@awebai/oats 0.29.4 → 0.30.0

package/docs/release-notes/v0.23.0.md

@@ -1,11 +1,9 @@
 # OATS v0.23.0
 
-This is the prerequisite kernel release for capability-owned external knowledge
-and independent harvesting. It adds generic directory work and more reliable
-record capture; it does **not** migrate existing knowledge or select a new
-knowledge integration. The bundled `oats.okf` and official catalog pin remain
-**1.6.1**. OKF 2.0 is a separate, subsequent capability release; no new catalog
-pin or bundled v2 runtime is included here.
+This kernel release adds generic directory work and more reliable record
+capture, the prerequisites for capability-owned external knowledge. It does
+**not** migrate existing knowledge or select a new knowledge integration. The
+bundled `oats.okf` and official catalog pin remain **1.6.1**.
 
 ## Independent directory work
 
@@ -47,8 +45,8 @@ docs and the CLI, but **excludes** this optional payload entirely. npm omits
 symlinks; a partial copy without the canonical source alias is not a supported
 package. Acquisition does not synthesize aliases or relax integrity semantics.
 
-After this immutable tag is published, acquire through the normal Git package
-route and explicitly opt in for an author soul:
+Acquire it through the normal Git package route and explicitly opt in for an
+author soul:
 
 ```bash
 oats install git:github.com/awebai/oats@v0.23.0 --dir /path/to/scope
@@ -56,15 +54,13 @@ oats use oats.knowledge-theory --soul <author-soul> --dir /path/to/scope
 ```
 
 The default Git package root is `oats-package/`; acquisition locks the resolved
-commit and alone activates nothing. An official catalog pin can follow only
-after the immutable tag exists. No unpublished theory catalog pin is shipped
-in this prerequisite release.
+commit and alone activates nothing. This release has no catalog pin for the
+package.
 
 The package has no knowledge-layer binding, mandatory injection, runtime hook,
 command or dependency on OKF. Authors may adopt, adapt or replace the reference
 model. Each selected knowledge capability owns its runtime, reader/capture,
-judgment and delivery instructions. The first external-knowledge design covers
-Git PR delivery and non-Git directory custody; no framework ACL layer is added.
+judgment and delivery instructions. No framework ACL layer is added.
 
 Canonical references are published under
 [the authoring guide](../knowledge-capability-authoring.md) and
@@ -79,15 +75,3 @@ own canonical alias through the unchanged normal composition path.
 Kernel, Pi adapter and Desktop versions are aligned at 0.23.0, including both
 lockfiles. Desktop still uses CLI API v1; its accepted kernel band is widened
 to `>=0.22.0 <0.24.0`, retaining support for released 0.22.x kernels.
-
-Local, CI and runnerless release checks share the recursive JavaScript
-inventory, including capability libraries, record and optional package scripts.
-Validation checks the optional theory manifests and canonical curriculum parity.
-Pack checks require public docs and reject any optional package bytes in the
-npm kernel. The installed kernel acquires an exact, self-contained Git fixture
-through direct and catalog routes, checks its tracked source alias, then removes
-the fixture checkout. Probes verify local reference closure, alternative-theory
-isolation, discovery, scaffold and retirement in Git and directory scopes without
-launching models. Publication
-remains gated on the exact tag's build/test/smoke results and Desktop artifacts;
-already-versioned candidates remain safe with `--allow-same-version`.

package/docs/release-notes/v0.23.1.md

@@ -1,18 +1,16 @@
 # OATS v0.23.1 — external OKF v2 integration
 
-This patch integrates the published **oats.okf 2.0.0** Git package, tagged at
-`4b6d861ce44e5662303e150cc85095d0eb00d7e7`, following the published OATS 0.23.0
-prerequisite. The checked-in mirror records verified remote tag/object and
-payload provenance. Updating OATS alone does not change existing exact locks,
-activate capabilities, migrate knowledge or install a host timer.
+This patch integrates the published **oats.okf 2.0.0** Git package. The
+checked-in mirror records verified tag and payload provenance. Updating OATS
+alone does not change existing exact locks, activate capabilities, migrate
+knowledge or install a host timer.
 
 ## External OKF v2 integration
 
 The framework mirror follows the standalone package's **only exported
 capability**, `oats-package/capabilities/oats-okf/`. OATS >=0.23.0 supplies the
 generic directory-work and public capture/recall/CLI boundaries; OKF uses no
-private kernel imports. V0.23.1 prepares the framework catalog for OKF 2.0.0,
-without changing an existing deployment's exact lock or activation.
+private kernel imports.
 
 This is a **breaking capability upgrade**, independently versioned from the
 framework patch:
@@ -49,11 +47,6 @@ record transport retains full returned evidence, not an inspection preview.
 Descriptor-selected `read`/`refresh` always writes new immutable views under
 source state, never the invoking repository or a deleted/replacement home.
 
-Regression qualification must retain behavioral coverage, including large
-piped documents, live identity failures, durable inspection after disappearance,
-external view placement and full native record backlog. Scaffold tests establish
-layout/custody, not that a model learned.
-
 ## Git distribution, not an npm payload shortcut
 
 Users acquire `oats.okf` through the catalog's exact Git payload and explicitly
@@ -65,12 +58,12 @@ integrity rules or advertise copying that mirror as a complete package.
 The optional `oats.knowledge-theory` catalog entry uses the already published
 **v0.23.0** source (package 1.0.0), avoiding a forward reference to an unpublished
 tag. The current Git source additionally contains the 1.0.1 authoring-reference
-patch, available through an explicit v0.23.1 Git source after publication.
+patch, available through an explicit v0.23.1 Git source.
 Its payload stays in the repository's `oats-package/` Git subtree,
 not the kernel npm tarball. It exports authoring resources and
 `knowledge-theory-expert`, without a knowledge-layer binding, mandatory runtime
 injection or OKF dependency. Canonical references and copied local curriculum
-must stay synchronized. Acquisition alone activates nothing.
+Acquisition alone activates nothing.
 
 ## Migration and verification
 
@@ -81,17 +74,8 @@ then deliberately cut over owner declarations and existing sources. Old
 watermarks are evidence, not v2 processing proof. No automatic migration deletes
 legacy material or leaves a knowledge symlink in the soul.
 
-Qualification includes the standalone suite against the actual published
-minimum kernel, strict byte/mode/symlink mirror verification, framework regression
-and installed-tarball Git acquisition probes. Iterative independent review
-covered custody, interrupted publication, source retirement and rejected-PR
-recovery. Separate real Pi learning after source/transcript deletion and actual
-GitHub PR merge/reconciliation/fresh-view acceptance were verified; scripted
-transport and model-learning evidence are kept distinct.
-
-The normal tag-driven release still gates npm publication on all tests and
-Desktop build/smoke legs. Live deployment and explicit knowledge cutover remain
-separate operations, not side effects of package acquisition.
+Deployment and knowledge cutover are separate operations, not side effects of
+package acquisition.
 
 See [knowledge runtime documentation](../knowledge.md) for settings, lifecycle,
 commands, custody and recovery boundaries.

package/docs/release-notes/v0.23.2.md

@@ -2,8 +2,7 @@
 
 This release refreshes OATS Desktop around souls, instances and reported
 capabilities, while keeping lifecycle operations behind the installed OATS CLI.
-It builds on the released 0.23.1 kernel and knowledge contracts; it does not
-implement the proposed Portable Souls architecture.
+It builds on the released 0.23.1 kernel and knowledge contracts.
 
 ## Workspace and visual polish
 
@@ -43,7 +42,6 @@ compatible installation it remains observation-only, with persistent recovery
 controls across Workspace sections. The root npm package still contains no
 Electron dependencies; Desktop remains a private, separately packaged app.
 
-New Knowledge/Tasks views, portable-soul membership/discovery and an agent-facing
-file-open CLI command are not part of this release. Workspace layout memory is
+Workspace layout memory is
 session-local, not restart persistence. macOS assets retain the existing ad-hoc
 signing model; this release does not introduce Developer ID notarization.

package/docs/release-notes/v0.24.0.md

@@ -1,104 +1,63 @@
 # OATS v0.24.0 — retained execution first cut
 
-This kernel/Pi/Desktop **0.24.0** cut covers the qualified retained-execution slice
-below. Source review, native acceptance, packaged-artifact validation, publication
-and deployment remain distinct facts; this note is not proof of any user's rollout.
+Kernel, Pi adapter and Desktop **0.24.0**: the first cut of retained (captured)
+execution.
 
-## Published official OKF pairing
+## Official OKF pairing
 
-This cut pins **oats.okf 2.1.0**, requiring **OATS >=0.24.0**, at the existing
-`oats-package` source path. Published tag `v2.1.0` resolves to reviewed commit
-`f20f8e57a22bdffb48b34dee9bcbc03a9e0704db`. The existing finalizer verified the actual
-origin tag object, committed payload bytes/modes/alias and wrapper files; the mirror
-inventory now records that publication. Do not use an installed0.23.x kernel with
-this newer provider floor. Kernel versions are stamped by the existing tag lane;
-no compatibility check is bypassed.
-
-Before kernel publication, real retained primary and operation-created SOURCE workers
-completed on both tmux and Herdr, with qualified process/SDK outcomes, protected
-captured turns and independent directory-knowledge delivery. A separate real probe
-passed exact replay and distinct restart for all four homes, observing the supplied
-instruction heading and selected skill read without a controlled unrelated ancestor
-canary. The release-stamped kernel/adapter tarballs with this provider also passed
-actual installation and smoke outside the checkout. These results do not extend the
-explicit feature limits below or substitute for installed published-artifact checks.
+The catalog pins **oats.okf 2.1.0** (tag `v2.1.0`, `oats-package` source path),
+which requires **OATS >=0.24.0**. Do not pair it with an installed 0.23.x kernel.
 
 ## Source-complete preparation and retained execution
 
-- Public `prepare --request` accepts one bounded nonsecret JSON input through the
-  shared strict reader and preparation validator. Source, deployment, work target
-  and workspace/standalone context remain distinct; no inherited current config
-  fills missing source authority. Exact executable approvals remain explicit.
-- Fresh onboarding detects existing managed state without deleting it. Inspected
-  deployment/work-directory replacement or later provisioning requires reinspection;
-  ordinary project edits remain allowed. This is a point-in-time check, not a lock
-  against concurrent writers or a general migration engine.
-- Captured instructions/resources, source identity and provider bindings remain
-  usable from retained bytes after the source is removed. Portable home/work
-  boundaries preserve canonical aliases and immutable source custody.
-- Captured primary/helper public start and restart use retained selections and
-  indexed incarnation/intent custody. A helper is launched through its exact
-  **SOURCE helper edge**, not by treating a dedicated helper ID as a persistent
-  source. Same-ID uncertainty is held rather than redispatched; failure receipts,
-  pending allocation, native history and cleanup obligations are preserved.
-- Provider execution keeps generic invocation, same-owner binding and explicitly
-  opted-in source-receipt inputs separate. Missing/invalid current transport does
-  not silently become legacy authority. Source-owned completion is not transferred
-  to a helper or invented instance.
-
-## Backends and first-cut Pi profile
-
-The shared native path supports the existing tmux and Herdr adapters. Herdr adapter
-selection understands exact protocols20 and22; it does not negotiate an unknown
-protocol, relabel a retained target or fall back to tmux. Public caller/schema support
-and the actual explicit server endpoint must match the selected protocol. API2
-availability/readiness-not-checked is not server, model or provider health.
-
-The first-cut Pi host target is explicit print-mode retained execution, not unrestricted
-interactive/plugin parity. Its packaged entrypoint, parser/native services, selected
-curriculum eligibility and external session-directory identity witness must be complete
-before that selected profile is usable. An absent/incomplete witness or required
-runtime/bridge/plugin contribution remains a refusal, never a dummy success or a
-silently dropped requirement.
-
-The user's already-authenticated harness retains its normal native profile,
-auth/helpers/OAuth/model configuration. This cut does not introduce an auth-file
-selector, credential inspection/copy, provider/key allowlist, empty production store
-or substitute profile. Strict selected curriculum and controlled native history are
-separate from that authentication boundary.
-
-## Desktop CLI compatibility
-
-Desktop's released-CLI band extends to `>=0.22.0 <0.25.0`, including0.24.x. Desktop
-CLI API remains **v1**; prereleases, wrong probe/API versions and failed probes still
-refuse. Optional execution/remote capabilities are advertised separately—version
-acceptance grants none of them. Observation-only degradation remains available when
-no compatible CLI is verified.
-
-This version-band update is not complete captured UI, Herdr0.9 terminal attachment,
-plugin, scheduling, retirement/recovery or all-platform Desktop parity. The existing
-release lane aligns kernel, Pi and Desktop manifests/locks together, retains package
-and installed-artifact checks, and keeps Desktop artifact gates before tag-workflow
-publication. Ad-hoc signing is not Developer ID notarization.
-
-## Explicit limits and safe adoption
-
-- No automatic reconstruction/in-place migration, old-state deletion, role-library
-  adoption or new operator-root/bootstrap-helper grammar is introduced.
-- Selected unsupported managed/plugin/bridge or interactive profiles stay held.
-  Default-OKF worker/capture/learning claims require the actual selected launcher,
-  real turn, captured result and accepted fresh-reader evidence—not seeded transcripts
-  or a successful scaffold. Git knowledge delivery remains PR-only.
-- Public captured retirement, wake and recovery remain separately bounded work;
-  do not strip selectors, use a legacy/private fallback, or delete an uncertain home
-  to simulate completion. Preserve old sessions, identities, work and receipts.
-- No private-aweb human/admin/privacy qualification follows from backend/model
-  success. External authority evidence cannot be fabricated by the framework.
-- Provider versions, catalog refs and compatibility floors must identify real
-  reviewed/published artifacts. This note does not finalize or repin them.
-
-Use a new explicit deployment/source request and the actual installed public contract.
-Do not assume parked source candidates or optional helper packages are published.
-Final release evidence must distinguish package installation, native dispatch, actual
-model/task completion, provider-worker behavior and learning; a narrow first-cut pass
-must not be presented as full parity.
+- `oats prepare --request` accepts one bounded, nonsecret JSON input validated
+  by the shared strict reader. Source, deployment, work target and
+  workspace/standalone context stay distinct; inherited current config never
+  fills missing source authority. Executable approvals remain explicit.
+- Fresh onboarding detects existing managed state without deleting it. A
+  replaced deployment or work directory requires reinspection; this is a
+  point-in-time check, not a lock against concurrent writers.
+- Captured instructions, resources, source identity and provider bindings stay
+  usable from retained bytes after the source is removed.
+- Captured primary and helper start and restart use the retained selections. A
+  helper launches through its exact source helper edge. Uncertain same-ID state
+  is held rather than redispatched; failure receipts, pending allocations,
+  native history and cleanup obligations are preserved.
+- Provider execution keeps generic invocation, same-owner binding and opted-in
+  source-receipt inputs separate; missing or invalid transport never falls back
+  to legacy authority.
+
+## Backends and the Pi profile
+
+tmux and Herdr share the native path. Herdr supports exact protocols 20 and 22;
+an unknown protocol is refused, never negotiated or replaced by tmux.
+
+The Pi target in this cut is explicit print-mode retained execution, not full
+interactive or plugin parity. An absent or incomplete session-directory witness
+or required runtime, bridge or plugin contribution is a refusal.
+
+Harness authentication is unchanged: the already-authenticated harness keeps
+its native profile, credentials and model configuration. OATS adds no auth-file
+selector, credential inspection or copying, or substitute profile.
+
+## Desktop compatibility
+
+Desktop accepts released CLI versions `>=0.22.0 <0.25.0` over Desktop CLI API
+v1; prereleases, wrong API versions and failed probes are refused. Optional
+execution and remote capabilities are advertised separately; version acceptance
+grants none of them. Desktop does not cover captured-instance UI, Herdr 0.9
+terminal attachment, or captured scheduling, retirement and recovery. macOS
+builds are ad-hoc signed, not notarized.
+
+## Limits of this release
+
+- No automatic in-place migration, old-state deletion or role-library adoption.
+- Unsupported managed, plugin, bridge or interactive profiles are held. Git
+  knowledge delivery is PR-only.
+- Captured retirement, wake and recovery are not supported in this release; do not
+  strip selectors, use a private fallback, or delete an uncertain home. Keep old
+  sessions, identities, work and receipts.
+- Backend or model success does not qualify private aweb messaging.
+
+Adopt through a new explicit deployment or source request against the installed
+public contract.

package/docs/release-notes/v0.24.1.md

@@ -4,14 +4,10 @@ Kernel/Pi/Desktop **0.24.1**. Publication is not deployment; every operator stil
 
 ## What changed
 
-- **Framework repository joins the Git workspace model.** `oats-workspace.yaml` (workspace `oats-development`, seven intended members) and `oats.yaml` (exports: transitional `souls/oats-expert` edition, `oats-package`, `capabilities/oats-authoring`) are published at the repository root. Member indexes are on `main` in oats-okf, oats-aweb, oats-authoring and oats-jira. Membership is discovery, not activation; `imports` stay empty until sources are pinned at reviewed revisions.
-- **`oats inspect --request <absolute-json> [--json]`** — read-only inspection of a source/workspace/member through the existing onboarding facade. Metadata only: provider payloads and adoption values are omitted, no deployment state or approval is touched, captured selectors are refused.
-- **Captured custody on the home-only session route.** `oats session inspect|input --home H` now applies the existing captured incarnation/custody checks for captured homes and refuses before any transport when the home was replaced (integrity drift). Non-captured homes are unchanged. This is the route the aweb broker uses.
-- **OKF 2.1.1 pairing.** The mirror, `package-catalog.json` ref and the transitional soul's source pin `oats.okf@v2.1.1`: ordinary Claude/Codex helpers with a complete approved capability closure are accepted by the OKF consumer; strict Pi still requires an explicit model and the sole-OKF profile.
-- **Official marketplace policy** — `docs/official-marketplace.md`: the reviewed `package-catalog.json` list *is* the official marketplace; listing is by maintainer-reviewed PR; discoverable ≠ installed ≠ approved.
-- **Kernel setup skill removed.** `skills/oats-portable-setup` is deleted on the human's instruction; setup guidance moves to the planned `oats.setup` capability (see the [decision](https://github.com/awebai/oats/blob/main/agents/oats-expert/soul/knowledge/decisions/official-capabilities-oats-core-setup-and-marketplace.md)).
-- Docs: `docs/workspaces.md`, `docs/workspace-adoption.md`, condensed `docs/layers.md`, `docs/design/README.md` navigation, program board.
-
-## Not in this cut
-
-`oats.core` / `oats.setup` capabilities, explicit default `oats.core` on soul creation, `oats-setup-expert` onboarding, the five expert soul editions, the aweb portable adapter (aweb 1.10.3 still has no binding interface) and Desktop marketplace views are in progress — see the [program board](../design/2026-09-20-redesign-program-board.md).
+- **The framework repository joins the Git workspace model.** `oats-workspace.yaml` (workspace `oats-development`) and `oats.yaml` (exports `oats-package`, `capabilities/oats-authoring` and a transitional `souls/oats-expert` edition) are published at the repository root, and the official package repositories publish member indexes. Membership is discovery, not activation. See [Workspaces](../workspaces.md) and [workspace adoption](https://github.com/awebai/oats/blob/v0.24.1/docs/workspace-adoption.md).
+- **`oats inspect --request <absolute-json> [--json]`**: read-only inspection of a source, workspace or member. Metadata only: provider payloads and adoption values are omitted, no deployment state or approval is touched, and captured selectors are refused.
+- **Captured custody on the home-only session route.** `oats session inspect|input --home H` applies the captured incarnation and custody checks to captured homes and refuses before any transport when the home was replaced. Non-captured homes are unchanged.
+- **OKF 2.1.1 pairing.** The mirror and catalog pin `oats.okf@v2.1.1`: Claude and Codex helpers with a complete approved capability closure are accepted; strict Pi still requires an explicit model and the sole-OKF profile.
+- **Official marketplace policy.** The reviewed `package-catalog.json` list is the official marketplace; listing is by maintainer-reviewed PR; discoverable is not installed, and installed is not approved. See [the policy as published](https://github.com/awebai/oats/blob/v0.24.1/docs/official-marketplace.md) and the current [official catalog](../official-catalog.md).
+- **Kernel setup skill removed.** `skills/oats-portable-setup` is deleted.
+- Docs: condensed [contracts](../layers.md).

package/docs/release-notes/v0.24.10.md

@@ -1,54 +1,43 @@
 # OATS v0.24.10 — confirmed, idempotent spawn (apply contract) and the Desktop Review → Confirm spawn flow
 
-Kernel/Pi/Desktop **0.24.10**. Tag `v0.24.10` → the commit carrying these
-notes; the version-bump commit lands after the tag. Consumers gate on
-`oats version --json` `features[]` names and API integers — never on the version.
-
-## Kernel — the spawn apply contract (K6c–K6f)
-
-A Desktop can now let a person **review** exactly what a spawn will do and then
-**confirm** it, with the kernel guaranteeing that what runs is what was
-reviewed — and that a lost response never spawns twice.
-
-- **`spawn-apply-2`** (`spawnApplyApi: 1`): the previewed `decision` binds
-  **effective launch facts** (`repo, work, runtime, model, launchConfig, yolo,
-  backend, childSpawns, relation/anchor`) as well as placement; an inherited
-  default edited between preview and apply → `E_DECISION_STALE`. No backend
-  (Herdr) is started before the decision fence. The home is reserved with an
-  **exclusive** non-recursive `mkdir` right after the check: two concurrent
-  applies of one decision produce exactly one home; the loser refuses
-  `E_PLACEMENT_TAKEN` having touched nothing.
+Kernel/Pi/Desktop **0.24.10**. Consumers gate on `oats version --json`
+`features[]` names and API integers, never on the version. Shapes are in the
+[Desktop CLI API](../desktop-cli-api.md).
+
+## Kernel: the spawn apply contract
+
+A person can review exactly what a spawn will do and then confirm it; the
+kernel guarantees that what runs is what was reviewed, and that a lost
+response never spawns twice.
+
+- **`spawn-apply-2`** (`spawnApplyApi: 1`): the previewed `decision` binds the
+  effective launch facts (repo, work mode, runtime, model, launch config,
+  yolo, backend, child policy, relation) as well as placement; an inherited
+  default edited between preview and apply refuses `E_DECISION_STALE`. No
+  backend starts before the decision check. The home is reserved with an
+  exclusive `mkdir`, so two concurrent applies produce one home and the other
+  refuses `E_PLACEMENT_TAKEN` having touched nothing.
 - **`spawn-idempotency-2`**: `spawn --expect-decision <rev> --idempotency-key
-  <key>` records both in the new home. A **same-key retry replays** the
-  recorded receipt (found by key, never by name — the planned name may have
-  been auto-suffixed past it), runs **before** any placement/branch/base check
-  (so a spawn that created its explicit branch still replays), and re-saves no
-  wake. Same key + different decision → `E_IDEMPOTENCY_CONFLICT`. A home whose
-  spawn did not finish (crash between metadata and launch) → `E_SPAWN_INCOMPLETE`,
-  never a replayed success. The wake outcome is recorded and returned on replay
-  (`wake {requested, saved, error}`; `saved:null` = not recorded).
-- Decision-bound receipts echo the **full** bound decision; the kernel's own
-  post-spawn writes (completion marker, wake record) re-stamp the retirement
-  baseline so a fresh keyed home retires clean.
-- Every one of these came from the Desktop engineer's pre-wiring reads of the
-  merged producer, several proved in an inert VM; each is a new advertised name
-  because a strengthened guarantee must be distinguishable from the installed
-  CLI that lacks it.
+  <key>` records both in the new home. A same-key retry replays the recorded
+  receipt (found by key, not name) before any placement check. Same key with a
+  different decision refuses `E_IDEMPOTENCY_CONFLICT`. A home whose spawn did
+  not finish refuses `E_SPAWN_INCOMPLETE`, never a replayed success. The wake
+  outcome is recorded and returned on replay (`wake {requested, saved,
+  error}`).
+- Decision-bound receipts echo the full decision, and a fresh keyed home
+  retires clean. Known issue: bytes the agent writes to its home early after
+  launch may not be recovered at retirement; fixed in [v0.24.11](v0.24.11.md).
 
 ## Desktop
 
-- **Review spawn → Confirm spawn**: the spawn modal prepares a server-owned,
-  immutable intent (soul, root, choices, task, wake, the kernel's decision) and
-  applies only by reference; the idempotency key is minted at the first
-  confirmation and kept for that intent's retries. A lost response shows
-  **unknown** with an explicit *Check result* (a same-key kernel replay), never
-  a second spawn or a guessed terminal. Stale/conflict refusals require a fresh
-  review and a new confirmation. `E_SPAWN_INCOMPLETE` points at the session
-  surface; an unrecorded wake outcome says so ("check Schedules"). A raw local
-  spawn request on a fully capable CLI is refused (`E_PLAN_REQUIRED`); older or
-  remote CLIs keep ordinary spawn with the new choices unavailable. No
-  persistent task journal: after a Desktop restart a submitted intent is
-  unavailable/unknown and mints nothing.
+- **Review spawn → Confirm spawn**: the spawn modal prepares an immutable
+  intent (soul, root, choices, task, wake and the kernel's decision) and
+  applies it by reference, keeping one idempotency key per intent. A lost
+  response shows **unknown** with *Check result* (a same-key replay), never a
+  second spawn. Stale or conflicting decisions require a fresh review. A raw
+  local spawn request on a fully capable CLI is refused (`E_PLAN_REQUIRED`);
+  older or remote CLIs keep ordinary spawn. A submitted intent does not survive
+  a Desktop restart.
 
 ## Upgrade
 

package/docs/release-notes/v0.24.11.md

@@ -1,29 +1,21 @@
 # OATS v0.24.11 — retirement recovery: kernel-owned fields only, nothing re-blessed after launch
 
-Kernel/Pi/Desktop **0.24.11**. Tag `v0.24.11` → the commit carrying these
-notes; the version-bump commit lands after the tag. **Upgrade from 0.24.10 —
-it can lose an agent's early home bytes at retire.**
+Kernel/Pi/Desktop **0.24.11**. **Upgrade from 0.24.10: it can lose an agent's
+early home bytes at retire.**
 
 ## Fix
 
-0.24.10 (PR84) made a fresh keyed spawn retire clean by re-hashing the **whole
-home** after the kernel's own post-spawn writes (completion marker, wake
-record). That re-stamp ran after the tmux launch, so anything the agent wrote
-in the launch→completion interval — `STATE.md`, notes — was blessed into the
-retirement baseline and **not recovered** at retire. Found by the Desktop
-engineer's exact-source inert analysis of the merged fix.
+0.24.10 made a fresh keyed spawn retire clean by re-hashing the whole home after
+the kernel's own post-spawn writes (completion marker, wake record). That
+re-hash ran after launch, so anything the agent wrote in between (`STATE.md`,
+notes) was absorbed into the retirement baseline and **not recovered** at
+retire.
 
-Now the re-stamp is gone. The baseline fingerprint hashes the root
-`instance.json` with exactly the kernel-owned post-spawn fields
-(`spawnCompleted`, `wake`) removed. Kernel writes never read as the agent's
-changes; **nothing else in the home is ever re-blessed**; there is no
-observation of the home after launch. Regression: authored bytes written at
-launch are recovered under `changed instance-home bytes` with the bytes
-intact; a plain keyed spawn still retires with `workRecovery: null`.
-
-Rule recorded for the framework: the retirement baseline may account only for
-bytes the kernel can *prove* it wrote — never for what it *observes* after the
-agent may have started.
+The re-hash is gone. The baseline fingerprint hashes `instance.json` with only
+the kernel-owned post-spawn fields (`spawnCompleted`, `wake`) removed; nothing
+else in the home is re-baselined, and the home is not observed after launch.
+Bytes written at launch are now recovered under `changed instance-home bytes`;
+a plain keyed spawn still retires with `workRecovery: null`.
 
 ## Upgrade
 

package/docs/release-notes/v0.24.12.md

@@ -1,56 +1,43 @@
 # OATS v0.24.12 — instance events API 2 and the Desktop activity popover
 
-Kernel/Pi/Desktop **0.24.12**. Tag `v0.24.12` → the commit carrying these
-notes; the version-bump commit lands after the tag. Consumers gate on
-`oats version --json` `features[]` names and API integers — never on the version.
-
-## Kernel — `instance-events-2` (`eventsApi: 2`)
-
-`oats instance events` was a working reader with four defects found by the
-Desktop engineer's exact-source review; each is closed under a new advertised
-name because a strengthened guarantee must be distinguishable from the installed
-CLI that lacks it.
-
-- **Bounded, descriptor-safe read.** Each log source is `lstat`ed first; anything
-  but a regular file is refused unopened. The open is `O_NOFOLLOW|O_NONBLOCK` and
-  the descriptor is `fstat`ed against lstat's device+inode (closes the
-  lstat→open swap). At most the last 4 MiB is read by descriptor
-  (`integrity.sources[].status: ok|absent|refused|tail`).
-- **Address history, incarnation-tagged.** `--home` must be a home of exactly
-  the named instance (`E_HOME_MISMATCH`). Rows of another address are dropped and
-  counted (`integrity.foreignRows`). Every row carries `incarnation` (the writing
-  home's `instance.json.createdAt`); the result echoes the current one, so a
-  recreated same-address instance's earlier rows are visible *as earlier*.
-- **`waitingOnYou` is a producer state**, per (producer, current incarnation):
-  that producer's latest row carrying the field decides, an explicit `false`
-  clears, earlier incarnations never contribute, and it is computed over the full
-  admitted read so a `--limit` window cannot hide a clear. `waitingClaims[]`
-  shows every producer's current claim. **An unknown current incarnation
-  (unreadable `instance.json`) admits no claim at all.** Still `null` today — no
-  producer emits it.
-- **Provenance and corruption never disappear.** Dedup includes the producer;
-  `integrity.unreadableRows` counts torn lines regardless of `--since` or the
-  window; `count`/`returned`/`truncated` are consistent.
-
-## Kernel — retirement fingerprint scope (K6h)
-
-0.24.11's kernel-field neutrality for `instance.json` — and the pre-existing
-`.oats-*` receipt exclusions — were keyed on a root-level *filename*, so they
-also applied to directory work trees and recovery trees. Both are now opt-in
-(`{ instanceHome: true }`), passed by exactly the four instance-home callers;
-work and recovery trees are fully significant. A comparison blind spot (directory
-work was already always recovered when non-empty), not a deletion.
+Kernel/Pi/Desktop **0.24.12**. Consumers gate on `oats version --json`
+`features[]` names and API integers, never on the version. Shapes are in the
+[Desktop CLI API](../desktop-cli-api.md).
+
+## Kernel: `instance-events-2` (`eventsApi: 2`)
+
+`oats instance events` had four defects; each is closed under a new advertised
+name.
+
+- **Bounded, descriptor-safe read.** Only regular files are opened, without
+  following symlinks and verified against the checked file; at most the last
+  4 MiB is read (`integrity.sources[].status: ok|absent|refused|tail`).
+- **Address history.** `--home` must be a home of the named instance
+  (`E_HOME_MISMATCH`); rows of another address are dropped and counted
+  (`integrity.foreignRows`). Every row carries `incarnation`, so a recreated
+  instance's earlier rows are visible as earlier.
+- **`waitingOnYou` is a producer state**, per producer and current incarnation;
+  an explicit `false` clears it, earlier incarnations never contribute, and a
+  `--limit` window cannot hide a clear. `waitingClaims[]` shows each
+  producer's claim; an unknown incarnation admits none. No producer emits it
+  in this release, so it is `null`.
+- **Provenance and corruption stay visible.** Dedup includes the producer;
+  `integrity.unreadableRows` counts torn lines; `count`, `returned` and
+  `truncated` are consistent.
+
+## Kernel: retirement fingerprint scope
+
+The `instance.json` field exclusion from 0.24.11 and the `.oats-*` receipt
+exclusions also applied to directory work trees and recovery trees. They now
+apply to instance homes only; work and recovery trees are fully significant.
 
 ## Desktop
 
-- **Reported lifecycle activity** in the selected-instance popover: an explicit
-  *Load / Refresh activity* control (no roster or per-card fan-out) shows the
-  kernel's dated events with source, integrity (refused/tail/torn/foreign
-  visibly incomplete), earlier/unknown incarnation labels, and attributed
-  waiting claims as *claims as of a timestamp* — never as current runtime
-  authority. Gated on `eventsApi === 2` and `instance-events-2`; two coalesced
-  process-wide read slots; one observation retained per open popup; a failed
-  refresh keeps visibly stale rows rather than a false empty.
+- **Lifecycle activity** in the selected-instance popover: an explicit
+  *Load / Refresh activity* control shows the kernel's dated events with
+  source, integrity, incarnation labels and attributed waiting claims (as
+  claims at a time, not current state). A failed refresh keeps visibly stale
+  rows. Requires `eventsApi: 2` and `instance-events-2`.
 
 ## Upgrade