packer
atpkg-publish: pack-bundle, the sysroot-bundle packer, as a typestate
atpkg-publish: build-local, the development build
atpkg-publish: retire the WP1 shell suites and their gates
atpkg-publish: a proven seal's LINEAGE end to end, and the staged hello
atpkg-publish: a bundle pack holds its program's lock; PROCESS.md drops the atpkg check
atpkg-publish: the review's fixes — the admitted sysroot, one trust repo, offline signing
aterm-verify: rewrap the merge-contract help line the AtpkgTooling removal left long
atpkg-publish channel: index, mirror, publish-group, status and the gh host in Rust
atpkg-publish channel: retire the shell index tooling it replaces
atpkg-publish channel: reads need no channel token, and leave nothing behind
atpkg-publish index: the compare-and-swap compares in scratch, not in --out
atpkg-publish channel: a lapsed head is re-signed, the gate's reason is read, review fixes
atpkg-publish cli: the channel verbs' synopses name every flag they take
lane: the Apple lane and the lanes' shared state, holds and reports in Rust
lane: the Linux lane, the snapshot install and its units, proven in Rust
provision: acquire the stock exceptions; bootstrap-publisher.sh folded in
provision: acquire under the build-stack header, before the checks it feeds
host: fetch\_repo — a scratch clone is fetched as the host's identity
lane: sign only what is proven — verified bases on both owners, a live key, the head's groups
lane: the snapshot is the tree it names; state that survives the migration
lane: delete the shell lanes and the suite that drove them
provision: acquire over an injected rustup, proven against a stateful one
docs, cli: the lanes' signing rules as they now stand; the lane synopsis whole
lane: one check that a signed pair is the program and build it claims
atpkg-publish: the group's trust repo reaches its packers; one roster election
atpkg-publish: one signer check, every head key carried or refused, one exposed list
tools: the last atpkg producer scripts go; every reference names the Rust verb
atpkg-publish: a release's SHA256SUMS is read under its own bound, not a manifest's
trustfmt: the integration's own edits, formatted
trust floors: atpkg-publish measured at 555/3239 through the lane
aterm-link: one mint-secret reader, and on reads the modes it reports
aterm-link: the one-host broker fabric on runs is guarded
aterm-link: a supervised broker rolls onto a replaced build
aterm-link: join takes a ring that expires, and mint-for --expires
aterm-link: tidy the broker's exe watch and guard note
aterm-link: on reads the rendezvous file's mode before it says 0600
aterm-link: one connect, bounded from the dial to every read and write
fabric tail over granted faces: a rendezvous hand-off, not an unbounded queue
aterm-link: back off a link that did not stay up, with jitter, holding nothing
aterm-gui: build.rs reads pins.rs by #\[path\], not an aterm-update-core build-dependency
aterm-spec-macros: drop syn's extra-traits; delete the dead syn/quote/proc-macro2 workspace rows
aterm-http, aterm-net: one provider() seam each; ring is one workspace row
harness: a person's own exchange is theirs — no token needed to answer a greeting
aterm-link: a roster read that did not finish is "unknown", never "nobody advertises it"
aterm-link: the routing read folds in the records its Last walk omitted
aterm-link: the fleet-halt splice folds newest-wins on offset
aterm-link: the attach answers the halt it applied from the Last snapshot
aterm-link: key the sender's refusal notice on the offset it answers
aterm-link: correct three comments about what astream does
vendor/astream: integrate the first-party capability digest
release: check source signing before a fresh cut on resume
forge: classify the bus digest without requiring the retired sha2 graph
bridge\_recovery: wait for the halt-acked watermark before deleting it
Fix audit findings in shared policies and resource boundaries
Record measured search and selection obligation totals
Account for vendored modification notices in source measurements
Keep the GUI ABI census attached to sends after module extraction
Refresh dependency measurements after the bus digest merge
vendor/astream: bump to 9a8a6c2 -- astream-cap hashes with astream-digest, not sha2
aterm-forge: bill a vendored first-party crate's dependencies, tested on a built edge
aterm-link tests: say what deleting halt-acked sets up now
atpkg: vendor versions gain the revision tier (x.y.z-R\<n\>\[.\<s\>\])
atpkg: sha512 as an alternative payload digest (D4)
atpkg: the tar-gz-binary payload lane (one file of a gzip tar at bin/\<entry\>)
atpkg: a vendor row may declare an exact URL query and never have been index-pinned
atpkg: a sha512 sighting still writes an empty sha256
agy and muse outside atpkg: shell twin watch, table-driven agent predicates, copy
atpkg: agy and muse join the vendor-direct agents
atpkg: a wanted vendor program serves the seed without the index
vendors: one candidate builder, laid-only shadowing, whole four-agent titles
atpkg: seal a single-binary build's bin/; a pass keeps an unread vendor head's download
atpkg: agy/muse digest logs survive older clients; muse logs after its pin
atpkg: say what the seal does not stop for agy install
aterm-gui: the frozen-tab note's widths follow the product-name title
release: use descriptor-isolated children across parallel work
link tests: accept the supported entropy fallback in backoff checks
aterm-objc: add cf and cg, CoreFoundation/CoreGraphics held to the SDK
winit: call CoreFoundation/CoreGraphics through aterm\_objc::cf/cg
aterm-objc: say what cf's opaque types are
aterm-forge: the mac rows and winit's marker floor as the CF/CG carve left them
aterm-objc: the cg feature's comment says what feature unification does
aterm-objc: the GUI sent-prototype census walks app\_menu\_bar.rs
aterm-link: one state dir is one bridge — hold it for the bridge's life
aterm-link: bound a bus-supplied presence inc= below astream's reserved half
aterm-link: a deduped answer to a just-reserved sequence is a collision
aterm-link: a reader thread that cannot start fails the attach
atpkg-publish: lane install refuses a missing machine record; two refusals read as one line
help fabric: stalled says when it shows and how the bridge's jittered back-off redials
aterm-link join.rs: a forged human's lift withdraws that human's halt, not every halt
winit: cut the Android, iOS, Orbital and Web backends
winit: drop the unused startup\_notify extension
winit: print the platform cfgs from build.rs, retire cfg\_aliases
winit: count key-text graphemes with aterm-grapheme, not unicode-segmentation
winit: hash the Wayland backend's maps with aterm-hash, not ahash
winit: decode X11 drop URIs with the backend's own helper, retire percent-encoding
winit: define SmolStr in the fork, retire the vendored smol\_str
aterm-release, aterm-census: drop smol\_str's floor and winit's iOS exemption
winit: carry the modification notice on every file aterm changed
winit: review tidy-ups — SmolStr's invariant, stale pointers and docs
aterm-forge: re-pin winit's marker floor for the trim and the CF/CG carve together
Preserve agent aliases in frozen-tab guidance
Report a sequence collision as a stalled fabric link
lz4: remove unsupported total contracts from partial sink operations
gpu: settle resident atlas readers before CPU uploads
gui: reconcile predictions against untouched logical cells
aterm-link: a standby bridge is neither the proof's instance nor the retirer
aterm-uds: the /dev/urandom fallback waits for the seeded pool, as getrandom 0.2 does
getrandom: first-party getrandom 0.2 over aterm\_uds::rand, patched under ring
aterm-uds: the readiness poll declares bionic's nfds\_t as unsigned int
getrandom: the macOS row names aterm-uds's /dev/urandom fallback
cleanup(phase): trim aterm-phase's dead API, trait boilerplate and policing tests
cleanup(supervise): drop copied defaults, the footer mode copy, word registries and free-text retry matching
cleanup(harness): drop dead paths, duplicate helpers and policing tests
cleanup(harness): review fixes
cleanup(gui): fold the harness row tests, drop dead registries and pins
cleanup(gui): review fix: the harness row test checks the rebuild against the reader
cleanup(atpkg): doctor reads primer's Claude defaults; dead params, checkers and duplicate edge tests out
cleanup(atpkg): review fixes
aterm-link: on re-mints a node cap its guarded broker would refuse
aterm-link: test that on --service systemd refuses an unmanaged broker
lab: the real-Claude lab as a Rust crate (crates/aterm-lab)
lab: Claude Code's screen text from aterm\_phase::anchors; footers accept the bypass dialog
lab: retire tools/real-claude-lab, capture-claude-screens.sh and harness-capture.sh
lab: dated measurements name the real-Claude lab, not a crate that did not exist then
xtask perf: every lane selectable, typed outcomes, the arena and wasm lanes in Rust
docs, comments: point at the xtask perf lanes and crates/xtask/golden
xtask perf: only the floor lanes decide whether the trend appends
xtask perf: the arena lanes run end to end and clean up after an interrupt
docs, census: name the perf lanes, not the scripts they replaced
xtask perf: a re-record excuses only its own lane's trend breach
xtask perf: an unusable baseline fails, and a lane that judged nothing says so
xtask: the interrupt test hands its runner the default signal disposition
xtask perf start: the worker and GPU drill-downs are summarised again
xtask perf compare: RFC 3339 run timestamps; drop an unreachable refusal
xtask perf: the arena ledger template is read before any trial
aterm-spec: models register themselves and declare their bounds
aterm-spec: the Trust checkers run from spec-check, never ambiently
aterm-spec: test that writing a model registers it
aterm-spec: drop the per-test copies of the non-vacuity sweep
aterm-spec: the model workflow names uncaught laws and spec-check
aterm-spec: spec-check counts uncaught laws, it does not list them
aterm-spec: a vacuity audit finding names the reason, not ty's transcript
ay: each obligation declares its verdict; spec-check walks the bundles
aterm-spec: models declare their scenarios; each law is what it declares
aterm-spec: drop two tests left with empty bodies
aterm-spec-macros: #\[refines\] requires its projection
aterm-spec: spec-check holds its controls to the real tools
aterm-spec: spec-check's doc names how test obligations run
aterm-spec: a violation step must break a law from a lawful state
aterm-spec: the checker run is a feature, not an environment variable
aterm-release: ship dev-app builds this checkout into aterm (dev).app
aterm-release: dev-app's tool calls take their words and paths as one argument list
aterm-release: dev-app takes its targo from the cutter's resolve\_targo
aterm: the words that said tools/dev-app.sh name targo --unverified ship dev-app
tools: delete dev-app.sh, dev-sign-id.sh and test-dev-sign-id.sh
aterm-release: dev identity tests pin the keychain settings and read this Mac's keychains
aterm-verify: the delivery roster drops test-dev-sign-id.sh and its run-alone lane
atpkg: comments name ship dev-app, not the deleted tools/dev-app.sh
aterm-release: dev-app pins its build to the plist's stamp and scrubs CARGO\_BUILD\_TARGET
aterm-release: site and transforms ported to typed Rust (not yet wired)
aterm-release: ship site and ship hook — the publication hooks and the site deploy in Trust
publish: site-sync.py and the two shell suites deleted; docs name ship site and ship hook
aterm-release: a signalled pre-promote check exits 128 + its signal
aterm-verify: the delivery stage drops the two suites ship site and ship hook replaced
aterm-release: the site tests name a neutral site layout
aterm-release: the site sync keeps the release's child rules, and says what it did
aterm-release: the export transforms run as the captured commit's own code
aterm-release: the commit's own cutter command is built in one place and tested
aterm-update: install.sh's tests as a Trust integration test
aterm-update: install.sh's Linux verifier held to the updater's chain
aterm-update: install.sh's source-build cargo gate under test
tools: retire install.sh's bash and Python suites for the Trust tests
aterm-update: the cargo gate through a case-changed checkout path
aterm-update: name install.sh's real floor in its tests' doc
aterm-update: install.sh's verifier tests fail closed and reach every binary check
aterm-update: install.sh's tests fence what the bash suites fenced
libc-oracle: the binding generator is aterm-libc-oracle regen, in Trust
libc-oracle: regen writes nothing until every cell generated
Verify pinned publication identities before accepting retry offsets
fabric: remint root node caps when their mint secret changed
link: watch the broker invocation across executable replacement
Keep grant grammar checks in combined cap validation
Resolve bundle staging paths before changing probe cwd
Keep bundle admission sysroot when skipping hello
Keep publisher snapshots alive until service arming succeeds
aterm-link: the sealed rung is a required-features target, so its arms are linted
aterm-forge: delete the real-checkout OB-1 unit test that attest already runs
aterm-verify: a vendored change selects its dependents from the graph, not the workspace
aterm-release: a release refuses a submodule pin its declared branch does not carry
aterm-release: the Trust lane discovers forks from every feature's graph
aterm-verify: say that a cone seed can be a vendored package
smallvec: replace the registry crate with a facade over aterm\_alloc::SmallVec
aterm-link tests: the harness mints the shipped node ring
aterm-link tests: polled bus reads share one healing read connection
aterm-link tests: an outage is observed before it is asserted on
aterm-link tests: the will is followed across a broker restart, not only a kill
aterm-link tests: what must not happen is counted behind a barrier, not a pause
aterm-link tests: two vacuous crash tests go, the refill test proves dedup
aterm-link tests: astream's own contracts are astream's to test
release: fetch declared submodule branches from refs/heads
aterm-types: fabric\_grammar, the one definition of the fabric's words
aterm-link: subject, body and the bridge take the grammar from aterm-types
aterm-gui: the endpoint checks the fabric's words by the one grammar
aterm-agent: the mail lane names kinds from the fabric grammar
aterm-census: the guards' script floor sits below what the ported tree holds
transforms: say what the lock pruning buys, as measured
aterm-census: installer-network fences install.sh's fetches to web\_curl
aterm-spec-macros: pin the anchor records the attribute tests collect
aterm-spec: absorb inventory into aterm\_spec::registry
aterm-link: a fleet halt is applied between the requests of a long duty
aterm-link: a replaced bus log lifts no fleet halt
aterm-link: an observer answers no halt, holds no inbox cursor, and is no node's twin
aterm-link: the presence retirements read the whole face, not the walk's rows
libm: first-party facade over std replaces the vendored libm fork
document-features: no-op proc macro replaces the crate behind wgpu
unicode-width: UnicodeWidthChar over aterm-grapheme replaces the crate behind naga
libm, core\_maths: docs say libm is first-party and atanh is std's own
aterm-link: the merge's state import, formatted
aterm-spec: the registry holds only Sync values
aterm-gui: name the registry, not inventory, in the xref gate
aterm-scrollback: cold tier on the LZ4 codec, zstd feature deleted
pkg-config: un-fork to the registry 0.3.33 copy
aterm-census, aterm-forge: delete the userless build-dep-only fork class
Separate publisher baseline, quad emission and upload stages
Preserve atanh precision near negative domain boundary
link: refuse observer takeover when a local holder pid is unreadable
aterm-wasm: keep the binding module's import order its gpu-web twin mirrors
harness: an upgrade record whose agent word this build does not know is no record
aterm-phase: Program names its product, and identify dispatches a named program through its reader
harness: a \[harness.\<agent\>\] switch in the policy, and the lanes table
harness: review fixes for W4
aterm-spec: the harness host's worker and leave models gain the per-agent switch
aterm-spec: review fixes for W6 (the harness host models' per-agent switch)
atpkg: VENDORS is the one agent roster; the names, verbs, stub lines and activation set derive from it
aterm-spec: the worker model's switch-off mutant is Start's own Buggy branch
aterm-zstd: XXH64 and a raw-block frame writer, held to libzstd
atpkg: test fixtures write their .tar.zst frames with aterm-zstd
serde corpus: record answers on registry serde for every persistence surface
serde corpus: read a CRLF answers file as the LF one it is
serde corpus: one answers file for every host: '/' desk ids, LF inputs
serde corpus: its own bless variable; every edit through the once-only assert
serde corpus: toy-pack overrides in key order, not the hash table's
serde corpus: record a readable fabric carry, the ambiguous gate, an escaped key
aterm-gui: seed the alt-screen shed fixture under half its budget on LZ4
link: service urgent halts between last-value pages
trust: record completed link measurement at 565/2952
verify spec: run the ty-only conformances beside spec-check
xtask perf wasm: label the stock build STOCK EXCEPTION
integrate review: cone, publication pin, dead code, a stale citation
aterm-link: hold astream's capfile::Line as Cap, and redact Config's token
aterm-link: attach a whole ring under one Hello (Client::attach\_all)
aterm-link: name a broker refusal by its code, not by ErrorKind::Other and its words
aterm-link: retire a post or receipt the broker refuses for good, and keep draining
aterm-link: long-lived subscriptions read with recv\_live, so a silent link ends them
vendor/astream: bump 543f4bd -\> dc7c7d1 (astream main)
aterm-link: the attach\_all call sites, as trustfmt writes them
aterm-link: a refusal not known to be permanent holds back only its own session
aterm-gui: outbox takes the sessions in turn, so one full queue is not every drain
Cargo.lock: pin tempfile's getrandom to 0.3.4, dropping the 0.4.2 tail
winit: KDE blur behind an off-by-default feature, plasma off linux
aterm-update-core: pin the Linux SHA-256 arm's answers from ring
aterm-update-core: Linux SHA-256 on aterm-digest, not ring::digest
harness: a relaunch snapshot names its agent, and the relaunch and upgrade-drive gates match on it
harness: upgrade status, watch and resume answer each agent by an exhaustive match
supervise: a Codex lost login types nothing and escalates with codex login; the policy's agent gates are exhaustive matches
supervise: the engine loops answer every per-agent question with an exhaustive match on Program
aterm-gui: every per-agent gate outside the harness host is an exhaustive match
aterm-render: record the font oracle corpora and pin them (TF.1)
aterm-render: commit the font oracle's recorder; spell out the hinting digest (TF.1)
aterm-render: shape every face the font\_features gate reaches; pin non-default instances (TF.1)
NOTICE: name the COLR v1 test fixtures' Apache-2.0 terms (TF.1)
harness: Claude Code's idle compaction ends no turn
harness: read the worker's last words through an idle compaction
aterm-phase: format the idle-compaction see-through
aterm-gui tests: size the alt-screen history by the bytes the store holds
aterm-gui: prune and correct its documentation
aterm-primer: prune and correct its documentation
aterm-link: the group-record waits in the bridge tests are hang detectors again
aterm-census: the guards' script floor sits just below what the tree holds
aterm-link: launchd is asked by the gui/\<uid\> domain it writes to, and a login with no such domain is refused by name
aterm-link: doctor's remedies are spelled for what the host is, and on will not take a host out of its fleet
aterm-link: a broadcast the gate refuses is read past by every frontier cursor
aterm-link: a broadcast catch-up pages one owed topic over its own filter
aterm-parser: drop the test-only batch path and tests that sample no spec
aterm-link: a bridge answers a fleet halt only with the state its holds reached
winit: headers, upstream's rustfmt style and lint-clean code, ahead of the re-home
aterm-window: re-home vendor/winit as a workspace member
aterm-window: repoint the vendored-winit wording the re-home left behind
aterm-link: a person side for the fabric — mint-for h-\<name\>, and aterm fabric halt|inbox|post
aterm-link notify: ask:\<person\> pages on an ask addressed to that person; a selector no cap grants is refused
aterm-link: Bridge::new checks its node against its cap, and refuses one minted for another node
aterm-link, aterm-cli, docs: what lifts a fleet halt and reaches a person names the command
aterm-link tests: the sealed two-host test tails the guarded broker through its faces
aterm-link: aterm link's usage names the person selector and the ring mint-for makes
aterm-cli: the fabric verb's front-door line lists halt, inbox and post
aterm-link: mint-for's expiry stamp takes the grant without a needless borrow (tippy)
aterm-link: a face at its mailbox bound pauses; its reader never sits on an unread socket
aterm-link: a subscription the broker cut while it answers reads cut-\<face\>, not closed
aterm-link: hold the broadcast face only while a local session has a topic
link/fabric status help and the manual: name the cut-\<face\> reason
aterm-link: a bridge whose aterm is gone stops at the next step
aterm-link tests: a bridge run through an update's ordering
aterm-link: the state dir flushes only what a power loss would outlive
aterm-link: a relaunched bridge re-learns its own in-flight offsets before it judges any
devtools: one spelling of the hand-over's words, and a decline marker
devtools: the digest line in atpkg's words, a Security capsule, and two window fixes
devtools: one hand-over lane for every origin, its quiet moment, and the panel's model
devtools: a DEVELOPER TOOLS status card leading Settings \> Security
devtools: the helper panel on AppKit, beside System Settings, with aterm to drag
devtools: the helper panel comes in front only while System Settings does
devtools: aterm ctl devtools hand-over [now], and doctor asks the window first
devtools: record the panel, the card and the verb; manual, help and changelog
devtools: one spelling of each step, and doctor says what is true
devtools: the status card never cuts its state short, and every press hears how it came out
devtools: a row already on while macOS still checks is never "done"
devtools: a failed spctl run reaches the panel and the Settings bar
devtools: judge the quiet moment again when a spctl run ends
devtools: an automatic hand-over refused as unknown can ask again
devtools: a panel with no icon leads with +, and learns a late subject
devtools: the live panel hides for a minimized Settings, spends no drop outside it
devtools: the digest line follows what the list holds of aterm
devtools: the status card never cuts its state sentence short
devtools: the status card says which switch matters and when Not now holds
devtools: doctor honours Not now in its own open, and a stale window verdict
devtools: say what Open Developer Tools… does on an empty list
devtools: one copy fence for every surface, a lean state table, Linux-clean arms
devtools: leave a listed-on row alone, judge a drop by its image, hide on a lost window
aterm-gui: devtools names ship dev-app, which installs the dev bundle
aterm-gui: a keeper-recovered session comes back with its fabric
aterm-types: the hold and post help say what a keeper crash recovery carries
aterm-ctl: a cut post says a crash does not carry it, and so does the gone note
aterm-link: a login with no systemd user manager is refused by naming it, before the unmanaged-broker check
aterm-core: name the plain-cell style memo's key and value types
aterm-gui: deliver checks the session's own topic set and refuses a dropped topic
aterm-gui: inbox seen and a parked inbox get @\<off\> wake the push lane
fabric: inbox seen reports the addressed lane's refill floor, and the bridge persists it
aterm-gui: a seamless update keeps dropped= and counts the unread broadcasts it drops
aterm-gui: rewrap the fabric comments the floor edits left over-long
aterm-cli: rewrap the topic-drop sentence to the help page's width
devtools: the docs say what the hand-over and the panel do
capabilities: hold the token seals and the mint seal by type; delete their source scans
aterm-spec: delete foreign\_facts\_are\_observed
aterm-objc: delete the send censuses and the objc2 exit-condition count pins
shims: delete the once\_cell and core\_maths consumer tripwires
triples: delete the two cross-tree roster tripwires
aterm-update-core: delete the env\_reads registry
web bindings: one source for the six shared modules; delete the parity test
aterm-types: delete the control-verb prose and registry pins
aterm-cli: delete the help-page prose pins
aterm-primer: delete the block-budget and no-hook word pins
aterm-link: deny unsafe\_code instead of counting it in the source
aterm-spec: delete the fabric Tier-1 pointer pin
consent card, exception digest: delete the banned-word and copy pins
control: a verb with no dispatch arm is refused, never a panic
aterm-types: hold the short catalog's byte budget at compile time
aterm-census: the launcher-mint guard keeps the root mint in the launchers
web bindings: one facade body for the 81 exports both terminals share
aterm-objc: a debug build checks every typed send's prototype at the send
atpkg: every published triple is a forge cell, checked on typed data
aterm-link: the screen-reader law is a forge ban; say what deny(unsafe\_code) holds
atpkg: name the anchor test for what it checks
fabric tests: the world suites run the one aterm binary from crates/aterm
render tests: checked-in faces, and a typed could-not-run for the host's
gpu tests: the fixture face on both backends, and no GPU is could-not-run
fabric: format the injected fence-wait call sites
effects tests: no hidden tools behind #\[ignore\]
render/gpu tests: could-not-run only on host facts, checked-in faces elsewhere
gates: the test run waits on no lane, fence\_wait is the one fence bound
perf gates: release benches, not #\[ignore\]d tests
gpu tests: one constructor that tells the host's lack from the code's
aterm-release: decide the cutter's identity at cut time, delete its build script
workspace: default-members leave out the publication tools and check runners
clean\_islands: the owning crates' build scripts ask the compiler
test seams: debug builds carry them, so dev dependencies stop flipping features
aterm-release: judge the cutter as it starts, and refuse another checkout's build
aterm-verify: the changed-crate cone reads every member, not the default ones
build: rust-analyzer keeps going in its own target dir; stale references
aterm-release: a test that the cutter's verdict is never taken after its start
w4a: after the three merges — formatting, two AGENTS.md rules, stale mentions
fabric\_world: main's joined-root test drives aterm link broker|serve
Foreign cells type-check again: islands stock can parse, two unix-only gaps
vendor/astream: bump dc7c7d1 -\> aa9fb85 (astream main)
aterm-link: the will's TCP connection keeps alive, so a vanished host is marked gone
aterm-link: a broker that cannot be talked to says why — another protocol, or its own last word
aterm-link: offsets are one log's — a log of another identity forgets them all
aterm-link: a subject only this node writes, past its budget, is retired; topics keep a reserve
aterm-link: a re-base still owed is judged against what this process knows
aterm-gui: after a log switch the addressed refill floor is the new log's
aterm-link: the reserve test's one known subject is a slice of it, not a clone (tippy)
aterm-forge, aterm-census, xtask: a renamed \[patch\] row patches the package it names
windows-sys: first-party windows-sys 0.52 for ring, under a renamed patch row
harness: a person's question is theirs though its answer takes minutes
harness: a wall splits a job, it never makes it an exchange; primer keeps a job's token
aterm-core: name the plain-cell style memo's type
aterm-link: only a human halts the fleet — an a- service's cap holds no halt row, and every node takes a human's task
aterm-gui: the config watcher's thread runs a named fn, so the stamp source is made in a madeBy body
aterm-serde: carve serde\_core 1.0.228 and serde's derive support into a std-only member
trust: record aterm-serde's first floor at 295/1818
aterm-serde: keep the ported suite inside aterm's attribute set
aterm-serde: pin the duplicate-tag error and the preallocation cap
aterm-link: a kept sid listed after the attach resumes from its topic cursors on disk
specs: recover the specs behind 8,350 tests in 21 more crates
aterm-link: the one writer onto aterm's lane refuses a line aterm would misframe
aterm-link: only the recipient's verdict books a refused delivery; a lane fault keeps the record owed
aterm-link: a roster the endpoint cannot list in is named once, not served; its rows read past added columns
fabric: the bridge and its instance name their lane grammar and build to each other (hello)
fabric: fabric attach arms only the command the instance's config names, never one the Owner token picks
aterm-link: the build-skew remedy names the host's own on, as every remedy now does
fabric: hello takes its place in the verb table's derived sets
aterm-forge: RowScope's doc names RowScope; in\_row\_scope says it reads the key alone
aterm-link: link log is bridge lane 2, written only to an endpoint that reads it
atpkg: bulk SHA-256 on ring's hardware digest (archive digest and extract fold)
aterm-digest: SPECS.md §5.3, the stale "compiled by path" claim, is done
aterm-digest: SPECS.md §5.3 names the date it closed, not a branch that is deleted on landing
aterm-effects: delete 30 tests that sample no spec
aterm-grid: delete 224 tests that sample no spec
aterm-core: delete 24 tests that sample no spec
aterm-messages: delete 3 tests that sample no spec
aterm-types: delete 17 tests that sample no spec
aterm-search: delete 45 tests that sample no spec
aterm-selection: delete 8 tests that sample no spec
aterm-grapheme: delete 21 tests that sample no spec
aterm-vi: delete 8 tests that sample no spec
aterm-regex: delete 1 test that sample no spec
aterm-predict: delete 1 test that sample no spec
aterm-rle: delete 1 test that sample no spec
aterm-alloc: delete 1 test that sample no spec
aterm-digest: delete 1 test that sample no spec
aterm-lz4: delete 1 test that sample no spec
aterm-sixel: delete 1 test that sample no spec
aterm-log: delete 2 tests that sample no spec
aterm-link: a broadcast on a topic the session dropped is its verdict, not a lane fault
Require the explicit serde corpus blessing value
Exercise the intended serde corpus field shapes
phase: preserve indented worker words through idle compaction
phase: stop attachment backtracking at blank rows
Correct current Trust and export documentation references
Show the package selector in Trust lane help
aterm-link: expose unconfirmed halt acknowledgements and missing retry
aterm-link: confirm all live holds before acknowledging a fleet barrier
style(link): format the isolated saturation helper
build: lock the model conformance test dependencies
aterm-release: main's export-cutter attestation test expects \<target\>/pre-promote
themes: stale comments and docs say what the code does
aterm-core: config/theme changes move the colour baseline; program-set colours and the kitty colour stack survive
surface refused OSC 4/21 palette sets once; default stays off
aterm-types: the themes folder is derived from the aterm.toml directory
theme catalog: every skipped file gets a row, caps apply after filtering, truncation keeps a prefix
aterm-types: one ThemeSelector grammar for dark:/light: values
one dark/light classifier: renderer, effects and web use ink::bg\_is\_light
aterm-render: Theme derives PartialEq/Eq/Hash and converts from ThemeParts
theme parser: duplicate keys, DTP spellings, #RGB, description/author, foreign-format hint
ink: ensure\_contrast picks its anchor by the contrast it can reach
band: warn and error inks seed from the theme's ANSI yellow and red
tab strip: floor the accent at 3:1 and stop calling the text floor AA
find: highlight-all is a visible tint, apart from the current match
matrix rain: hue = "theme" falls back to the accent on a neutral fg
aterm-gui: Config::resolved\_colors resolves the theme and every colour override once
themes: ThemeMeta on catalog entries; built-ins carry description, pair and Default Light
themes: aterm theme import converts other terminals' themes into a native .conf
theme colours: #RGB needs its #, so a bare word stays an error
aterm-gpu: the Metal path takes the NSView from aterm-window; raw-window-handle leaves macOS
Retire Smart Titles (title\_summary): every chrome label is the title alone
Retire Smart Titles: fix the review's residue findings
aterm-http: delete the request/response half Smart Titles left callerless
trust: aterm-http's floor follows the deleted request/response half
aterm-http: the probe's handshake is the crate; drop the stream it never used
aterm-http: restore the request/response half for aterm-lab
aterm-gui, aterm-link: a receipt for a row of an earlier log is retired, never published on the new one
aterm-link: an in-flight record decided on another log is dropped at the re-base, never republished
atpkg: discovery asks its HEADs in rounds, quads and manifests at once
atpkg: pin that the fetcher's walk and the set completion really go out at once
aterm-render: take rustybuzz types out of the public API (TF.2)
aterm-render: read the hinted advance and the unhinted LCD outline off skrifa (TF.2)
aterm-render, aterm-gui: font\_hinting = native renders as light (TF.2b)
aterm-render: pin the hinted advance on a face whose width moves with wght (TF.2)
docs, aterm-render: list TF.2's sub-pixel deltas for acceptance (TF.2)
atpkg: a session's detached passes run at utility QoS, like the window's
new tab: an unanswered network folder starts in home; zsh/bash integration forks less
spawn folder: a failed home folder is asked about once; the zsh tty comment says which bodies defer
accounts v2 S7: the login lifecycle — renewal through a staging home, waited-at ended logins, one ask per machine
accounts v2 S7: one machine deep per sitting; a renewable login never signed in where it stands; renew named where it signs in; the default login stays the own row's; staging homes claimed outside the label space
accounts v2 S7: a login a renewal replaced is never sent to renew again; the tab is told what still holds it
accounts v2 S7: a renewal made while its escalation stands decides the point again; renew names the master switch
accounts v2 S7: a renewal made under a wall is waited for, not asked again; a superseded login's end strikes nothing
accounts v2 S7: a superseded login follows its renewed one whatever the account's usage
accounts v2 S7: the opener's profile is internal protocol; a module a test-only file declares is test-only
accounts v2 S7: no follow onto the same account at a usage limit; one account's tap readings are recorded
accounts v2 S7: at a usage limit a session is its account's; the tap follows the one account through its renewals; the off switch's docs name the real gate
accounts v2 S7: \[harness\] hosts names the machines; renew says sessions move at their next idle turn end
spawn folder: trustfmt the home-check test
spawn folder: say where a hung network home still holds the child
aterm-zstd: recorded CLI frames for the decoder, held to libzstd
aterm-zstd: the decoder, carved from ruzstd 0.8.3, held to libzstd
xtask perf: a zstd decode floor (aterm-bench zstd\_decode\_harness)
aterm-zstd: a cargo-fuzz target for the decoder (STOCK EXCEPTION)
aterm-zstd: recorded RLE-table and 9 MiB-back frames, held to libzstd
aterm-zstd: Decoder docs name each check libzstd skips; stale zstd notes fixed
aterm-zstd: literals header read as fixed-width words; floor 157/720, reproduced
aterm-gui: a post still queued at a log switch lands on the new log and keeps its re-id
aterm-link: a log switch forgets the inbox-group debt the old log owed
harness: Autopilot — the \[harness\] autopilot key, Land's turn ends, and Off's park in the loop
harness: what the harness did, folded from its ledgers for Settings ▸ Harness (Autopilot slice A2)
harness: the harness card's pure emitter (rainbow border, pixel-art kitty, trail, stars) and its motion and serious-mode entries
harness: Autopilot and its stats, the review's findings — Off gives the claim back, Land's answers and ends, a person's wait while a badge stands
harness: review fixes on the card locator and the harness card — a narrow banner is refused whatever follows it, the card's version, a kitty clear of the border, an owed episode, a final deadline and a pane clip
harness: Autopilot in the window — the session's word, the host's Off, status and ls, Settings ▸ Harness and the API the chips build on
harness: the review of … — Off published before any start, the disk watch and the exit read hands-off, an Off restored drop clears its word, a real let-go caught
harness host: the review's nits on … — the design names every Off skip, the probe pauses while a pass publishes, the measured flake rate
harness: Autopilot's second review — Off's panel gets one plain close, a park takes the loop's badges down, every badge's end is journaled, Land's rules are the policy's, a holder is said once
harness: second review on the card locator and the harness card — a bare narrow banner only at the narrow column, the version from the banner row itself, a bounded settle ask, nothing drawable holds the episode, an owed episode lapses
harness: the Autopilot and ⚙ chips in the rule under Claude Code's input box
harness: Settings ▸ Harness as its own page — switches, each session's Autopilot, what the harness did, the A/B wait share and the effective table
harness: the harness card on the glass — Claude Code's launch card wears the rainbow border, the kitty on its trail and the enhanced by aterm harness line while the harness carries the session
autopilot: the merged surfaces settle the API's dead-code allows — default\_mode had no reader, ALL is the tests' sweep
harness: Autopilot's third review — Off's ledger panel waits out its grace, a park's badges come back without a second ask, the card's owed show covers the latch
harness chips: a pill too wide keeps Autopilot, the gap between chips is theirs, the reader allocates nothing
harness card: the review of … — cut out under the tab menu, frames anchored and judged every wake, the card moves with its pane, no wake behind Settings, serious mode in the key
harness: Settings ▸ Harness review fixes — session presses Owner-only on both control paths, no ghost row for a closed tab, the A/B per Autopilot state (Cruise against Off), the default's button hands a session back
autopilot: what a real aterm showed — a lock-order cycle, a dropped second click, Sessions on page one
autopilot: an Off loop's busy reads act on nothing; a spent landing wraps no relaunch; an adopted limit ends where the worker answered
autopilot: Off forgets an ended agent, the upgrade view sets Off aside, a lapsed claim moves the A/B arm
claude lights: one narrowing order, every button and the rename on the chips' glass
Settings ▸ Harness review fixes — Search draws Default autopilot, an Off press pins Off, the A/B says a finished agent waits, midnight that comes twice
autopilot docs: say what Land, the chips and Settings ▸ Harness actually do
harness card: no per-frame copies under the menu or per pane, no window-server ask without a card frame
harness\_host tests: wait for the restored landing's look, not the step's count
autopilot: the harness card and chips cost a frame at rest nothing
claude\_card: an episode draws a frame a frame time, never a frame a wake
harness card: an episode cut off by lost motion rests — replayed, no clock
aterm-phase: the launch card's scan says where it stopped, and a kept reading is checked without one
harness card: a repaint that moved nothing the card reads costs it nothing
harness card: a kept layout re-reads only what its layout read, and a refilled stream costs the strip no sort
aterm-link: fabric inbox reads a long catch-up to its end and marks read what it scanned
aterm-cli, aterm-link: the manual and fabric help say what a bare on keeps, and when it is refused
atpkg: the seed puts bin/ on PATH and answers targo before trust lands
atpkg: the toolchain walk's pending-stub check reads its head lossily
atpkg, aterm-cli: a pending command stub holds no call hostage
Tests and benches build with debug assertions: say so, drop what assumed otherwise
Stale pointers to deleted tests and helpers
aterm-gui: the theme-catalog tests' imports compile on Windows
aterm-update: find a release in about a minute, and check 3 s after a wake
aterm-gui: about\_to\_wait is O(1) in tabs, booked and watched; no UI-thread wait on a helper is unbounded
aterm-gui, aterm-types: the paused-writer test fails instead of hanging; metrics help names main\_busy\_ms\_per\_s
aterm-gui: harness\_host's retry-plan doc no longer says the clock is a date subprocess
aterm-link: aterm fabric and notify --on halt report a halt by the bridge's own rule
aterm-gui, aterm-link: the fleet never lifts the owner's local hold
aterm-gui: the wake-surface comments say what the surfaces print, now the hooks are gone
fabric: a stopped bridge's log and the comments say what the default does to its sessions
fabric: a refused Release and the fabric skill name the command that lifts a fleet hold
aterm-rle, aterm-grapheme, aterm-grid, aterm-search, aterm-bidi, aterm-gui: Clean islands under cfg(trust\_verify) go through a token-dropping macro
xtask: gate cells does not owe a target artifact for a crate only proc macros reach
bumpalo: first-party Bump::new + alloc\_str for wasm-bindgen's interner
aterm-gpu-web: take the canvas types from wgpu::web\_sys and drop the web-sys row
aterm-wasm-abi: the console.error panic hook replaces console\_error\_panic\_hook
aterm-time: the browser clocks are a link-time seam the wasm module defines
bumpalo, aterm-effects, forge: WP.1-4 prose says what was measured; parity keys its non-vacuity per file
aterm-gpu, aterm-gui: compile the first window's Metal shaders on a launch worker
aterm-gpu, aterm-gui: the first-frame Metal warm runs at Responsive on every order, and its hold test waits on a hang detector
aterm-link: a log restored under its own identity keeps no in-flight record decided before it
aterm-update: the installed-build cache is not held across the PlistBuddy read
aterm-gui: the messages writer's overflow is locked in place, so the lock census sees its holds
Exercise GUI record references across bus log switches
Keep GUI mail record references on their bus log
Exercise log switching at Commit and successor boundaries
Exercise notifier identity uncertainty without changing its saved offsets
Use the scalar log floor in addressed refill filtering
Apply endpoint log transitions before admitting a new bridge
Refuse uncertain notifier log ownership before adopting offsets
Exercise supervisor stderr attribution by recorded deployment role
Attribute broker stderr only to a locally served endpoint
Own Link fixture threads and bound concurrent broker cases
Cancel fixture relay accept without a spare descriptor
Let scripted lane hangups close their active stream
Keep Link socket fixtures under a short private path
Resolve roster links before reading the write target
Keep person inbox snapshots within their captured log and head
Bound concurrent agent control fixtures before opening descriptors
Keep seed coverage when zsh is unavailable
Refresh Autopilot before actions inside a busy wait
Count badge waits only from confirmed journal results
Exercise per-agent Autopilot projection against live policy admission
Reach the real roster through its test-only control reexport
Join effective Autopilot projections with each agents policy gate
Measure the WASM panic stack separator when slicing smoke output
Exercise durable rewind refusal through regrowth and bridge reopen
Refuse a rewound known broker identity until a durable new-log fence
Exercise recovered message writer draining without another UI call
Refresh native timezone rules before reading local offsets
Let the message writer drain accepted overflow without a UI wake
Observe the actual endpoint clock requests in rewind refusal regression
harness: trust\_roots defaults to Claude Code's own temp root, not one person's folders
harness: Claude Code's temp root is a Read root only once proven the user's own
harness: no root reaches into a temp root the probe refused
harness: trust\_roots is empty by default; the temp-root ownership probe is gone
harness: say trust\_roots' empty default matters under "safe"; pin trust\_dialog = false's clear
harness card: Off back to Cruise plays the episode though the claim lands a frame late
Settings ▸ Harness: a session with a blank title is named by its program
aterm-gui: the bus-log retirement wait uses the session's fence bound
new tab: identities are made on the control thread, no per-spawn edge sweep, one stat per private dir, warn once, scripts warmed at boot
atpkg: a first run lands the Trust toolchain first, the agents beside the rest of the set
atpkg: two lanes of one pass never lay agents/ or one shim name at once
atpkg: a first run's progress queue names the toolchain before the agents that wait for it
atpkg: the agents/ turn is taken at each site, where the lock-order census sees it
atpkg: an agent a person asked for lands beside the toolchain, not after it
xtask: gate cells owes no target artifact for what only a proc macro reaches
aterm-serde-derive, aterm-macro-support: a syn-free serde derive over aterm's closed attribute set
trust: record first floors for aterm-macro-support (97/484) and aterm-serde-derive (106/441)
aterm-macro-support: read a discriminant as an expression, not a type
aterm-macro-support: keep a leading :: in an attribute key
aterm-serde, aterm-serde-derive: say who depends on aterm-serde before SP.6
trust: raise aterm-macro-support's floor to 100/491
aterm-agent: prune and correct comments
aterm-census: prune and correct comments
aterm-core: prune and correct comments
aterm-ctl: prune and correct comments
aterm-effects: prune and correct comments
aterm-gpu: prune and correct comments
aterm-http: prune and correct its documentation
aterm-render: prune and correct its documentation
aterm-gui: one theme-install path; DSR 996 / mode 2031 report the palette on screen
theme listing: aterm theme list, list-themes and --list-themes print one report
settings preview: draw the colours Config::resolved\_colors resolves, not a VGA table
themes: built-ins legible as shipped, a derived selection band, split-override warning
themes: signature themes, two light/dark pairs (Aterm Night/Day, Hearth/Linen)
aterm-types: one import write path for the CLI and the window
Settings theme picker: filter, sections, Needs-attention rows, verbatim labels, swatches
aterm ctl theme: live theme read verb, transient preview lane, miss-reporting replies
theme: the OS appearance has its own source, read before launch and independent of window chrome
aterm theme check | new | export | schema: theme authoring for humans and AIs
aterm-types: Default's description says pale grey, so a "light" filter finds light themes
Settings: Follow system light/dark pair editor on the theme card
aterm-gui: command palette Theme section with live preview; View ▸ Choose Theme…
aterm-gui: an unset theme follows the OS (dark:Default,light:Default Light)
aterm-gui, xtask: name the time before winit runs, and the freeze's end on the successor's clock
aterm, aterm-types, xtask: a real headless boot reaches every preparation cut
aterm-zstd: Decoder::require\_checksum refuses a frame without a content checksum
atpkg: .tar.zst decodes with aterm\_zstd::Decoder; an unsigned tree\_root requires the frame checksum
aterm-zstd: trust floor 157/720 -\> 156/719, the obligation NoChecksum took away
aterm-gui: a session holds a set of origins, so a fleet lift never frees the owner's stop
aterm-link: the bridge converges the fleet's slot alone, beside the owner's hold
help, manual, fabric skill: a hold is a set of origins
aterm-gui, aterm, atpkg: bin/ on every session's PATH from the first tab; the first run's row and seed at launch
aterm-gui: the early first-run row claims no outcome for a pass that only waited
aterm-verify: fold xtask in; fmt, forge, cells, census and guards run in-process
docs, config: point every xtask reference at verify
aterm-verify: cells audits only rows no foreign cell can use; fmt names
aterm-verify: fixture tests for fmt and the in-process checks' refusal
aterm-verify: a census walk the library no longer has is NOT RUN
aterm-gui, aterm-forge: name verify cells and verify forge in two comments
aterm-verify: one JSON reader, one lifeline, one rustup cargo
aterm-verify, aterm-forge: apply the fold's review
aterm-agent, aterm, docs: no live text names the deleted xtask
contract-probe: the Trust contract probe as a crate and its tests
forge: forge serde-attrs, the serde key inventory in Rust
docs/measured: the NSEvent accessor matrices, without their probes
lab: lab instance, a private headless aterm for agents; visual-judge goes
lab: lab codex-upgrade, the Codex live upgrade in Rust; tools/ is install.sh
trust: floors for aterm-contract-probe and the grown aterm-forge
contract-probe: the off-switch lane builds through targo --unverified
aterm-verify: codex drives lab codex-upgrade; the contract probe is an ordinary test
aterm-verify, aterm-forge: trustfmt over the merged files
atpkg: lease, quiet and toolchain docs name the runs that exist
aterm-gui: comments state the rule, not merge-gate measurements
comments: drop merge-gate vocabulary across the crates
tools, docs: name verify's checks, not tools/verify.sh
aterm: headless\_activation names only the posture a regression reads
aterm-digest: the SHA-256 header states only what is true
aterm-types, aterm-update-core: keep the strict Trust gate wording
atpkg: a view lease is an aterm pkg lease holder's
aterm-gui: the last gate vocabulary goes from comments
comments: a loaded machine, not a loaded gate
comments: a test failure, not a gate failure
aterm-census: the shared-application guard admits os\_appearance's two windowed-only sends
aterm-verify: a run, not a gate, in its own comments
AGENTS.md: tools, checks and tests are Trust code in crates
aterm-verify: cells finds a third-party proc macro through forge's package\_dir
atpkg: the frame-checksum install test is unix-only, like the vendor helper it calls
aterm-wasm-abi, aterm-wasm-abi-macros: the export layer that replaces wasm-bindgen's runtime and macro
xtask: wasm-glue writes a module's JS glue from its aterm\_abi descriptor; gate wasm-glue binds the toy
aterm-wasm-abi-macros: string literals through aterm-macro-support
xtask: gate wasm-glue builds the toy staged, so its module carries no host path
aterm-wasm-abi, aterm-wasm-abi-macros, xtask: an export returns its throw in the return slot
xtask, aterm-wasm-abi: wasm-glue refuses an unrecorded export; the oracle against wasm-bindgen
aterm-link: the bridge reads its cap ring again before every dial
aterm-link: aterm link broker --repair <log>, and doctor prescribes it
aterm-link: the systemd unit appends the broker's stderr to \<root\>/broker.err
aterm-link: fabric on and doctor compare and name each bridge's program
aterm-link: keep the mint usage row's column after the --repair row
aterm-link: QueuedPost keeps its doc line beside the new ring helpers
aterm-forge: OB-1's mutation controls start from a built valid tree, not the live checkout
aterm-release: the Trust lane gates a member feature that turns on fork code as a row of its own
trust: floor aterm-link+sealed at 623/3380, measured; the roster says the sealed arms are verified
aterm-link: read\_fleet\_halts says what a second page of the halt walk really takes
aterm-link: directed mail cannot spend the node's subject budget on made-up destinations
aterm-link notify: a standing attention pages once per transition, not once per offset
aterm-link: the subject-budget door judges a post once, before its sequence is reserved
aterm-update: the stage pays the first-exec scan, one bundle's helpers run at once, helpers end at their exit
aterm-uds: outputs\_until keeps a pipe open across an interrupted read
aterm-update: the stage probe never starts a build the records already withdrew
aterm-uds: outputs\_until's tests hold no latency budget on work that must finish
aterm-gui: tell the bridge the handled watermark, and carry what it refills
aterm-link: a durable handled floor per (sid, topic) re-offers unhandled broadcasts
control verbs: topic ls and inbox-seen say the handled watermark they carry
aterm-gui: the topic verb's tests read the seen= its ls header now carries
aterm-gui: a cold launch rebuilds its desk a slice per park, not in one turn
aterm-gui: a drained tab behind the front one redraws only the strip; a quit stops the drain
aterm-gui: Settings ▸ Themes, the Theme Showcase (gallery, live trial, Customize, Save as theme)
docs and model: themes help topic, architecture section, DTP amendments, ghost invariant
community and AI theme-authoring kit: guide, template, examples, aterm-themes skill
aterm-render: record SF India's CFF2 faces; split the oracle's std-only half (TF.3)
aterm-render: record a committed CFF face in the font oracle (TF.3)
aterm-font: carve ttf-parser's outline core into a first-party reader (TF.3)
aterm-render: record every GSUB lookup's subtables in the font oracle (TF.3)
aterm-font: carve the GSUB reader the autohinter's style coverage needs (TF.3)
trust: record aterm-font's first floor at 434/1671
aterm-render: record the faces past 32 gvar tuples with ttf-parser's gvar-alloc (TF.3)
aterm-font: draw a glyph past 32 gvar tuples, as Linux's ttf-parser does (TF.3)
aterm-font: bound cmap enumeration; refuse a CFF2 blend on an empty stack (TF.3)
aterm-font: say why a stack push always finds its slot (TF.3)
atpkg: the window's seed asks no index, the \[machine\] edge runs beside the pass, the lock re-polls every 50 ms
atpkg: machine apply lets its queue go before the build-cache walk
atpkg: the set completion fetches its next archives while it stages the one in hand
atpkg: the download-ahead lane asks the network nothing to plan, and a finished download waits honestly
aterm-gui: the drain's crash-journal test is unix-only, like the journal's test helpers
accounts stats A5: list-price dollars, the spend file and capacity
accounts stats A5: the spend seam files a non-id model as unknown
accounts stats A5: re-record the transcript usage projection's answer
accounts stats A5: one count per message in the home, a session's price, lab.sh prices
accounts stats A5: a price check compares only a span the table prices whole
accounts stats A5: rewrap the price check's module note to the file's width
accounts stats A5: the price catalog check is the lab's prices verb
accounts stats A5: a price check compares only spans of closed messages
accounts stats A5: a stream the person stopped holds its span's check off
accounts stats A5: count a message approx from the first row that says so
accounts stats A5: drop the price check, take C from five-minute buckets, approx from any row
accounts stats A5: no capacity from an empty numerator, and left's error bar unclaimed
accounts stats A5: any iteration but a plain message makes a message approximate; the backfill seeds C only from windows with no credit use
aterm-zstd: the level sweep and its flip verdicts recorded, held to libzstd
atpkg-publish: packs compress through the zstd CLI, read back by the client decoder
aterm-zstd: the differential runs on recorded answers; zstd, zstd-safe, zstd-sys leave
xtask gate, forge budget, docs: the zstd family's ledger entries retired
atpkg-publish: a compressor that does not start is named without a PATH claim
atpkg-publish: the Apple lane refuses a run without the zstd CLI before any build
atpkg-publish: the pack drains the compressor's stderr while it writes
aterm-zstd: a cut between frames decodes to exactly the frames before it
Cargo.toml, audit: jobserver's stale contracts and the recorded total corrected
aterm-gui: a new tab's shell spawns off the event loop
aterm-gui: a tab spawned off the loop lands at its window's grid and revokes an overlap
harness card and chips: trim the per-frame cost (rest 3.4 -\> 2.4 us, episode 13 -\> 8.4 us over the bare footer)
harness card: a test that the border's and trail's segments meet; the host model's doc says what its linger witnesses
census guards: os\_appearance's two sharedApplication sends are windowed-only sites
aterm-gui: a broadcast the refilling bridge let go of is counted lost
aterm-link: UNHANDLED\_KEEP's doc says the endpoint counts what it lets go of
real-claude-lab: claude.ai account routes, the stats readers, and L0's facts on 2.1.301
Read existing AppKit application for appearance observations
Quote the log path in the broker repair diagnostic
accounts stats A0: the typed .claude.json allowlist reader, the account key, the Fable plan answer
accounts stats A0: the Fable plan answer in Claude Code's own order
accounts stats A0: the profile and label of the home CLAUDE\_CONFIG\_DIR names
accounts stats A0: the roster row's label, and no-home for a home it could not resolve
accounts stats A0: St::home\_profile says nothing reads \~/.claude's inside profile
accounts stats A0: the renew conformance test's Env names claude\_profile
accounts stats A0: the refused-roster control names the home it refuses
accounts stats A0: read the file Claude Code reads for the home
accounts stats A0: say where no .config.json is looked for
accounts stats A0: the manual and stats' doc name where no .config.json is looked for
aterm-pty: record why the PTY child stays forked, not posix\_spawn'd
aterm-pty: name the mechanism behind the forked PTY child's ctty
trust floors: 0.105's whole-tree facts (trust-facts-… on …) — 56 floors raised, totals corrected; aterm-verify lowered with its code
aterm: the corrupt-log test reads the repair command with its quoted path
trust: memory.tsv keeps one row per library and RAM
aterm-verify: a glue test on a machine without node is COULD NOT RUN, not a finding
aterm-link: a lapsed cap is reason=expired, and a lapsed publish waits for the renewal
aterm-link: doctor renews a lapsed cap instead of minting another from scratch
aterm-link: a bridge's dial nothing answers gets the broker's own remedy
aterm-gui: a PTY keeper recovery goes on counting dropped=
fabric\_world: the repair test reads the log path as the quoted word cli writes
Reap uninstalled tab spawns before normal Quit
Test whole-request repricing across streamed rows and saved buckets
Retire the whole prior price when a streamed request becomes unpriced
gates: the review's last stale names, and wasm-glue counts only a Pass as ok
harness cli: limits reads each tab by its own program, and the hand-run upgrade obeys each agent's switch
harness cli: review fixes for W9
census: the agent-gate guard keeps per-agent equality tests out of shipped code
aterm-gui: Settings ▸ Agents draws the harness rows and one switch per agent
aterm-gui: review fixes for Settings ▸ Agents
aterm-gui: an agent's switch on Settings ▸ Agents applies when saved
atpkg: a vendor row carries its whole warm
harness: every per-agent gate is an exhaustive match, a Codex is told its resume line, and Claude Code off turns the accounts off
harness: review fixes for W5r
harness: main's stats tests name the sweep's agents\_off; trustfmt
harness: W5r's resume-line test builds its worker with main's lifted\_off
harness: review fixes — admission names no agent list, a switched-off agent's exit is forgotten, the upgrade view sets its tab aside
aterm-gui: an agent switched off by its own table reads off on the chip, the Settings ▸ Harness row and autopilot=
harness: the CLI and its help name each agent's own switch where it holds a session
aterm-gui: a restore leaf names its agent by its record word, and an unknown agent's leaf is relaunched by nothing
Revert "aterm-gui: an agent switched off by its own table reads off on the chip, the Settings ▸ Harness row and autopilot="
aterm-census: the OS appearance's window-attach sends are windowed-only
harness: fix-verification round — a switched-off agent's snapshot is forgotten only once it is surely gone, --status reads its switch, a contradicting leaf is no agent
harness: a replaced agent is forgotten only once its process is known gone; tippy
aterm-agent: spend's Claude-home fold answers its agent by an exhaustive match
trust: the memory record keeps one row per library and RAM
fabric tests: the broker's repair line names the log quoted, as it now prints it
release snapshot: prune src/ to the commit's tree before vendoring reads it
verify list: test's NEEDS names node in a cell the table can hold
aterm tests: the corrupt-log repair test expects the quoted log path
aterm-gui: the Services claim stamp no longer says it follows the package lane
aterm-gui: a first run's early row withdraws when the update only states a fact
xtask, aterm-wasm: the CPU module's boundary replay, recorded on wasm-bindgen's glue
aterm-wasm, aterm-gpu-web, xtask: aterm-wasm exports through aterm-wasm-abi and leaves wasm-bindgen
xtask: wasm-glue's web glue replaces its TextDecoder before Safari's 2 GiB limit
xtask: the wasm lane times process\_str, ASCII and non-ASCII
aterm-wasm-abi: a release build takes the glue's string bytes as UTF-8 unchecked, as wasm-bindgen did
xtask: wasm-glue drops the DWARF sections, as wasm-bindgen does
aterm-release: ship site names the CPU module's glue step the site script owes
aterm-wasm, aterm-wasm-abi, tools: prose that still described the CPU module's wasm-bindgen
aterm-wasm-abi: re-record the toy module on the merged source
aterm-gui: a recovered dropped= is bounded as the carry that wrote it
aterm-link: a test holds the lapsed-publish fix of …
aterm-link: node\_ring\_of's doc names the token a lapsed ring now reads
themes: the authoring guide ships — docs/themes/README.md moves to contrib/themes/GUIDE.md, and contrib/ joins the export
theme\_author: the community folder law admits the authoring GUIDE beside the README
aterm-window: record dpi, cursor-icon and bitflags answers ahead of the absorb
aterm-window: dpi and the six cursor icons aterm sets are the crate's own
aterm-window: the seven flag types are aterm\_types::bitflags!
aterm-window: cut the macOS gesture rows, mac device events and never-sent events
aterm-window: carve the macOS extension API to what aterm calls
aterm-window: the macOS FFI module declares only what the backend calls
aterm-window: comments stop naming the API the carve removed
aterm-release: winit's trust floor follows the WC.5 carve (360/3862 -\> 312/3348)
aterm-window: cut the shared builders and deprecated shims nothing calls
aterm-window: the window controls aterm never calls leave macOS
aterm-window: custom cursors, exclusive fullscreen and the event-loop extras leave macOS
aterm-window: each window-attribute field is gated to the backends that read it
aterm-release: winit's trust floor follows the macOS API carve (312/3348 -\> 263/2922)
aterm-window: input lead L1 names the Option rebuild the WC.5 carve cut
aterm-window: review tidy-ups for the WC.5 carve
aterm-window: ActiveEventLoop::exiting is back on macOS; aterm-gui calls it now
aterm-release: winit's trust row follows exiting() coming back (263/2922 -\> 264/2925)
trust: retain the window carve measurement provenance
Settings pickers show every choice that fits and save only what you pick
Settings shows short choices as segments in their row
Settings pickers list an explained default once and keep titles whole
Draw the classic trail as ink on light themes
Draw the water trail as ink on light themes
Show every cursor trail truthfully in the Settings preview
Preview only a setting the search results show
Give the light-theme water wake its full veil range
Leave a free row under the cursor preview's prompt
Read an unchosen font row as automatic in the text preview
Settings: one subtitle per page, and drop dead states and stale docs
Settings: one plain name per setting, and notes under their own rows
Settings: keys that do nothing are not rows, and Modified says so plainly
Settings: effect and sound rows name the switch you can see
Settings: plain copy on Security, Packages, About and the contrast floor
Settings: removing a no-effect key no longer says it was kept
Settings: Modified states a fraction's default as its slider does
Settings: Modified keeps a row's reason in view, and search counts once
Settings: notes name each switch the way its row does
Settings: About heads itself like every page, and dates its build locally
ctl key reaches a focused native view
Settings: every page is one scrolling list, with no pager
Settings tests walk every screen of the special pages
Settings: the pinned preview keeps a whole specimen row
Settings: Page Up turns back a whole screen
Settings: Tab walks the whole list, not just its screen
Settings: a card's words stay on screen with their control
Settings: compact Packages lays its switches on one line
Settings: Cursor Kitty no longer says "No modified settings."
census: the Settings cursor preview's companion engine is its own scope
Settings search takes every word of a query, and the words people use
Settings: an Agents page, true sidebar groups, and an icon for every page
Settings search finds the switches Software Update, Packages and Messages draw
Settings search lists pages first, settings next, aterm.toml keys last
Settings: Appearance says where Color theme and window appearance are
Settings search: "N more…" hands the keyboard to the first key it shows
Settings search lists each Top Setting once
Settings search: aterm.toml keys read as links, and one key never hides
Settings search ranks aterm's updater first and drops stray plurals
Settings: true comments, and the Top Settings link says what it means
Settings sliders save the number they show
Serious Mode drops the rainbow wash behind Settings
A forced Window appearance turns the Settings pages, on macOS too
Appearance leads with its theme; Wallpaper owns its image settings
Tab Color works from the keyboard, VoiceOver and automation
The Window page switches Live Activity and keeps its padding rows honest
Settings states a refused color, a load failure and Live Activity off plainly
Wallpaper's Remove says it removed the wallpaper
Settings tests pass lint
A slider that cannot move looks it, and Tab Color's brightness reads clean
Live Activity's Edit in Manual opens on the provider line
Software Update: a copy that can't update offers no live update button
Packages: a copy without its package tool stops contradicting itself
Messages: say when a filter matches nothing; the load switch is a row
About: name the site once, and don't paint the byline as a link
Packages: a switch that does nothing here names no timing
Messages: docs say what the page draws now
Software Update: test that an empty notes card is one line tall
Settings search: the selected tab color row is found on the Window page
Settings: a short sidebar drops its title before routes shrink
Cursor styles that draw the same look load as aliases, not entries
Settings: a Cursor Styles page lists every style with a live preview
Settings: refresh two comments the Sound and Cursor Styles pages outdated
Cursor Styles: a style's tuning shows only knobs that change it
Cursor Styles: choosing a checked Off saves it over a forced Off
Sound: the volume and the sing-along riff name their real gates
Settings: trail-off notes name the cursor style or the effects switch
Cursor Styles: a short window lands with a style row in view
Cursor Styles: Up, Down and Tab take the preview from a resting pointer
Settings: a reset leaves no empty table behind in aterm.toml
Settings: Changed means written in aterm.toml, and every changed row can reset
Settings: Modified lists keys only in aterm.toml as one group, with Reset All
Settings: Undo names the change it undoes, and goes with its status
Settings: a value that can't be saved says why under its row and stays to fix
Settings: the Manual page says where aterm.toml is and what only it holds
Settings: Undo names the old value whichever news arrives first
Settings: box Modified's prebuilt rows and use is\_multiple\_of
Settings: Reset All's Undo names the value it puts back
Settings: Explain heavy load says Changed and offers Reset
Settings: a compact Manual page says what Manual is
Settings: an empty Modified says what will appear there
aterm-toml: a reset leaves no header standing over only sub-tables
Settings: every write says what it expects its key to hold
Display faces draw =\> and != as characters, never boxes
Text & Fonts: three boxes by use, and the specimen caret clears the ligatures
Display faces: reachable at every size, shown in their own letters, previewed as drawn
Font size is always one slider, and an out-of-range size cannot blank the specimen
aterm-render lists installed monospace families, and a family loads its regular face
Text & Fonts: pick fonts from a list, and the specimen settles on its own
Text & Fonts: a one-row specimen draws no stray caret
Text & Fonts: a font the terminal cannot find is "Not found", never "Applied"
Text & Fonts: the specimen names the automatic face, and tests pin the font rows
Font picker: typing keeps Cancel's name and shows which font it previews
Settings: font picker doc comments sit on the items they describe
Display faces: a full mix keeps every switch reachable and says why
Text preview: a font that is not found is not what the sample is said to show
aterm-render: a family's name-table search ends at its regular face
Font lists: Space and typing search the list instead of saving by accident
Font rows: typing on the list button types a name in place of the saved one
Font lists: Other… starts from the name typed into the search
Settings previews draw sample text at its real size, fewer lines when short
Top Settings shows one color preview per card
Preview headers keep the value being tried whole
Look & Feel pages keep one content width
Settings never draws its own numbers in a display face
Display faces draw at full size in their own letter width
Top Settings' tall color preview fills with a terminal session
Pin the 80x24 color preview as shown at its one-row floor
Comments name the status pill as it now reads
Keep Software Update's switch names whole in one wording
Lay out a Modified card's rows alike
Say whether this copy can update on every Settings page from the start
Give About one tagline and list its facts whole
Say once on Packages what the status card already says
Name Security's permissions plainly and explain a missing package tool
Paint no "Now" on rows that apply when saved; say which check applies
Say in plain words what limits agent supervision
Keep the Explain heavy load note on compact Messages
Group the Software Update status card's fit flags
Say "No effect in this copy" so search never cuts off an update switch
Name the escape sequences in Manual now the Security rows don't
Say plainly what All approves on Agents, and what its notes are per
Pin where Universal Control's Saved line names Apply Now
Settings: name an unset tab color and wallpaper in plain words
Settings: Tab Color fits on one screen, and its wheel shows keyboard focus
Settings: the Window row for the selected tab color goes to Tab Color
Settings: name background materials by how they look
Settings: mark wallpaper dim and tint inactive when the image did not load
Settings: the Live Activity card says Off once, plainly, lined up with the cards below
Settings: padding says Sides and bottom and Top, and Top stops at the sides
Settings: say what the keyword toys do; search headings name real places
Settings: search results keep one column width whatever page you searched from
Settings: aterm.toml search rows name each key
Settings: Modified never says nothing to reset beside a row with its own Reset
Settings: the offer after an Undo is a Redo, and an outside change takes a stale Undo away
Settings: a font or display-face status line goes when its value changes elsewhere
Settings: display face credits move to About; the card is a group like its siblings
Settings: no font banner over Settings when its row says Not found
Settings: the specimen keeps drawing its face while another resolves
Settings: timing tags and Apply Now say only what is true
Manual: suggestions wait to be typed or asked for
Manual: opening a key that is not in aterm.toml adds it
Manual: toolbar says Go to Line and Commands, with no EMACS badge
Settings: put stranded doc comments back on the functions they describe
Settings: Keyword kitties says a cat peeks out, as it does
Settings: Search and Modified head the Live Activity rows Tab titles, like their card
Settings: the Window row says Automatic (default) for an unset tab color; Terminal's subtitle reads as a list
Settings: a wallpaper that did not load no longer pushes Settings down with a banner
Settings: an Undo in flight is not mistaken for an outside change to its keys
Settings: the Tab titles card says an online service runs the model, not "provider-hosted"
Settings: Terminal's subtitle keeps the wording that fits a phone-width page
Settings: search result notes wrap to the width of the cards they sit in
Settings ▸ Agents: one note for the supervisor switch
Draw every cursor style in ink under the letters on light themes
Count Classic's trail in trail status and the trail ring
Preview trail colours the way the terminal draws them
Cursor Styles: Off first, every look described, a list in view
Say what changed: Serious Mode, outside edits, units, default colours
Sound and cursor notes say where the fix is, in plain words
Keep long slider readouts inside their control
Open Cursor Styles on the saved style however you get there
Keep light-theme Beam and Comet dust off the letters
Find a saved look-alike style by name; Off reads plain in Serious Mode
Sound notes name the Sound volume row and the Sound page
Settings controls read clearly: accent text at 4.5:1, a visible focus on the selected segment, destructive and idle styles, whole preview lines
Settings rows: notes and timing on the row's own second line, Reset's place kept, the list peeks, drafts and errors stay honest
Settings keyboard: Home and End move the list, the sidebar is one Tab stop with arrow keys, the category grid moves by column
Settings pages: About and Software Update keep their buttons in their cards at 80x24, the first Top card keeps its title, honest preview headers
Appearance preview never paints a sample line its window cuts
Settings lists: a control the list's edge leaves whole answers the pointer, Tab and screen readers
Every Settings page's list fills the room kept for the status bar, not only field pages
The Tab Color page no longer offers a Choose… that opens the page it is on
Top edge's row names the value that was set, now that its slider shows the one used
The All Settings sheet never ends a screen on a group heading with nothing under it
The unsaved-draft bar paints a refused draft's name, not its reason a second time
Doc comments sit on the functions they describe again
aterm-gui: the linux and win cells' dead\_code expectations are all fulfilled
accounts v2 S5: usage credits on one account, and the watchdog's retry row as a wall
accounts v2 S5: credits seen in use drop the limit row that said them off
accounts v2 S5: the vendor's served retry ends the remembered wall too
accounts v2 S5: off macOS a reply drawn with a dot is the model's
accounts v2 S5: the usage recorder reads settings only for a named process; true docs
accounts v2 S5: credits seen on outlast their drop; a warning keeps the other window; the usage switch is read with the accounts switch
accounts v2 S5: a kept week's figure is as old as the warning that named it
accounts v2 S5: a reset ends the week's warning; Esc on the vendor's retry is no retry served
accounts v2 S5: one rule for the usage words; the vendor's retry read by the screen and the ledger
accounts v2 S5: of one answer, the later read of its warning stands; turn\_served on the fullscreen renderer

_Truncated to fit GitHub's release-body limit — the complete note is release-notes/v0.105.0.md in this release's source tree._

v0.104.02026-10-15

aterm v0.104.0

2026-10-15 · 313 changes since v0.103.0

Features

devtools: read the Developer Tools switch, prune stale copies, and hand the owner the pane
doctor: a devtools: row says when macOS checks each new program aterm starts, and the fix

Fixes

aterm-agent: a Claude home with no projects/ holds no transcript, and no restart resumes a conversation without one
aterm-agent: a harness restart's relaunch that ended at once is stopped then and reads as agent-down
aterm-gui: the relaunch limit is said only for an exit it kept from coming back
aterm-agent: a signalled agent that has exited is gone, reaped or not
aterm-agent: a relaunch reads as ended only once its line's command was seen to run
aterm-agent: a relaunch stopped as never picked up whose agent came up after all is reopened and carried on
an upgrade stopped after its exit is asked about by its own row alone, and no-resume is said as what happened
aterm-agent: wait\_exit reads a Linux zombie as exited
the turn end's task read is the agent's own Claude records
aterm-phase: a footed Dialog two columns in under the inline ─ rule is read whole
aterm-phase: a key-hint footer Ink wrapped over several rows is read as one
aterm-gui: an input method's commit holding a control character is a paste
aterm-objc: ClassPtr::from\_ptr is unsafe, so safe code holds only real classes
aterm-gui: an input method's commit of one control key stays a typed key
aterm-cli: signals wake the session loop through a self-pipe; the session ends with its shell
aterm-net: idle unauthenticated sockets no longer lock token holders out of the network drive
aterm-net: rule 2 never cuts a lighter address's handshake for a heavier address's newcomer
aterm-net: the listener's slots and the watchdog's claim get a ty model, Tier-0 and Tier-1
aterm-gui: a Containment tab's OSC 52 reaches no clipboard
aterm-gui: a Kitty t=t file is unlinked in the directory that was judged
aterm-sandbox: Containment's resource limits bind; Safety's are said to be soft
aterm-gui: a Containment tab gets no Kitty file medium and no desktop notification
aterm-gui: a refused smart-title answer is an error naming its status, and a refused warm-up fails
aterm-gui: a loopback-classified smart-title endpoint is dialed at loopback, never at what its name resolves to
aterm-gui: a provider's error message is checked whole, before the excerpt's cut
aterm-update-core: a roster key the schema does not declare is refused, not dropped
aterm-winsign: the signer is the chain's leaf, which signtool prints last, not its root
aterm-observe: a row the scan budget could not read is undecided, so gone waits instead of latching
aterm-net: the serve slot's handle is a tenure, not a lock guard
aterm-alloc: SmallVec's by-value iterator is opaque, so safe code cannot forge or rewind it
aterm-alloc: ArrayVec::retain keeps the undecided elements when its predicate panics
aterm-alloc: a panicking element destructor no longer leaks every element after it
aterm-alloc: retain's rejected-element destructor panic is held to std
aterm-once-cell: unsync get\_or\_try\_init refuses a reentrant init, as upstream does
aterm-gpu: impl\_pod\_zeroable! proves its field list exact with an exhaustive pattern
aterm-gui: one-component names are judged raw, so "link/" never reaches through a symlink
aterm-dirfd: the docs say Arg carries paths and the one-name rule is the caller's
aterm-render: text-keyed memos hash under a per-process secret
aterm-effects: the done-mark index hashes under a per-process secret
aterm-gui: a draft journal is named by a keyed MAC of its URI, not a public hash (hashclock-2)
aterm-gui: a clean legacy journal never hides a keyed draft, and no open sets one aside silently (hashclock-2 review)
aterm-verify: a checker's --version is bounded by a hang detector, as aterm-spec's is
aterm-grid: a scroll after a rows-only grow appends at the ring's logical end
aterm-core: the resize fuzzers check that a bottom line feed scrolls every row
aterm-grid: pin the top-anchored region's scroll after a rows-only grow of a wrapped ring
aterm-ctl: a peer's mail body is shown on a terminal, not obeyed
aterm-control: the control path's JSON escapes what a terminal acts on
aterm-ctl: a server's status lines and refusals are shown on a terminal
aterm-parser: a GR byte in a DCS header keeps the string
aterm-parser: a DCS header is carried as itself
aterm-parser: the Verification section names the checks that exist
aterm-core: an ASCII run from outside a DECSLRM span goes glyph by glyph
aterm-grid: a cell an operation blanks drops the extras it carried
aterm-core: REP repeats the folded character on the bulk path too
aterm-grid: one row len rule for every writer, printed blanks included
aterm-core: a VT52 address takes two bytes; ASCII never folds after a ZWJ
aterm-grid: an extras run resets only an occupied slot; the ring path relies on its source
aterm-grid: ICH and DCH on a double-width row shift its cells only as far as its extras
aterm-grid: a rectangle scroll keeps the row's wide-character hint
aterm-grid: an alternate-screen width cut drops the cut head's extras
aterm-search: key postings from a per-index base so rows past u32::MAX stay findable
aterm-search: scale the regex scan budget with the line and report a line it cannot finish
aterm-gui: a search header names every cause of a short list, the depth cap included
aterm-ctl: the search note is built in one String, keeping the Trust lane's proof count
aterm-search: run-length encode the column map so a non-ASCII index holds a small multiple of its text
aterm-search: report a match in the grid cells that hold it, read from the grid, not re-measured from the row's text
aterm-gui: find joins a soft-wrapped run by the grid's cells, row k from column k\*cols, so a hit after a VS16 base left narrow in the last column is where it is drawn
aterm-grid: ASCII after a ZWJ opens a cell of its own when a stored line is laid out, as the live grid draws it
aterm-messages: the presence row's tokens strip every invisible character, from one table
aterm-messages: the presence row is laid out and painted in the terminal grid's cells
aterm-messages: a presence cell holds what the grid's cell holds, so a token stays bounded and the walk stays linear
aterm-core: the DCS header carry test holds under the sixel feature too
aterm-gui: the consent\_at\_risk test holds the env lock while it reads HOME
aterm-grid: a tiered grid whose store keeps nothing keeps history contiguous across resizes
aterm-grid: a drag step during the offloaded rewrap keeps a zero-share grid's history
aterm-grid: name where the zero-share re-attach keeps more than a ring-only grid
aterm-grid: a width resize inside the detach window keeps history in order
aterm-grid: the offloaded width reflow keeps the rows its resize pushes past the ring
aterm-grid: the offloaded Native reflow rewraps a line straddling the store/ring seam whole
aterm-grid: a history row rebuilt where a wide glyph cannot fit keeps no link or underline colour for it
aterm-grid: a scrolled-back history row keeps a link or underline colour only on the cells its glyphs fill
aterm-grid: a VS16 glyph the live grid kept narrow stays narrow in history, so the links after it stay on their glyphs
aterm-control: a double-click selects the word in the cells the grid drew, across a soft wrap
aterm-core: a web host's word and link under a cell are read from the cells the grid drew
aterm-grid: a stored line lays a flag half into its base's cell past a mark, as the live grid draws it
aterm-core: a history row is read, copied and found in the cells either tier draws it in
aterm-gui: the keeper META fits at any width, and a META not sent is retried
aterm-gui: the keeper META's version-skew record says what an older window trades, and its worst case is the widest
aterm-gui: the keeper's META is serialized after the terminal's lock is released
aterm-verify: a second interrupt ends an interrupted gate's grace, and no interrupt leaves a survivor
aterm-verify: the interrupt handler's review: one SIGTERM is pinned, a nap asks for no remainder, sigaction only where its struct was read
aterm-verify: an interrupt that lands inside a spawn takes that child too
aterm-verify: a SIGKILL sent to a stage group is repeated until the group has stayed empty
aterm-verify: the gate signals a process group only while it still holds the group's leader
aterm-agent: a no-resume stop is reopened only for a holder its line can have started
aterm-agent: a limit whose notice left the screen waits for the reset it named
aterm-agent: a write a hold or a busy server refused is decided again, not dropped
aterm-agent: a limit the vendor continued by itself is over, and the vendor's cancel ends its by-itself
aterm-agent: a limit whose notice left is decided by the wall's policies whole, and by nothing with resume\_limits off
aterm-agent: a limit whose notice left is waited on across a loop's restart
aterm-agent: the wall memory writes its row only at a reading of the wall
harness: a kind's reason takes its article — an edit box, not a edit box
harness: an owner's bare-tool ask rule holds the file box Claude Code draws no reason on
harness: a box Claude Code draws for more than one tool is held under a bare ask rule on any of them
harness: read the agent's settings chain where and as Claude Code reads it, never skipping the user's file
aterm-agent: a person's turn at a left limit ends its wait, read off the screen's order or the transcript
aterm-agent: a refusal that persists is journaled when it first appears and when it changes
aterm-agent: the wait on a left limit wakes on the screen, as a wall's does
aterm-agent, aterm-phase: a turn ends a left limit's wait only when served under THAT limit's own notice
aterm-agent: a refusal's episode is its kind and holder, its measures dropped, and ends after a quiet spell
aterm-phase: a wall's notice Ink wrapped in a narrow pane is read as the one line it is
aterm-phase: the login back is read from its row's whole line, wrapped or not
aterm-phase: a narrow pane's error-row bound counts only a notice drawn in the vendor's column, by Ink's own wrap; a reset keeps a date after its clock
aterm-agent: the supervisor's waits count a Mac's sleep, and its acts wait for the wake's settle
aterm-agent: the wake's settle holds every turn typed into the agent, counted from the wake
upgrade: the live upgrade reads every Claude home its tabs' agents run under
upgrade: a build that failed to start for a conversation is not retried for its hand resume
upgrade: a user's home with no Claude records no longer waits the step's pass
upgrade: an agent under another Claude home is judged by that home's model files
upgrade: a restart on its own program keeps the stop of a build that failed to start
relaunch: the relaunch on exit takes no build that failed to start for the conversation
consent: the in-bundle fence judges the bundled image behind a launch symlink
aterm-verify: only Live reaps by pid, and git\_bounded kills git by pid only on a real overrun
seamless: a successor's Commit fail-stop says which ending it took, with the pipe's read end already closed
devtools: the window opens the Developer Tools pane once per process, even before its marker lands
control: input into a background tab that reads nothing never parks a control lane
spawn: OSC 52 query and Kitty file media read before the terminal lock, never inside process()
control: a framed wait refused busy closes, never serving its body as requests
spawn: the reads done before the terminal lock are bounded per slice
control: a background paste a discard drops is not OK; a wheel cut short is not "nothing written"
the merge contract's two reds on … (rounds 16-17 landed ungated)
the merge contract's three reds on … (round 18's landings lane)

Refactors

aterm-agent: seed\_named\_reset takes the open row's instant, not its age and now

Tests

aterm-agent: reproduce the quiet upgrade resuming a conversation that has no transcript
aterm-agent: reproduce an upgrade relaunch that ended at once reading as a stuck start-up screen
aterm-gui: reproduce a graceful exit under relaunch = false said as the owner's limit
aterm-agent: reproduce a relaunch that never stamps the exit of an agent its shell has not reaped
aterm-agent: reproduce a relaunch stopped no-resume while its shell had not run its line yet
aterm-agent: reproduce a no-resume stop that stands while its relaunched agent holds the conversation
reproduce the host's second, false report over an upgrade whose own row asks
aterm-agent: pin restart's guard that never resumes a conversation with no transcript
aterm-phase: the usage-limit dialog Claude Code 2.1.295 really draws, in place of the hand-built frame (reproduction, ignored)
aterm-phase: a footer Ink wrapped in a narrow pane, as Claude Code 2.1.295 draws it (reproduction, ignored)
the artifact quarantine tests hold their guard until they end it
the contended title retry is read at a fixed instant
an idle harness host owes itself no look
host\_live times its held scenes from the host's attach
operator\_live\_headless retries manage's busy refusal and parks its nexts
control lanes judge a refusal below a known limit as a moment, under HANG
host\_live waits out an earlier claim as a hang; the badge test releases its worker once the server read it busy
a parked operator next is started again only when a probe turned it away or it timed out
the idle-drivers starvation loop waits out a busy moment, as the waits test does
host\_live's fake writes one cell at start, so a stale program name gets re-read
the restart-holds-the-tab test says what ran when it fails (status, screen, launches, host log, journal, process tree)
the zsh hang-detector test asks a longer window when zsh was slow to print its first line
handoff: v0.103.0's producer fixtures, written by its own cut
aterm-gui: NET-2's credential fixtures are split, as the file's others are
aterm-cli: the job ignores SIGHUP before the seam lets its shell exit
aterm-core: a seeded random stream is read-boundary invariant
aterm-core: the generated corpus include carries rustfmt::skip
aterm-verify: a stand-in gate arms on its grandchild's exec, not on the pidfile
aterm-verify: a stand-in gate arms on the image its grandchild runs, not on its name
aterm-verify: the spawn window's review: the wait's bound, the count's place and its lowering are pinned
aterm-verify: a second interrupt does not end the wait for a spawn in flight: pinned; the docs name what the count costs and how long the wait is
aterm-verify: the kill-until-gone second reading's notes: the door's order and Live's refusal are pinned, the git test ends its helper on unwind
aterm-gui: the parent-death fixture hands its pipe over under every std, and a stand-in checks what it was handed
aterm-gui: the parent-death fixture's review: the watcher says it still watches, the fail-stop's 74 is pinned, a handed descriptor is taken once
aterm-agent: reproduce a hand resume after a no-resume stop reopened as the relaunch that landed (#\[ignore\])
pin the block stamp, the reopen's streak, the re-arm's block and the host's agent home
aterm-agent: a limit whose notice left the screen is continued at once (reproduction, ignored)
aterm-agent: a continuation refused by a hold or a busy server is dropped (reproduction, ignored)
aterm-agent: a limit the vendor continued by itself gets a usage-resume (reproduction, ignored)
aterm-agent: a limit whose notice left passes the roster over, and is continued with resume\_limits off (reproductions, ignored)
aterm-agent: a loop restart loses the wait on a limit whose notice left (reproduction, ignored)
aterm-agent: a fenced press a hold turned away is pressed again once it lifts
harness: reproduce the policy sweep's pressed ask-rule boxes and its a edit box, ignored
harness: reproduce the review's pressed Bash sed box and the settings reader's false and skipped reads, ignored
harness: pin the Bash sed box on Claude Code 2.1.299, and record the lab's live check of the fixed harness
aterm: the relaunch fake keeps its conversation's transcript, as Claude Code does
aterm-agent: a person's turn at a left limit leaves its wait standing (reproductions, ignored)
aterm-agent: a refusal that persists is journaled at every retry (reproduction, ignored)
aterm-agent: the wait on a left limit sleeps through a person's short turn (reproduction, ignored)
aterm-agent: the probe's left text whose Enter the server turns away is written again
aterm-agent: a turn under another limit's notice, an unanswered prompt and another conversation's transcript end a left limit's wait (reproductions, ignored)
aterm-agent: a refusal whose counter moves is journaled at every retry (reproduction, ignored)
aterm-agent: the refusal episode's two ends, the remembered wall's served-turn rule and the unanswered prompt, each caught when reverted
aterm-phase: a wall's line Ink wrapped in a narrow pane, as Claude Code 2.1.299 draws it (reproduction, ignored)
aterm-phase: the login back, its row wrapped in a narrow pane (reproduction, ignored)
aterm-phase: the worker's prose read as the error row in a narrow pane, and a reset's date cut off its time (reproductions, ignored)
aterm-agent: reproduce the sleep's two residuals (ignored)
aterm-agent: reproduce the review's sleep findings on fix/r15-sleep (ignored)
upgrade: reproduce the sweep and the view missing an agent under another Claude home
upgrade: reproduce a hand resume moved onto the build that failed to start for it
handoff\_rendezvous: every rendezvous test runs under a long TMPDIR, or fails saying why
harness: reproduce the exits nobody reads — a host panic's window, a Commit's hold (ignored)
harness: reproduce a relaunch owed at a host panic being dropped (ignored)
harness: the switch-off control says the restart stands down (comment only)
harness: reproduce the review's majors of round seventeen's first cut (ignored)
harness: restate the narrowing repro by the policy each loop ran under; reproduce a switch-on that waits out the back-off (ignored)
harness\_host: reproduce the explicit restart's residuals that strand an agent
harness\_host, restart\_act: reproduce the review of rulings 20-22
harness: reproduce round eighteen's landings and exits left to nobody (ignored)
harness: reproduce the review of round eighteen's first cut (ignored)
harness: a panicking host's always is armed after its first panic, never before
harness: reproduce the round-18 upgradebuild review's strands and minors (ignored)

Docs

what the harness does at a usage limit on 2.1.295, live; the narrow-box note; two doc reflows
aterm-gui: the parent-death fixture's second reading: the CHANGELOG names both limits, two more comments are conditional on the std
aterm-agent: the wall memory's note on a shell-less tab names the policy's rule as it is now
aterm-phase: wrap's header names the login reader and how a message's rows are counted
spawnfd, grep\_guard: a bare Command's child inherits unflagged descriptors only on a std without SP-1
the settings lane's amend — what the fence is now, the live runs, and what is left
the trim's review — the inbox note says queued=1, the private-instance rules come back, the verified table lives in ATERM\_DESIGN.md

Other

style(aterm-agent): trustfmt the sweep fixes' tests
WIP(aterm-deflake): load-proof gate tests written, A/B flip evidence and merge contract not run
release(stamp): build scripts read cargo's run-time CARGO\_MANIFEST\_DIR and CARGO, never env!'s
render: a sub-script glyph lands exactly, to a fraction of a pixel
footer: set the facts as a line of type, the facts an even gap apart
render: bundle Iosevka Term, selectable by name on every platform
footer: the owner's-layout test says the facts stand three spaces' room apart, not three cells
spec(aterm-spec): SupervisorUsageWall models a notice that leaves an idle screen, and a person's turn there
kitty pet: a ghost is drawn as the body the user last saw, stance included
kitty pet: an adopted look's stance eases only forward, through a restarted ramp too
kitty pet: a ghost wears the palette its body was drawn in
kitty pet: an adopting arriver resumes a ghost's palette only on its own surface
spec(aterm-spec): SupervisorUsageWall lifts a limit before its named reset and resumes another conversation at a left wall; the bind walks both
chore(upgrade): the watch names where it reads before what it reads; the sweep test says its cases
harness\_netprobe: reproduce the route reading its own settings list, not Claude Code's chain
harness: the API route and the stored login read Claude Code's one settings chain
harness: reproduce the readers of an agent's Claude records that miss its own home
harness: one resolver for an agent's Claude records; every reader reads its own home
claude\_settings: reproduce the approval lane failing every chain read in a file-provider domain
claude\_settings: a document not there sets nothing; the file-provider fence is the route's alone
claude\_settings: reproduce the route's fence opening a linked worktree's git files
claude\_settings: the route's fence covers the git files the chain opens
upgrade\_models: reproduce a byte-order-marked settings.json read as no allowlist
upgrade\_models: the model reader parses settings.json as Claude Code does; the chain's claims say who its readers are
AGENTS.md: cut the process cruft to the rules an agent needs
primer v15: drop the \~/Developer sentence and trim the agent block
devroot: delete the \~/Developer feature and its ceremony
devroot: the doctor's help and a machine-apply doc drop their Spotlight claims
update handoff: the Commit's \_exit no longer cuts a control write mid-frame
update handoff: activate the successor from focus read at the Commit's write
update handoff: a reset on a parked session stands the Commit down
update handoff: a reset at the Commit's write is never answered OK
update handoff: the Commit's egress fence fails closed with no attempt
Quit ends every tab's shell the way closing its tab does
wait and await inbox end with their session, not at their deadline
A window's tab ends with its shell, not with the slave's last close
Quit's document barrier re-plans before it lets the app exit
A Quit replayed after an update rollback asks the document barrier too
A shell's exit wakes what is parked on it from the exit edge itself
A held pane goes on reading a job's output after its shell's exit
fabric: SessionFabric::closed is endpoint\_closed, so the lock census sees no cycle
aterm-agent: repro: a limit met inside the own act's take window is never tracked
aterm-agent: a wall is tracked wherever it is read, a point or not
aterm-agent: repro: a retry the wall answers in its window is read as taken; a lost login no point decided is held silently
aterm-agent: a wall read in an act's window answered it; a lost login no point decided is decided as the wall it left
aterm-agent: repro: a wall read inside the own act's window is placed as a wall found sitting
aterm-agent: a wall read inside the own act's window is placed as the act's answer, once per act and words
harness: a host panic loses no exit its workers held; an exit nobody is handed is read as it is seen
harness: a switch-off while the host is down stands it down at once, and never spins
gui(harness): three Trust seals on the policy cell, its stamp and the stamp source (off-lane: --cfg trust_seals)
aterm-agent: repro: a limit cancelled before any read after the own act is typed into
aterm-agent: the limit a cancel left before any read answers the own act
aterm-agent: a cancel's answer is confirmed only by a notice written since the act
aterm-phase: left\_wall's block end reads unwrap_or (tippy); handoff: the final tree's lab run
aterm-phase: left\_wall reads only a notice above the cancel
harness: a panic's restart acts on news and holds its workers to the policy; a landed agent is watched until a pass names it
harness: say when a landing's agent is watched until a pass names it
harness: reproduce three homes residuals (ignored)
harness: pin the relaunch's home hunks that passed every test reverted alone
harness: an empty CLAUDE\_CONFIG\_DIR's profile is $HOME/.claude.json
harness: the model list grows from the home an agent is judged under
harness: the CLI's sweep finds Claude homes from every instance's tabs
harness: reproduce a relative home's readers losing an agent that changed directory (ignored)
harness: a running agent's relative home resolves where it filed its record
harness: a unit test's sweep never dials the machine's instances
harness: reproduce the review of fix/r17-homes2 (ignored)
harness: a recorded home keeps the profile it keeps apart; a live leader's read comes first
harness: the wall's tail is the transcript its agent writes now
harness: the CLI's sweep waits on no tab it only learned homes from
harness: another home's list growth is its own agents' alone
harness: a look at an agent that left its record waits, asking nothing
harness: the instances a pass with no roster reads are a field, not a cfg(test) arm
harness: the relaunch's roster reads records as every reader does; two wordings corrected
harness: carry an asked exit through a hand; the act's KILL reads its stamp on disk and waits for its reader
harness: a carry asks the claim at every look; it waits on the line's own hands; take\_if judges a stamp in place
harness: a watch disarmed while it waited for the end reads nothing at that end
spec(harness): HarnessCommitOwed models round eighteen's landings and the restart's panic
harness: round eighteen's landings and exits are no longer left to nobody
harness: the handoff's read of what a tab is owed carries the cause; the snapshot-only view is the tests'
harness: the restored landing's late read asks the live list by contains (tippy)
aterm-agent: repro: a cancel's limit answering a person's turn, the same reset, or a resumed older limit
aterm-agent: the limit a cancel left answers any turn asked since the last look; the transcript tells the same reset; an undated one stays within a session window
agents: cut AGENTS.md, the CLAUDE.md primer and the four skills to what an agent acts on
agents: the primer says who types keep going; cut more cruft from AGENTS.md and the skills
supervise-agent: a worker's private instance keeps the real HOME, so its login persists
agents: the CHANGELOG counts against 0.103.0; the primer says when ATERM-TASK-DONE is due
build cache: Rust intermediates go where Spotlight never looks, decided per command
build cache: braces, symlinks and Trust's verified lane are left alone; the sweep uses the shared gone rule
build cache: the sweep reads a build with a target, skips a running build and follows no link below $HOME
build cache: the reclaim tests make links, so they build on unix only
harness: the explicit restart's cause rides the handoff layout alone, never a durable one
harness: the restored queue keeps its attempt for a landing no read reaches
harness: relaunch = false does not refuse the explicit restart's carried relaunch
harness: a panic inside the host's restart is tested; no "exactly once" rests on a sleep
harness: reproduce the upgrade's three round-18 residuals (ignored)
harness: a build that failed to start is the build's fact; no agent is moved onto it until it is proved to start
harness: the upgrade's model rule reads an agent's settings through the one chain
harness: one resolver of a Claude home for every reader: an unset one is the agent's own HOME's, the footer's included
harness: a build that fails to start strands no agent the upgrade asked; the stop taken back, the owner's --now, the record's own argv

v0.103.02026-10-10

aterm v0.103.0

2026-10-10 · 39 changes since v0.102.0

Fixes

aterm-containment: deny every mach-lookup but the user and group queries
aterm-gui: a press the tty will not echo is never predicted
aterm-predict: an echo proof ends at every boundary the predictor cannot see past
aterm-predict: a killed typed-ahead word does not stay on glass as a ghost
aterm-predict: the echo proof covers only the cell the last echo left the cursor in
aterm-predict: only a line terminator keeps typed-ahead guesses on glass
aterm-core: log a block's eviction once, not on every read
aterm-gui: thin the network drive's refusal lines as the local socket's are
aterm-grid: log the reflow window's cap per window, not per dropped line
aterm-core: thin evicted-block log lines by doubling, not one per block
aterm-release: a release is not done without its signed source manifest
atpkg: the dmg lane stages a bundle at the archive lanes' modes (AT3)
atpkg: the stage path's directories and records, and a dmg copy's owners, follow atpkg's rule, not the umask or the image (AT6, AT7)
aterm-pty: a -e command's arguments reach the program byte for byte; a NUL refuses the spawn
aterm-pty: a configured shell holding a NUL refuses the spawn instead of running another

Tests

a key-journey hang detector counts from the last key; a lost shell test says how it ended
a status wait in agent\_verdict\_live\_headless that times out shows the screen
the question tests hold the fake's busy screen until the host has told its answer
the gsettings read test gives its child a hang-detector bound, not the product's 200 ms
a stand-in that "exits on EOF" exits when the stand-down tells it, not 200 ms after spawn
the weekly-limit test names its reset from one clock reading
the question tests' busy screen is bounded, so it never waits on what waits on it
a timed-out status wait in agent\_verdict\_live\_headless shows the instance's process tree
atpkg's doctor probes wait a hang-detector bound in test builds, not the 5 s production ceiling
"no step while parked" waits for the park to take effect instead of 20 ms
a timed-out wait for CHOSE shows the instance's process tree
headless\_activation waits out an instance that has not accepted yet
the held-claim park test starts its reader right before the Commit
the pointer-licence test judges the typed hint as of the key, not as of "now"
the "no bus record reaches a pty" baseline waits for the shell's first prompt
handoff: v0.102.0's producer fixtures, so the 0.103 cut's fixture gate passes
the silent launch fakes write one cell at start, so a stale program name gets re-read
every live test that calls aterm ctl waits out an instance that has not accepted yet
the tty-drain reap test repeats a starved take with a larger budget, as its neighbours do
handoff: the fixture generator is a \_tests.rs module, under cfg(test) where it is mounted
the short-turn loop test starts its loop once the INSTANCE shows go taken, not once the worker has stamped drawing it

Docs

containment: claim "no mach service lookup", say it wherever --sandbox is described

Other

proxy: a forward reads the host's pid before it delivers the verb, so a quick hang-up still says "gone"
release: the cut writes and lands its own handoff fixtures; the generator is in the tree

v0.102.02026-10-10

Added

Code has one home, ~/Developer, and aterm measures that Spotlight skips it. Spotlight indexes every text file in your home and, since macOS 27, attaches an embedding to each, so source trees there cost mds_stores real CPU. Apple documents one way to keep a folder out of the index: System Settings ▸ Spotlight ▸ Search Privacy. Add ~/Developer there once per Mac. aterm doctor and aterm pkg doctor gain two rows: devroot: names the git checkouts and worktrees under your home that are not in ~/Developer, and spotlight: MEASURES whether Spotlight skips ~/Developer (a probe file and a later control, both removed), never assuming it from the name (a ~/Developer that is a link is never opened, and is not measured). aterm pkg devroot lists each checkout outside, where it would go and what holds it; aterm pkg devroot move --all (or named checkouts) moves them, refusing the whole run while any has uncommitted work, a process working in it or in another checkout of its repository, or an agent session, and never splitting a repository that has submodules (their links are relative). It moves one repository at a time and repairs what names the old paths — worktree links (git worktree repair), the git config and alternates of every git directory, submodules' included (a cut clone's aterm-release.receiptsFrom), Claude Code's ~/.claude/projects/<path-key> folders (not the transcripts in them), aterm pkg link dev links and the publication engine's registry rows — then checks that every checkout still answers git status. A ^C waits for it to finish. aterm pkg devroot verify measures the root on demand. The window's six-hourly look raises one entry in Messages ▸ To look at, only when it measures Spotlight indexing the root, and its button opens Search Privacy. The move is a one-time migration: it goes once every owner Mac on the release roster reports a clean devroot: row; the survey, the rows and the measurement stay. The window's disk cleanup looks for idle build output in the checkouts in ~/Developer as it does in your home's.

Changed

The supervisor's trust roots and the publication engine follow ~/Developer. [harness] trust_roots defaults to ~/Developer/aterm*, ~/Developer/ay*, ~/Developer/trust* and /private/tmp/claude-*, so a checkout left in your home is no longer answered for. The release tools and the export content scan read the engine at $PUBLICATION_ENGINE, else ~/Developer/publication. The agent primer (v14) says where code lives. Run aterm pkg devroot move --all right after updating: until the checkouts move, the merge gate's export content stage is NOT RUN (its reason names ~/Developer/publication and the move), and the supervisor answers for no session in the old checkouts.

A rerouted tool name warns in one line and runs, instead of stopping your command. Inside an aterm session, clippy, rustfmt, rustdoc and lean with no Trust tool installed now run the upstream copy after a line naming aterm pkg install <program> or aterm pkg repair (they exited 127), z3 runs upstream after a line naming ay (it exited 2), and so does a stub that cannot reach aterm's package manager. Only a name with nothing to run still exits 127; [reroute] announce = false silences the lines and [reroute] strict = true brings back the refusals (aterm help reroute). One place refuses by design: inside a Trust source checkout a cargo or rustc that is not Trust (next entry).

A bare cargo or rustc in a session now says what it is about to run — Trust or stock, by name — and inside a Trust source checkout a stock one does not run. The line used to say "running upstream 'rustc' (no proof claim)" whatever that name ran, so after rustup default trust it said it over Trust itself. Now aterm asks the copy on PATH what it is (through rustup which when it is rustup's proxy, +toolchain included, then that file's -vV) and names it: -> Trust 7d5533b2, via rustup trust (the rustup default), or -> STOCK rustc 1.97.1 (…), via rustup 1.97.1-… (pinned by ./rust-toolchain.toml); not Trust, plus one line naming the file. STOCK is said only when nothing in the answer marks Trust: a build that prints a Trust mark but no trust: version (the cargo of the Trust seal e9ca4908) is "not known to be Trust", and so is a copy that does not answer as a Rust tool; neither is ever called Trust. Inside a Trust source checkout (an x.py beside a src/stage0 saying compiler_dist_channel=trust) a cargo/rustc that is not Trust exits 2 without running, naming the Trust spelling and how to run it anyway, a session started with aterm --no-reroute: there a stock compiler would build part of Trust. A cargo/rustc a tool spawns there by name is judged the same — a cargo subcommand, an xtask, a build script running rustc +nightly, the compiles a stock cargo started by its path spawns — including beneath a Trust cargo the reroute let run (its children are not announced again, but no longer inherit the escape), with no package store resolving, and with aterm's package manager unreachable (then a stub refuses there outright). A compiler run by its own path, or handed to cargo as RUSTC, is looked up by no name and is not judged. [reroute] announce = false does not silence the refusal. The answer is cached in the package prefix (reroute-identity.cache), but only for rustup's answers and a toolchain's own compiled cargo/rustc; a wrapper or shim in front of them is asked on every call, because it can run a different compiler in each directory.

Removed

The Spotlight rename pass and [machine] spotlight_noindex. aterm no longer walks your home renaming cargo target folders to target.noindex behind a symlink: the name trick is not an Apple mechanism, and the developer root above replaces it for your checkouts. aterm pkg noindex scan|migrate|apply, the Spotlight half of aterm pkg machine apply, its row on Settings ▸ Security and the spotlight_noindex key are gone (a file that still sets the key gets the ordinary unknown-key note). aterm pkg noindex verify <dir> stays, as the measurement. Folders an earlier pass renamed are left as they are, and still build. The trees aterm's own gate and release tools make beside a checkout keep their .noindex names for now (<checkout>-verify.noindex, -verify-cells.noindex, <clone>-release.noindex, <checkout>-cut.noindex, dist/cut-<build>.noindex): on a Mac whose code is not yet in ~/Developer they keep Spotlight off build output, and they go once every owner Mac has moved.

Fixed

A pane kept open after its command ended has no clickable links in its scrollback after an update. Since 0.101.0 a --hold pane's scrollback crosses an update along with its last screen. The links on that screen were removed, because nothing runs behind the pane, but the links in the scrollback above it could still be clicked. The scrollback now crosses with every word and colour and no links, the same as the screen.
Resizing the window no longer deletes spaces or misplaces the prompt. A space just before a wide character (CJK, emoji) at the end of a wrapped line was deleted by a width change, words in history could run together after a rewrap, and after a full-screen program exited following a resize the prompt could land on top of earlier output.
Neovim's cursor stays on the right character on lines with CJK or emoji. Neovim 0.11 and later turn on a grapheme mode in which aterm moved the cursor by whole characters instead of by cells.
Copy and find give back exactly what is on screen. Copying a wrapped line no longer drops the space at the wrap point; with right-to-left text (Hebrew, Arabic) the selection now copies the words it highlights; find and double-click measure wide ambiguous characters as drawn; find gives the same results for a line on screen and in history; and dragging over double-width text selects what is under the pointer.
Wide ambiguous symbols are two cells in wide mode. With ambiguous_width = "wide", symbols such as ★ ♪ ☎ ❶ were drawn one cell wide.

A terminal session no longer freezes when you paste into a program that is not reading. Running aterm as a session in another terminal, pasting or typing ahead more than about a kilobyte into a program that prints but does not read its input (ping, tail -f, a build) stopped everything for good: no output, no keystrokes, no resize. The program's output keeps flowing now, and what it has not read yet waits until it does.
A resize while aterm starts reaches the program. A terminal resized in the moment a session started (a window manager or split laying it out) left the program at its starting size until the next resize.
Zooming the font over a picture no longer uses gigabytes of memory. An inline image (imgcat, sixel, Kitty) was decoded at the size of its cells at the new font size, so zooming a window-wide picture to the largest font asked for about 2 GB a step and could reach 13 GB. A picture now decodes to at most a full-window raster, however far the font is zoomed.
Screens full of pictures or large emoji repaint without starting over. Showing more images than the image cache held at once (two window-wide photos, layered Kitty images, a sheet of thumbnails) decoded every one again on every repaint, a tenth of a second to seconds each time; drawn without a GPU, a screen of distinct emoji at a large font was rasterized again on every full repaint. What the screen shows now stays decoded and rasterized between repaints.

Caps Lock and non-US keyboard layouts type what the key shows. Caps Lock + A typed a; on a German, French, Russian or other non-US layout, Shift typed the US character for that key (German Shift+2 gave @, French number-row digits could not be typed, Russian capitals came out lowercase), and Ctrl with a Russian letter typed the letter instead of the control key (Ctrl+С now interrupts). Typing now sends the character your layout produced, and Ctrl+letter on a non-Latin layout sends the same control key as on a US keyboard.
Option keeps working on Backspace, Enter, Tab and Escape when Option is not Meta. With option_as_meta = false, these keys lost the Option modifier (Option+Backspace erased one character instead of a word in shells that bind it).
Ctrl+Alt+Backspace deletes a word and Ctrl+Alt+Space reaches the program. They were sent without the Alt. Ctrl+~ now sends the control character other terminals send.
The mouse over a split pane talks to that pane. Hovering, scrolling or right-clicking over a pane that does not have focus went to the focused pane's program instead; a button released after switching tabs or panes went to the wrong program; releasing one of two held buttons stopped drag reports; and a program tracking the mouse got a report for every pixel moved inside a character cell.

Output that scrolls a huge count no longer freezes the window. CSI 65535 S (scroll up) archived one history line per count, so a few kilobytes of it from any program, a cat of a file or an ssh session, held the terminal for seconds and froze the window's redraw. A scroll of a screenful or more now archives exactly that screenful and leaves the screen blank, as xterm does.
Links in scrollback can no longer use gigabytes of memory. The web addresses of links (OSC 8) that had scrolled into the in-memory history were counted by no limit, so output full of long, distinct links could hold about 4 GB in one tab, out of reach of the memory-pressure trim. They now count toward the tab's history budget: past a quarter of it, the oldest rows' links are dropped (the text stays), and the memory-pressure trim frees them.
Copy mode's cursor stays on its text. With output streaming, the vi cursor on a fixed row below a scrolling area (Codex's composer, apt's progress bar) was dragged up a row per line of output; it now stays put while rows in the scrolling area and in history still carry it with their text. A resize, clear or a lowered history limit no longer leaves it off the grid or on other text.

A control client that stalls or stops reading no longer turns the other clients away. Eight connections could tie up every control thread, and every other client (aterm ctl, each supervised tab's harness) was then answered ERR control server busy; retry until they let go. A connection did this by stopping part way through its AUTH line (no token needed), stopping part way through a request or a feed-bin/paste-bin body, or not reading a long answer (aterm ctl help --full into a pager that pauses). A control thread now takes a connection only once it holds a whole request, and it does not wait for the client to read the answer; a pager that pauses still gets every byte.

The control verbs wait, ready and await refuse a timeout that is not a whole number of milliseconds. wait 2s, ready timeout=1.5 and await idle 500 timeout=5s waited the 30 s default instead, and wait 2s answered a command that had already finished as if 2s were fine. They now answer their usage line, as turn timeout= already did. A number still waits that long, held at 600 s.

The cursor pet no longer flashes an old cat you could not see after a screen or pane switch. When the pet changed breed under a text selection, the cat it was replacing was hidden by the selection, yet an alternate-screen enter or a split-pane switch brought it back at full brightness for a moment (or let the new cat jump straight to full brightness beside it). A cat now crosses those switches at the brightness it was last drawn at, and one that was hidden does not come back.

aterm --headless no longer connects to the WindowServer (macOS). A headless instance built the real AppKit event loop, and creating its application object opened a WindowServer connection, so WindowServer ran a synchronous privacy check of the binary on its own main thread for every headless launch: one per idle instance, 50 in one run of the headless integration tests. From a build directory holding a very large number of files that check has outlasted WindowServer's watchdog and taken every window on the machine down with it. A headless launch now runs a display-free event loop with no application object, so neither opens a WindowServer connection and LaunchServices holds no record for the process. (A headless render on the GPU of a Mac with several GPUs, none of them low-power, still asks Metal for the system default device, which does connect.) aterm ctl chrome on a headless instance now answers menu (none) (it answered AppKit's default menu, which only existed because of that object), and a headless instance paces its frames at the fixed 8 ms interval, as a display-free Linux run always did.

Vi mode moves by the text you see when the view is scrolled back. Scrolled back, a motion on a line of the live screen (w, e, b, ^, %, {, }, f, t) read the history line that many rows above it and landed mid-word; H, M and L jumped to the live screen instead of the top, middle and bottom rows on view; and output that scrolled the screen left the cursor on its row while its text moved up, so it sat on the wrong line. Every motion now reads the line the cursor is drawn on, and the cursor moves with its text.

aterm pkg verify no longer calls an untouched install drifted. On a Mac's default case-insensitive disk, an archive that laid two directories whose names differ only in case or Unicode form (Dir/ and dir/) merged them on disk while aterm recorded both, and a home folder on an HFS+ disk stored an accented name under other bytes than the archive's, so the install's recorded fingerprint described files that were not there. Such an archive is now refused at install, with nothing left behind.

A Containment shell can no longer change your preferences or register a login item. Under --containment containment (aterm --sandbox), a contained program could write any app's preferences (defaults write), which the macOS preferences daemon saves outside the sandbox, and could ask the ServiceManagement daemon to register a login item or launch daemon that runs outside the sandbox later. Both are refused now; shells, git, Python, compilers and codesign work as before.
A program's output can no longer change what Escape and Enter send. Output holding the sequence a Windows console host uses to ask for key records (cat of a file, an ssh session) switched the tab's Escape, Ctrl+[, Alt+[, Alt+Backspace and Shift/Ctrl+Enter to Windows key-record sequences for every program after it, until a reset: vim read them as stray keys, and an agent's Escape did not stop it. Only a Windows console host turns that mode on now; a web host in front of one turns it on with set_win32_input_enabled.
Dropping a file into PowerShell or Git Bash can no longer run code from its name (Windows). A dropped or pasted file whose name held $(…), a backtick or a curly double quote (a download, a file from an archive) ran a command when you pressed Enter. Such a name is now inserted in single quotes.
Pasting text that holds a NUL character or half an emoji works (macOS). A clipboard holding a NUL character pasted only the text before it, and one holding half of an emoji (left by an app that cut text in the middle of one) pasted nothing. Copied text beginning with an invisible byte-order mark (U+FEFF) lost it. Text now crosses the clipboard, input methods, the tab-rename field and dropped file names exactly, and a lone half of an emoji shows as �.

v0.101.02026-10-08

aterm v0.101.0

2026-10-08 · 2030 changes since v0.100.0

Features

control, harness: the person fence at the write — key|send if-quiet=\<ms\>, and every question key carries it where the host names it
spec: the policy text in SupervisorQuestionAnswer — the laws before the code, Text = 0 still today's model state for state
harness: the question priority words — long-term and short-term decided by the text decider, one config key, a four-word session grammar; the recommended path byte for byte
harness: the loop types the question policy text — one fenced send, read back exactly, Enter on it only as its own; the prose choice follows the same word
kitty: images stack as layers ordered by z, then id, then placement
kitty: X=/Y= start a put's image inside its first cell
kitty: compose animation frames with PNG data or PNG frames
kitty: play animations on the host's clock, one wake per frame
kitty: place a placement relative to a virtual placement
control: screen since=<etag> answers "unchanged" without gathering the grid
render: Windows' default terminal face is the bundled Cascadia Mono PL
windows: the version at the right end of the tab strip, the macOS Version menu's twin
trust: the candidate gate (D27) — a trust pack that proves less than the published seal is never published
consent: read tccd's Developer Tools answer from its own log
privacy: the devtools row on aterm ctl privacy
settings: the Developer Tools row on Settings \> Security

Fixes

update: a relaunch owed between the handoff's two captures refuses the Commit by its own name
gui: a handoff park's lift commits the held fold and the band's growth in one re-grid
gui: the chrome re-grid batch measures its second commit, survives a panic, and its Commit lift is tested
gui: the initial-frame settle vetoes the compositor echo before it reaches the PTY
gui: the settle's async veto outlasts a configure round trip; its Wayland grant is tested
gui: hold the adoption size pulse so the program can read it
gui: the adoption pulse hold is not cut short, and holds only a repaint
gui: a divider wobble across a cell edge no longer re-grids both panes N -\> N±1 -\> N
gui: the divider dead band flushes a coalesced step, reads a clamped offset
gui: a split's shrink stands a quiet before the same pane grows back
gui: the split's take-back hold judges only a collapse, spares the newborn, lasts 250 ms
ctl: a self subscription follows a successor that did not carry its session
ctl: a self stream moves to a successor's own session only when that successor started after the hang-up
ctl: a self stream moves only on the fixed socket it named, judged as the process asked, against its own leg's hang-up
update: confirming a trial and forgiving a killed trial launch wait on the apply lock within a deadline
update: a swap rolled back for a failed receipt keeps the intact cross-volume stage
update: a non-writable install location is refused before the park, as a person's to clear
update/linux: a kept rollback copy is judged as the rollback opens it
update: a window's successor is pinned to the window, whatever its stdin
update: a launch that overlaps a still-running launch of the trial is not counted as a crash
update: the cold lane leaves its successor the quit layout instead of closing native tabs
update: a write the disk refused for a moment is retried, never the build's fault or the person's
update: only a window's own handoff is spared the trial count, and a kept copy we may not read is judged, not retried
gate: three reds on the round-two merge — aterm-link's edition-2021 format, an OB-17 scope phrase, and a stale stages pin
harness: the question-policy review — O5 before the text, a fallback kept to, the fit on the pane, a controller's option over text, one true notice; the model per tab, once per tab, its memory isolated
harness: the question-lean merge review — ask holds dialogs only, a priority word answers prose over a switch that is off, the refused priority sticks, the claims made true
phase: only the launch card's own row ends the live zone — a todo or queued message naming "Claude Code v…" no longer hides a running turn's spinner
supervise: the audit's nine findings on the integrated question-lean branch
supervise: a short reply no longer loses the told choice, and a dialog's first key waits a settle, not two seconds
test: host\_live has one journal reader, and the Linux band test names bg\_is\_light's path
control: a person-count read never pairs a counted gesture with an older stamp
harness: the question-lean re-port review — a held dialog is the person's, status pairs its count with its screen, the question model splits by path
presence: a tab or pane switch is not a read, so away-and-back pays no re-grid
presence: a bound tab/pane switch key reads nothing; a key folds a blank row a non-calm tab does not want
presence: a blank pending row is the front's to fold; a click away reads nothing of it
update: the trial-launch doc says a window's handoff bound without the census's reserved phrase
update: an adopted shell's exit is read from its kernel witness, never by waiting on its pid
update: a visible paste at the prompt counts as the person's gesture, so the history import leaves the view at the bottom
restore: a crash journal is judged by its own run's panic — a consumed main-thread report counts, a later run's does not
update: the successor takes its parent's crash journal over at Commit, so a crash before its first image reopens the desk
restore: a quit layout no longer deletes a crashed desk — both come back, the quit's first
restore: a layout past the window or tab caps keeps every window it can, instead of being refused whole
restore: a quit cut short opens its desk once; a taken-over image places only its writer's shells
restore: a re-tagged kept shell finds its taken-over pane; an older build's cut-short quit opens its desk once
update: the cold lane's quit layout names its run, as a quit's does
restore: write\_to is the tests' spelling once the shipped writers stamp a run or publish a wire
rainbow-kitty: a mid-line insert re-reads the pushed tail's stops at their new columns, and the walk's anchor stays put
rainbow-kitty: one row, one walk — a run minted beside a lit run on its row takes that run's walk by position
rainbow-kitty: the revive comes back on its own walk — the seam names its re-lay with the walk the run's cells had
rainbow-kitty: the fold glyph comes back with its row — the seam remembers a typed fold's landing, and the census folds like a real shell
rainbow-kitty: a run's walk is read on the frame that lays it, and the census reads every fold — the review of the walk-continuity round
control: a request whose client hung up never reaches the main thread
ctl: the reconnect after a dropped connect sends the successor's token
restore: an older build's quit sets aside only a journal no newer than its layout
restore: a desk whose build stamps its quits is never an older quit's own
rainbow-kitty: a key typed while Claude Code re-lays its screen keeps its cell
gui: the lost-integration row's remedy line reads as one sentence
handoff: the scrollback row sizes the band in the Commit's one re-grid; an unstamped build refuses before the launch
handoff: a zoomed window crosses the update at its own size (P6 finding 4)
control clients: the token is read once connected, by the one hardened reader
ctl: the token reader refuses a symlink on every Unix it claims to
spec: every ty spawn is serialised machine-wide, not only within one test binary
spec: the machine-wide ty lock is released by LOCK\_UN, not by the close
spec: the ty lock guard is Debug, so its test's expect\_err compiles
rainbow-kitty: a busy Claude Code's status rows keep their program-row brand (the owner's s▯de gap)
rainbow-kitty: a status tick never forgets a hesitated key's press — the minibuffer forget is the minibuffer's alone, and the row memory evicts the least recently printed row
effects: a cooling rainbow caret keeps its lane to its last visible step — paced by its own next change, never frozen mid-fade
harness: the disk help, report and log lines say the rule, not the mechanism
harness: review fixes
update: stopped installs and stuck staging say what happened in plain words
update: review fixes
notices: the operator's alerts point at fleet status, the Linux wait's end and the keeper's start line read right
notices: review fixes
ctl: on Linux a self stream follows a relaunch too — its start is read off /proc
ctl: a clock step cannot reorder a successor's start and the hang-up
ctl: a relaunch is judged against the old server's exit, not the relay's read
uds: a Rosetta-translated process reads no boot clock; Linux reads USER\_HZ from the kernel
ctl: redial orders on the wall clock under Rosetta; item-2 tests fail on behaviour
update: a broadcast under the Commit's fence waits for the attempt, and the wait says so in aterm.log
fabric: the fenced delivery's wait logs under its own guard — lock census OB-7
update: history's unheld\_below stays said until the lost turns would have aged out
rainbow-kitty: a line-editing key keeps the hand on its row — the first key after a Backspace, an arrow or a Shift edge is guarded like any other
rainbow-kitty: while the hand types on the caret's row, another row's print is no key's echo — whatever glyph it ends on (the owner's v0.1▯0,)
rainbow-kitty: one licence fence for every press route; Enter into a program, a paste and a composer under a scroll keep the hand's row
rainbow-kitty: a press the hand's-row hold keeps is held to the hand's row — no clock, so a stalled composer's echo still lights
uds: the exit-moment thread is marked native-only where the wasm census reads
uds: ExitMoment::watch carries the not-wasm32 marker the freeze-safety census reads (main red since …)
handoff: every window crosses the update at its own frame (P6 finding 4, windows 1..N)
control clients: drive and the sibling forward send the token read once connected
net: dial and listener lines name the right token, peer and cause
net: review fixes
net: the man page and the listener's token line say what dial and a failed token file mean
atpkg: lane refusals, which and doctor lines now say what is true
atpkg: review fixes
ctl: a dialled turn or post cut by its remote is never sent again blind
ctl: a dialled wait from its arm is never re-dialled blind; notes claim no false reason
uds: mark ExitMoment::watch native-only for the wasm census
kitty: name what kitty\_tags\_on\_screen yields, one tag per covered cell
pet: read a cell's image layers through the renderer's own accessor
uds: gate the exit watch's thread for the wasm-process census
kitty: bounded floating placements, redraws that replace, kitty's draw order, playback that neither freezes nor spins
gpu: the image plane gives its texture to the layers a cell shows on top
ctl: image read <r> <c> reports the top image of a stacked cell
uds: ExitMoment::watch carries the wasm census's marker (OB-12)
gui: paused-install, lost-integration, no-socket, restore, auth-denial and tabs-too-many words say what is true
gui: review fixes
harness: upgrade and frozen-agent text now reads right
help: harness, keeper, reroute and trust-lane text now match what the code does
help: review fixes
harness: upgrade rows say what Upgrade now does, and list tabs the command takes
gui: a build on hold is no longer offered, and the socketless and upgrade rows keep their facts
help: the upgrade's done row, the Codex limit reset, the keeper twins and the lane rows now read right
update: a refused intake sends exit 75 only to a parent that reads it, and gives its counted trial launch back
restore: a cold restore brings every window back at its own grid and size
tests: the ty arming's pinned flags and the env guard's protocol list catch up with main
rainbow-kitty: a typed lay the caret comes to rest behind is recalled — a zle redisplay torn across reads no longer leaves band on the Ctrl-R match
rainbow-kitty: the torn-lay recall asks for a print off the row and a hand off it — genuine echoes keep their band, and the zero-ink law stays latent
gui test: the a11y-tree row fixture takes the sealed standing hold the way its siblings do
gui test: the conformance's serialized pty helper no longer shares the library call's name
spec: the trace-validate dir counter is its own static, as on main
link: the node's cap and state default only WITH the rendezvous broker
messages: port audit13-regressions onto audit #14 (a build on hold is never started, quiet goal waits and refusal counts read true)
messages: a refused apply on hold restates the hold, and the skills say where a crashed agent comes back
keeper: release an unplaced offer on the wire; a successor that never took part quits cleanly
spec: every ty checker call writes its spec in a scratch dir of its own
gui: an open overlay card repaints on a live theme change
control: a Kitty animation step, or another terminal at the same address, is never screen "unchanged"
keeper: a tab closed while the window's link is down is released, not kept until the window ends
keeper: a quiet successor that hands the master on is not judged by that exit
control: the search depth cap is per test thread, so another test's App can't reset it
update: ledger tests start once every detached ledger writer has landed; the seeded rung is in whole microseconds
update: the quiet ledger hold acquires no lock itself, so the lock census can place its callers
test: one ledger hold for every test, search caps passed not set, causal park-cost waits
changelog: review fixes
gui: upgrade and update records say the state once and the act that works
harness: supervise and upgrade text now says what the code does
update: a full disk reads as a full disk, once; trial and cut refusals say only what to do
ctl: foreign, stale and redial notes say the state and the one action
ctl: review fixes
keeper: a window's own PENDING only, and a Commit whose successor died first is a handoff
spawn: no descriptor reaches the bridge or a shell unless handed over
spawn: the review's findings: list-don't-probe strip, helpers and successors inherit nothing, bridge lanes retire
update, handoff: a dry run seeds rung 0 from the microseconds the ledger keeps
update: what the health notice announced is the process's — a replacement checker and a successor owe its recovery
update: a successor takes up the health warnings its landing does not answer — each healed by its own proof here, never latched
update: what the parent's health warnings said crosses the cold lane's exec too, so its landing records the healing
update: a folder that cannot be written stays the person's — no reconcile releases it, and the row names it
update: the Linux check loop cues the window when a pass changes the copy's update state
update: one notice is one class — a taken-up download warning is not said again for its sibling spelling
update: a folder that took the swap's write since it refused releases its block
update: a standing block names its own remedy, not the reason booked since
update: the checker watchdog's heals end the digest's day too — one update-health heal
aterm-gui: one child-only duplicate for both park lanes; launchd test off the clock
spawn: every child aterm starts inherits its stdio and nothing else
spawn: the review's findings on inherit-nothing: B27 sees every shipped spawn, warm and ship, the strip past 2,048 fds
spec: a ty child's HOME and cache never come from this process's HOME
spec: tool discovery asks the account's store, never the moving $HOME
uds: a process whose executable was deleted is still read, through its working directory and descriptors
windows: no console window flashes from the window — aterm\_uds::spawn decides every child's console
render: the bundled Cascadia Mono PL yields Nerd Font private-use points
guard: B27 runs on BSD userland; a test-only field no longer hides what follows it
windows: only a window in the windowed image writes the taskbar jump list
spawn: reconcile review: B28e raw rows decide their console, B28s stale fails, aterm-verify scanned, negative control measured
phase: a failed /compact reads as the full context's wall, so the 1, 5, 15, 30, 60 minute ladder holds
pty: redrive the /dev/ptmx open XNU gives up on; name every failed step
flock: let every flock go by LOCK\_UN; fence the doors (tippy + B29)
gui: a shell that fails at start keeps its pane under load — the start window is a hang detector
spawn: spawnfd::command starts its child without a fork on Darwin
spawn: reconcile the spawn-no-fork review
spawn: spawnfd's Command takes arg0, for the keeper's re-exec
gui: a shell that only got aterm's query replies still failed at start
trust-lane: the gate list's profile reader finds a Python 3.11+ itself (r8 mainred)
update: a busy resident operator is a retry, never a strike against the build (r8 #70)
update: a candidate that never swapped for a reason that is no verdict exits 75, not 0 (r8 #75)
update: a codesign run that ended without a verdict is a passing refusal, not a verdict (r8 #37)
update: a signature download that is not a signature is a delivery fault, not a stale anchor (r8 #86)
update: never write defaults over a floor.toml that could not be read; its gates fail closed (r8 #71)
update: a cached pre-park pass is checked against the stage it was cached for, not the floor alone (r8 #36)
update: a facts read that could not prove the installed bundle spends none of the structural latch's bound (r8 #80)
update: only a named moment is a passing codesign refusal; every other exit stays a verdict (r8 #37)
update: the stage-state refusals of the cached-pass check are passing, as the full check's (r8 #36)
update: a floor that stays unreadable is booked, so its stop is said, not only refused (r8 #71)
update: unproven looks at a structural latch have their own bound; at it the re-sample moves a day (r8 #80)
update: aterm update check names the release it just installed (r8 audit #65)
phase: Claude Code 2.1.287's remote-hook reason is still read as a hook's
gui test: the half-closed-subscriber test bounds its reads with a timeout every platform's stream has
primer: the drive and supervise skills match what the supervisor does (audit #15)
help: the agent brief reaches the topic index, names await agent, and fits 92 columns
ctl-help: fabric states, the stale remedy and wait timeouts now read right
fabric: review fixes
atpkg: doctor, repair and per-verb help now read right
settings: macOS access, update, package and notice copy now reads right
settings: review fixes
install: install lines and README say what each step needs and what this Mac gets
install: review fixes
doctor: the report names what aterm starts and what to fix, without rows about itself
doctor: review fixes
drive, fleet: help and hints spell aterm drive/aterm fleet, --dial examples carry --socket, --timeout says what is capped
drive, fleet: review fixes
harness: the harness CLI's status, disk and help text read right
messages: the menu-bar digest opens its entry and Messages' day headers tell the truth
messages: review fixes
update: Software Update, the menu bar and update status say what is true
http: a certificate check macOS never answers fails closed after 30 s instead of hanging
http: review fixes
signing: a code-signing check macOS never answers fails closed after 2-60 s instead of hanging
signing: review fixes
update: the successor's no-activate launch pinned as one table row, and both halves of an update's activation now say so in aterm.log
harness: the same box is one point — a redraw, a re-wrap, a moved focus or a ticking countdown no longer re-asks the manager
harness: a box someone is answering is never re-asked, and a retried long command is asked again
handoff: an adopted session dropped before Commit leaves the predecessor's re-key and body pointer (r8 #20, #44)
handoff: a held (--hold) pane keeps its session id across an update (r8 #21)
handoff: a handed shell dropped before the proof degrades the handoff, never a partial proof (r8 #58)
restore: a co-viewed held (--hold) pane comes back in every window that showed it (r8 #59)
keeper: stop says stopped only when the keeper ended; reroute and keeper help read right
keeper: review fixes
help: rust and permissions pages say each fix once, and only where it holds
menus: tab-menu spawns, palette rows and Fabric menu now read and act right
menus: review fixes
fabric: help fabric and aterm fabric warnings say what a lost bridge, a halt and the inbox verbs really do
tools: a codesign that never answers stops the build, install and pack with one line
tools: review fixes
four review findings on the last day's main — the gate self-test follows the judge, true remeasure advice, ledgers kept on a failed read, a busy host is not gone
quit, fda: the quit dialog and the Full Disk Access entry say what really happens
quit, fda: review fixes
config: the config page, starter file and validator say what aterm.toml actually does
config: review fixes
ctl: control refusals name their cause and their bound
help: agents, ay/ny/nn and trust-backends pages now match what ships
update: aterm update's refusals, log path and Linux rollback lines say the facts
help: --help, the manual and man aterm say what ctl reaches, when the brief prints, and what each containment mode is
gui: tab and pane hover text says each fact once
update: log lines and the update trouble hint say what happened, in plain words
install, docs: Windows and Linux install text names what actually works
update: a taken-up warning keeps its "To look at" line across the update, and a healed stall withdraws its own
update: the review of group RL — a carried warning's line keeps its cause, the stall posts no dead banner call
handoff: round-eight findings 16, 17, 18, 33, 38, 39, 51, 52, 57 and 69
linux: install.sh withdraws a revoked machine's floor (round-eight finding 66)
spec: the escalation-tier line names the build actually used
spec: an evidence header's build stamp follows a wrapper to its binary
gui: the update banner names the owner's remedy; low disk counts the hogs it hides
harness: supervise and accounts text says what the code decided
update, keeper, release: respawn, blocked-streak, keeper stop and lapsed-budget lines read right
update, keeper: review fixes
cli, release, atpkg: Windows update lane, memory refusal and noindex refusal now read right
cli, atpkg: review fixes
harness: a daemon-mode Codex's exit hint is read in the shape 0.159+ prints, so its upgrade resumes the conversation
gate: the two reds main's baseline recorded — a LibreSSL-first PATH and a 5 s probe bound
primer: the agent block and the off switch name what is true
primer: review fixes
agent-docs: installed skills, primer and help say what the code does
agent-docs: review fixes
harness: footer path, branch and mode light read what Claude shows now
supervise: escalations name the real keys, Codex walls quote Codex
supervise: review fixes
verify: gate output names what the reader can do, and calls a refused run NOT RUN
verify: review fixes
notify: consent banners name the asking tab and lead with the action
notify: review fixes
atpkg: the refused agents/ line leads with the managed claude/codex not being first on PATH
conn: aterm conn replies name sessions as @\<sid\> and say what changed
conn: review fixes
grep\_guard: review fixes
trust-lane: toolchain and trustd refusals name the fix that works
trust-lane: review fixes
spec: a provenance line holds only its own tool while it probes
spec: find\_ty follows the store again, and a ty verdict comes only from the build that gave it
ctl: replacement notes say what the relay knows, in one line
mux: silencers, aterm ctl mux and the refusal now read right
mux: review fixes
release: ship's refusals read right, and a yank declares Linux like the cut it publishes
release: review fixes
spec, xtask: NOT RUN notices reach a passing test's log; gate and perf verdicts name what they know
spec: review fixes
gui: harness rows name the tab and the cause, not the harness or its internals
a respawn that never started gives its budget slot back, and the pooled ty co-process inherits only its stdio
spec: a forwarder's exec word is read without byte offsets
ctl: discovery and connect failures name the cause the code found
atpkg: disk, config and claude-update notices state real figures and one action
help harness: the \[harness\] page states power, offs, disk and the upgrade default truly
help harness: review fixes
toolchain-records: the ALab tools records say the whole undo, the real cause, and nothing twice
toolchain-records: review fixes
atpkg: maintenance verbs say the state, one remedy, and refuse a toolset the disk cannot hold
front-door: a forward the running aterm took never opens a second window, and its replies say what to do
front-door: review fixes
help: ship, trust, ty and update pages name the commands that run
find: a capped search names its cause and how far it searched
find: review fixes
atpkg: update, rollback, uninstall and seed lines say the state once, in one set of words
atpkg: machine, noindex, relocate and lease lines say what the code does
help: the ty, clean and aterm pages name commands that run and say each fact once
editor: save, recovery and config-editor lines say the state, not internals
editor: review fixes
review fixes for the fish, accounts, ctl and atpkg series
spec: a ty verdict comes only from the build the provenance line names
update: a standing block follows the newest refusal only a person can clear, and a folder that answered is not named as the remedy
gui: in-window notices name the real cause and say why nothing opened
trust-gate, docs: the build refusal and contributor docs now say what works
trust-gate, docs: review fixes
keeper identity: a peer can be checked against a requirement this build states, or the code at a path (r8d U36)
update handoff: the launched lane grants only to the successor's code, and an exit answer never corroborates a live dialer (r8d U36, #735, P1)
keeper identity: a check trustd did not answer is typed apart from one that could not look the peer up (r8d U36 review)
update handoff: every candidate's dialer must run an aterm release; a silent trustd holds the successor; a turned-away successor is filed by the refusal (r8d U36 review, P1 + P2)
keeper identity: a code check can judge a token the caller read once, and the audit token says when it is taken (r8d U36 second review)
update handoff: the rendezvous judges one audit token and sends nothing if it changed; a candidate signed otherwise takes the fork lane before any launch (r8d U36 second review, P1 + L1/L4)
atpkg: the managed bin/claude answers claude update too — outside aterm it IS the managed name
atpkg: a warm the window started reads the person's opt-out from their login shell
atpkg: a window-started warm takes the person's whole login-shell setup, not two lists' names
restore: keep another instance's quit desk; relaunch a co-viewed agent once; journal the agent a restored tab is still owed
restore: count a co-viewed program in every tab; no relaunch beside a kept shell
handoff: a v0.97.0 producer's policy withholding is said as the policy's request (r8 #87)
handoff: a hooked DCS string rides the parser carry unless it is a query (r8 #57)
handoff: tab stops past the width and an OSC payload are shed; past every shed, screens are lowered (r8 #51)
keeper: a kept shell finds its pane however many updates its journal's image is old (r7 leftover I2b)
handoff: a held pane's scrollback crosses beside its screen (r8 #39)
handoff: a hooked DCS string is carried in a state that reads every byte as it does (r8 #57 review)
handoff: a held pane's scrollback that failed to cross is said as a failure (r8 #39 review)
handoff: only v0.97.0's unexplained loss is read as this build's policy (r8 #87 review)
handoff: a held pane's scrollback export gives way to a live tab's follow (r8 #39 review)
exceptions: the report says what it read, in a person's words
exceptions: review fixes
cli: explain-config, show-face and list-themes say what is true and what to do
cli: review fixes
atpkg: lease, lane, verify, link, unlink and help refusals say what happened
harness: a stale relaunch's line says what happened and what held it
paste-confirm: the paste question says why it asks, keeps its keys when narrow, and is read without the warn glyph
paste-confirm: review fixes
harness: watch an adopted session through its claim grace (r8 #501)
harness: an exit read alone inside the claim grace reads the claim (r8 #501 review)
descriptor ownership in aterm-gui, and review fixes for the front door, atpkg, find and harness series
control: a turn whose text is typed still gets its Enter after its caller hangs up (r8 U51)
update: on Linux a session confirms its start only once its shell spoke (r8 U45)
update handoff: a successor reads an older producer's over-cap manifest (r8 U8, L3)
update: a capture refusal that comes back is spaced, and a parser between reads is no desk change (r8 U43)
update: a busy-desk refusal takes its baseline at the probe, and a refusal that came back says its spacing (r8 U43 review)
update: a capture refusal reads which tabs are open with no engine lock, and a busy engine costs only its own tab (r8 U43 second review)
nudge: a flap during the hold is judged, not dropped; a streamed answer is an answer
nudge: a halt during the hold is judged; no digest line for a healed epoch
install: --uninstall removes only the store entries it placed, and keeps the bundle a failed toolchain sweep still needs
install: the store-overlap refusal reads .. as mkdir -p does, and covers \~/.local/bin too
render: a renderer swap carries the outgoing renderer's geometry
consent: the claimant census counts bundles, not spellings
release: a sealed rescue names builds that shipped, read at origin's tag
primer: one answer for a dangling skills dir; a settings write never undoes a save made after its read (primer-r2 #0, #1)
primer: a context file's write never undoes a save made after its read either (primer-r2 review)
atpkg: a window-started warm whose login shell cannot be read runs nothing
handoff: carry the engine's in-flight output state across the park (r8 #502)
update: an open link or a VT52 address re-parks only a hop to an older build (r8 #502)
handoff: carry a pending ZWJ, the XTPUSHSGR stack and the XTSAVE'd modes across the park (r8 #502)
keeper: the keeper's META carries no in-flight output state (r8 #502)
core: a flag rebuilt from a Line stays a complete pair (r8 #502)
metrics: a mistyped metrics argument is refused; reply shapes and slice caveats read right
metrics: review fixes
robi: tips read right on every platform and point at Settings
robi: review fixes
render, gpu: test skip lines name a cause the code can tell apart
render, gpu: review fixes
gpu: one line per GPU start failure or device loss, no resize or attach dumps
gpu: review fixes
gui: lost-integration count, held-pane scrollback cause and disk-conflict line read right
harness: the usage-limit help no longer forbids the reset it then describes
release: yank's missing-build refusal shows a yank that is accepted
verify: could-not-run rows and --snapshot help name the suite and builds, not lanes or rungs
update: a moment's failed read of the candidate's Info.plist is no verdict on its chunked grant (r8 U19)
handoff: connection rows carry each live triple once, and give way before the update does (r8 U23)
fabric: a session opts into at most 32 broadcast topics, so its opt-ins cannot outgrow the handoff manifest (r8 U54)
handoff: a screen that carried no title takes its layout leaf's park title, not the record's stale copy (r8 U47)
update: a person's fork-lane Install reads the candidate's policy before it parks (r8 U35)
handoff: the pane in front keeps the record's title when its park read missed (r8 U47 follow-up)
update: a person's Install waits out the candidate's read and runs; dropped connections are audited at the Commit (r8 U35, U23 review)
nudge: a spent wait ends on what the engine owes, never on answers counted
nudge: the debt judges a debt attempt only; an unanswered adoption is a give-up
disk: the Claude Code census reads a process caught mid-spawn again instead of refusing on it (r5 disk F2)
harness: a Codex's exit is aterm's restart only for the TUI that restart ended (harness-r4 F0)
restore: a restart's quit layout keeps the agent a relaunch still owes a tab (restore audit r2, f1)
restore: a restart's quit layout also keeps the agent an update's parent handed over running (review of restore audit r2, f1)
update: no lane swaps a stage whose roster confirmation is a day old (r8 #503)
update: a stage waiting for its roster confirmation is held, never failed (r8 #503 review)
update: a cold relaunch's roster wait is held, a check's report is never lost, and an unconfirmable stage is said (r8 #503 second review)
handoff: the control carry is spelled for its receiver, never vouches for a record it left out, and says a lock it gave up on (r8 U15/#714, U32/#731)
handoff: a turn-id count at the top of the manifest's range never stands every later Commit down (r8 U16/#715)
handoff: a committed successor holds what arrives before its Commit wake instead of dropping it (r8 U25/#724, U53/#752)
handoff: a topic, keyed escalation or supervisor claim moved after the park's draw stands the Commit down (r8 U52/#751)
handoff: a held pane's turn ledger and archive tail cross the update as a handed session's do (r8 U31/#730)
handoff: a rollback to v0.100.0 or later keeps hangup, and the carry's lock WARNs read as one sentence (r8 U15/#714, U32/#731 review)
update: a handoff policy holds several rescues, each kept until it is retired (r8c #504)
update: fold a desk past the window and tab caps into the handoff layout (r8c #505, D5)
update: the successor says once what the update folded to fit (r8c #505, D5)
update: a folded window captures whole, and the panes in front are the outgoing build's (r8c #505, D5 review)
update: the crash-loop revert re-execs the restored build pinned to the window, as the boot swap does (r8 U50/#749)
update: an unreadable foreground no longer hides why the handoff is unavailable (r8 U26/#725)
handoff: a held pane's failure the person had seen stays seen across an update, and its exit is not replayed as news (r8 U34/#733)
update: the cold lane's layout write waits a bounded time, retries only a passing fault, and goes on past a settled one (r8 U48/#747, U49/#748)
crash-journal: a killed run's consumed evidence survives the prune until its journal is claimed (r8 U59/#758)
handoff: a held pane's carried exit names the block its checkpoint carries, so the first sweep does not re-arm a seen failure (r8 U34/#733, review)
update: the cold lane records tabs not kept once the switch is granted, and owes a refused take-back until it lands (r8 U48/#747, U49/#748, review)
nudge: every attempt that held ends judged and logged, whatever ended the hold
nudge: the host's let-go stamps resizes at once
install: a scoped --uninstall leaves the account's toolchain store and the links of the aterm outside it, and no uninstall leaves the decline its own sweep wrote
install: a scoped --uninstall judges "another aterm" by the bundle it removes, and leaves the account-wide pieces that aterm uses
consent: the Trash rule is spelled once; each row says whether the move takes it (r3 F5)
settings: a linked copy's row names its link whatever keeps it (r3 F5 review)
update: a rescue must name a producer that follows a policy (seal r3, f6)
gui: a face rebuild drops the CPU window cache too (one helper, both renderers)
trust: the candidate gate (D27) refuses every way the review let a candidate through
update: a held Linux download is hashed once, not at every pass (r8 #25)
update: a window of a settled Linux install starts without the update lock (r8 #26)
update: an abandoned Linux install puts back the trial it displaced (r8 #27)
update: the Linux loop says a lock held past its bound, and only a check heals (r8 #28, #64)
update: a killed or failed Linux writer's full-size temp is removed (r8 #29)
update: a Linux release this system cannot run says why, and is not downloaded again (r8 #30)
gui: a Linux window open when its copy updated still finds the package tool (r8 #63)
gui: a Linux windowed launch is a trial's window start only when a display server answers (r8 #82)
update: the Linux lock-busy refusal names a stopped aterm update as a holder (r8 #28)
gui: a headless Linux launch does not ask the display server (r8 #82)
update: the Linux lane compiles into macOS test builds only, never Windows (r8 LX review)
update: a Linux pass that waits on a pending trial is no check (r8 #64 review)
update: the Linux lock's notice keeps an announced failure under it (r8 #28, #64 review)
gui: a Linux window start follows winit's display, and one it cannot vouch for counts once the display opens (r8 #82 review)
gui: a window counted once its display opens reads its update path at the boot apply's point (r8 #82 review)
screen: the etag reads the host style policy — a config reload is never unchanged
update: a give-back that meets a held apply lock is owed and paid by the next holder (r8 U7/#706)
update: no retire of an activation under another window's live candidate, nor a cached pass over a moved install path (r8 U56/#755)
keeper: one process is one claimant, held by its newest link, so a reconnect never takes the successor's slot (r8 U58/#757)
update: a switch the automatic lane retries by itself is recorded as waiting, not as a failure (r8 U39/#738)
update: the upgrade rim starts at each lane's reader park, not at apply begin (r8 U60/#759, U40/#739)
update: unsaved work holding the automatic lane is a standing row, the wait's one notice (r8 U38/#737)
update: carried Settings drafts no build could put back are saved whole, and the row says where (r8 U61/#760)
messages: a carried row the parked parent ended after the capture ends in the successor too (r8 U62/#761)
update: group U5's review — drafts lost only at Commit, every wait said, the wait ends with its lane, a dismissal heals on record, the rim per park (r8d #737, #739, #759, #760, #761)
messages: a healing the parked parent recorded is decided by its record, not by how the row ended (r8d #761)
update: a yanked installed bundle starts no pending-update clock (r8d #701)
update/linux: a revoked signer's build still comes back from a crash loop (r8d #702)
update/linux: a start's youth is timed on the boot's monotonic clock (r8d #745)
update/linux: a start reads its clock holding the update lock (r8d #745, the review)
update: one record per capture refusal, caps named where passed, Settings named when it holds the update
harness: a census refusal no longer claims an unnamed executable was unlinked
update: failed Linux starts, stranded-stage notes, give-back and memory refusals read right
cli: move-back, memory-refusal and scoped-uninstall lines now read right
gui: the capture-refusal and editor-hold records agree with the single-record rule after the merge
keeper: the named token is read off Apple too, so a Linux build is warning-free (r8e #903)
update: the code gate's limit is measured, and the docs no longer say a stranger needs aterm's help (r8e #904)
update: connections give way before a held screen or a queued post is lost for good (r8e #908)
update: a successor reads only its parked parent's healing, and ends the healed warning's row (r8e #909, #910)
update/linux: a silent session still up buys its burst one more window, once (r8e #905)
update: whether the connections alone fit the manifest is measured, not bounded (r8e #908, second review)
update/linux: a silent session's deferral that finds the lock held tries again (r8e #905, second review)
update/linux: a pass that failed before the update lock says nothing of it (r8e #802)
handoff: a held pane's scrollback pass never stops a live tab being followed (r8e #801)
handoff: a Commit whose answers took time holds its claim through one more input fence (r8 #18)
handoff: the drain gate's re-post hands a refused completion back boxed (r8 #18, tippy)
handoff: a held Commit claim stops the supervisor at its write, and the menu's Hold never waits on it (r8 #18 review)
handoff: a held Commit claim activates the successor at its write, never at the claim (r8 #18, second review)
update: the park gate waits for a deep held pane's first pass again
gui: a refused Lift Hold and a press past an update cap now read right
update, release: a failed identity check and a bare memory refusal now say what they are
verify: memory refusals name the RAM that would do the work
man: ctl exit codes, socket dir, child env and verb list read right
man: review fixes
ctl: catalog rows and INTROSPECTION.md match what the verbs do
primer: fabric and supervise skills, drive help and the primer say what the harness does
gui: settings defaults, help and starter config read right
aterm-toml: one depth budget for the whole tree, so stacked constructs cannot overflow the stack
aterm-toml: find a key-value line's table by position, so parsing stays linear
aterm-json: a power of two gets ryu's shortest digits, not one digit more
aterm-toml: a fixed-length target refuses a longer array instead of truncating it
aterm-toml: a unit variant in table form must carry nothing
aterm-png: stream the image data so every image inside the caller's budget decodes
aterm-lz4: refuse a match offset of 0 or one reaching before the output
aterm-codec: refuse a zlib stream whose DEFLATE data ends before its checksum
aterm-lz4: revert the match-offset check, which no real input reaches
aterm-regex: a negated POSIX item folds before it negates
aterm-regex: a quantifier after a flag directive is refused
aterm-regex: a find\_iter is held to one step budget, not one per match
aterm-search: a budgeted regex scan that runs out of budget is refused
aterm-grapheme: byte\_to\_column and column\_to\_char\_index count grid cells
aterm-lexicon: bound no-space surfaces so the maximal-run scan stays linear
aterm-grapheme: GB11 joins a pictograph only after ExtPict Extend\* ZWJ
aterm-grapheme: skin-tone folding follows Emoji\_Modifier\_Base exactly, in the grid and the measurer
aterm-selection: a column past the text has no word
aterm-grapheme: grapheme\_grid\_columns walks a cluster with the grid's own rules
aterm-grapheme: measure grid columns with one walk over the line
harness: the upgrade watch uses the time it is given, not the wall clock (the test that broke at Oct 4 00:00)
aterm-parser: ill-formed UTF-8 is replaced one U+FFFD per maximal subpart
aterm-parser: an ignored DCS string keeps its high bytes and ends at the 8-bit ST
aterm-parser: a 0x9C inside a UTF-8 character does not end a DCS or APC string
aterm-parser: a 0x9C inside a character takes the dispatch's one table lookup
aterm-gui: delete a Kitty t=t file only where the protocol allows
aterm-core: bound the inline images the live screen holds
aterm-core: hold an iTerm2 footprint to the screen or 4096 px tall
aterm-core: saturate a Kitty footprint's offset sums
aterm-core: charge each screen's live images separately
aterm-gui: read a Kitty t=t file without the marker, as kitty does
aterm-net: drain decrypted plaintext after every TLS feed in the relay
aterm-http: bound every socket call of an established TLS stream
aterm-net: bound the dialer's post-grant exchanges in wall-clock time
aterm-http: read $SSL\_CERT\_DIR as a list of directories
aterm-http: the global deadline and the guard hold on every TLS read and write, not only the handshake
aterm-http: read past interim 1xx responses and frame bodies per RFC 9112 §6.3
aterm-http: NO\_PROXY matches IP literals as addresses, IPv6 included
aterm-http: every number read off the wire goes through one strict HTTP-grammar parser
aterm-http: land one copy of the per-syscall TLS bound, hunt2/tls's
aterm-grapheme: VS16 widens exactly the text-default emoji
aterm-core: say the live-image bound is per screen, in words the scope census reads
proxy: the relay's host pump stops on a flag, never on a lost wake
proxy: review fixes
aterm-grapheme: one word rule, where a joiner belongs to a word only if it spells it
aterm-selection: a double-click selects a word a ZWNJ or ZWJ spells whole
aterm-gui: the find field and the editor step over the words a double-click selects
aterm-grapheme: a script's own format controls spell its words, and a caret's words read from the last break
aterm-gui: M-f applies its count in one pass, and the find field's word motions cost the distance they move
aterm-parser: an empty CSI parameter after the last ; reaches the handler as the default
aterm-parser: CAN and SUB cancel an OSC or APC string instead of delivering it
aterm-core: a canceled kitty chunk ends the chunked transfer it belonged to
atpkg: the tar structure counts against the signed uncompressed cap
atpkg: a member the filesystem names like another is refused, not folded twice
atpkg: tar structure gets its own signed allowance, and the packers sign what it admits
pkg, http: refusals say what clashed or what was wrong, without jargon
pkg: review fixes
verify: the gate's start and test-run lines say the cap, the order and the RAM once
trust-lane: the lane's verdict, memory and floor lines name what happened
verify: the trust row names the failing library; verdict blocks drop repeats
release: the cutter's and release scripts' refusals name the real need and say each remedy once
xtask: gate cells and fmt lines state the fact and the action, no mechanism prose
xtask: review fixes
verify: the busiest-binaries header names what it leaves out, and config.toml's alias header sits on \[alias\]
verify: the test pool's admission reads right in --test-jobs help, PROCESS.md and AGENTS.md
spec: the tiered liveness check judges the committed verdict before a mutant's panic
link: both --tcp refusals say the broker serves TCP only sealed
aterm-link: the broker survives a readiness reader that closes its pipe
verify: the tests-only doc names cfg(test) \*\_tests.rs modules too
subscribe: an adopted session's watch is seeded before it registers, as the main path's is
phase: the proposed goal's column and the lab README's findings read as measured
exceptions: an unreadable messages.log is named even when its rotated copy reads
crash-journal: a program shown in two windows counts once in the crash row
harness: an exit under another supervisor's live claim is theirs past the adopted-claim grace too
supervise: a held Read's reason names its cause, and the dialog notice promises only a measured panel
supervise: a Read box with no folder grant names a plugin among its senders
review fixes for the 2026-10-03..07 landings
disk: the \[disk\] cleanup notes, help and changelog say what turns removal off
disk: review fixes
devtools: review fixes for the Developer Tools row
devtools: round-2 review fixes for the Developer Tools row
devtools: round-3 review fixes: a row for each classifier guard, D13 apply step
devtools: the subject and Resp:{ guards are pinned against weakening; D13's apply step reads both paths on each lane
privacy: the slots lock through MutexExt, not a guard-returning helper
review fixes for the 2026-10-07 landings (disk settings told truly everywhere; Kitty load parity)
trust gate: a retraction excuses only the obligation it was audited at; receipts and preflight fail closed
aterm-core: a cancelled query is not answered, RIS keeps owed replies, a refused OSC 8 URI ends the link
foreground handback: a bracketed paste a gone program armed is handed back (PG1)
links: the caption names the host a click opens; a URL ends at invisible ink and discloses faint ink
fish: re-assert the shell's own cwd at every prompt, as zsh and bash do
fabric bridge: a peer cannot spend this node's subject budget or end a wait with a forged expired
scrollback: one page limit for writer and readers; a block is split by bytes; a quarantined block keeps its rows (SB1)
documents: a journal of a clean document holds no draft, so a changed file reopens plainly (DJ1)
restore, logs: an unreadable crash journal is kept and named; dead writers' restore temporaries and old fault records are collected (RH2, RH4, CL4)
config: removing a setting keeps the comments above it, and a byte-order mark stays first (CL1)
fabric on/off: read aterm.toml the way TOML does, refuse an edit that would not read back, write through a link under the config lock (CL2, CL3)

Performance

input: a precise delta pushing a band parked at a history end takes no lock — the seam is skipped only when its route is known lock-free
gate: the test run stops waiting for driver builds only the tail drives
gate: delivery suites run four at a time with a time line each; --no-windows builds no window driver
wasm: the module ceiling is re-based on the module that ships — 5,886,685 B, the 2026-09-30 reading + 10%
spec: prove\_and\_catch\_tiered takes its ty yardstick from the walk it just did
spec: the ghost-invariant ratchet walks each model once, on every core
spec: cache ty discovery and reuse a ty trace verdict for identical input bytes
control: image read screen mode walks the extras map once and dedups by set
control: the styled frame reads its OSC 8 links in one extras-map walk
verify: every worktree's run shares the main checkout's snapshot, so the gate builds warm
search: amortize posting prefix eviction in full history
agent: share linear Codex readback and project context metadata
gui: retire native render caches outside the visible plan
render: release cached source payloads with weak image identities

Security

a contained shell cannot reach the launch brokers, and four control/shell scope leaks are closed
mail and tasks believe only the attested sender, task text is never options, atpkg writes and runs only what it means to, a window refuses a uid-floor keeper
output cannot echo text into the prompt, a newline-ended unbracketed paste asks, ⚠ titles are folded, OSC events are byte-bounded

Refactors

kitty: name kitty\_rgba's pixels-and-size result
gui: the retired Settings card's test-only overlay slot leaves
screen: render\_sig folds the resolver's list once; concise etag doc
privacy: one TtlSlot\<E\> for the census and debugger slots

Tests

core: alt\_archive p1/p2 build their membership set only when rows left the top
grid: the out-of-range shift no-op tests assert, and three copies go
grid: #5573 pins Row::new/resize unsafety at compile time, not by spawning trustc
gpu: the wasm clock guard finds a file's first test marker once, not once per line
gpu: the wasm clock guard scopes test code to the attributed item, not the rest of the file
gpu: the wasm clock guard ends a last-in-list attributed element at the list's closer
effects: the trail\_sound walk pins read every settle from one walk per voice and seed
gui: the recovery page fixture is sized to span pages, not to fill 240 of them
gui: the two fabric link waits run on a fake clock instead of sleeping
gui: a live Palette pointer strips the frame remainder and top origin exactly once
gui: spec\_xref\_closure reports every failing Tier-1 conformance, not just the first
gui: the glide tests arm and tick on one synthetic clock, and the residual test samples through end
once\_cell: ask cargo each question once per process; the empty lib harness goes
atpkg: the dmg lane builds three real images, and the removed-member hold one fixture per channel
atpkg: the dmg success image carries an in-root .. climb, laid verbatim
spec: delete derived\_coverage, a name-string echo of seven imported models
spec: the orphan guard — no test file compiles into nothing, no test hides in an untested target
spec: the orphan guard reads a --test whose name opens the next line
conformance: the eleven engine-read files run as one vt suite binary
conformance: an orphan guard for the crate's autotests = false
aterm-lexicon: two binaries instead of eight; the alloc pins count per thread
tier 2: http, regex, search and toml suites
core: panic-freedom fuzz observes cheaper, caps its resize history, absorbs two suites
render: the raster accuracy guard's reference visits only the edges a row can cross
aterm-objc: weak.rs splits each scanned file into lines once, not once per fn
gui: the three pure conformance suites run inside the lib test binary
gui: the press and selection custody wrappers stop re-running what spec\_xref\_closure runs
aterm-scrollback: the decode fuzz runs in the gate, as unit tests
aterm-forge: resolve the real workspace once per test process
aterm-update: the rename probe moves into the lib
gui: Dynamic-Type sweeps run their rungs concurrently; zero-overflow checks skip the full audit
gui: a Dynamic-Type rung never outlives its sweep and never passes without running
gui: fit\_failures is pinned to the full paint audit it replaced
spec: the orphan guard reads main's tree as it is
aterm-forge: check\_one\_cell's doc spells the forge verb the Trust way
gui: the page-scroll conformance reads the seam from native\_settings
effects: the music-box ting pin reads its settles from one walk too
spec: the orphan guard knows main's two new re-run-spec fixtures
gui: the Commit wake's merge-first pin follows the landing record into the freeze's lift
ctl: the fallback leg's reset is checked through the relay, across a second successor process
gui: the stalled-listener test waits until its thread has seen the wedge
phase: the 2.1.283 question captures — a typed policy text reads back exactly, and a wrap at any other column never reads whole
host\_live: the question policy answered live — the fake claude's *.type scene reads the one text, and the worker decides by it
the eight reds of a workspace run — stale assertions fixed, load-flaky tests made deterministic or cut
delete the registries, wording fences and sleep-raced tests the dev loop was carrying
harness: the Codex prune's Tier-1 holds a Claude record under a Codex name
keeper: a removed job is waited out of launchd, not read gone at once
rainbow-kitty: a key typed inside a lit line steps the walk backward at the tail it pushes
rainbow-kitty: measure the three walk-origin questions left by the odometer
rainbow-kitty: the walk's continuity census, and two red reproductions it found
rainbow-kitty: every landing wears the band's number, whichever cell each reader takes — the guard for the landing walk, which needs no reader of its own
host\_live: pin the restoring knobs where the tests are about the old flows
the rest of the sweep — ignored benches and censuses, wording pins, shape greps and a duplicated fault-knob scan out
host\_live: the three tests of an ask flow turn on its switch — the owner's new defaults are warnings
two reds from a heavy-load run of main — the measuring stage's needles follow release\_bin, and a Ctrl-C is judged by its status, not a 2 s clock
tty: keep sleep 4 — judged by its status the Ctrl-C check needs no longer sleep
tty: Ctrl-C waits for the command's own word, the read for its own result
core: the folded fresh-terminal fuzz replays what it prints, builds with sixel, deepens with PROPTEST\_CASES
scrollback: the fuzz feature restores the decode fuzz's pre-move depth
spec: pin the kernel family's derived twin names where the models are tested
spec: the umbrella's Safety rows fail closed on a function-valued model
spec: the orphan guard reads attributes, not whole lines, and plants the \[lib\] door
core: keep the no-sixel engine testable; the vt suite runs the fresh soups with sixel
spec: the orphan guard also checks every line on its own
core: mount the fresh-terminal module by path from the test root
the last of the sweep — live-suite stopwatches, duplicate pty/lock/ledger tests and source greps out
handoff: the Commit's scrollback row is checked without sleeps or pinned words, and said once
verify: the gate's eight test suites are one binary, contract
verify: the by-hand test-run measurement can take the whole tree
spec: the routing scan reads a ty\_output CALL, not the substring
verify: main's new nearest\_base suite is a module of the contract binary
verify: the mount guard reads contract.rs's own mod lines, not a list beside them
spec: the arming rule's anti-vacuity count counts ty check drivers only
aterm: two of main's reds — one scratch tag per host\_live test, and the teardown test reads the state-root line … wrote
verify: the measuring-stage pin reads …'s release_bin spelling
supervise: the resume-policy test stops waiting out a 30 s budget — 30 s to 2 s
lights: the one-lap refusal stops waiting 60 s for a press that must not come — 60 s to 0.6 s
update: the fenced-delivery test sits out every fenced bound before it lifts the fence
host\_live: a busy relaunch step is the designed retry, not a wrong answer
fences: a ctl call is read until it exits, not until a sibling's spawn lets go of its pipe
live: every ctl client is read until it exits, through the one helper
control clients: the replaced-listener tests fail rather than hang when nothing connects
reply fidelity: the tokenless-sibling run is judged, never hung, when nothing connects
verify: register github.rs's stage-lock drops in release\_then\_probe
verify: drop the github.rs row origin retired as stale
atpkg: which z3 with no upstream copy says so in both reroute modes
control: the hung-up turn waits for its caller's hangup to show, not the instant after the drop
agent: the footer bind judges each Read transition once and walks beside its ty queue — 387 s to 117 s
spec: the upgrade ladder walks its committed fired set once, and reads its livelock cycles beside the tiered proof — 44 s to 39 s
gui: strict vacuity is its own test and audits beside its ty queue — the spec-xref pair 58.8 s to 21.1 s
agent: the footer bind drops its own verdict cache — verify's ty cache already does that job
agent: the zsh measuring walks run under a ten-minute hang detector, not a 60/120 s latency budget
verify: the delivery-suite pool test is unix-only, like its neighbours (Windows cells type-check its test targets)
twenty more duplicates, subsumed cases and pins out (-892 lines)
twenty-six source greps, duplicates and subsumed cases out (-1286 lines)
gui: a demoted present ends a pending kitty flash, whichever config its rescan read
kitty: drive the GUI animation clock test on a fixed clock
host\_live: every wait for something that must happen is the one-minute hang detector
net: an unreachable local socket's test tolerates the pair its failed relay already dropped
gui: the sync-reopen conformance runs on its own clock, not the terminal's real-time force-clear
host\_live: the upgrade fake draws what is typed into it, as Claude Code's composer does
host\_live: the upgrade fake keeps its composer's frame under the text it draws
twenty-three more duplicates, subsumed cases and dead-helper tests out (-974 lines)
twenty-two more duplicates and subsumed cases out, fixtures shared (-977 lines)
shared setup for the gpu parity, gui conformance, objc census and grid tests (-2312 lines)
redial, the gate's contract suites and the release journal/channel — twenty-one out, three folded (-773 lines)
link: r3\_ls\_paging runs aterm-link ls with no rendezvous file to read — red for the machine, not the tree
five more that read the machine they run on — red or green by whose Mac, not by the tree
the slowest CPU-bound suites run their independent cases side by side, each distinct look decided once (49 s -\> 12 s, 29 s -\> 4 s, …)
keyboard encode, bench differential, codex upgrade, harness cli and cursor-glow review — seventeen out or folded (-359 lines)
forge red fixtures reuse cargo's tree cache (35.7 s -\> 4.5 s); the index-publish bind shares one stub per tool (27.2 s -\> 11.0 s)
six more that turn red with who else is running, or what time it is — not with the tree
env\_reads: the S1 relaunch names are internal protocol; the launcher's limit rides the cold lane too
rendezvous: the never-granted claim is held by a bare accept, not the gated one (r8 #80 review)
gpu parity, effects replays, messages, phase readers, gui handoff — twelve out, twenty folded (-315 lines)
every test pty is close-on-exec from birth, never openpty(3)
gui: Robi's name typed through the real key path pokes him, only while he is on
ctl: the help golden carries licence=recall in trail's row
the last pty masters open close-on-exec — no forkpty, no unflagged posix\_openpt
the pty fixtures' forked child keeps ONE \_exit — exec only after login\_tty
spec: the one-walk oracle's sample is re-picked for main's registry
link: r3\_ls\_paging runs under an empty XDG\_RUNTIME\_DIR — a machine with the fabric on no longer defaults a --cap-file into the stub's ls
host\_live: the upgrade fake never prints into the last column, and a turn's submit must verify
aterm-verify: drop the release-then-probe tripwire and the suite-mount registry
aterm-spec: drop the test-hygiene tripwires
aterm-release: drop the RELEASING.md wording pin
aterm-types: drop two verb-catalog lints, fold the help-line counts
aterm-primer: drop the wording pins, fold the paragraph budgets into one
aterm-cli: drop the manual-page prose pins; no first-exec tax on files never run
aterm-scrollback: drop three wall-clock ratio tests that have exact twins
aterm-conformance: drop the tests-directory orphan guard
aterm-forge: drop four live-tree duplicates of xtask gate forge
atpkg: run the three real-hdiutil dmg images as three tests
aterm-ctl: drop the mux-notice copy pin
aterm-agent: five relaunch tests stop sleeping on production waits; drop a prose pin; ignore the 960 s zsh walk
aterm-gui: drop help/starter/UI-copy prose pins, a release-only stopwatch and a redundant one
aterm-effects: busy\_status\_rows replays a bite-checked sample by default, the full grid on request
put back the guards the diet review found uncovered; sample the zsh walk by default
help: drop the 178 KB ctl\_help\_full.txt golden — help --full is generated, its shape is what is asserted
the two pty-open locks and the rig's helper get names of their own (OB-7)
the r8 S3 tests are tippy-clean
the quiet flow's give-up row fits its cut too (r8 #4)
link: the retire test waits for the bridge's ev line instead of reading it once
handoff: v0.100.0's producer fixtures, so the 0.101 cut's fixture gate passes
the web band golden, regenerated
restore: a fixture layout's show state is read as its parent carried it
aterm-types: the integration files are one types\_suite binary
aterm-buffer: the integration files are one buffer\_suite binary
aterm-agent: the integration files are one agent\_suite binary; the bins stop running empty harnesses
atpkg-keys: one keys\_suite binary, one pty lock
atpkg: twenty integration files are one atpkg\_suite binary; four keep their own
aterm-containment: eleven integration binaries become three
aterm-objc: the fourteen read-only files share one binary
aterm-core: the integration files become core\_suite, core\_fuzz and five isolates
aterm-effects: 71 integration files run as one effects\_suite binary; four allocator isolates keep their own
aterm-render: 68 integration files become one render\_suite binary; eight keep their own
aterm-gpu: the integration files become gpu\_suite and gpu\_fontdue, split by one environment write
aterm-spec: 99 integration files become one spec\_suite binary; the export drops the targets it withholds
aterm-scrollback: the two wall-clock scaling proofs main kept count work instead
aterm-link: the world binary caps live stack tests, not only boots
gui: the cold-exec retire test runs alone in its own process, where no sibling's fork holds its listener
control: a closed client is gone once a sibling's fork has exec'd, not on the first probe
pty: the HUP-ignoring teardown test waits for the corpse instead of reading it once
gui: the ring-cap Messages test counts the render's work instead of timing it
the digit read witness, the survey card, every instance's claims; turn help names the witness
the cold lane's health variable is internal protocol in the env-read registry
the person's-refusal tests run where such a refusal exists — macOS
control: the hung-up caller's refusal is waited for, not read the instant after the drop
gui: a push test's client hangs up for the whole socket, and its loop is joined with a hang detector
gui: one run-this-test-alone helper, which requires the child to have run that one test
harness: the snapshot test plays each exit once the host has followed the tab, not after a pause
harness: the /clear is rung once the attach has read the agent
gui: a test body's scratch dir is a TempDir, removed when the test ends
gui: process-lifetime scratch goes at exit, and a dead run's is swept
atpkg: every scratch dir is a guard removed on drop, however the test ends
atpkg-keys: scratch dirs are removed on drop and unique per run
launch roots, SDK probes and fixtures that outlived their test go with it
aterm-gui: drop the held capture's sub-second wall-clock assertion
aterm-gui: fork-after-park asserts the limit check, not the park's clock
aterm-gui: must-land parks get a hang-detector budget; held margin pinned without a clock
aterm-gui: a test's park lands by default; a miss test opts into the real rung
atpkg: integration scratch dirs go on a failed run too
atpkg-keys: owner\_to\_client's scratch goes on a failed run too
control: every hung-up caller in control\_hangup\_tests is waited for as a fact
control: a relay test's client hangs up both halves, and its forward is joined with a hang detector
control\_listener: the asking client tolerates a supervisor that already answered, and reads a line
control\_auth: the sibling's namespace lock is released on a fact, not after 50 ms
harness\_host: the relaunch-at-the-commit test waits on facts, not sleeps
gui: helper-test stand-ins must run exactly their test (test\_alone::StandIn)
app\_restore: the spawned-leader test runs alone; its control's pair is never inheritable process-wide
gui: a handoff fixture puts HOME and XDG\_RUNTIME\_DIR back before its scratch goes
spec: the one-walk oracle samples the registry by outcome, not by name
aterm-gui: the status record's argument check looks for a word no field spells
aterm-gui: the daemon's descriptor stand-in stays out of the shell's script slot
aterm-gui: the test process forks only once libnotify is up
aterm-gui: a stopped controller's reap is awaited by a hang detector
aterm-gui: an authority transition's reap is awaited by a hang detector
aterm-gui: a refused late install's reap is awaited by a hang detector
aterm-gui: the already-due title wake is read at a fixed instant
atpkg-keys: a revocation test asserts which index is selected, not the NoIndex symptom
update: the tampered-bundle table names its type, so the workspace lint stays clean (r8 #37)
harness: the parked stand-in agent lives as long as its test, not 30 s
drop the pty-open locks and retries; the opener redrives the race they hid
the last bare /dev/ptmx opens redriven; atpkg-keys' pty lock gone
a wait for something that must happen is a one-minute hang detector across the tree
spawn: a descriptor test the kernel cannot stage says NOT RUN — the soft limit overstates what a process can open
containment: the task-port proof's probe is bounded, so an administrator prompt fails it by name instead of hanging the gate
spawnfd, pty: the descriptor-cap tests size to this host's kern.maxfilesperproc
spec: SupervisorBoxAsk joins the non-vacuity ratchet, and its Tier-1 binds the real loop read by read with the old key replayed
elapsed-time assertions in correctness tests are hang detectors where the regression they catch takes far longer
one suite binary for aterm-session, -grid, -phase, -codec, -lz4, -shell-integration and the aterm crate; aterm-release's top-level files join it
the atlas scan and the two shim tripwires come back
the generated-input tests draw from one generator, aterm\_spec::rng
gui: spec\_xref\_closure builds xtask in target-xtask, never the test's own target dir
aterm-agent: the footer bind walks the states within 5 actions by default; the whole reachable space is #\[ignore\]d — 110 s to 22 s
aterm-gui: Settings layout matrices — rungs run as threads, not re-exec'd binaries; the two big sweeps are sampled where the answer changes, their full grids #\[ignore\]d
diet2 wall: review fixes — pin chose\_model\_since directly, sample one rotating middle pager page, state costs as ratios
aterm-session: conformance\_input\_unread drives the stall bands on an injected clock, no sleep, no retry
aterm-ctl: an\_explicit\_timeout\_bounds\_the\_wait\_for\_a\_successor tells the deadline from the bound by the bound, not a stopwatch window
atpkg: the wedged-driver leg of the unattended-pass test no longer waits out the 5 s probe bound twice
linux-bootstrap: an installed OpenSSL 3 is found, so macOS's LibreSSL first on PATH no longer fails the suite
verify: a hung test binary's ceiling is a minute, so a starved one that finishes is never the one named
spec: the store-update audit-trail test's step closure needs no mut
aterm-spec: the\_account\_rotation\_moves\_one\_session\_alone... — re-explored the 34,251-state space for every liveness question → walks the committed space once per audit
aterm-agent: account-rotation tier1 + defects walks — asked the real code at every model state and edge → asks it once per projection
aterm-agent: a\_version\_probe\_is\_bounded\_whole — a stranger's sleep and a failed ps both passed or failed it for nothing
aterm-verify: the two delivery-suite stages tests — 28-30 first-execs each → one inode per text
aterm-verify: environment\_contract ladders and the driven-suite law — a full Fast ladder per run → a lean ladder, a measure run, one text per stand-in
aterm-core: process\_crafted\_escape\_sequences\_never\_panics — every resize reflowed an uncapped 10,000-line ring → capped at 1,000 like its siblings
aterm-phase: the\_reader\_never\_panics\_on\_any\_window\_of\_any\_fixture — read\_all took 7 readings for 4 distinct ones → binds each once
aterm-effects: rainbow\_kitty\_v2\_steady\_frames\_allocate\_nothing\_and\_idle\_to\_exactly\_zero — twelve independent cells ran one after another behind a process-wide tally → par\_map over per-thread tallies
aterm-release: trust\_facts\_model::the\_retired\_floor\_excuses\_are\_refused — each Harness exec'd two freshly written stand-in trustc scripts (Prover::at, six first execs) → exec-free testing::prover
aterm-link: r15\_review\_fixes::x3\_a\_reply\_to\_another\_session\_does\_not\_cancel\_my\_expired — waited out a real 30 s wall-clock deadline → bridge fault marker fires the sweep once the misrouted answer is delivered
aterm-link: r13\_presence — read detail= once beside phase=busy → wait for it like the other fields
uds: the no-descriptor child is spawned, not forked from the multithreaded test binary
gui: spawn test children through aterm\_uds::spawnfd, holding only their stdio
gui: the shell-start-exit tests run /bin/sh -c, never a freshly written script
update: the Linux check's cue to the window is pinned where it is made — one reporter step, and both ends of the wiring (r8 #31 review)
agent: the measured-zsh walks run as ONE probe under a state-aware hang detector
agent: the zsh walks run a third of the processes and outwait opendirectoryd
agent: zsh\_walk's doc says what the one probe costs beside main's side-by-side groups
agent: a zsh probe ends with zsh even while a grandchild holds its pipe
agent: the zsh walk's review findings: a silence count that output resets, a second verdict, the shims' claim
temporal: the unseeded keyframe's control is a hooked DCS query (r8 #57 follow-up)
aterm-verify: load\_average — a sysctl spawn twice per planned stage → getloadavg(3) in-process
aterm-verify: standin\_body — a fixture's stand-in text was one fresh inode each → one constant text, the body is sourced data
aterm-verify: handback\_lane\_keys — the fake forked a helper per verb → every verb is a builtin, one linked copy
aterm-verify: gate\_contract driven-stage, recording and driven-suite tests — a fresh stand-in inode per fixture text → bodies are data behind one shared stand-in, one repo per run
aterm-verify: environment\_contract — a fresh targo inode per fixture and ladders no assertion read → one shared stand-in, bare runs
aterm: pipelined\_waits\_are\_held\_while\_wait\_lanes\_are\_free — 16 waits sat out a 30 s timeout only so the version behind each could be read → the held waits end by the text typed into the session
two timing and descriptor defects the evening's contract runs tripped
rendezvous: the dribbling-dialer test reads its code requirement before the clock runs
zsh: the xtrace test refuses a line traced inside aterm's own functions, line-init's included
handoff: an unreadable output\_state costs only itself (r8 #502)
render: the two Windows-only callers take renderer() as the Renderer it now returns
gui: count the arm-time pre-park read in the arming function only (r8 U35, #503)
restore: a folded window reopens every native tab it received (r8c #505, D5)
atpkg: a Mac whose Spotlight server is off skips the mount-point index test with one line
handoff: a held pane's seen failure stays quiet after the next sweep too; the audit names the take-back's bound (r8 U34, U49)
handoff: the held pane's next sweep is timed after the successor restores it, and must read the block (r8 U34, review)
update: the Linux transaction tests run on the macOS gate (r8 LX)
update: no needless mut in the reuse test's negative control (r8 #30)
update: #26's test holds the update lock as another aterm does (r8 #26)
update: #25's in-place controls set the stamp they test, at any clock (r8 #25 review)
screen: hold the conditional read's etag to the host's changes too (red on main)
screen: name the etag-under-test type (tippy type\_complexity)
control: the etag corpus reloads the host palette with no output
update: a busy user's exhaustion row leaves once the draft no longer holds the lane (r8 U38/#737)
update: the grant's last token check is pinned for the chunked grant and on a real exec (r8e #901, #902)
update: a held press's lane wait and its no-double-up guards are pinned (r8e #906, #907)
handoff: the fork lane's held-pass test does not depend on the halt's 100 ms (r8e #801)
atpkg: the mount-point index test skips whenever mdutil reports no state for the mount, quoting mdutil
verify: the hung-binary fixture pays its scripts' first exec before the run's one ceiling
live: the at-start stub shells pay their first exec before the 2 s start window measures it
update: a landed park's ledger write is made and finished under its test's ledger hold
control: the cold-exec retire test runs alone in a child, where no other test's fork holds the listener
host\_live: the upgrade fake's files are replaced whole and checked before the rename, and upgrade steps wait by the product's retry
host\_live: the upgrade tests stage every build before the session starts, and an await that is not idle names why
gui: review fixes
aterm-link: review fixes
update-handoff: a trustd hold in the dialer tests is its own outcome, one timer
update-handoff: review fixes
keeper: review fixes
effects: run the slow sweeps' independent takes side by side
spec: shard the slowest model-derived tests; run a liveness claim's ty checks side by side
phase: the panic sweep shards its tall screens and skips readings it already took
gui, agent: run the slowest conformance walks side by side and split the timed agent runs
effects: the pet host reuses an unchanged snapshot; recolours stops building prefixes
phase: the reader reads its rows on bytes, a quarter of the sweep's CPU
spec: walk models over a once-resolved form, not BTreeMap envs
core-fuzz: cut the resize fuzzers' CPU by a quarter to a third
two reds of today's main gate made deterministic — a dead server's socket is a datagram socket, a ctl call the instance never accepted is asked again
the gate's slowest three lanes cut 5-10x without dropping a case
the gate's five hottest test modules cut without dropping a case
shell-integration: type each zsh prompt's line once zle owns the tty
aterm-gui's lib tests 256 -\> 199 CPU-s, and a limit oracle on the minute grid
the footer walk replays its paths on a pool, judged in walk order; xref hands a worker's entered anchors back
the world suite's seeds are pipelined and its long pole starts first
update-handoff: a dropped exporter's test waits for its worker to finish, not for an empty directory
the press-retry test ends on its third press and its badge, not on a 3 s clock
update-handoff: the stranger stand-in reads the whole grant before it exits
aterm-link: the world suite judges a stale aterm-gui once, outside every gate
aterm-link: a binary built as a dependency is judged by its real inputs, not every source file
gui: the crash-journal conformance reuses a desk per worker; the entry-cap test lays its files on four threads
aterm-render: the font-less configurations compile and pass
aterm-uds: set a read timeout while the peer is still open
aterm-spec: walk models resolved, not by name, in the suite's own walks
aterm-agent: cut the CPU the heaviest walks spend, coverage unchanged
aterm-effects: cut the lib and effects\_suite CPU without touching coverage
messages, effects, gui: spend less CPU in the heaviest lib tests, same coverage
the most-edited inline test modules below aterm-gui move to sibling files
cap: the mint-reachability scan reads a \<stem\>\_tests.rs module file as test code
gui: the update-health digest test reads the streak's own date, not a fixed month
the update-health entry's month is the streak's own, not September
gui: make update health date fixture calendar independent
prepare agent warm fixtures before product deadline
link: the queued-fetch test waits for the watch and bounds the read by the hang detector
phase: the store canary owes only the anchors its build's version was measured for
approval: the owner's subagent rm box, re-driven on Claude Code 2.1.292, is pressed at default power
spawn: the descriptor-leak controls left on std's Command start through spawnfd::transparent
handoff: a paused export is stopped under the hang detector before finish(ZERO), not finish's 100 ms
supervise: a move to Gone is a read of the composer — the key-off successor's test ends on what happened
supervise: the symlink Read test builds its fixture under /tmp, not $TMPDIR
stand-ins: one pre-assessed inode per stand-in body, so a live test's first exec is not syspolicyd's
aterm-session: the drained reading waits for a probe that took the spill mutex
gui: 49 extraneous aterm-gui unit tests deleted, two trimmed, each adversarially confirmed
fabric on: the fake launchctl is one pre-assessed stand-in, its paths read off $0
aterm-agent: the auth runner's and the fleet subscriber's stand-ins are pre-assessed
gui: the slow-answer handoff test's client waits for its answer before taking its 50 ms
gui: aterm-gui's 130 big inline test modules move to sibling files — a test edit stops rebuilding the gui and its dependents
shell-integration: the zsh tty tests hand the body pointer over whole, through deliver
effects: 17 extraneous aterm-effects tests deleted, each adversarially confirmed
agent: 9 extraneous aterm-agent tests deleted and two folded, each adversarially confirmed
atpkg: 35 extraneous atpkg tests and two whole test targets deleted, each adversarially confirmed
first exec: a just-built binary is run once, unclocked, at the point of launch, before its hang detector starts

Docs

gui: the grace override's pin is an assert\_eq! on the constant, not a const assertion
update: the trial-ownership rule says why an ejected volume never reaches it
audit: section 2 gives the session word as the parser's four words
harness: say the question priority words in a paragraph, not a page
warm successor: P5's as-built section — the artifacts slice was the layout sidecar's syncs
no supported Trust install off Apple-silicon macOS
correct comments the gate speed-up landing made untrue
keeper: the one-generation re-tag is a known limit, said where the placement is
verify: the report-time reader names its landing date on main, 2026-09-28
trust: the L0 catalog gets its own document, and deriving models from code is Trust's D-11(e)
trust: each retired doc gets its own reason, and no line claims a model Trust has not derived
the changelog and the manual say what changed (tall-window read, the tab's next try, the resumed stream)
pkg: aterm pkg lane's manual and usage line say the same true things
effects: code comments name the Phase 4 seams
effects: comments name the Phase 4 successors of what the swap deleted
kitty: the not-built list, GHOSTTY\_COMPARISON and CHANGELOG to the truth
kitty: module docs on their own modules, codec claims narrowed, the record to the truth
trust: the self-test's duration, as measured twice under load
rating surveys — help, skills, audit, measured facts, CHANGELOG, Settings label
review fix - no dangling plan citations, and the observer default is stated as taken, not ruled
the render-integrity design, the Row Law rulings, the skill
review fix - what render=displaced means, and that the repair is opt-in
upgrade: review fix - renumber the upgrade rulings 394-398 to 407-411 and widen the typed-hand ruling
how a wall ends - every limit is answered by an automatic continue when tokens are available
review fix - every place that says a limit is continued "a minute past its reset" says 150 s and a share
stale design records made true; settled questions recorded; cruft retired
review corrections to the stale-record pass
effects: three design-record rulings decided — digest bias declined, T1/X1 strict, kitty rungs 12-14 not planned
effects: the trail verb names licence=recall, the changelog carries the torn-read fix and the flying head's meteor, and kitty-motion points at companion\_look
host-boundary: the record says what is parked, who takes the next wasm trip, why Robi and the windowed checks are owed; stale references follow the companions
identities: the keychain question is read from Claude Code's own code
§0.1 lists 418 (d) and quotes the owner; the keychain naming is read, not unverified
the nearest-base ruling's doc lines reflowed, and the ceiling note's opening points at its ruling
cut the ownership, claim and owner-wait dogma from the agent docs; keep the facts
paint: row 9 says it is judged trail-dark, and its dark-era red is dated
paint: the explicit-tall row no longer claims to be pet-free
effects: the exhaustive brand sweep's run line names effects\_suite
keeper: SuccessorCrashesFirst judges both ends whichever is read first
control: a one-key card over the composer takes no key of a typed text
control: the subscription ack follows the seed; the socket path is run\_subscribe\_socket
the debugger-change deadline follows wants_poll
the debugger-access lock, records and marker notes say what the code does
delete finished audits, reviews, superseded RFCs and uncited measurement logs; one key doc; CHANGELOG to the newest release
agent\_suite: the ty driver holds no lock since 2026-10-01 — say so
spec: notice() links the provenance report by its new name
update handoff: the Developer ID dialer requirement is measured against a running installed window (r8d U36)
atpkg: which\_sentence's doc says bin/ carried no block until 2026-10-02 and is an under-claim now
handoff: the meta's OSC payload is hex, not a JSON array (r8 #51 follow-up)
core: the output-state module says what REP and a link keep (r8 #502)
disk: the census's reread budget says why 255 ms, not only the 1 ms median (r5 disk F2 review)
handoff\_carry: rewrap the export's doc comment
update: the asks-nothing refusal names the knobs; the next fixture generator reads PolicyFile (r8c #504)
update: the reader build is enforced for every later cut; the seal rule said in order (seal r3 review)
screen: document the conditional screen since=<etag> read where agents look
audit: the second review of #904, #905, #908 and #909 — the keeper's code check is open the same way, and the park-window residual is recorded
every cited test target is one its package declares
record the leaf-parser hunt of 2026-10-03
one true status note for ROADMAP, the memory cap in PROCESS, leaner RELEASING/README, stale paths fixed
SLOW FIRST RUNS in aterm help permissions; O3 reopened, O9-O17
session: the large non-parking frame delegates to the blocking body, not write\_frame
trim incident narration from PROCESS, INTROSPECTION and top-level docs
trim war stories and repeated wire-rule prose from the bundled skills
review fixes
trim history narration from crate READMEs

Other

aterm-pty, aterm-gui: every spawned child is reaped — no lifelong zombies in a window
aterm-pty, aterm-gui: gate the two tty-drain reap tests to macOS
aterm-gui, aterm-spec: bind the one-server-per-@sid order of a live update to the model and the real publication
aterm-pty: the gather tests read parks and budgets by census, not by stopwatch
aterm-pty: the census tests check how long the idle wait lasts and pin the hot budget to a value
build: test = false on twelve libs whose libtest harness runs 0 tests
build: test = false on eight more harnesses that run 0 tests
build: aterm-census keeps its bin harness in this landing
messages: a flood thins the queue before it touches the glass — the center's eviction takes every queued row before any row on the glass
chrome: a window's grid does not grow back within 400 ms of a chrome-driven shrink — proposed for review
wip(ledger-split): pair a split flap in the resize ledger — superseded on main by … and …
harness: a turn is shown only once it commits, and aterm's own turns are aterm's hand — a refused turn no longer flaps the grid
presence: the row moves at most once every 400 ms, chrome re-grids are paid once per window, and aterm's hand needs its credential
messages: a window's chrome rows do not grow back within 400 ms of another source's rise (ruling 414, proposed); the band's and strip's re-grids are booked site=chrome
lifeline: the adopt tests assert what adopt retires, not a reusable number
merge contract: three reds main carries, fixed in their own idiom
style(gui): trustfmt the install-location remedy test
conformance: a plain targo test no longer builds a release aterm to time paint and spin rows
harness: an agent ends its task with ATERM-TASK-DONE — nothing more is typed until a person does
messages: the engine bug hunt — 21 defects found, each proven by a test that failed first, and fixed
aterm-agent, aterm-gui: one waiting Claude upgrade is one entry — no row posted and withdrawn at every round, and a standing row says its age in place
aterm-agent, aterm-gui: only an overdue row's age wakes the host — a held-back, refused or stuck row, whose words carry no age, is not re-sent every minute
aterm-messages, aterm-agent, aterm-gui: a waiting upgrade's record says its age in place — behind for 7 h moves to 8 h on the one entry, never a new one
aterm-messages, aterm-gui: a waiting upgrade's record names only its own buttons, and one upgrade stays one standing entry when its entry changes shape
consent: observe macOS debugger access (developer mode) — the P0 probe core
privacy: the debugger row in aterm ctl privacy
doctor/help: debugger access
config/diagnose/guard: the debugger rule under \[privacy\] check, and B21
debugger access P0: review round — no enable command on agent surfaces, remediate unset, B21 narrowed
simplify (round two): render core, Metal tests, GUI chrome, aterm-link, operator and consent — duplicates and dead code out, less work per frame and per record; net about -1,400 lines, behaviour unchanged
style(harness/footer): format the slug test main left unformatted
aterm-types: the quiet fence keeps its residual guard, not a needle list
aterm-phase, supervise: a dead Claude Code frame above a new one is not the live zone, and no busy wait is armed on its footer
style: trustfmt prefs.rs and the prose-doc pin's single check
primer v13: every agent paragraph states facts, not orders
skills: the bundled drive, supervise, rust and fabric docs state facts, not orders
help: the agent brief, permissions and fabric pages state facts, not orders
help: the drive pages say what a re-post and /compact do; reflow the brief
help: debugger access and ls state facts, not orders
aterm-gui: the drain-reap test's gate names unix, so the Unix-only seam check counts it gated
harness: a frozen agent and an unproven rm breaker are warnings by default
harness: the live upgrade moves an idle session and types nothing
fabric: a lost bridge leaves its sessions running with an advisory
fabric: the lost-bridge warning passes its line by value (tippy needless\_borrow)
fabric: the advisory's helpers live where bridge\_lost does (unix and tests)
control help: the golden regenerated over the merged verb table
publish: the public snapshot keeps the Trust pin; the gate builds on Trust
harness(upgrade): a closed tab's settled Codex record is collected after its week (gap #22)
tests, tools: the last unarmed headless launchers hold a lifeline, and B21 fences every launch site (gap #36)
spec(harness): the collection model's fairness names when the prune runs
handoff: a dev seam kills a launched successor before its rendezvous dial
handoff: a launched successor that dies before its dial ends the wait at once
handoff: the retired cancel-only abort breaks an invariant of its own
handoff: the pre-dial death seam stops at the hop to a child shell
handoff: the layout sidecar and the pipes are made before the park (warm successor P5)
review(P5): drop the unfulfilled dead\_code expectation off macOS; correct the as-built numbers
harness: the Codex prune reads a registry only over a state root of its own kind
spec: the Codex collection's Rewrite mutant breaks a safety invariant of its own
harness: the prune's test Opts take main's new ask (the default, false: the prune never reads it)
aterm-gui, aterm-session: a closed tab 0 releases its PTY master
aterm-gui: the owner lookup retries a timed-out lsof; the socket-owner and mode-return tests wait on facts
aterm-pty: the fork-race test ends on a stalled churn, not a 120 s clock
aterm-pty: the fork race's stall detector keeps a clock per side
aterm-gui: press\_not\_due bounds the press's deadline on both sides
simplify (round three): CPU rasterizer, GPU renderer, atpkg CLI, rainbow effects — less work per frame, duplicates out; net about -825 lines, behaviour unchanged
atpkg reroute: every stub runs something; \[reroute\] strict restores the refusals
reroute: Manual knows \[reroute\] strict; help, changelog and design note say warn-and-run
harness: a window with no control socket says, on glass, that it supervises no agent
harness: a reload refused for encoding or size still runs the file's \[harness\] lines
verify: --no-windows — no stage opens a window on a desktop a person is using
chore(restore): classify\_death takes the next run's start itself; the non-unix cells keep the new items quiet
gui(status item): one menu, painted on open; the title is set only when it changes
effects: a hidden cursor on a blank row is no caret for the motion engines
host\_live: the three tests of the ask flows opt into the owner's switches
spec(harness): no upgrade stuck forever — HarnessUpgradeProgress, its law, and main's two open gaps bound to the code
harness(upgrade): a limit past its reset is told, the refused notice's instant is named, --status says cause= and told=, a visit's retarget is said, and the record has one remover
harness(upgrade): a limit past its reset is never told to be waited out, the mark says what the record read, and "closed" says for whom
harness(upgrade): a READY covers any version — a newer build is taken in place, the round and its READY kept
publish: the wasm32 clause adds its own target; its channel lives only in the clause
WIP (untested): the review repair of HarnessUpgradeProgress, cut off by the usage limit
control, harness: turn if-rows= — the upgrade's notice fences on Claude Code's input box, not the whole screen
spawnfd: the staged-fd test's launcher strips inherited descriptors, not just 3 and 4
spawnfd: spawn\_with\_two\_fds strips every other inherited descriptor before placing its two
harness(upgrade): a usage limit whose reset no look read is told once any limit has ended — never a record for ever
messages: the second bug hunt — 24 defects in the host glue and the engine's remaining modules, each proven by a test that failed first, and fixed
harness, effects: fix what the review of the last three commits found
handoff: the pre-dial death seam can check in with LaunchServices first
handoff: a named successor that dies before its dial ends the wait at once
review(exitwatch): drop a duplicated Tier-0 walk; correct the substitution doc
harness: a READY is heard at the turn end it ends, and one the agent was moved on from is asked again
aterm-types: regenerate the ctl help golden for the upgrade= column's new words
harness: the screen's READY holds no point under the quiet upgrade
harness, effects: fix what the second review round found
gui: a tab that lost its shell integration in an update says so, and what gives it back
rainbow-kitty: keep main's crossed-echo lay; the relayout takes land as its pins
gui(messages): the tabs that lost their shell integration are ONE row, named by place, restated, adopted across an update
gui(messages): the lost-integration row says nothing before Commit — the successor's host is still suspended
harness, effects: fix what the third review round found
config watcher: fix what the fourth review round found
profile: aterm-spec's model interpreter builds at opt-level 1 in dev — the model suites run \~3x faster
spec(harness): anchor HarnessUpgradeProgress's two new actions — main red since …
release(publish): an answered 4xx frees an upload's intent, and a full source release is never adopted
release(publish): a refused upload keeps its object named, proves the lease, and is modeled
xtask(citations): never walk a cargo target dir for definitions or prose
build(profile): the differential oracles and aterm-png compile at opt-level 2 in dev
verify: the fixture ladders drive every smoke send without the real pacing
verify(tippy): the required-features pass lints aterm-gui's gated targets, not its test library again
verify: every gate records each test's wall time and prints the slowest
verify: the fixture ladders drive every headless-smoke send without the real pacing
verify: libtest's unstable env inputs never reach a child
build(profile): the oracle rows carry the 2026-09-28 re-measurement
trust(lane): a machine too small to verify a library refuses it up front, names the RAM that can, and exits NARROWED, not FAIL
trust(lane): a record that says a library fits is never excused; the re-base guard fails closed; every MEMORY line adds up
profile: aterm-effects' unit tests build at opt-level 1 in the test profile — 174 s to 67 s, dev builds untouched
Merge remote-tracking branch 'origin/main' into land/batch8
effects: simplify kitty\_pet, trail\_sound, rainbow\_kitty\_v2 and the bakers (-874 lines, identical output)
simplify grid extras, core render, atpkg flow and the effects pipeline (-462 lines, identical output)
simplify terminal handlers, search index, render helpers and the scrollback codec (-976 lines, identical output)
scrollback, search: keep the Trust-proved shapes — back out round three's changes there
trust lane: one slot per 16 GiB, not 32 — the verifier is already held to RAM/8
spec(verify): ty's verdict on a transition is taken once per process — a Tier-1 walk stops paying a ty process per repeat
harness: the config watcher is the policy's one writer, proved by trustc and ty
spec: the window catches up with the harness policy file — a ty liveness claim
spec: bind or waive every HarnessPolicyOneWriter action, so spec\_xref\_closure is green
spec: waive HarnessPolicyOneWriter's three Buggy=1 mutant actions
gui: less work per frame — one geometry, one theme read, no per-frame footer allocations
spec(interp): a reached state is keyed by its values, not (name, value) pairs — 16% off every exhaustive walk
verify(testrun): the shared test binaries start longest first, by the last run's times — the long poles stop trailing
gui: less work per keystroke — no per-key session snapshots, window-Arc clones or throwaway owner clones
gui: less work per PTY read and output wake
harness: the watch says what holds the move when its read would act (RecordedWordStands closed)
harness: a record nothing has checked reads unwatched, with a grace after wake (C10)
supervise, harness: a limit notice left on the screen a grace past its reset is an idle point (C9)
harness, supervise: fix what the review of the rulings branch found
spec(harness): drop this branch's duplicate HoldTurns/RestartAtIdle waivers — main anchored both in …
harness(codex): a Codex wall's named reset is recorded and told there, and a grace past it the quiet move goes (C9, the Codex half)
harness(codex): a Codex wall's reset is read in its Codex's own zone, and the same words keep their first placement (review of the C9 Codex half)
harness: press the upgrade notice key by key, so Claude Code reads it as its person's
help golden: regenerate for turn's new cap=\<n\> option
uds: mark ExitMoment::watch not-wasm so the wasm census stops flagging it (OB-12)
gui, presence: pin that the tab's retry countdown ticks on the presence timer
phase: the tail asks whether its zone is above it; the sweep is exact, the docs say the gap rule
agent: the loop's tail read sees a tall pane's wall through a blank gap
agent: the tab's retry plan is cleared when the try is typed, told again after a sleep, and pinned end to end
ctl: a resume ask a live successor closed on is judged as its refusal, never exit 0; the note says what the successor was
messages: a retry's next try lapses with its time on the row
gui: the tab's plan carries its own clock, a failed loop takes it with it, the 429 wall takes it too; the host half is pinned
hygiene: no account name in shipped source (a shape test, and the guard learns the word); the fast-notice comment credits the right captures
fmt: turn\_end\_loop\_tests
Revert "ctl: a resume ask a live successor closed on is judged as its refusal, never exit 0; the note says what the successor was"
aterm-ctl, aterm-gui: discovery skips dead and foreign graph entries; auth DENIED line thinned
aterm-ctl: the foreign hint points at the report's own rows, not at aterm doctor
aterm-gui: auth DENIED thinning restarts on quiet and on a new peer; blind dials and wrong tokens are separate kinds
aterm-gui: DENIED thinning keeps a run per peer program and judges quiet against the run's restart gap
aterm-gui, aterm-spec, aterm-verify: heal an output wake only when it is proven lost
aterm-gui, aterm-spec: never fold a past wake-heal recheck; re-post a wake stranded with its loop wake-up
aterm-gui, aterm-verify: the latch field and heal docs state the evidence rule
gui: an idle aterm does less per wakeup — and the title worker stops polling
control: less work per request — one parse, one resolution, no per-request copies
supervise: less work per sweep — the busy guard compiles once, reads copy rows once
Revert "land: hold audit #9's census and verify edits back from this landing"
Revert "land: hold the aterm-cli build script too"
Revert "land: hold audit #10's aterm-cli edits back from this landing"
aterm-sysprobe, aterm-agent, aterm-gui, aterm-cli: a supervised agent's memory has a ceiling aterm measures itself
aterm-agent, aterm-sysprobe, aterm-messages, aterm-gui, aterm-cli: the memory ceiling halves while the Mac thrashes at warn, not only at critical
aterm-agent: an agent past the memory ceiling is restarted behind a wall too
aterm-agent: a memory wall that falls back under the ceiling hands a limit's point back
aterm-agent: the relaunch tests' stand-in shell lives as long as its test, on no timer
aterm-agent, aterm-sysprobe, aterm-gui, aterm-cli: the memory ceiling warns first; it restarts only the largest agent of a Mac in trouble
aterm-agent, aterm-gui, aterm-cli: a point the memory escalated is handed back when the Mac recovers; the warning is said again when its verdict changes
aterm-agent: a memory restart the host refused says the person's restart, as its badge does
aterm-session, aterm-gui, aterm-spec, aterm-agent: the unread-input gate warns a slow read and refuses only an established stall
aterm-agent: the supervisor reads a warned turn's warning off its verdict line
aterm-gui: operator-propose-bin carries the slow-read warning its catalog row promises
grid, core: less work per output byte — no cold call per ASCII row, no drain buffer
effects tests: twelve duplicate and subsumed tests out (-439 lines)
supervise tests: fourteen subsumed and duplicate tests folded or out (-522 lines)
settings tests: eight extraneous tests out (-519 lines), one of them vacuous
update(cold lane): the steps around exec are two methods — prepare\_cold\_exec and resume\_after\_cold\_exec
update(cold lane): the control socket is retired before exec — a client is refused or reads EOF at once instead of waiting out 10 s
update(cold lane): the retired listener is shut down before the dup2, so Linux refuses at once too
update(cold lane): the control socket is retired inside the commit permit, so a refused permit shuts down no connection
control socket: the exit's record follows a rebind, so an instance that rebound its socket no longer leaves the file behind
gui tests: eleven source pins, duplicates and subsumed cases out (-310 lines)
effects, render tests: twenty-three duplicates and subsumed cases out (-720 lines)
gpu: less work per presented frame — resident scratch, shared streams, no redundant memcmps
gui: a config edit during the dial's hold is warmed again before the successor presents
gui: a window's presence row crosses an update inside its window
gui: the presence-row carry test drives the real Commit lift
update: a held successor's counted trial launch is settled by its death, not by our kill
ctl: a connection through the latest alias presents its own instance's token
ctl: pin the latest alias through macOS's EINVAL readlink mid-rename
one hex, one FNV-1a, one percent codec — 72 hand-rolled copies call them
lexicon, wasm: keep their Trust-proved local codecs
effects: the window drives its effects only through its EffectsPipeline (host-boundary Phase 4)
census(scope): OB-14 sees a closed type's named constructors, not only new/default
effects: one scroll decision and one rain construction; the swap's leftovers go
effects(page): the page's word pass is pinned, and its PRISM WAKE is the window's step
style(gui): trustfmt the demoted-present pin
trust(lane): a trustd that is not this build's is COULD NOT RUN, never a finding
verify(trust lane): the row's reason is tested against the real script's words
release(cut --gate): the lane's inputs pinned; COULD NOT RUN is not "fix the tree"
gui: a discarded warm's font refusal never reaches the successor's band
aterm-ctl redial: a same-pid server on a fresh listener is a successor
update: give a boot-trial launch back by the process that made it, not by the count's movement
one scratch dir, one bounded poll, one epoch clock — 88 hand-rolled copies call them
gpu-web: mirror the wasm twin's local percent encoder — web\_binding\_parity red since 0ae1
update: the death nothing names gives back the launch named since the snapshot, not the count's movement
gpu-web: the band's percent encoder is the CPU twin's local copy again
ctl: a --pid pin follows its own process back onto a fresh listener
ctl: pick the cold-lane replay's redial policy by flag, not a fn table
delete dead production code — 43 items with no live caller (-2723 lines)
gui: one overlay-card path, one stall/quit block, fewer native repeats (-583 lines)
agent: pin the Codex usage-wall gate on real 0.159.2 screens
agent: say what a Codex at its usage wall does with typed text
agent: keep the Codex carry-on off the usage-wall gate, and pin why
agent: pin the Codex usage-wall gate against the wall's own screens, and its later looks
agent: say that nothing lifts a Codex's wait at a usage wall, and cite C9 as the open bound
harness, turn: a pressed notice is held between its keys and never sent in part
harness, upgrade view: a retarget, a restart and a limit are told as they are
harness, upgrade view: a tab no worker runs in is told by whose hand holds it
supervise, harness: a limit's reset is read where the agent wrote it
harness, turn: a pressed notice's Enter is guarded, and aterm takes its own words back
upgrade: aterm never takes its own words back from Claude's prompt; the owner is told
effects, atpkg, link, forge, agent: measured duplicate blocks merged (-620 lines)
upgrade: the Codex lane never takes its own words back either; the owner is told
upgrade: the Codex notice names what runs before its closing sentence
upgrade: --status reads another supervisor's claim as the window does
upgrade, codex: every leftover of the lane's own words is a person's hold, said so
turn: a typed if-rows= turn is held to its composer's frame, so a box that mounts mid-notice gets no digit
turn: the caret anchor arms only on rows that are an input frame
agent: correct the Codex wall comments — the quiet upgrade's grace does lift a wall that names its reset
update: the pid-less pre-dial death gives back the launch its successor stamped, never the newest gone name
ctl: a --pid pin whose process has ended is gone at once, even unreaped
effects tests: one drive harness in tests/common, nineteen test files use it (-1216 lines)
warm successor P2: re-warm when a theme file or feed the config names moved during the hold
render: less work per CPU frame — a glide's present in one pass, one memmove per band shift
gui tests: twenty-two duplicates, source scrapes and list-policing tests out (-621 lines)
upgrade tests: nine duplicate, subsumed and source-pin tests out, spawn and Opts setup shared (-457 lines)
review(restore): keep the handoff test under its own fix; name cold restores in the carried-size comments
panic sweep: one job per screen and cut, tallest first, each distinct window read once (67 s -\> 18 s)
gate: the trust self-test runs only when a trust-gate script changed; fixture stand-ins share one file per text (contract suite 160 s -\> 47 s)
relaunch: one move writes one adopted row, worded from its record
codex: the notice stays under Codex's paste placeholder
upgrade: a pressed text's turn budget covers its keys and its digits
pet: a load shed never snaps the resident; it only coarsens its cadence
kitty pet: a full-screen program's repaint is not output
kitty pet: hold the resident's z-order, and decide it from ink, not the caret's ring
pet: a torn frame's hidden write cursor is no caret, and the repaint hold holds
kitty pet: pin the full-screen hug gate against the caret's own stream
kitty pet: the torn-frame tests hold with all four pet fixes merged
kitty pet: under the load shed no resident wake lands sooner than the shed cadence
kitty pet: the escort keeps station beside the caret instead of trailing over what was typed
gui test: the hidden-caret home test reads where the cat stands, not a frozen sprite
aterm-link: the twenty-one world suites are one test binary (123 s serial -\> 46 s)
relaunch: the orphan pass reads who holds a conversation afresh; an adoption is kept off resumed\_pid
update(relaunch): a running window's successor carries its flags, never its launch
gui(lifeline): a lifelined headless instance survives its own update relaunches
update(cold lane): a refused relaunch is booked, never relaunched into again
update(trial): on macOS a headless launch no longer vouches for a build's windows
update(r8 S1 review): the cold lane's budget crosses its exec; -e stays for new tabs
update(r8 S1 review 2): a headless first boot keeps the predecessor; a passing read stops the relaunch
spec: every ty run gets a scratch HOME with an empty check cache, and whole-space checks run one worker
aterm-ctl, aterm-uds: instances names an orphaned instance — its launcher gone, its binary deleted, its uptime — and the kill that ends it
aterm-ctl: a foreign instance under launchd is said to be exactly that — its launcher exited, or launchd started it
gui tests: the default App prepared once per process, font locks per thread, the slow sweeps sharded (aterm-gui lib 87 s -\> 49 s)
aterm-gui: the quarantine tests drive the reaper's sweep instead of waiting for a starved thread
ctl: --pid 0 names no instance — an entry with no pid line is not "pid 0"; and a PATH test stops pinning /etc/paths
update(rendezvous): a grant that never comes ends at the successor's own deadline (r8 #80)
update(cold lane): the launcher's descriptor limit crosses the exec as it crosses a fork (r8 #81)
update(park): a Dock-launched window makes room for its own park (r8 #3)
update(park): no raise toward an older target, so that pairing runs as before (r8 #3 review)
update(park): an older successor starts at the limit held before the park's raise (r8 #3 second review)
dev profile: ttf-parser at opt-level 2 (the Dynamic Type settings tests 19.6 s -\> 6.8 s; aterm-gui lib 255 -\> 187 CPU-s)
atpkg: one flip gate for the whole unattended pass; an apply-only pass re-lays the rustup seam
atpkg: the rustup seam is the pass's own, through its PassSeams — no test writes \~/.rustup
atpkg seam: the put-back hold is on the tree, and an unfinished heal's in-flight record settles nothing
update: a full disk is a passing moment of the check lane, never the release's or the host's
gui: the automatic lane's deadlines count the Mac's sleep
update: the full-disk test's negative control asks the classifier, leaving the process-wide delivery note alone
gui: say that a mid-turn sleep can bring a freshly minted update deadline sooner
update: a full disk mid-extract is named by its ENOSPC line, not ditto's last
update: the passing key's doc names where it is minted now, the full disk among them
primer/atpkg: the rating-survey switch is a default, held back over a hand-set probability
phase: every rating card, the drafts card and the ask cards are one parked block
supervise: the rating survey's 0 is guarded, settled, given time to land and pressed on busy reads
host\_live: every kind of rating card, busy or idle, gets its 0; the other prompts get nothing
spec: the rating card's 0 is written only where it lands nowhere else
atpkg: the managed claude launcher exports the survey switch
supervise: review fix - badge a withheld rating card first seen on a busy read; phase says withheld
primer/atpkg: review fix - feedbackDrafts quiet is a fifth default, the switch line no longer reads as an updater
integrate: close the break-offer test the survey merge left open
update: a failed exec no longer leaves SIGPIPE at default
privacy: stop asking what cannot stick, and stop touching provider folders
privacy: ask for Full Disk Access once, when macOS shows the dialog, and watch for the dialog itself
privacy: review fix - the stream's header lines are not messages, and drift is not sticky
privacy: review fix - test the sentinel-to-card link, and stop the card asking on doubtful reads
grid: a resize keeps the 24-bit colours the rgb ring held
cast drift: a recording that says which resize law made it is replayed under that law only
resize ledger: judge the epoch from the engine's debt, not the run
nudge: a displaced Claude Code tab is repainted by a closed loop (PTY only, agent class, log first)
spawn: the render debt crosses the handoff, and a blank Claude Code tab is repainted
gui: the two marks of a busy tab that needs a look keep clear
gui: the band's re-grid is booked site=chrome
gui: the tab's hover names why it needs a look
render: a band row's words keep one clear pixel row above its closing seam
nudge: review fix - the L0 censuses, the spawn pin, the Windows call, the cap test, the wake
harness(upgrade): the record keeps why it waited, the last 24 changes and the first time each was seen
harness(upgrade): an upgrade's age belongs to one process, not to the session or the build
harness(upgrade): the composer is read where it is drawn, and the cursor only proves typed text
harness(upgrade): the notice and the release are typed under aterm's own hand
harness(upgrade): the end of the agent's work asks no oftener than every ten minutes and six times a day, and a declined round rests longer
harness(upgrade): loudness follows what the owner can do, never how long it has been behind; only an agent the upgrade ended takes a band row or marks a tab
harness(upgrade): the Codex twins and the continuations are typed under aterm's own hand, and a guard fails the build for a typed act that is not
harness: a Claude relaunch exports the survey switch, and no line the harness types starts with a digit
harness(upgrade): review fix - the manual resume finds the executable under every relaunch line
harness(upgrade): review fix - work-end asks from the stop, an age's whole process, hands on keys, survey export never refuses
messages: a message has a class; the digest store beside the band; dismissed once, filed in the log
wire: a script's hold= is at most two minutes, refused at parse with the usage line
gui: the exceptions host - the menu-bar item, Settings placement, the digest's clock and its readers
update: a dev build that writes the release setup is an entry, not a standing row
messages: the Settings page dismisses one exception or all of them
cli: aterm exceptions and the doctor line, the log to read with aterm not running
messages: review fix - a press after a restart answers the entry; skewed filings and aged-out words
gui: review fix - a scripted dismissal moves the surfaces; the host wiring is tested
integrate: two horizon tests know the watch's instant, and the granted note is a record
privacy: the Full Disk Access card's four seam methods hand the need to the digest
harness: the upgrade's rows hand their day-one line to the digest
exceptions: update health, supervisor, disk, upgrade host, surveys and render reach the digest
messages: review fix - a cause's end resets the quiet memory of a fact the owner filed
exceptions: review fix - every end of an event family acts on an adopted line, and the wiring words what happened
resume: a wall the turn ended on is seen behind background work, waited on through every gesture, placed after its print, and answered by the fallback, never by a guess
presence: a wall the harness answers is a note, not a stop
supervise: the wait survives a sleep and the sessions of one account spread
aterm-phase: the vendor's limit catalog is classified; the vendor's countdown, armed or fired, stays with its wall
supervise: the stall canaries — a screen no reader names is noted, and the claude anchors and wall phrases are checked by the suite
supervise: name the points only a person can answer, with the one thing to do
aterm-spec: a usage wall ends and a model switch never ping-pongs, each bound to the real decider
aterm: review fix - live wall tests boot with tags of their own, and a replaced loop is tested live
aterm-phase: review fix - a reset key followed by no time no longer hides the time a later key names
supervise: review fix - the reset jitter, the sleep, the ledger rows and the hidden wall are tested where they are wired
supervise: review fix - the budget a watcher stretches past a limit is stretched to the reset the wait holds for
integrate: the help golden keeps the resume stream's status sentence, and a wall behind background work draws NotIdle
harness: the resume loop hands its exceptions, and the stalled ladder, to the digest
harness: a tab's relaunch marks the tab only where the owner can act, with why and the command
messages: seal the persistent holds behind an ask
harness: review fix - a tab's relaunch lines end with the tab and after a restart
aterm-spec: review fix - the usage-wall and model-switch mutants are each caught alone
supervise: review fix - a stall that ends tells the host the point that stood under it
messages: review fix - a restatement of an unclassified row is cut like a post, and ruling 412 says so
integrate: adapt main's upgrade-entry tests to the owner's rule, and the gate reds the merge left
docs, tools: renumber the five-fixes rulings and guard ids past main's, so no number means two things
exceptions: a closed tab's relaunch line is found by the keys of the tabs that are there, not by an id read back out of a key
merge fixes: main's mark-asserting tests read the attention classes, the B24 ratchet counts the memory warning, the survey rate stays a person's, and the polish list lands
upgrade\_attention sweep: main's words (next-point, claimed, left-typed) are rows of it

_Truncated to fit GitHub's release-body limit — the complete note is release-notes/v0.101.0.md in this release's source tree._

v0.100.02026-09-30

aterm v0.100.0

2026-09-30 · 145 changes since v0.99.0

Fixes

harness: only an explicit setting takes the harness's power away — an unreadable value keeps its default, and the host is never given up on
rainbow-kitty: a torn present's hidden cursor is the program's write position, not the caret, and no longer spends the hand's keys (the owner's tab-2 gap)
rainbow-kitty: the trail reads the program's own account of its frame, so a bracket the terminal times out mid-frame no longer spends the hand's keys (review round 1)
aterm-uds: gate the owner-lock tests with a bare #\[cfg(test)\] so the wasm census sees them as unshipped
update: the outbox, the owed receipts and every per-instance id carry across an update
ctl: a wait anchored at its arm, and a cut turn, exit 75; a resumed events stream keeps its anchors
update: update check under a dialog or a stall answers the typed refusal, and never hides a stage
update: a bridge armed by fabric attach is armed again by the successor
update: a per-process update candidate publishes and serves only at the Commit
update: idle waits and a turn's submit hold their clocks while the session's reader is parked
update: the mailbox carry sheds before it refuses, a delivery in the overlap waits, a resumed self stream is pinned, a cut post exits 75
update: mail in the overlap is numbered under a reserve, never vetoes the Commit, and a fenced delivery is never refused
fabric: the Windows cells compile again — serial\_of and lift\_hold\_fence carry their callers' gate
update: a turn open at the carry's export is not vouched for, and a preempted turn records under a rising id
update: the handoff's turn-id count leaves a reserve for the overlap, and only outrunning it stands the Commit down
update: the control carry's aggregate sets every session's ledger aside before any archive rows
update: a session carried at the Sanitized or Repaint rung, or degraded by the receiver, keeps its turn ledger and archive rows
update: a control carry lost at export, write or adoption is logged with its session and cause
update: history names the floor of a ledger a handoff could not carry whole, and drive ledger reads it
update: the Commit's turn-id ceiling rides its own attempt; a turn's id is minted under the ledger lock
update: history's unheld\_below goes quiet once the ledger has evicted past it
trust lane: a writable target root is COULD NOT RUN, never NOT-VERIFIED
trust lane: refuse a symlinked or foreign-owned target root too
agent: a zsh probe the alarm kills fails as a timeout, not a truncated list
agent: the arithmetic zsh probe fails loudly too; the alarm kills the probe's whole group
keeper: start and status say what actually answers, and why a job is silent
keeper: review fixes
notifications: aterm's desktop notices name aterm and say what is true
notifications: review fixes
docs: Linux trial wait and Windows snapshot lane now match the code
docs: review fixes
gate: two of main's reds — fabric compiles on Windows, and the control-lane tests' long wait is one that cannot latch
keeper: an offer whose link drops goes back to Orphaned, and a BYE is the process's
update: notices across the handoff — ids, history, the landing's rows, and a notice while parked
update: the parked parent's ids and records never meet the successor's — a reserved band, and the file merged first at Commit
update: a landing answers "Couldn't install updates" only — the check and download warnings wait for their own proof
effects: the page's cursor step takes its reduce-motion preference; a hidden page retires the bodies
census, xtask: the main-loop verdict names its census, and gate perf says where it went
gui: the hold serial's sum and the fence's lift take their callers' cfg, so the Windows cells type-check again
ctl: a resumed self stream is pinned only when it carries anchors
ctl: the fallback to self outlives an update, answers only a missing session, and forgets the old anchors

Tests

rainbow-kitty: a torn full-screen repaint spends the hand's keys on Ink's hidden write cursor — the owner's tab-2 gap, reproduced (red)
rainbow-kitty: the torn-present tests reach the engines through main's cursor\_fx
aterm-uds: pin the owner-lock probe's own LOCK\_UN, and let a parked child go on every path
keeper: the lost-BYE next window is its own role, not a literal bye: bool
update-core: ATERM\_HANDOFF\_LAUNCHER\_NOFILE is parent-to-child protocol
ctl: the help golden carries round seven's await/timeline/exits wording
update: the held-screen strip test's manifest names group J's new carry fields
harness: a carry that must take more than one step waits on a pause seam its bound survives a loaded disk under
update: the help --full golden carries history's unheld\_below; two new tests formatted
gui: the crowded-desk carry test says is\_empty, as tippy asks
presence: the forced turn preemption's driver wake and the peer's held row, bound to the real App
presence: the peer's held-row bind names Regrid and projects gen
teardown: a refused state root is asserted by its sentence's head and verdict, not the list of what is off
gui: the viewport-restore pipe is close-on-exec, and its EOF has a bound
gui: the shell-start fixtures state their stamps instead of timing a spawn
effects: the torn-space pin is exact — the frames after a space change are a fresh cursor family's
core: the checkpoint round trip drives OSC 9;4 through the byte stream
update: the stopped-stage-holder test's first release says it is LOCK\_UN
gui: a shell that ends at start starts when its PTY closes, not before the harness spawned it
aterm: the refused-state-root test reads the line main's state root now prints
aterm: the control lanes' long wait is a match no row shows, not a seq from the future
wasm: the tests that count a pane's store run apart from the one that sets the module-global budget
aterm: host\_live's boots each take their own scratch root, and a reused tag fails before it boots

Docs

host-boundary: the wave-C effects review settled against main
effects: reduced motion turns the page's cursor light off, and the CHANGELOG names every /terminal look change
the wave C docs findings' fix pass — the A-2 retirement and the retired interpretation tier carried through, xtask perf spelled as it is, drifting line cites made section anchors
agent: the harness exit contract cites the CHANGELOG entry, not a line range

Other

messages: day ten — the whole day live after the page moves; the page's Primary is a press that still acts and never a decline, and an overdue row says how long again
supervise: the loop tells its host its next try — one plan per wait, cleared when the wait ends
wip(tab retry plan): host hook, Wake::HarnessWait, presence overlay and its test
tab: an API wall says the harness's next try — can't reach the API → 08:58 · 3m
supervise: the tab's retry plan is told for a wall's retry waits only — not the check that a try landed
handoff: the warm prologue runs before the dial (warm successor P2)
handoff: the stale-hint Tier-1 reads its reshape with unwrap\_or (tippy)
handoff: the warm hint's module doc names the real join field (warm\_miss\_px)
env reads: admit ATERM\_HANDOFF\_WARM\_HINT as handoff protocol (parent → launched successor)
restore: a private instance's layout and crash journals follow its state root; messages: the page's Primary is the engine's
doctor: a Spotlight count from a scan its budget stopped says "at least"
aterm-session input\_backlog\_pty: date bounds from observed instants; hang detectors to a minute
aterm-gui: cross-process and child-exit tests wait a minute, not 10 s / 3 s / 1 s
aterm operator\_live\_headless: poll the waiter control; successor and submit bounds with room
aterm control\_lanes\_live\_headless: a refusal must stay 5 s; waits outlive a loaded saturation
aterm host\_live\_program: hang detectors to a minute, below a ten-minute shim
aterm fences\_live\_headless: hang detectors to a minute
aterm agent\_verdict\_live\_headless: hang detectors to a minute; latched await within half of it
aterm ctl\_redial\_live\_headless: time the no-successor exit from the kill
Revert the aterm-session input\_backlog\_pty change (…): the session lane owns it
aterm control\_lanes\_live\_headless: a cleared refusal answers for itself; busy judged on its fastest reply
aterm operator\_live\_headless: the submit is held to the nine seconds of turn orchestration; the fastest successor to 3 s
aterm agent\_verdict\_live\_headless: a latched await is judged on the fastest of three asks, within 2 s
aterm fences\_live\_headless: a connection-bound claim is released with its connection, the fastest of four within 5 s
aterm-session: the contended-write test holds the lock until the write returns
aterm-session: sink tests wait a minute for what must happen
aterm-session: input\_backlog\_pty dates fresh bytes against their own write
aterm-session: spill\_bound's reproduce deadline is a minute
aterm-ctl: redial tests reach positive verdicts under a 20 s bound
aterm-ctl: fake-server waits in lib.rs and drift.rs are hang detectors
aterm-cli: the bounded probe's bound is a minute under a longer helper
aterm-uds: roundtrip and hangup waits are one-minute hang detectors
aterm-verify: the bounded-git test's helper outlives a minute of slack
aterm-verify: the TERM-ignoring smoke child is retired after its trap
aterm-verify: exec ceilings outlast the shell's own output; grandchildren get a minute
aterm-release: the x86\_64 turn test waits a minute for its fake socket
aterm-spec: the pending-stub FIFO test waits a minute under a longer hold
aterm-pty tests: count reap\_shell's ticks, tie budgets to product constants, minute hang detectors
aterm-core tests: pin the batch clock in the two sync-episode dirty-bit tests
aterm-gpu tests: GPU and worker-handoff waits are minute hang detectors
aterm-link unit tests: retry-close bound against a minute's retry, minute hang detectors
aterm-link r13\_link\_state: hold the outage past the back-off cap; budgets against the waits they bound
aterm-link r15\_review\_fixes: X3's deadline 10 s -\> 30 s; the fair polls are the harness's minute
aterm-link world tests: backstop, await, fleet-halt and presence waits are the harness's minute
aterm-pty drain tests: census the parks, arm waits past the detector, pin the wakeless poll
aterm-pty no-wrap spawn test: run yes, which outlives a late reader
aterm-link r13\_link\_state: "refused at once" is bounded by the bridge's clocks
keeper: a failed write ends the writing to a peer, never the reading
holders: an exited process holds nothing, never "unreadable"
holders: a descriptor closed between the listing and its read is not held
keeper test: the unwritable-reply unit test waits for the peer's hang-up
holders, kernel\_custody: descriptor floors under the default 256 limit; a non-vacuous EBADF control
keeper: an OFFER whose duplicate fails ends the writing, never the reading
simplify: relaunch/fallback and footer/lights — one representation per fact, less work per frame and per visit; net -183 lines, behaviour unchanged
fabric status: a program row, which says when the bridge runs a development build
simplify: effects, pet, native UI and atpkg — dead code, duplicates and per-frame waste out; net -3,500 lines, behaviour unchanged
aterm-pty: the busy-parser hot-gather test waits on its park, not on the 1 ms hot budget
aterm-gui: the shell-start tests stamp the reader's EOF at start instead of reading the clock after /bin/sh ran
aterm-gui: the semantic-font worker tests wait for the landing, with a hang detector instead of a 20 s deadline
aterm-pty, aterm-gui: the refused-handoff test's PTYs are close-on-exec from birth, and its witness waits for the slave's EOF
release: the source is never published ahead of a binary that cannot follow it — ship check, publish/pre-promote, and the preflight's TRUST BLOCK
release: ship check answers only as the commit's own cutter, asks every commit-only pre-claim gate, and says when the engine will not ask
release: one command — tools/release.sh takes a clean clone to live, resumable by facts
trust(lane): the slots take the longest libraries first, by a cost history each run records beside the receipts
atpkg: a private instance never applies \[machine\] to this Mac — the daily launch apply, a pass's edit and Apply now all stand down under a private state root
ctl: a subscription whose pinned self stream the successor refuses falls back to its own session
messages: the log merges the file read again after a handoff; the wire's answer while parked
spec(keeper): the custody model states finding 65 — an offer returns when its link drops, a BYE is the process's
keeper test: an undupable OFFER returns to Orphaned at its link's EOF (finding 65 meets main's end\_writing)
chore: comments, the shipped manual and the perf goldens name the gate verbs that exist
trust(lane): a check dies with its run; a hand-lowered floor takes its total down as far; the docs say what the lane is
trust(lane): trustd is held for the run, a refusal decides nothing, a hand-lowered total is measured
style(verify): trustfmt the trust lane outcome test
trust(lane): a refusal excuses only the drop it can cover
style(gui): trustfmt the start-exit test the last commit reflowed
publish: the public snapshot keeps the Trust pin; the gate builds on Trust
publish: the wasm32 clause adds its own target; its channel lives only in the clause

v0.98.02026-09-28

aterm v0.98.0

2026-09-28 · 60 changes since v0.97.0

Fixes

size font previews correctly and retire idle probe resources
settings: keep font controls reachable beneath large previews
complete shutdown conformance and explicit artifact handoff
declare the footer repaint fingerprint derived scope
verify: the gate's verdict, header and refusal lines say only what is true of the run
verify: review fixes
link: aterm link's help, refusals and bridge logs say what is true
link: review fixes
platform: Windows, containment and web lines say what is true, once
platform: review fixes
gui: keep tab labels stale while metadata is busy
claude-lights: stop mode return at elapsed press deadline
atpkg: recheck live install consent for index probes
atpkg: fail closed when live probe config is unreadable
atpkg: initialize live probe without nested CLI cache
atpkg: the rustc-group preflight refuses a sibling that would pack at or below the public pin
atpkg: step 2 re-checks the sibling judgment; the seal, off-triple spec rows and BASELINE meet the floor at preflight
update: a newer release takes the place of a converged activation — the running build takes the install path back and the newer one installs over it, the stuck build never started again
update: an unsaved Settings draft and a failed save ride the seamless update instead of holding it (plan P2-2)
update: a withheld scrollback carry is said as the new version's request; the release-then-probe lint judges code; one-lane docs
update: a layout naming an exited pane is placed, and every carried Settings draft that does not survive the restore is said once, with its text
update: a refused retire gives its release back to be offered again; a deferred disarm is a retire; the models replay the refusal and gap 14's own Decide
spec: account for Claude mode return deadline passage
update: a link-dense line costs its links, never the tab's carried history
update: the link-stripping decoder admits only records the serializer writes
rainbow: keep focused band continuous at quad cap
gui: Reset All, update, restart-hold, operator and image replies say what the code does
gui: review fixes
cli: update, release and help lines name real buttons, real remedies and a rolled-back Linux copy
cli: review fixes
atpkg: offline vendor install, pinned rollback, Linux group skip and doctor's update note read right
atpkg: review fixes
agent, link, verify, containment: a relay turn names its timeout, doctor names the hold's instance, and five lines stop claiming what the code does not do
agent, link, ctl, containment: review fixes

Performance

release retired fonts and skip idle Settings preparation

Tests

gui: bound tab metadata contention regression
handoff: v0.93.0's producer fixtures, and the guard imports every desk's history sidecars
verify: a deterministic release's evidence names the released binding as a whole word
handoff: v0.97.0's producer fixtures, so the 0.98 cut's fixture gate passes
harness: the elision fixtures carry stand-ins, not a real session's paths and ids

Docs

keep winit coverage references within the vendor budget

Other

messages: day eight — the whole day again on 0.96.0; the update health warning is keyed by kind, the tag chips wrap as one block, and aterm's own hand is not the window's news
release,verify(gate): the gate and the cut name one compiler, and the preflight asks for the MEASURE receipt before a source is staged
verify(gate): gates take the machine in the order they arrived
spec(update): Law 1 of the apply ladder is machine-checked — a livelock checker, and "the staged build lands" as a liveness property on both tiers (plan P1-7)
messages: the band painter moves into the core — the engine paints a row's structure, and the macOS host only resolves its colours
messages: the band's colours move into the core — aterm\_messages::ink resolves every ink over plain RGB, and the macOS host only maps its theme
gate(verify): one hardware burst per GUI-smoke lane, fail-closed; the headless smoke keeps only its lost-wake check
gate(verify): the headless smoke keeps its cursor round trip, and its lost-wake check needs half the burst delivered
gate(verify): the one-burst GUI smoke verdict, run on a real window; its floors and ceiling cite the readings
messages: the host sheds the band's last logic — its tests, the repaint fingerprint and the pixel-to-cell arithmetic move into the engine, and the engine's public surface is what the host calls
messages: every hover target on a band row is its own repaint key
harness(upgrade): the notice quotes a long command to its end — the middle of a long path is elided before the 160-character cut
harness(upgrade): a notice whose process is gone is asked afresh of the process that holds the conversation — in a new round, never on the old READY
harness(upgrade): an agent the upgrade gave up on is told to carry on at a break too, and a Claude status its idle screen contradicts no longer waits forever
harness(upgrade): a restart the harness left in flight is carried, not read as a person's exit — and one that stops or sticks after its SIGTERM stays in the owner's view
harness(upgrade): review fixes — the restart never signals on a lagging status, a break's late READY is bounded, a slow shutdown is carried, and the Codex relaunch is known by its pid
harness(upgrade): merge review fixes — the restart's own gate waits at a break, and next\_step's doc says what the merged break arm does
harness(upgrade): merge review fixes — a restart in flight that sticks says so on the tab's one row, and a stuck row leaves once the restart moves
harness(upgrade): merge review fixes — a stuck row put down ends on the record as the upgrade moving again, never asking again

v0.97.02026-09-28

aterm v0.97.0

2026-09-28 · 9 changes since v0.96.0

Tests

handoff: v0.95.0's producer fixtures, so the 0.96 cut's fixture gate passes

Docs

the Claude Code lights as they now behave, and the changelog
claude\_footer: name where the fast latch lives instead of claiming it is app-wide — the scope census blocked the freeze gate

Other

claude lights: one permission-mode light, bypass and auto both expected
claude lights: draw only what differs from what the owner expects
claude lights: a mode return decided from the engine, one deadline per press
claude lights: fast mode works — typed mid-turn, and Claude's answer read back
claude lights: thinking is honest — shown only while really off, never switched
claude lights: review fixes — no unseen selection, no key into a box, every stop named

v0.95.02026-09-28

aterm v0.95.0

2026-09-28 · 417 changes since v0.94.0

Features

config: editing only a lexicon or pack file hot-reloads it
introspection: compose-side prim counters and the video trail ledger
verify: the GUI smoke's paced burst in four effect lanes
containment: confine Containment writes; refuse to start without an OS sandbox
harness: a git read is approved only where its config runs nothing
control/windows: a peer pid gate on the Windows control socket
keeper P0: the recovery census — one ledger row per windowed launch says how the run before it ended
tones: a password prompt sounds one tone — every key the same, no ting, no melody moved
tones: a capital's ring is a twelfth — the strike stays the line's own note, struck forte
harness/upgrade: SAME FAMILY FIRST, THEN THE PRIORITY LIST — the owner's decision of 2026-09-27

Fixes

trail-sound: a close bracket straight after its open keeps its tink
gui: close the open effects & wake follow-ups (items 6, 7, 8, 10, 11, 15, 17, 21)
spin-gate: a fixture that actually splits the clocks, re-proven red
help: regenerate both help goldens for the video … trail flag
status: an owed agent look waits for the output to pause, not the next due instant
spec-link: recount the registry after main's three new models (200 -\> 203)
tests: the four update-ledger writers in app\_native hold the ledger lock
gui: one attach-time focus adoption — withdraw the 500 ms grace winit's creation-time blur always spent
introspection: a ribbon witness that can go red, and the video trail's tail is taken at finalize
verify: the GUI smoke's effect lanes cross the effects master with the sounds, must show engagement, and are calibrated
tests: two load flakes the merge contract hit — a sink failure that a fork could hide, and a stopwatch
tippy: a\_refused\_window\_claim\_defers\_its\_held\_flip\_look passes its Copy closure by value
containment: the tests and the skill state the fail-closed contract; the scope says what stays open
harness: the git-read check finds git as the classifier does, reads submodules, and counts a filter only where selected
harness: a git read is judged where the Bash tool stands, read from the live session's transcript
lint: the classifier's wrapper result is a named type
forge: re-measure the six winit cells for the fork's windows-sys move
logging, windows: the log rotates on Windows — the rotation lock is opened so it can be locked
render: keep capped rainbow slabs attached to head
cross: make foreign-cell checks compile cleanly
release: a head the cut made is finished, never refused — and ReleasePublishOnce proves the join, both floor reads and the upload order it claims
release: the debugging aids stay in dist/ — the public channel carries the client set and nothing it does not need
release: the finished-head resume re-sends its PATCH — a read-only resume wedges once another release has taken latest
release: a journal is read by its header first — a finished one of any format is history, an unfinished one goes to the cutter that wrote it
sandbox: macOS refuses RLIMIT\_AS only below the mapped size — say so, and make the refused-limit test reach its path
keeper P0: the census thread declares its QoS role, and a run that left no evidence is unknown, never clean
keeper P0: the ledger's first row never reads another kind of launch's crash as the run before it
fabric: keep roster status off a busy timeline
rainbow: keep leftward wake head lit at quad cap
rainbow: keep midline edit head lit at quad cap
manual: the help pages say what the code does now, without history or mechanism
manual: review fixes
update: Linux update lines name the copy, the version and the next step
update: review fixes
reroute: each reroute line says what runs, and only once it can run
reroute: review fixes
gui: refusals, menu rows and hover text state the fact and the one remedy
gui: review fixes
merge: audit #4 meets main — refuse_input names the measured cause, the atpkg tests follow main's one activation link, and the round's CHANGELOG entry
tools: the handback lane reads who holds the terminal before each key — a Ctrl-C on a guess reached zsh, not the job
control: a lane holds a REQUEST, not a connection — persistent drivers no longer use up the socket
control: the connection cap answers to the descriptor limit; the lanes' live negative control is deterministic
harness/upgrade: a dry run no longer reports a caught-up session as behind
rainbow: preserve uncapped quad order and retry only at cap
pty: a spawned shell inherits its stdio and nothing else
claude: stop dormant footer refreshes
upgrade: no stop is for good — a stopped round rests two hours, then a new round asks again
rainbow-kitty: zsh's Ctrl-R search lays no band under zle's fake cursor
rainbow-kitty: review fixes — a hopping Ctrl-R match lays no band, a hidden caret keeps its lane
rainbow-kitty: a word typed in at the fold keeps its first letter, and no stub in the indent
rainbow-kitty: an insert that pushes a word down keeps its band, and a re-wrapped word keeps its first letter
rainbow-kitty: review fixes — a typo fixed mid-word keeps the wrapped word lit, a hard-broken token keeps its row, a word that stays keeps its light
rainbow-kitty: fix/trail-land review fixes — a flushed park is witnessed by the glyph it was held over, a soft wrap keeps the prefix left of its key, typeahead across the wrap lays no indent stub
rainbow-kitty: trail-land merge review fixes — the soft wrap's seam is pinned off the relaid word and the indent, a skipped neighbour row is no row, the witnesses' docs name their readers
aterm-update: review fixes — nothing looks past a head the client cannot install from; next\_check= is absent while the loop checks
harness/upgrade: a restart moves the model to the newest of its OWN family — never across, never down, an alias kept, \[1m\] kept
upgrade: the no-stall round's review — a resting round is not moving, still reads overdue, owns its first settle, and a repeating stop backs off
claude: distinguish footer request in lock census
handback: a re-armed input mode is the re-armer's — one missed job no longer disables every later handback in its session
tools: the handback lane releases its live holder by a line on its stdin, not a 2 s timer — and forces the missed one-shot that load only sometimes dealt
tools: the handback lane's forced miss runs LAST, followed by one recovery row — every pre-existing zsh row runs from a clean state again
windows: aterm is a Windows daily driver — console front door, Enter chords, atpkg, history, close safety
gate: the grep guard's git greps never recurse into submodules, and the footer watch's dormant mutant lives in its stop
drive: a verb followed by --help asks for help, and can no longer type into the active tab

Performance

harness: cache unchanged Claude footer transcript tails
atpkg: reuse process snapshot for quiet flip checks
gui: swap single-pane glow into render input
atpkg: recheck empty index eligibility each park slice
fabric: skip broadcast parsing with no topic subscribers
claude: reuse pane text buffers across changed frames
atpkg: retry shared index stamp at its expiry

Refactors

policy: retire the undischargeable Kani harnesses; docs in the present tense

Tests

gpu, render: pin the rebuilt face, and fail rather than skip a broken renderer
paint: a split window being typed into, with its effect-off twin
gui: the handoff paint decision is tested through the helper the proof calls; RED-before claims say what they pin
one headless boot, and a product that cannot start fails
the three newer live boots fail a product that cannot start too
the Windows twin's launch\_isolation compiles again
a headless instance is not WindowServer-free — say so, and skip AppKit's refusal
provenance: the compile-fail guarantees run as doctests; stale sandbox docs
gui: roster the renamed Windows peer-check test
host\_live: wait for the relaunch fake's first launch before counting launches
host\_live: the relaunch and upgrade tests wait for the fake's first launch
claude-lights: fail the sink on its own socket, not by closing a peer another process may hold
claude-lights: the accepted follow-up holds its deadline ahead, so a slow machine cannot turn its Return into a take-back
18 tests no longer trust a close that a sibling's child can still hold
control lanes: the cap is a refusal that STAYS; a made moment keeps the retry live
app\_input: paste fixtures' sinks own their pipe, so a queued paste cannot land in another test's pipe
aterm-verify: time the dead-instance handback from the death, not the stage start
supervise: the idle-fix merge's two host-step tests stop on the step, as main's Stop asks
host, presence: fake Claude Codes keep the cursor on the prompt box's caret row, as Claude does
objc: the MainThreadBound container drive runs in the workspace test run, as a harness=false test
verify: the answering-smoke fixture checks its config with builtins, not seven grep spawns
title-summary: the home test names no real account — 'dev', not the owner's login (the public export refuses it)

Docs

effects, gpu, render: retire stale wiring and flip notes that described closed work
gui: two doc comments back on the functions they describe
correct what the effects package's own notes got wrong, record the bracket A/B, and log the round
the gui wave's neighbouring passages say what is now true
cap: no-mint-reachability is delivered; cite the gate by its real file
consent: name what measuring §7 S2 needs, at the flag it would flip
containment: the man page and the modes listing say what each mode enforces
containment: --sandbox's one-line help and its spawn test name the write confinement; drop a #7996 tag
three claims the wave left half-corrected
four claims the tree no longer bears out
keeper P0: a killed run whose consumed marker was pruned reads as clean — say so
gate decruft wave 1: the live docs describe the gate that runs — the new ladder, what moved to --full, and what is gone
gate: the wave-1 docs say only what the code does — dates, pins and row names corrected

Other

sink: stop reaches a parked paste, the UI egress refuses at the cap, sever and per-class egress permits
gui: bounded typed egress, refused keys ring the bell, sever on close, deferred keys arm the echo clock, input legs measured
capture: reserve a frame's bytes before capturing, answer busy before the photograph
gui: pin the reply lane's byte plateau under a query flood
sink: a writer waiting for spill room arranges a pending drainer itself
sink: the unix-only refusal constructors and spill-room wait compile warning-free on Windows
harness: the version probe and the codex daemon update build on Windows
gui: mouse, wheel and focus reports take the keys' route — encoded on the UI thread, queued behind earlier input, never inline on ConPTY
harness test: the version probe's bounded checks time the probe, not a new script's first exec
capture: a frame's reserved bytes go with its raw framebuffer, before the answer
egress: a stopped paste's close still reaches the program, every UI-thread report takes the reports' route, reports get their own budget
sink: the spill's prepend rule names both prepends, the split tail and a stopped paste's owed close
core: the damage-scoped refill reuses a resident row mask
scrollback: dense segment walk; product scans read history through it
web hosts: damage-scoped refill as the single damage consumer
gui: output-wake scale proof; the status gate retries only unclassified newcomers
gui: end-to-end present-retry test through a scripted CPU surface
core/grid: clippy-clean the dense-walk readers
gui: one terminal hold per single-pane frame; the torn-frame fence is gone
render: the two-hold vocabulary goes with the second hold
gui: the scale proof's no-wait check is causal, not a stopwatch
gui tests: the TrustIr registry count follows …; every ledger writer holds the ledger
review: the native search reads history densely; claims and comments say what the code does
cells: aterm-gui's test build compiles for Linux and Windows
effects: take the recommended defaults on four parked taste calls
aterm-gui: close five small gaps the triage found open, each with a test
aterm-gui: stale notes corrected and small product calls recorded
containment: TmpOnly writes are OS-scoped, and Containment fails closed off macOS
aterm-gui: a maximized window's restore capture persists the frame it restores down to
aterm-gui: input latency corrects coordinated omission with a per-window edge ring
PressCustody: model the three shapes the Tier-1 conformance listed as KNOWN GAPS
identity\_claim: close the handoff window with a successor marker (third gate)
consent: the Claude Code footer's refused repository read is the per-session EPERM producer
aterm-gui: round 18's identity rows — New Window/Tab With Identity… and Show Identity
windows: control-socket peer gate — afunix peer pid plus a token-user compare
native markdown: inline spans paint — bold, code, links, strikethrough, emphasis
aterm-gui: the identity picker test scopes ATERM\_STATE\_HOME, not a second override
aterm-gui: the Linux motion read sits outside the macOS module's doc, and stale notes follow the gui wave
windows: the harness upgrade probes and the successor markers compile off Unix again
containment: two doc words tippy's doc\_markdown refused (TmpOnly, unsandboxed)
identity\_claim: the marker write collapses its nested if (tippy collapsible\_if)
aterm-gui: the deferred-flip test passes its Copy closure by value (tippy needless\_borrows\_for\_generic\_args)
PressCustody conformance: the header lists coverage notes, not KNOWN GAPS
containment: macOS unchanged — the TmpOnly write scope is withdrawn pending the owner's ruling
aterm-gui tests: every env scope primes the update-root Once before it locks
native markdown: styled spans clip to the block's own text, never into the cut's ellipsis
handoff: the corroborated group sweep keeps the fork lane's pin as its second proof
metrics: a full input-edge ring lets go of never-echoed keys before refusing a fresh one
aterm-gui: the normal-frame tracker's rule is testable, and its tautological test is gone
effects: split cursor\_glow's tests into cursor\_glow/tests/\<area\>.rs
effects: split cursor\_glow.rs into named parts (style, custody, companion, raster, ...)
gui/effects: the native window drives the resident pet through CompanionOwner
effects: point the last cursor\_glow.rs citations at the part that holds them
gui: the spec-link registry pin counts main's three new models (200 -\> 203)
companion: the owner lifecycle bind projects the brain's identity, and the native sense projection is gone
gui: pin the one native cadence change Phase 2 made — a static resident offers nothing on the shed recovery ramp
aterm-link: one trust\_of table; the exited-keep note and hook tombstone told true
harness: a git read is approved only when its config runs nothing
session: no VT model, one agents-dir rule, a Windows protected-spawn twin
harness: rm\_policy's cd limit is permanent, and says why
ctl: tier 3 of the mux guard takes tmux's TERM\_PROGRAM
net: the launch-nonce pin reads the remote's roster; the relay test is sequenced
keyboard: a right-side modifier is the kitty RIGHT\_\* key; sink's token bucket stays with its design
control: close the introspection residuals
metrics: fires apart from arms, wakes by variant, turns by root, the GPU repaint scope
drive: say that typed text reads as pasted to a model worker
gui: direct tests for the pane selection fold and the capture model's pane loop
gui: the one unit test that built a GPU renderer moves to a live-GPU lane
verify: the interrupt test waits for its stage group to be live
harness: a git read's cwd is read fresh, and its post-index-change hook counts
operator: a dead client's next frees its waiter; RFC §9's live runs
harness: below 10 GiB free the window reclaims its agents' stale build dirs
control: the gui's tests and goldens follow the package's own changes
supervise: the zero-settle press is checked by its event, not a 250 ms clock
ctl: the mux guard decides from one MuxEnv, not eight positional options
lint: the workspace passes tippy -D warnings again
verify: the unhandled interrupt stand-in meets SIGINT at its default
harness: one git-read check — withdraw this branch's copy for wb/security's
keyboard: a modifier's release keeps its kitty bit while the other side is held
disk: every \[disk\] key is known to Manual, a negative floor is off, and the tick frees the volume it measured
control: a half-closed operator client keeps its next; an older sibling's escalations still reach the menu; the verb docs say what the wire does
flakes: four load flakes wait on facts, not clocks; the fabric demo's check joins the gate
ctl help golden: regenerated for the key and text entries
disk: the verb's help and the design's knob line name the negative-off rule and the measured volume
update: watched-output gap, one RFC3339 parser, derived stale bound, dead check-lane code gone
atpkg: one activation link, typed-lane Unreachable, C-toolchain probe, hook reroute order
install.sh: the uninstaller's ownership tests on the install path; --no-toolchain persists
verify/xtask/release: retire the targo-clippy candidate; honest x86\_64 refusal
update: two processes arming one build swap it once — model + Tier-1
release/atpkg-index: the x86\_64 slice runs before a universal cut; no silent darwin-triple drop
update(test): name the LOCK\_UN release at the two-process Tier-1's lock hand-offs
atpkg(test): the tmux pane command is a literal, not a format!
update: the boot lane's peek, lock and under-lock decision are one function the two-process Tier-1 runs
release: a builder without Rosetta is refused before the claim, not after the build
atpkg(test): the failed-flip repair is staged the way a junction swap fails; tmux carries the reroute case
install.sh: the bin verdict runs a foreign file bounded and stdin-less; the plan and the store lanes say what happened
aterm-cli(test): trustfmt the no-toolchain page test
atpkg(prereq): the probe's bound is the host's, so the answering tests do not race the code assessment
aterm-cli(manual): pkg lease names \<toolchain-dir\>, the operand the binary parses
atpkg(test): main's provenance-heal tests read the one activation link
update: the schedule's constants compile everywhere, the schedule does not; three descriptions of the watched-output gap and the two-process Tier-1 say what the code does
agent/types: the harness's transcript-stamp reader is the workspace parser, so …+05:30 is refused, not read as UTC
agent(test): each scratch call gets its own directory — two Codex drive tests shared one and raced
atpkg(test): the default set's C-toolchain line takes the probe's host, so its test widens the bound as prereq's tests do
install.sh: a re-run repairs a damaged aterm.app instead of skipping it, and --no-toolchain says what it does to an installed toolset
release: a universal cut keeps the record of running its x86\_64 slice; the runbook and the bootstrap name Rosetta
install.sh: the foreign-binary --version bound is one script constant, so the suite's answering cases do not race code assessment
aterm-gui(test): every test whose blocked attempt writes the apply ledger holds its lock
build(winit): windows-sys 0.52 -\> 0.61 in the fork, handles through typed conversions
build(cells): main's harness and program code type-checks for Windows and Linux ARM again
build(cells): one mechanism for the off-Unix harness fix; parse\_procargs2 stays macOS-only
build(winit): the last handle casts go through handle.rs; the fork declares rust-version 1.84
style(containment): trustfmt the fail-closed audit assertion
style(harness): trustfmt the loop test … added
aterm-alloc: #!\[no\_std\] + alloc, so the arrayvec shim's no\_std holds for its graph
aterm-buffer: ReadCap/WriteCap are aterm\_cap capabilities, not forgeable unit structs
aterm-search: O(1) tail removal for postings; retire test-only jump\_to\_match; honest Kani harnesses
proof markers: strengthen the Pin packing harness; drop stale TODOs; date the OSC harness verdict
aterm-spec: drop the stale trail-audio KNOWN PARTIAL note; past-tense the ty POR canary
grid: WideCharConsistent is asserted by the fuzzers, and the DECDWL resize bug it found is fixed
spec-models/clean: ct\_eq.lean checks green on ground instances; delete the unelaboratable keyboard\_shift.lean
XTSMGRAPHICS sixel geometry rides the CSI 14 t window-ops gate instead of an unconditional mint
conformance: SO + DECSTBM + truecolor region scroll (REARCH B-5), with no-SO and SI controls
window\_auth: one mint path — delete the now-unused bool-only try\_mint
checkpoint: carry application colours and shell integration across a handoff; delete HostBindings
fmt: rustfmt the wave's earlier commits
update: sync the fixed-path swap's parent directory; the disk-transaction model says what it covers
render: draw the Unicode 16 block octants (U+1CD00-1CDE5) procedurally
custody: model the in-place rewrite of the selected rows (OutputRewritesTheSelectedRows)
spec: model the §3.2 two-way supernova burst mutex (SupernovaBurstMutex), bound to the real grants
paint: the paced recorder publishes its sampling ledger; scan reads holes from it
aterm-bidi: complete UAX #9 — X1-X10 embeddings/overrides/isolates, N0 bracket pairs, the full Bidi\_Class table
control verbs: regenerate the paired help goldens for the custody and video rows
paint: re-enable the main-screen effect-off control — the ledgered instrument reads it sound
aterm-link tests: the stray guard counts daemons, not shells that name them
aterm-gui: the bench-support headless fixture builds again (DocumentStore::for\_test)
history carry: the key reserve raises only the shortfall, so carried shell marks keep their lines
checkpoint meta: say that every live session now writes absolute\_row\_counter, and pin the key set
grid tests: the DECDWL truncation regression starts from an intact wide pair
window\_auth: the module docs describe the one mint as it is — policy gate first, the bool as fallback
spec: register SupernovaBurstMutex, and say its Tier-1 bind is test-only
custody: take back OutputRewritesTheSelectedRows — wb/gui's PressCustody is the superset
paint: the sampling ledger books a tick only when its redraw proved the screen unchanged
control verbs: regenerate the help golden — the custody row is main's again, the video row names the proved-unchanged ticks
paint: the effect-off control's doc names m7, and the re-measurement under the tightened ledger
fmt: trustfmt the history-carry GUI test
forge mirror: settle the open seams instead of carrying TODO tags
verify.sh: refuse a checkout with no toolchain pin (exit 3)
install: land the Linux hicolor icons the desktop entry names
verify: run gate forge, gate fault and gate cells-foreign on every tier
wasm perf lane: module-size ceiling, the three Wave-6 present lanes
kani floor: run the four SIMD unwind harnesses by name, and self-test it
grid: A3 scroll zero-alloc lemma — bounded in the merge contract, Kani pair authored
gui: count the MPT-2..5 and subscribe idle-wake wins in the merge contract
style: targo-fmt the verify stage, perf lane and new verify tests
verify: the ladder contract and PROCESS.md name the three new gate verbs
kani: the dispatch-body frontier measured; A3's discharge need made exact
forge: re-pin the winit fork after the WakeTimer patch (…)
host\_live: the upgrade fake is macOS-only, as its one caller is
verify: the foreign cells build in the snapshot's cells lane, which the disk preflight counts and caps
forge mirror: the deferred signature is named as what would anchor rows, never as one that exists
verify: the cells budget's two floors are compile-time assertions
land: the merged tree compiles, and main's footer test is formatted
land: two tests the merge left pinned to words and a box nobody named
atpkg flow: trustfmt the typed-lane assertion
atpkg/hooks: inside aterm the shell hook puts \<prefix\>/reroute first, ahead of agents/, so a bare cargo is announced in a TTY session too
atpkg/hooks: a TTY session whose front door handed no agents dir still gets reroute first; docs and CHANGELOG say what the change does
aterm-link: fault injection dies by SIGKILL through the aterm-uds cordon, not abort()
gui: a dev seam keeps every test off the owner's clipboard — and a unit test that wrote it on every run no longer does
messages: day three on today's main — upstream's new rows keep the rulings, the upgrade row says what happened, and a reused log id never swaps records
aterm-gui Settings card: 80 tests and 11.7k lines leave with the retired painter, input model and hit-testing
aterm-gui: 7 tools-as-tests leave — ignored benches, print-only probes and env-gated PNG dumps
aterm-gui consent fences: 5 fewer — two B13 path pins go, five module fences fold into two
aterm-gui: 9 source-text pins leave and six tests drop their source-scan tails
aterm-gui: 11 duplicates, stub tests and a tombstone leave
aterm-gui native\_config\_language: 84 -\> 81 tests — the three retired-key families fold into the family sweep
aterm-gui app\_introspect: 106 -\> 104 tests — the split and single-pane first-capture pet twins become two parameterised tests
aterm-gui control\_query: 77 -\> 71 tests — the seven metrics-form pins become one field table
aterm-gui: 28 copy-paste tests become 6 tables across app\_config, alert\_keys, accessibility and quit\_safety
aterm-gui: three source pins and three tails come back — each was the only proof of its property
aterm-gui consent fence: the global/env scan reads both modules to their test module
decruft(update-core): the Releases API GET is gone — nothing has called it since R3
decruft(release): a cut publishes once, straight onto the channel — the private draft/flip/archive/verify leg and the mirror are gone
decruft(release): an unclaimed release is adopted only as the source release — the byte-proved "own release" reading had no producer left
harness(upgrade): a background wait that can never end no longer holds a Claude Code upgrade for good
after merging assembly/0.95: a citation of the retired draft delete, and a load-sensitive bound
WIP: the adversarial reviewer's repairs in progress — UNVERIFIED
gui(keeper P1): the crash journal — a crashed window's layout and folders come back
gui(keeper P1): the journal's write rate, measured — titles wait 30 s, a repaint wakes nothing
gui(keeper P1): NoLoss on the real kernel, and the boot order pinned
gui(keeper P1): the bench-support build has the test App's inert journal lane too
gui(keeper P1): off unix the journal's file half is said to be dead code, not left to warn
gui(keeper P1): the journal's test layouts compile off unix, where the message tests use them
gui(keeper P1): Tier-1 replays every claim with its evidence read first — the WIP repair, verified and kept
watchdog: the sampler's per-wake verdict is SamplerWake, not a second Wake
watchdog: the quiet rule ends only a spin reported at a park point
harness(upgrade): a Codex background terminal is waited on, asked about again and given up on — and a dead Claude's leftover session file no longer strands a restart
harness(upgrade): at a break the Codex wait keeps the break's name — only an idle point's wait on terminals alone is named background-terminal
style(harness): format remote Codex upgrade assertions
control lanes: the request lanes loop on serve\_next; the warm-up scan reads the lanes
phase: Claude Code is idle only at its composer, so await agent idle waits for the REPL
phase: Claude Code's shell-mode prompt box reads idle again, as before the composer rule
agent verdict: read the last 40 DRAWN rows, so Claude Code's inline REPL is idle
agent verdict: Claude Code is idle at the prompt box that HOLDS THE CURSOR
fmt: r13\_presence.rs at its crate's edition (2021), which the merge contract's per-file sweep reads
harness: the harness's own turns are no task — a session nobody asked anything gets no notice, no carry-on, no act
harness: a turn end the upgrade let go is decided again, its pauses start over after a turn, and quiet is the agent's verdict's
harness: a turn the harness types returns once its submit is taken — the tab is never held on the agent's answer
harness: the owner's view of the upgrades is published headless too; a fresh restart is a move the view shows
harness: one restart arm, the task memo keeps its transcript, and an unknown verdict leaves the settle to the screen
harness\_host test: return the pauses directly (tippy let\_and\_return)
harness\_host test: three looks is at least three — the fourth follows at once
harness\_host: a turn between two looks starts the ladder over, not the hold on the turn ends
supervise: a point a host step moved is not decided again — only one it left standing
harness: a first prompt of someone else's is a task the moment it is recorded; a fresh restart settles briefly first
harness: what a tab's own supervisor typed is no task — read from its ledger beside the mark
harness: every text that carries the mark is built from the one mark
harness docs: D1 names the case it closed, the invented work stays open, and Codex is said as it is
supervise: a turn the harness typed is no work of the worker's — its answer neither lengthens nor ends the short streak
supervise: a turn the host typed holds the policy's acts back, never the host's own next step
harness: a restart holds the tab from its last look to the relaunched agent's first idle, and a fresh one settles the full QUIET\_S
harness: a restart whose carry-on is typed reads restarting/…/continued until its model is read — never a blank column
harness: a session is behind from its worker's attach — its upgrade row and age start there, not at the first step
supervise test: the host that asks again counts down without the deprecated fetch_update
supervise: a harness turn answered with real work ends the short streak — a short answer leaves it, and its back-off, as they stood
supervise: a restart whose host typed the carry-on typed a harness turn — its answer is awaited as the harness's
harness: a carried-on restart reads restarting while its model is waited for, then done from the wait's end
harness: a session is behind from the activation notice too, after an earlier upgrade too, and a Codex as a Claude Code
control: a drive lease can be a HARD hold — every other connection's writes refused, its own typed through — and signal … quiet=<s> refuses itself on a person or unread input
supervise: a point the loop's reader cannot vouch for is waited on by its content, never by the server's verdict
host\_live: the relaunch-on-exit test waits for the first launch and the worker's first idle point, not two seconds
harness: every restart holds its tab with the server's hard hold, never let go for the relaunch line, renewed through every wait — Codex's /exit too — and the signal is quiet= the grace
harness(codex): the /exit restart's last look answers ControlFlow — a stop is a report, not an error, and tippy is clean again
harness: a look that cannot read the session is a wait — journaled, looked at again on the ladder — never "nothing to take"; a READY'd session is never let go for one
harness: a fresh launch is behind from its worker's attach — its note is asked until Claude Code's record reads, and the state is minted with the attach's second
harness docs: the re-test of … — what held live, N3's real scope, the look that could not read, and the column's words as they are
harness: a look's record counts as read only where it decides — a process not read whole is wait:no-process, never "not due"; a launch's record is waited on for its first 30 s, not for good
harness host: a look whose read failed climbs its own short ladder (5 s to a minute) and spends none of the step's waits; a launch's unwritten record is not logged at every attach
harness docs: what a look that cannot read decides, said as the code does — the socket, the records, the process and a launch's first 30 s wait; what no later look would read otherwise is still nothing to take
harness host tests: wait on what the look journaled, not on the step count; the snapshot test waits for its relaunching worker to be reaped
aterm-gui: the encode worker tests wait for a starved Background-QoS worker as long as it takes
claude lights tests: a closed sink is SHUT DOWN, not only its observer dropped — a forked child's copy kept the socket open
aterm-verify tests: an early-exiting instance is read off the lane's own reason, not a 10 s stopwatch — red on main's own tree
decruft(examples): the three drives no gate ran are gone — drawable\_acquire\_drive, objc\_dispatch\_drive, objc\_containment\_bench
decruft(gpu): the drawable-acquire probe seam is gone — its only installer was the deleted drive
decruft(gui): the styled-frame allocation test nothing ran is gone
gate(verify): the per-commit ladder is 30 rows — the test compile starts at t0, regex search is always built, and six duplicate rows are gone
gate(verify): every run is a real run of a snapshot — --selftest, --in-place, --timings, the nested-gate bypass and the retired-hook migration are gone
gate(verify): the gate's own tests keep one witness per property — duplicates and implementation pins pruned
tools(grep\_guard): one stripped corpus serves every source rule — 108 s to 18 s — and the retired rules are gone
xtask(gate): gate lint is tippy and trustfmt — the guards lane and the paint, spin and proof-cache scripts are deleted
style(aterm-agent): upgrade\_codex\_drive\_tests.rs is trustfmt-clean
gate(decruft wave 1): the reviewers' fixes — the release-then-probe lint stays, full disk stays COULD NOT RUN, and the prose matches the gate
harness: the login wall is read, waited out and never spent
spec: HarnessLoginWall — the login wall's model, Tier-0 and Tier-1
harness: name harness\_login\_wall\_model among the models bound to this module
harness: the login Claude Code 2.1.283 writes lifts the wall
harness: say what a notice Claude Code asks again after a /login is counted as
harness(login wall): the tests hold under main's cursor and taskless rules
spec(harness): the model ladder is a derived model, bound to the real model\_moves\_now
messages: day four — strain runs without focus, the log is sectioned by day, and a Claude upgrade stall says which tab and what it waits on
harness: a drift canary for every captured Claude Code build, and the tool that captures one
aterm-effects: re-baseline the typed-parity pins for the capped rainbow head (…)
Revert the typed-parity re-baseline: upstream restored the uncapped quad order at the source
containment: TmpOnly confines writes to the temp roots (decided 2026-09-26)
harness/git-read: judge a git read in the WORKER's environment; the two refinements recorded as decided
containment: the history allowance cannot be redirected, and only the user's own $TMPDIR joins the write roots
harness/git-read: every spelling of git grep -O and git <cmd> --help are no reads; the probe's git and the Bash tool's settings are the worker's to choose, so they escalate; the worker is bound by the id the loop addresses
harness/upgrade: trustfmt the Codex re-ask test the 0.95 assembly merge left unformatted
xtask gate cells: every run prints what it cost; forge's every-tier stage records its departure from the triage
effects: the frozen-sweep vacuity floor follows the band redesign (5,000 -\> 3,600)
aterm-verify: cells-foreign's place on every tier rests on where it ends, measured against the test run's start
aterm-agent: trustfmt the codex drive re-ask test that reached main unformatted
supervise: a point read before any footer waits on the content, so the mode's first frame is read
harness: a build whose --version answered late is looked at again, and host\_live's fakes pay their first run themselves
aterm-link tests: a stray is a daemon of THIS checkout's build, so other worktrees' live suites never block a run
harness: due's AskAgainAt is tested at its source, the timed look is named, and host\_live waits on the host's own retry
supervise: the content wait on an unread mode is the agent's start alone, and the changelog says what was shown
aterm-link tests: a stray is any of this checkout's builds, read by the file it runs
aterm-agent: trustfmt the Codex background-terminal re-ask test main landed unformatted
aterm-gui tests: "attached again" after a relaunch waits for a NEW worker, not the one winding down
atpkg: Flock's citation names its surviving witness — the aterm-verify probe it cited was pruned
host\_live: the upgrade deadline follows the no-version looks the loop JOURNALS
harness(upgrade tests): the login wall's Targets names no unanswered build
claude footer: drop the thinking light; ⌂ shows the session's path (\~/aterm), not the repo name
atpkg,aterm-gui,aterm: no sentence still promises a GitHub rate-limit hold the package lane no longer has
aterm-update: a Mac behind a source-first head installs the app release it slept through, found on git's unmetered tag list; a deferral no longer wakes its own process inside its window; update status says checked\_at and next\_check
claude footer: request is request_facts, so the lock census stops reading it as the program resolver's
gui: the Claude footer resolver declares its scheduling role inside its spawn closure
spec(claude footer): DormantWatchCannotRead names its slip — a session stop that leaves the watch reading (the dormant-refresh class of …)
spec(claude footer): the dormant-refresh mutant is a Buggy branch of StopSession, so ty's strict vacuity credits it
shell integration (cmd): no run-time read of ATERM\_DISABLE\_PROMPT\_TITLES — a user's own PROMPT title is the override
aterm-gui: a live copy of the restore manifest, so a crash, a kill or a power loss reopens the layout
aterm-gui: the live layout carries the agent each tab hosts
aterm-gui: the live layout writer declares its QoS role (Background, the messages log's)
harness: an agent whose tab a crash of aterm took is relaunched in the tab the next launch reopens
aterm-gui: a restart, a logout or a shutdown keeps the hosted agents for the next launch
aterm-gui: a restored leaf boxes its agent, and the crash relaunch is written down
aterm-agent: the relaunch-line pin reads the exit relaunch where it now lives
gui: the Claude footer resolver declares its QoS role where the census reads it