@loompad/cli 0.1.0 → 1.1.1

package/CHANGELOG.md

@@ -7,6 +7,1048 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.1] — 2026-10-16
+
+Found installing 1.1.0 on a Mac whose projects live on an external drive.
+
+### Fixed
+
+- **Loom Desktop explains a slow start instead of sitting blank.** The first
+  time it reads projects on an external drive (or in Documents or Desktop),
+  macOS asks whether Loom Desktop may access those files, and the background
+  service waits for the answer. The window now says *Starting Loom…* at once,
+  and after a few seconds that macOS may be asking, and to choose Allow.
+- **It no longer starts a second background service** onto a port that's
+  taken when the first is running but waiting on that prompt. It waits for
+  the first one, up to five minutes.
+- **The error page gives an installed app's advice**: quit and reopen, where
+  the permission lives in System Settings, and where the log is. It no longer
+  says "run npm run build". The pairing request has a timeout.
+- **Builds prune compiled files whose source is gone.** Leftovers in a
+  long-lived checkout changed the build fingerprint the desktop app and the
+  CLI compare, so the same release could look like two builds and each would
+  restart the other's background service.
+
+
+## [1.1.0] — 2026-10-16
+
+### Can you trust what your agents did?
+
+- **Proof**: when a reply claims the tests, build, typecheck or lint pass,
+  Loom checks the claim against what that turn actually ran, and re-runs the
+  tests in a clean worktree holding exactly the agent's changes. The verdict
+  is a card in the thread: Verified, Didn't hold (with why), or Unverified.
+  Every turn card has **Check it**; `loom proof` from a terminal.
+- **Loop watch**: the same command failing three times in a turn (or the same
+  call five times) gets a card with Stop / Nudge it / Hand it off, and a push.
+  `watchdog.auto: "nudge"` also stops it and tells it to step back, once.
+- **Blast-Radius Shield**: a force-push, `reset --hard`, a recursive delete
+  outside the project, `DROP TABLE`, `terraform destroy`, `npm publish`,
+  `sudo`, `curl | sh`, and the like get a red card and a push the moment an
+  agent runs them. `shield.auto: "stop"` (the default on a night shift) stops
+  the turn.
+- **Review Triage**: every turn card says which files to read first, and why:
+  an added secret, a deleted or skipped test, auth code, a migration, CI,
+  dependencies, risky calls, a big change with no test.
+- **Scorecards**: each agent's record of how often its "done" held up, its
+  circles and shield trips, and cost per verified result, in the
+  Observatory leaderboard, the phone, and `loom scorecard`.
+
+### Work that carries on without you
+
+- **Night Shift**: line up tasks, one per line. They run one after another, a
+  chat each, while you're away, guarded by Proof, the loop watch and the
+  shield, and stop at a stop-by time or a budget. One morning report says how
+  each went. Desktop ⋯ → Night shift, phone 🌙, or `loom shift`.
+- **Quota Relay**: an agent that hits its usage limit mid-task hands its work
+  (and a briefing) to the next agent, routes new prompts there while it's out,
+  and takes the baton back when the window resets.
+- **Pre-flight forecast**: the composer shows what a turn on the chosen agent
+  usually costs and takes, from its own recent turns, and turns amber when
+  one more could cross its daily budget.
+- **Replay**: export any chat as one self-contained HTML page to share, with
+  no scripts and nothing to load. ⋯ → Export as replay, or `loom replay`.
+- **Design Mode**: a picked element in the Browser tab brings its computed
+  styles and its own screenshot into the composer.
+
+### Agent Teams
+
+- **Persistent teammates** (P2) with their own native sessions and **crew
+  memory**. Teammates can now `remember` decisions, constraints and
+  conventions themselves.
+- **Parallel builders** in isolated worktrees, and **races** where you pick
+  the result (P3).
+- **Team coordination**: crews across teammates' daemons, owner requests, and
+  runners that execute crew goals. Full crew controls on desktop and phone.
+
+### Windows and a lighter daemon
+
+- Windows **Job Object** containment, native continuity on Windows, and
+  OpenCode 1.19 continuity. Fixes for ConPTY exit races and CLI launching.
+- **Memory**: the daemon starts ~25 MB lighter (the Claude SDK loads on first
+  use), idle OpenCode servers stop after 30 minutes, CLI probes are cached,
+  event reads are indexed, and long sessions no longer leak turn text,
+  attachments or socket backlogs.
+- OpenCode bash calls report their exit code, so a failing command no longer
+  reads as a success.
+
+### Fixed
+
+- A prompt sent to an agent just after its usage window reset, before the
+  baton came back, failed with "does not hold the baton". A stand-in that was
+  mid-turn at the reset kept the baton for good.
+- A runner's dropped progress heartbeat left a goal's PR invisible to the
+  team for up to a minute; it's re-sent after 5 seconds.
+- Phone sign-in aligned with GitHub; OAuth callbacks are validated.
+
+
+### One link to bring a teammate in, and crews of agents
+
+- **Invite** (a project's header, or `loom invite`) gives you one https link.
+  Opening it signs the teammate in with GitHub, joins the team, and clones the
+  repo; for a private repo, your Loom grants push access on join and theirs
+  accepts GitHub's invitation. It then opens the repo with *their* agents,
+  shares it with the team, and sets up your crews. Without Loom, the link's
+  page shows one command that installs it and joins. `loom join <link>` does
+  the same from a terminal.
+- **Crews** (Agent Teams, Phase 1): a lead, builders, a reviewer and a tester
+  work one goal in its own worktree. The Lead plans, you approve, and each card
+  is built, reviewed (with rounds of changes) and tested; then you apply the
+  branch. Use the Crew tab, or `loom crew create|goal|say|approve|stop|resume|apply`.
+- The Crew tab: the crew's faces in a hero, each teammate as a card that
+  lights up while it works, the goal's progress, a board with a column per
+  stage, an approval banner, the channel as a conversation, and a composer
+  that knows whether you're starting, answering or changing the plan. Pick
+  which agent sits in each seat when you make a crew, and swap one later.
+- Crews keep going when an agent misbehaves: a teammate that goes silent is
+  interrupted and retried once (`stallMinutes`, default 8); a turn that errors
+  is retried once; a reviewer or tester whose turn failed fails the card
+  instead of approving it.
+- **Fixed:** OpenCode chat turns could end after a step that only ran tools,
+  before the answer, when the model was slow to start its next step. And
+  interrupting an OpenCode turn that never answered no longer waits out the hour.
+- **Fixed:** a project forgot which tab you were on whenever it redrew while
+  loading, so you landed back on Chat.
+- Team invite links are https links now. `loom://team/join#…` links still work
+  anywhere a link is accepted.
+
+### A hundred small things (the enhancement sweep)
+
+Ranked, filed as #109–#208, and built top down. Each one was tried in the
+running app with real agents before the next started.
+
+**In the thread**
+- **Find** (⌘F) with highlighted matches; **drafts** that survive reloads and
+  chat switches; **↑** recalls your last prompts; **[ / ]** jump between them.
+- A reply's ⋯ menu: **Retry**, **Retry with…** another agent, **Continue** a
+  stopped reply, **Edit & resend**, **Quote**, **Star**, **Copy link**
+  (permalinks), **Branch from here**, **Make a card**, **Read aloud**.
+- 👍 / 👎 on replies, counted on the Insights leaderboard.
+- Day separators, relative times that stay fresh, **Show more** on very long
+  messages, a token estimate in the composer, **Reply length** (Brief /
+  Normal / Detailed), `{{variables}}` in saved prompts.
+- **Mermaid** blocks get *Draw diagram* — the renderer is fetched the first
+  time you press it, never before.
+- Export a thread to Markdown (also `loom export`).
+- Error cards you can act on: a countdown on rate limits, *Send to…* another
+  agent, *Copy details*.
+- A prompt sent while Loom is down waits and sends itself.
+- Very long live threads trim themselves; the outline rail lists your prompts.
+
+**The sidebar**
+- Pin, archive and unread dots on chats; **folders** (right-click → Move to
+  folder…, fold them, rename or ungroup); **Group chats by agent**.
+- *Since you were here*: back on a new day, Main opens with what happened
+  while you were away.
+
+**Orchestra**
+- The plan as a **graph** and a **timeline**; a live cost and time ticker;
+  **Run again**; a finish flourish.
+- **Resume**: a run Loom stopped by restarting picks up where it was.
+- **Race**: every picked agent takes the same goal in its own worktree; the
+  entrants sit side by side with a diff each, and *Pick this one* merges only
+  that one.
+
+**Agents, memory, board, insights**
+- Per-agent **standing instructions**, **pictures**, model **temperature and
+  max tokens**, and **Check** — installed, signed in, model listed, no prompt
+  sent.
+- Memory you can **edit**, **export** and **import**; which memories agents
+  actually get (*used N×*, Most used); a **graph** of memories joined by the
+  files they share.
+- Board cards with **priority** and **due** dates; **WIP limits** on columns.
+- Insights: an agent **leaderboard**, an activity **heatmap**, costs as
+  **CSV**, and month-end at this pace.
+- Diffs **side by side**, and **revert one file** of a turn.
+
+**The app around it**
+- Tab title and favicon show what's working and who needs you; a finished turn
+  in a hidden tab notifies (with an optional chime); **?** lists every
+  shortcut; **focus mode** (⌘.); a first-run tour.
+- Text size, density and accent colour; view transitions between tabs;
+  reduced-motion respected; skeleton loaders; the branch in the status bar;
+  empty states you can recognise; a project whose folder is gone says so.
+- Terminal find and clear. Diagnostics says what's running. Project settings →
+  Storage shows the log's size and compacts it.
+- Voice input without a transcriber uses the browser's own speech recognition.
+- CLI: `loom backup`, `loom export`, `loom stats`, `loom completion zsh|bash`,
+  `loom orchestra:resume`; `loom pair` carries the Loom Cloud route.
+- Hardened edges: security headers, a throttled pairing claim, JSON errors
+  instead of Express's HTML pages (which leaked stack traces).
+
+**On the phone**
+- Follows the system theme; long-press a message to copy or share; a copy
+  button on code; pull to refresh; unread and working dots on the chat chips;
+  haptics.
+- The daemon card graphs **link quality** over the last two minutes.
+- An **offline copy** of the project list and your last eight threads, per
+  paired daemon, cleared on unpair.
+- Android's status bar no longer covers every screen's header.
+
+**Fixed on the way**
+- Every *Rename…* used `window.prompt`, which the desktop app doesn't have —
+  they silently did nothing. An in-app dialog replaces all seven.
+- A turn's diff was logged to Main whatever chat the turn ran in.
+- An orchestra task's second attempt sent an empty prompt.
+- A queued prompt lost its reply length.
+- A skipped tab transition filled the console with uncaught rejections.
+- `npm test` skipped four DOM suites; it runs them now.
+
+### Replies you can watch being written
+
+- **The thread showed nothing between your send and the finished reply** —
+  fifteen seconds of a blank pane, then a wall of text. Nothing between an
+  adapter and the socket carried text that wasn't a finished event.
+- Replies now stream token by token: Claude Code (`--include-partial-messages`),
+  OpenCode 1.18+ (`session.next.text.delta`, which the adapter had never
+  listened for), OpenAI-compatible model agents, and every orchestra worker in
+  its own task thread. The typing is a `stream` socket frame and is **never
+  logged** — the finished message is still the record, exactly once.
+- Model agents logged a reply as a message per sentence (and a message per
+  reasoning token), which read as one answer chopped into a stack of bubbles.
+  They log it once now.
+- **Stop keeps what was written.** A turn stopped mid-reply used to throw away
+  everything you'd watched arrive; it's kept, marked *stopped*.
+- From the moment you send, the thread shows who's on it, for how long, and
+  what they're doing ("Codex · shell: npm test · 54s") instead of nothing.
+
+### A thread that reads like a document
+
+- One reading column; replies have a byline (the agent's mark, name, model and
+  time) instead of a bordered bubble; prose is Geist, mono only for code.
+- A run of tool calls folds into one line — *Ran 3 commands, read 2 files* —
+  that opens to the list.
+- Every turn ends on a footer: who, how long, which model, what it cost.
+- An orchestrator's plan is a card of tasks, agents and files, not a page of
+  JSON. An empty round says "still looking" rather than "didn't parse". A
+  task's status updates in its own row instead of adding a line per state.
+- Code blocks are syntax-highlighted with a language label; markdown tables
+  render; errors are a card with the provider's raw payload folded away.
+- The thread stays where you are when you've scrolled up to read, with a
+  **Latest** pill, instead of yanking you to the bottom on every event.
+- **Load earlier messages** pages the thread backwards (`?before=` on the
+  events API); it stopped at the last 60 events before.
+- An empty thread offers something to start with instead of a blank pane.
+
+### Picking who and on what
+
+- The agent and its model are one control in the composer. The agent picker
+  shows each agent's model and permission mode, hides switched-off agents, and
+  ticks with a check (it was the info icon).
+- The model picker has descriptions, keyboard navigation, **free models
+  first**, and fits the window (it ran off the top with Orchestrate open).
+- **Picking a model agent's model from the list broke the agent.** The list
+  leads each id with its provider (`openrouter/google/gemma…`), and that whole
+  string went to the provider as the model name. It's split now, on save and
+  for configs already saved that way.
+- A model agent with the generic id is named by its model ("gemma-4-31b-it").
+- **Ask several models** is in the composer's More menu: tick models, and
+  what's in the box goes to each, a thread apiece. It was CLI-only.
+
+### Orchestrate
+
+- The cast panel reads as Lead / Team / At once, and each worker chip has two
+  zones — include/leave out, and its model and mode — so a click on the chip
+  no longer lands on a badge and opens a menu instead.
+- The cast is remembered per project; a reload reset it to "every agent" and
+  the next run quietly used agents you'd left out.
+- Each task thread is pinned to its worker: the sidebar says who, and the
+  composer in that thread aims at that agent.
+- A finished run ends on a result card with **Apply to your branch**; a run
+  that ended before any task finished no longer offers an Apply with nothing
+  on its branch.
+- Loom's own `.loom/` state no longer counts as "uncommitted changes" in the
+  warning every run showed.
+- Fleet said "no agents running" above a run with workers in flight.
+
+### One workspace at every window size
+
+- **Narrowing the window swapped in the phone layout** and took the sidebar,
+  the tabs and the panels away. On anything with a mouse the workspace now
+  stays at every width: the sidebar slims, then slides in behind a toggle; tabs
+  go icon-only (each with a tooltip); the right panel steps aside. The single
+  column is for touch phones only.
+- Tabs say what they are: **Chat, Orchestra, Agents, Board, Memory, Insights**
+  (they were Thread, Fleet, Brain and Observatory), each with a one-line hint.
+- A turn reads as a timeline: the agent's mark, a hairline through its tool
+  steps, a node where it ends. Your prompt is the card that opens a turn;
+  code blocks have an editor header; file edits are a review card
+  ("Edited 3 files +12 −4"); a reply can be copied from its byline; the
+  composer's border lights up when you're in it and send lights up when
+  there's something to send.
+
+### And the rest
+
+- **Loom on Node older than 22.5 showed every thread empty** — no node:sqlite,
+  so it opened a fresh JSONL log beside the real one (a shell that put nvm's
+  Node 20 first after a reboot). The CLI now refuses to start on <22.5 and says
+  why, and the log refuses to open an empty fallback beside a log.db.
+
+- `loom up --restart` left the old daemon alive — its port freed, the process
+  and everything it held still running — because shutdown waited on the
+  browser's keep-alive and WebSocket connections forever. They're closed now,
+  and a stuck shutdown exits after five seconds.
+- The sidebar rebuilt itself every five seconds, dropping hover and focus under
+  the pointer; it only redraws when something changed. Older threads fold
+  behind "Show N older".
+- The everyday confirmations (abort a run, remove a project, clear the queue,
+  update Loom) are an in-app dialog; the browser's own was dismissed unseen by
+  some embedders, so Abort simply did nothing.
+- Escape closes any composer menu; the right panel opens by default only on
+  wide windows; a reload reopens the project you were in.
+- **Reload mid-reply and the reply is still there.** A thread's first page
+  carries what agents are typing in it right now, and stream frames carry their
+  offset, so a window opened mid-answer shows the whole reply so far and keeps
+  going without repeating or dropping words.
+- When the daemon stops answering, one banner says so and how to start it,
+  instead of a "Failed to fetch" toast every few seconds; it clears itself and
+  the views refresh when the daemon is back.
+- Terminals stopped stacking a "restored scrollback" divider and prompt for
+  every restart nobody typed through.
+
+### On the phone
+
+- Replies stream in live, over the LAN, the tailnet or Loom Cloud, and render
+  as markdown — code blocks, lists, bold, inline code. The orchestrator's plan
+  reads as a plan card, not a JSON dump, and the Fleet previews drop the marks.
+- The Pair screen's second button said "Paste link instead" and actually
+  submitted the fields. It now says Connect when something's typed (Enter works
+  too) and pastes from the clipboard when nothing is.
+- A thread that can't load (the route still settling, the daemon down) says so
+  and retries until it does, instead of sitting blank; "Network request failed"
+  became a sentence that says what to check.
+
+## [1.0.1] — 2026-09-21
+
+### Orchestra spawns its workers again
+
+- **An orchestrator's plan was being thrown away before it ran.** Every run
+  planned tasks and started none: the Fleet sat idle, no task threads appeared,
+  and the thread said *"your reply had no ```loom actions block"* directly
+  underneath a reply that plainly contained one.
+- The engine parses accumulated turn text, and that text was capped to its
+  **last** 20,000 characters. A plan's block sits at the END of a long reply,
+  so the cap kept the closing fence and threw away the opening one; the parser
+  saw an unterminated block and reported nothing to run. **The better the
+  orchestrator planned, the more certainly its plan was binned.** Measured on a
+  real run: seven consecutive plans of 6, 5, 5, 5, 5, 8 and 8 tasks, every one
+  parseable from the log and every one destroyed.
+- The budget is now far clear of any plausible reply, and when it is reached
+  the cut is made at the start of the actions block rather than at a blind
+  character offset — so what protects memory can never decapitate the payload.
+
+### Answer an agent where it asked
+
+- **An agent's question is now a card you can answer in the thread.** It was a
+  line of text with nothing to click, which made the one moment Loom exists to
+  surface — an agent blocked on a human — the worst affordance in the app.
+- The answer goes to **the agent that asked**, taken from the card. Through the
+  composer it went to `state.selected`, which in an orchestra thread is the
+  orchestrator — so answering a worker sent the answer to the wrong agent.
+- A question that plainly offers a choice becomes buttons. Anything ambiguous
+  falls back to the text box, because a wrong guess puts words in your mouth
+  and sends them to an agent.
+
+### A giant icon no longer eats the Board
+
+- Board → GitHub rendered a single enormous ⓘ filling the pane whenever `gh`
+  couldn't list pull requests, pushing the columns out of view.
+- `svg()` emitted no width or height, so an icon in a container that forgot its
+  CSS rule stretched to fill the line — and `.bnote` was such a container.
+  Icons now carry an intrinsic size, so a **future** icon dropped somewhere
+  unstyled looks slightly wrong instead of covering the screen.
+
+## [1.0.0] — 2026-09-21
+
+### Rewind — put the work back the way it was
+
+- **A checkpoint before every turn**, and **Rewind** on the Update card of the
+  turn it undoes. There is a **Rewind…** list under More for all of them, and
+  `loom rewind` in the terminal. The honest answer to *undo that* used to be
+  "read the diff and retype it": `turn_diff` looks like the answer and isn't,
+  since its patch is truncated at 12KB and an untracked file appears in it as
+  a line with no content.
+- **It restores files, not history.** HEAD does not move, your commits are not
+  touched, and the thread is not edited. What happened still happened.
+- **`.gitignore` applies at capture**, so `node_modules`, build output, `.env`
+  and `.loom/` are never read, never stored and never restored — which is why
+  a rewind cannot eat the event log.
+- **A rewind is itself rewindable.** It saves what it is about to replace
+  before replacing it, and hands that back: *Undo the rewind* in the thread,
+  an id on the command line.
+- **Refused while an agent is mid-turn**, naming who. Replacing the tree under
+  a running agent puts the damage in whatever it writes next.
+- Checkpoints live on hidden refs under `refs/loom/checkpoints/`, so no branch
+  listing, no stash and no `git log` shows one. The newest 60 are kept.
+
+### A transcript you can turn up
+
+- **Normal / Thinking / Verbose**, under More. Normal drops reasoning entirely
+  rather than folding it — the working out is not the transcript. Verbose
+  opens it and attaches the raw payload to tool calls and to the
+  orchestrator's brief, the two places a summary stands in for something
+  bigger. Remembered per project.
+- **A long block is readable to the end.** Code wraps instead of scrolling out
+  of the bubble, and every block — markdown or raw — carries a copy button.
+  The orchestrator's `{"actions": …}` plan used to be clipped in a scroll box
+  with no way to reach the closing brace.
+
+### Orchestrating from Main stays in Main
+
+- **The orchestrator answers in the thread you asked in.** It used to open one
+  of its own and walk you into it, leaving the goal you typed behind in a
+  thread that then said nothing about it.
+- **Each task row opens that task's thread.** They were findable only by
+  hunting the sidebar for a title you half remembered.
+- **A borrowed thread is given back.** Replying in a run's own thread steers
+  the run for good; a thread the run borrowed stops answering for it once the
+  run is terminal, so Main goes back to being Main rather than forwarding
+  every later message to a finished goal.
+
+### A thread says who's working in it, and whether it's still going
+
+- **A task thread is labelled with the agent doing that task**, not with
+  whoever holds the project baton. During a run with four workers every task
+  thread used to claim to be the baton holder, so a Codex task and an
+  Antigravity task looked identical. A thread pinned to an agent answers the
+  same way.
+- **Thread rows show status** — a live pulse while a task runs, green when it
+  finishes, red when it fails, amber when it's waiting. Every answer comes
+  from a status the daemon already reports; a thread it can't know about gets
+  no mark rather than a guess.
+- The status payload now carries one row per task (thread, agent, kind,
+  state) instead of only a count, which is what made both of those possible.
+
+### Models in Orchestrate
+
+- **Every agent chip carries its model**, orchestrator and workers alike,
+  beside its permission chip. Orchestrate could pick who ran a goal and never
+  what they ran it on: the model picker was bound to the one agent the chat
+  composer is aimed at, which in Orchestrate is nobody.
+- **A dashed “+ model” chip** adds an API model to the cast and opens its
+  picker straight away. Until a model is picked the chip warns, and Orchestrate
+  refuses to start — naming the agent — rather than failing three tasks in.
+- The model list's provider-asked source had no case in its footer, so it
+  printed *“no model list for this agent”* directly above 446 of them. And it
+  no longer offers a model agent a **Default**, which for that kind is the one
+  option that cannot work.
+
+## [0.2.6] — 2026-09-20
+
+### Right-click, and a composer that fits
+
+- **Right-click a project** for everything you can do to it: open, new chat,
+  settings, **rename**, copy path, and **Remove from Loom**. Those were
+  scattered — settings behind a gear, rename nowhere at all, and removing a
+  project only in `loom projects --forget`.
+- It says **Remove from Loom**, not Delete, and the confirm says the folder,
+  the history and `.loom/` stay on disk. A menu item that says delete and
+  doesn't is as bad as one that says delete and does.
+- **Right-click a thread** to open it, rename it, pin which agent answers in
+  it, or forget it. The main thread offers only what applies to it, rather
+  than offering everything and refusing half.
+- Escape and any click outside close the menu, arrow keys walk it, and it
+  flips rather than hanging off the edge of the window.
+- **MCPs and Skills moved into a More menu** in the composer, which also
+  reaches Prompts and Attach. That row was holding the model, the agent, a
+  permission chip, five buttons and send, and wrapped on a narrow window. The
+  count badge stayed outside — *two skills are on* is the part you need
+  without opening anything.
+
+### Setup tells the truth about this machine
+
+- **Claude Code showed "not installed" on machines where it is.** Anthropic's
+  installer puts the binary in `~/.local/bin`, and Loom trusted `PATH` alone —
+  which an interactive shell has and a detached daemon may not. Codex, Grok
+  and Antigravity already looked in their known locations; claude-code was the
+  one still guessing. Telling someone to reinstall software they already have
+  is the worst kind of wrong answer.
+- **The Model (API) row said "couldn't confirm it's signed in" and printed a
+  blank command.** There is nothing to sign in to: a model agent is usable
+  when a provider has a key, so it says which providers are configured, and
+  when none is, it gives you `loom providers:set …` instead of an empty box.
+- **The desktop app says Loom in the menu bar**, in a dev run as well as a
+  packaged one. macOS takes that title from the running bundle, not from
+  `app.setName()` — which is why setting the name in code never fixed it. The
+  `.app` filename is unchanged, so the Homebrew cask keeps working.
+
+## [0.2.5] — 2026-09-20
+
+### Install it with Homebrew
+
+- **`brew tap nickthelegend/loom https://github.com/nickthelegend/loom` then
+  `brew install --cask loom-desktop`** — and `brew upgrade --cask` after that,
+  which is a real update path for the macOS build that can't replace itself.
+  The cask carries both architectures and is regenerated from the published
+  checksums by the release job, so it can't go stale.
+- **Check for Updates… recognises a Homebrew install** and hands you the
+  `brew upgrade` command instead of downloading over a copy brew is tracking —
+  the same rule the Linux `.deb` already had. **Run it in Loom** runs it in
+  Loom's own terminal, the one in the dock, so you watch the upgrade rather
+  than having it happen invisibly inside the app.
+- It does **not** get you past Gatekeeper, and doesn't pretend to: brew
+  quarantines cask downloads on purpose. First launch asks once, as it does
+  for a dmg you downloaded yourself. The cask deliberately does not strip the
+  quarantine attribute — that protection exists *because* the app is unsigned.
+
+### A model agent can write, when you say so
+
+- **`--write`** gives a model agent `write_file`, and **`--run "npm test"`**
+  gives it `run` with an allow-list. Every write and every command is a card
+  in the thread that you allow or deny before anything happens — the same
+  approval surface Claude Code's "always ask" already uses, now asked from
+  inside the daemon instead of over MCP.
+- **It asks in `auto` too**, which is stricter than the CLI mapping and
+  deliberately so: a CLI in your roster is one you installed and signed into,
+  and a model agent is a name you picked off a provider's list an hour ago.
+  `bypass` is the only mode that doesn't ask, because that is what bypass
+  means.
+- **The card says what would happen** — *write src/app.ts: 40 lines
+  (replacing 12) — fix the port* — rather than dumping the whole new file at
+  you.
+- The allow-list is a prefix match on whole commands and there is no shell, so
+  `npm test` permits `npm test --watch` and refuses `npm testify`,
+  `npm test; rm -rf ~`, backticks, pipes and redirection. A tool is only
+  offered when it can be used: no allow-list, no `run` tool at all.
+- With nobody to ask — no daemon, a script, a test — the answer is **no**. A
+  tool that proceeded because the UI wasn't wired up would be the worst
+  failure this could have.
+
+### A model agent can read the project
+
+- **`"tools": true`** on a `model` agent gives it `read_file`, `list_files`
+  and `search` — read-only, inside the project, `.git` and `.loom` excluded,
+  every path resolved and proven contained before anything opens it. A
+  reviewer that can't read the file it's reviewing is being asked to guess.
+- Each call appears in the thread as a `tool_call`, like any other agent's
+  work, and the loop is bounded: after eight hops the model is told to answer
+  with what it has rather than being cut off mid-thought.
+- **No writing and no shell.** A model that can write files is exactly as
+  dangerous as a CLI that can, and the right answer is the permission layer
+  Loom already has. That's the rest of #87, and it stays open for it — a free
+  model editing a repository because it felt like it is not a thing to ship
+  quietly.
+
+### Ask several models at once
+
+- **`loom ask --models a,b,c "…"`** sends one prompt to several models at the
+  same time, each in its own thread named after the model, with the project's
+  memory brief attached. `--free` picks the free ones the providers have right
+  now, up to `--limit`. With free quota, asking five models costs what asking
+  one costs — and *which of these is right* is a judgement a person makes in
+  ten seconds and a model makes badly.
+- The agents that run are **transient**: five asks don't leave five agents in
+  your roster. The threads stay, because those are the part worth keeping.
+- One model failing doesn't take the others down — its thread carries the
+  error, the rest carry their answers.
+
+### A thread remembers who answers in it
+
+- **Pin an agent to a thread** and it answers there, whoever holds the baton —
+  so two threads can be talking to two agents at once, which is the point of
+  having agents that cost nothing. Picking an agent for a new chat now pins it
+  instead of handing over the baton, and the sidebar shows which thread is
+  with whom.
+- **It doesn't take the baton.** The baton is the write lock for work on the
+  repository; a conversation doesn't need it, and taking it would stop
+  whatever is actually working.
+- A thread can pin a **model** too, for agents that can change model per turn
+  (the `model` kind). Binding one to an agent that bakes its model into a
+  spawned process is refused where you can fix it, rather than ignored where
+  you'd never notice. The main thread still follows the baton — that's what
+  makes it the main thread — and a thread whose agent has left the roster
+  falls back to the baton rather than becoming one nobody can type in.
+
+### Agents that are models, not CLIs
+
+- **A new agent kind, `model`.** It's an HTTP endpoint rather than a
+  subprocess: OpenAI-compatible chat completions, streamed into the thread as
+  they arrive, with reasoning shown as reasoning and token counts on
+  `run_complete`. Nothing to install. It has no tools yet, so what it's for is
+  the thinking work — planning, reviewing, summarising, answering — which is
+  most of what a fleet does between edits.
+- **Providers, and keys where keys belong.** OpenRouter, AgentRouter, OpenAI,
+  Groq and a local Ollama are known by name; anything else speaking
+  `/v1/chat/completions` works with a base URL. The project config names a
+  *provider*, never a secret: keys live in the environment or in
+  `~/.loom/providers.json` (0600), and no route, log or listing ever returns
+  one — you get the last four characters. `loom providers`,
+  `loom providers:set <id> --key …`.
+- **`loom models`** asks each configured provider what it can run right now,
+  cached for ten minutes and refreshable, with the free ones marked. A model
+  list that's typed out by hand goes stale; one that's asked for doesn't.
+- **Fallbacks that read the answer.** A dry free pool (402) or a rate limit
+  (429) moves to the next model in `fallbacks` and says so once in the thread;
+  a wrong or retired model name (503) stops, because trying something else
+  would hide the typo rather than fix it. Each refusal is explained in its own
+  terms — a rejected *client* is not a rejected key.
+
+### Retrieval that can follow a synonym
+
+- **A semantic channel for the brain** (`brain.semantic`, or Settings →
+  Brain): all-MiniLM-L6-v2 embeddings unioned with the three lexical channels,
+  so *how does login work* reaches a note about Supabase JWKS. Measured on the
+  recall set that shipped with 0.2.4: recall@5 **0.50 → 1.00** on synonyms,
+  **0.80 → 1.00** across word forms, unchanged at **1.00** on literal queries.
+  Warm cost is about a millisecond a query.
+- It is **not** a dependency and never will be: the model is 23MB but its ONNX
+  runtime is ~470MB, so Loom asks you to install that yourself
+  (`npm i -g @huggingface/transformers`) and behaves exactly as before when
+  it's missing — a channel that can be absent must fail into the old answer,
+  not into an error. Vectors are cached per memory hash beside the brain, and
+  the model stays offline after its first download.
+
+### macOS gets the update too
+
+- **Help → Check for Updates… on macOS** now finds the build for your
+  architecture, downloads it, and **verifies its SHA-256** against the
+  checksums the release publishes — a file that doesn't match is deleted
+  rather than opened — then opens the disk image for you to drag across. The
+  drag stays yours: macOS only lets an app signed by a certificate it trusts
+  replace itself, and this build is ad-hoc signed. The checking is the part
+  worth having; the checksums have shipped since 0.2.0 and nobody compares
+  them by hand.
+
+## [0.2.4] — 2026-09-20
+
+### The desktop app can update itself, where that's honest
+
+- **Help → Check for Updates…** on **Windows** and the **Linux AppImage**:
+  it asks before downloading, installs on quit, and restarts only when you
+  press Restart. On **macOS** it refuses and says why — the build is ad-hoc
+  signed, and macOS only replaces an app signed by a certificate it already
+  trusts — and opens the releases page instead. A `.deb` install is left to
+  the package manager that owns it. The release now publishes the update feed
+  for those two platforms and deliberately not for macOS: advertising an
+  update the OS will refuse to install is worse than advertising none.
+
+### Dark mode in the preview
+
+- **Auto / light / dark for the previewed page**, independent of Loom's own
+  theme and remembered per project, alongside the widths. It re-points the
+  page's own `prefers-color-scheme` rules through the proxy bridge and makes
+  `matchMedia` answer to match, so both CSS-themed and JS-themed apps follow;
+  Auto restores every rule exactly as it shipped. Where Loom can't reach the
+  page it says so rather than offering a switch that does nothing, and the
+  screenshot — a real browser — honours the scheme either way.
+- The width you chose is now actually **read back**: it was being saved and
+  never restored, which is the same as not remembering it.
+- A screenshot and an element pick both carry the conditions they were taken
+  under (*375×812, dark mode*) into the prompt.
+
+### The baton can carry the work
+
+- **`git.mergeOnHandoff`** (with `worktreePerAgent`): handing the baton from A
+  to B merges `agent/A` into B's checkout, so the next agent starts from what
+  the last one finished. It refuses rather than guesses — uncommitted work on
+  either side, or a merge already in progress, is reported instead of merged —
+  and a conflict is left in the tree with the files named, in the briefing and
+  in the handoff event. A conflict stops a route instead of prompting an agent
+  on top of conflict markers.
+
+### Routes: steps that decide whether to run
+
+- **A route step can carry a condition on the previous turn** and is skipped
+  when it doesn't hold: `loom route 'planner,executor,reviewer?lines>200' "…"`,
+  or `{ "step": "reviewer", "when": "lines>200" }` in the project config.
+  Conditions read the turn's own diff — `changed>N`, `changed<N`, `lines>N`,
+  `lines<N`, `touched:<glob>`, `!touched:<glob>` — and nothing else: a
+  condition must be something Loom measured, never a judgement about the work.
+  Unreadable ones are refused when the route is defined rather than quietly
+  never matching, the first step can't be conditional (no turn to measure),
+  and a skipped step appears in the thread with the numbers that decided it.
+  Skipping isn't failing — the route completes.
+
+### A pull request you asked for
+
+- **Open PR on a review card.** With branch-per-card on, a card in review shows
+  what a PR would carry — the branch, its commits, its files and the exact
+  command — and opens it only when you press the button. Asking pushes
+  nothing; publishing has never been implicit and still isn't.
+
+### Coming back to a project
+
+- **A digest of what happened while you were away** — goals, landings,
+  failures, a dead server, and what's waiting on you, newest first and each
+  line clicking through to the moment it came from. Shown when you've actually
+  been away; `loom digest --since 8` in the terminal.
+- **The desktop app's notifications carry the question itself**, not "an agent
+  needs you", and on macOS you can answer from the notification. Nothing fires
+  while you're looking at that conversation.
+
+### Goals: a spend cap, and more than one at a time
+
+- **`loom orchestrate --max-usd 2`** stops a goal at its cap the way the team
+  budget always did — running work finishes, nothing new starts, and the goal
+  waits for you. A project default lives in `budgets.perGoalUsd`, and a word
+  lands in the thread at 80% rather than the stop being the first you hear.
+- **`maxConcurrentGoals`** lets disjoint goals run side by side. A goal's
+  scope is the `touches` its plan declares; one that hasn't said what it
+  touches counts as everything and waits. Overlaps queue with the collision
+  named. Still one at a time unless you ask for more.
+
+### The queue can wait, and can be kept
+
+- **Queue for later**: a prompt can be held for a time, until a goal actually
+  **lands**, until that goal's **checks go green**, or until the project has
+  been quiet for a while. The row says what it's waiting for and a click
+  releases it. (`loom queue at 03:00 …`, `loom queue after green:<runId> …`)
+- **Recipes**: save what's queued and run it on any project. Steps remember
+  their target by **role**, so a recipe travels; anything the project can't
+  resolve becomes an Auto prompt rather than a refusal. (`loom queue save`,
+  `loom queue run`, `loom queue recipes`)
+- **Drag to reorder** in the web app; the arrows stay for anyone who can't
+  drag, and the phone gained up/down controls it never had.
+
+## [0.2.3] — 2026-09-20
+
+### The Browser tab knows your dev servers
+
+- **Loom can run them.** Declared under `servers` in `.loom/config.json` and
+  suggested from `package.json` (a suggestion you accept, never something that
+  starts itself). Start, stop and restart from the Browser tab or the CLI.
+- **The state is a fact, not a guess**: *running* means a port answered,
+  *starting* means the process is up and nothing is listening yet, and
+  *crashed* carries the exit code.
+- **Its output is there too**, under the page it serves — which is where the
+  reason for a blank frame usually is — and a server that dies while an agent
+  is working against it says so in the thread.
+- Clicking a server points the preview at it; no more typing ports from memory.
+- Every server Loom started is stopped when the daemon goes, so nothing is left
+  holding a port.
+- `loom servers`, `loom servers start|stop|restart <name>`, `loom servers logs
+  <name>`.
+- **The preview emulates a width** — Fit / 375 / 768 / 1280, remembered per
+  project and scaled down when the dock is narrower than the page.
+- **It reloads when an agent changes files** (a toggle, on by default), so
+  watching a change land doesn't involve remembering to refresh.
+- **The previewed page reports back.** Loom previews a server through its own
+  proxy — forwarding everything, including the hot-reload socket — and injects
+  one script. The **Page** pane shows the page's console and its requests,
+  live, and a click puts a line into the composer as context.
+- **An element picker.** Click the thing that's wrong in the preview and its
+  selector, text, box and markup land in the composer.
+- **A camera button puts the view into the composer.** The page is another
+  origin and can't photograph itself, so the daemon takes the shot with the
+  project's own Playwright; a project without it is told exactly that.
+
+### An Update button that actually updates
+
+- **Loom says when a newer version is out** — checked against the published
+  release, cached for hours, shown as a pill in the status bar.
+- **One button in Settings → Updates**, which says exactly what it will run
+  before it runs it: a git checkout pulls and rebuilds, a global npm install
+  reinstalls itself, and anything else is pointed at the release rather than
+  having a command guessed at and run over it.
+- **A checkout with uncommitted changes is refused** (modified tracked files —
+  an untracked scratch file doesn't stop a fast-forward).
+- The commands' output streams while they run, then the daemon restarts on the
+  new build and the page reconnects to it.
+- `loom update [--check] [--yes]` does the same from the terminal.
+
+## [0.2.1] — 2026-09-20
+
+### The prompt queue
+
+- **What you type while something is running now waits where you can see it.** A
+  prompt sent to a busy agent used to be queued invisibly — logged into the
+  thread as if it had been sent, with nothing to look at and nothing to change —
+  and a goal typed while another goal ran was refused outright.
+- **The queue is a surface**, above the composer on the web, the desktop app and
+  the phone, and `loom queue` in the terminal: every waiting prompt with who
+  takes it, editable in place, movable, removable, pausable.
+- **Each prompt names its own target:** one agent, the **orchestrator** (a whole
+  new goal, started when the running one finishes), or the auto router — and you
+  can change it while the prompt waits. The baton moves with it.
+- **A question holds the queue:** an agent that stops to ask you something isn't
+  answered by whatever you queued behind it. The queue waits and names who
+  asked; your typed reply goes straight out and lifts the hold, so what was
+  waiting runs next. A pause you set yourself stays until you resume it.
+- **Stop pauses the queue** instead of emptying it, and a prompt that can't be
+  sent (budget, quarantine, a policy, a missing agent) stays put with the reason
+  on the queue rather than disappearing.
+- **A prompt enters the conversation when it is sent**, not when it is queued, so
+  the thread stays an honest record of what each agent was actually asked.
+- Survives a daemon restart, reloaded **paused** (`.loom/queue.json`). API:
+  `GET/POST /api/projects/:id/queue`, `PATCH|DELETE .../queue/:itemId`,
+  `POST .../queue/pause`, `DELETE .../queue`, plus a live `queue` socket frame.
+
+### Fixed
+
+- **An override of `loom/review` made while that review is still running** is no
+  longer overwritten when the review finishes (D61) — found on a real PR, where
+  a late review wrote `failure` over the owner's decision.
+- **A turn is no longer blamed for Loom's own `.loom/` files.** In a project that
+  doesn't gitignore `.loom/`, the event log and the queue file were landing in
+  the agent's turn diff.
+- **grok-code and agy** are detected from their own auth files instead of being
+  reported signed-out, and the status bar says **live**, not offline, before a
+  project is open.
+- **A reply that lands after its window closed** no longer throws from a redraw.
+- **An overridden review leaves its status where the owner put it.** A review
+  coming back to a commit that was already overridden kept the decision but
+  posted nothing, leaving its own "reviewing…" status pending — on a repo that
+  requires `loom/review`, for ever.
+- **Retargeting a queued prompt** to an agent the project doesn't have is
+  refused when you make the change, not when the queue reaches it.
+
+### Loom Teams, Phase 6: land in turn, hear it now
+
+- **6 more design decisions** (D79–D84), settled with the owner.
+- **The landing train:** on a repo with no merge queue, Land queues a goal in its
+  lanes and Loom merges it on its turn: fresh main in, the fast tests, a push,
+  green checks on that commit, then `gh pr merge --squash`. The slot is a team-hub
+  lease on `.loom/landing/<lane>` held as a hard zone, so every hub (in-memory,
+  `loom hub`, hosted SQL) arbitrates it with no new API. Waiting goals show
+  **queued** and go as soon as the lane frees. A red check on its turn hands the
+  lane on, and the goal rejoins when it's green. Repos with a merge queue land as
+  before.
+- **Lanes:** `landing.lanes` in `loom.team.json` are path scopes; goals in
+  different lanes land at the same time.
+- **GitHub webhooks into the hub, no App needed:** `loom hub` takes
+  `POST /github/webhook/:teamId`, checks `X-Hub-Signature-256` against the team's
+  secret, and posts PR, check, review and deploy events to the feed.
+  `loom team webhook [--install] [--rotate]` sets it up. The hosted hub gets a
+  `github-webhook` Edge Function and `supabase/migrations/0009_phase6.sql`
+  (deployment pending).
+- **Polling and webhooks agree:** one mapping (`src/core/github-events.ts`) gives
+  both the same dedupe keys, so a fact is posted once. Failing checks are now one
+  feed event per check and commit, and `gh pr list` polling reads `headRefOid`.
+- **Faster fixes:** a check result or merge for one of your goal PRs makes your
+  daemon look at it immediately, not at the next 30-second poll.
+- **UI:** a `queued` landing chip (desktop and phone), and feed lines for the
+  train and for reviews that arrive by webhook.
+
+## [0.2.0] — 2026-09-19
+
+Loom Teams: five phases, 78 design decisions, several people and their agents on
+one repo. The sections below go phase by phase, newest first.
+
+### Loom Teams: loose ends closed
+
+- **Paste-the-URL sign-in** for the hosted hub on machines without a browser
+  (`loom team signin --paste`; `loom runner join` uses it by default).
+- **Stacks fold when a lower PR keeps failing:** its lower PRs close and the top
+  one retargets the base branch, so the normal fix loop can fix it.
+- **CI minutes per goal:** Actions time on a goal's branch is recorded when it
+  lands and shown in team spend (desktop and phone).
+- **Docs:** a Teams user guide ([docs/teams.md](docs/teams.md)), a docs index,
+  a source map, and READMEs for `supabase/`, `src/hub/`, `test/`, `scripts/`
+  and `hardware/`.
+
+### Loom Teams, Phase 5: runners
+
+- **12 more design decisions** (D67–D78), settled in a design interview.
+- **Runners:** a member's always-on Loom daemon that takes goals from the team
+  hub. Pair it with `loom runner pair` / `join` (a device of the same member,
+  revocable with key rotation); keep it up with `loom runner install` or
+  `Dockerfile.runner`.
+- **Jobs on the hub:** start / continue / fix / return / land, with atomic claims,
+  heartbeats carrying a progress snapshot, and stale reclaim (MemoryHub, `loom
+  hub`, SQL `0007_runners.sql`).
+- **Move a running goal** to a runner at a safe point (branches pushed to
+  `refs/loom/run/<id>/*`, the orchestrator resumes there) and **bring it back**;
+  Land reaches goals that live on a runner.
+- **Trust tier:** a fresh clone (or container) per goal, a scrubbed environment,
+  `runners.permissions` as the ceiling, shared runners only when
+  `runners.shared` allows, a fine-grained token checked by `loom runner doctor`.
+- **Away-from-keyboard CI fixes:** the owner's runner takes a goal that needs
+  someone once the owner has been offline 15 minutes.
+- **Deploys and release notes:** deployment results in the feed, a phone alert
+  when a failed deploy contains your goal, `loom team release-notes --since`.
+- **Phone:** tapping an alert opens its project and goal.
+
+### Loom Teams, Phase 4: land safely
+
+- **15 more design decisions** (D52–D66), settled in a design interview.
+- **Checks come back to the owner:** the owner's daemon polls its goal PRs every
+  30s (`gh pr checks --required`). A failing check is rerun once; a pass on rerun
+  is labelled `loom:flaky`. A real failure's log tail (fenced as untrusted) reopens
+  the goal, and the fix is pushed to the same PR. At most 2 attempts, then the
+  goal needs a human and the phone is alerted.
+- **Cross-vendor review:** a different-vendor agent reviews each goal PR on open
+  and after each fix (max 3), posts a COMMENT review and a `loom/review` status;
+  only high findings fail it, and they share the fix budget. Owners can override
+  with a reason.
+- **Land** (`loom land`, a button on desktop and phone): fresh main merged in,
+  `landing.fastTest` from `loom.team.json`, push, `gh pr merge --auto --squash`.
+  Conflicts get one agent attempt; hard-zone conflicts go to a human.
+- **Stacks** (opt-in, `delivery.stack: "auto"`): big goals become 2–4 PRs cut
+  along the integration branch's merge commits, landed bottom-up.
+- **Adopt:** a teammate takes a stuck goal whose owner is away, fixes it on the
+  owner's branch, and hands it back; the owner's daemon backs off meanwhile.
+- **Budgets:** per-goal cap (pauses the goal) and per-member daily cap (no new
+  goals); cost rollups per member/day, per goal and per landed PR.
+- **Doctor:** `loom team doctor` reports merge-queue traps and opens a PR adding
+  `merge_group:` to workflows. It never changes settings.
+- **Hosted hub:** `SupabaseHubClient` over RPC and Realtime, GitHub sign-in via
+  Supabase (loopback), `loom team signin` defaults to hosted; SQL `0005`
+  (`extend_lease`, `team_member_list`) and `0006` (landing feed events).
+
+### Loom Teams, Phase 3: one brain
+
+- **12 more design decisions** (D40–D51), settled in a design interview.
+- **Team memories:** durable memories from a shared project are published to the
+  hub sealed under the team key, with an HMAC of the normalized text. The hub
+  merges exact twins as confirmations without reading them (MemoryHub, `loom hub`
+  and SQL `0004_team_memories.sql`, tested on Postgres).
+- **Who can change what:** only a memory's author edits or forgets it; a teammate
+  records a correction that supersedes it. Resolving keeps the loser, linked to
+  the winner, which inherits its confirmations.
+- **Tiered briefings:** canon > confirmed by 2+ > your own > a teammate's
+  proposal, each line labelled. Failures and facts age out of briefings after ~90
+  days unless re-confirmed.
+- **Untrusted memories:** a turn that read the web, GitHub issue/PR text or a
+  fetched URL marks what it taught as untrusted. Untrusted memories stay personal
+  until you trust them.
+- **Canon in `AGENTS.md`:** a Loom-managed section with per-line markers; lines
+  added by hand count too. Promotion goes through one rolling `loom/canon` PR,
+  which also adds `@AGENTS.md` to `CLAUDE.md`. The native-memory import skips the
+  section, so canon never loops back in.
+- **Live team context** in worker and handoff briefings, up to 1.5k characters:
+  - teammates' leases on the same paths;
+  - open PRs that change them (PR feed events now carry changed paths);
+  - failing checks;
+  - predicted conflicts.
+- **Inbox:** contradictions, near-duplicates, corrections, untrusted memories and
+  promotion candidates. REST `/api/projects/:id/team/brain[/:action]` and
+  `loom team brain`.
+
+### Loom Teams, Phase 2: stop colliding
+
+- **12 more design decisions** (D28–D39), settled in a design interview.
+- **Leases:**
+  - scopes are expanded to real files plus directory prefixes, and hard zones come
+    from `loom.team.json`;
+  - hub claim, extend, renew, landing and release, with atomic hard-zone
+    arbitration, in both MemoryHub and SQL (tested on Postgres).
+- **Orchestra holds** stop a task from starting:
+  - **decide:** the task overlaps a teammate's lease and needs an `overlap`
+    decision;
+  - **wait:** it waits for another goal's PR to merge, then rebases onto main;
+  - **zone:** it queues behind a held hard zone;
+  - **capacity:** the team is at its agent limit;
+  - "Stop waiting" releases a wait by hand.
+- **Drift:** when a worker edits outside its declared touches, the lease widens and
+  the team is told. Drift into someone else's hard zone pauses the worker.
+- **WIP refs** (`refs/loom/wip/<member>/<run>`) plus `git merge-tree` predict
+  conflicts. Both owners and both orchestrators hear about them.
+- **Leases are released when the goal lands.** "Landing" means a merged PR, a
+  delivered push, or an applied run.
+- **Team policy enforced:** permission ceiling (`bypassRequiresPlan`), agent
+  allowlist, protected-branch delivery (forces a PR), and per-member and
+  team-wide concurrency caps.
+- **Fixes:**
+  - an orchestrator replying with no actions while nothing was running looped
+    until the round limit, and now waits for a human;
+  - an abort during a run's final wrap-up was overwritten by "completed";
+  - a member's own `gh` poll reporting their PR merged was ignored.
+
+### Loom Teams, Phase 1: see each other
+
+- **The design is settled:** 27 decisions from a design interview, recorded in
+  docs/teams-architecture.md §1a.
+- **Team crypto:**
+  - an XChaCha20-Poly1305 team key;
+  - an X25519 sealed box for key envelopes;
+  - Ed25519 signatures on everything a daemon publishes;
+  - the invite link carries the key in its `#fragment`.
+- **The hub:**
+  - the `HubClient` protocol, with `MemoryHub` as the reference rules;
+  - `loom hub`, a self-hosted hub over HTTP + WebSocket;
+  - the hosted hub's SQL (RLS plus rule functions), tested against a real Postgres.
+- **Team Link in the daemon:**
+  - sign-in, create, invite, join and leave;
+  - removal rotates the key forward;
+  - opt-in project sharing, with auto-match on the git remote;
+  - heartbeats carry intent only;
+  - a goal/plan/PR feed, with `gh` polling when there is no GitHub App.
+- **Worker commits carry `Loom-Goal`, `Loom-Task`, `Loom-Agent` and `Loom-Member`
+  trailers.**
+- **The orchestra protocol gains `touches`** (declared file globs per task).
+- **Fix:** a removed member's daemon now hears its own removal. It was cut off
+  before the announcement.
+
+### Permissions, plan mode, git delivery, fleet, prompts
+
+- **Permission modes per agent: bypass, auto, always ask.**
+  - Each is mapped onto each CLI's own flags, and every cell was verified against
+    the real CLI (`scripts/verify-permissions.mjs`).
+  - Always ask on Claude Code routes each tool use to a real approval in Loom,
+    through a built-in MCP permission-prompt server. Verified with the real CLI
+    (`scripts/verify-approvals.mjs`).
+  - Two cells measured broken are shown as unavailable instead of lying: OpenCode
+    "ask", and Antigravity "auto" (which writes to agy's scratch folder).
+- **Plan mode.**
+  - Chat turns write a markdown plan instead of code.
+  - Orchestras commit `plans/<run>/PLAN.md` plus a spec per task before workers
+    start, and write results back at the end.
+- **Git delivery policy: none, commit, push, or PR.** Covers chat turns and finished
+  orchestras. PR mode pushes the run's branch and opens a PR with `gh`.
+- **Fleet:** `GET /api/activity` and a Fleet view of every agent's thread, task and
+  last step.
+- **Prompt manager:** saved and pinned prompts, plus automatic sent-prompt history
+  (`/api/prompts`).
+- **Teams:** researched architecture in docs/teams-architecture.md.
+
+### Orchestra: one orchestrator, many parallel workers
+
+- **`loom orchestrate "<goal>"`**, plus Orchestrate mode in the app.
+  - Any agent can orchestrate: Claude Code, Codex, Antigravity, Grok or OpenCode.
+    It plans the goal into a task graph.
+  - Worker agents run every ready task at once, mixed kinds or several of the same
+    kind. Each task gets its own thread and git worktree.
+  - Finished work merges into `loom/orchestra/<run>/main`, and the orchestrator
+    reviews, follows up, or finishes.
+  - `orchestra:apply` merges the run into your branch. Nothing touches it before
+    that.
+  - Verified against the real CLIs:
+    - Claude orchestrating Codex and Antigravity (278 s);
+    - Codex orchestrating Grok, OpenCode and Claude Code (82 s, $0.31).
+    - Both delivered working code with passing tests
+      (`scripts/verify-orchestra.mjs`).
+  - Design credit: Agent Orchestrator (Apache-2.0). See THIRD_PARTY_NOTICES.md.
+
+### Loom Cloud: reach your agents from any network
+
+- A Supabase Realtime relay, end-to-end encrypted (XChaCha20-Poly1305). The key
+  exists only in the pairing QR's URL fragment, so Supabase relays ciphertext.
+- Relayed requests run against the daemon with the phone's own token. The admin
+  bootstrap is refused over the relay.
+- New commands: `loom cloud enable|disable|rotate`. Setup guide: docs/cloud.md.
+- Connection patterns credited to T3 Code (MIT).
+
+### Fixes found by running the real agents
+
+- A worker's `.loom/` state made `git add` fail whenever the project gitignored
+  `.loom/`. That failed every real Codex task.
+- A project reached through a symlink (every macOS temp dir) registered twice, so
+  two runtimes ran over one `.loom/`.
+- OpenCode's default model is refused headless ("Model is unavailable"). With no
+  model pinned, the adapter now picks one the server can actually run.
+- `test/git.test.ts` assumed the default branch is `main`; CI runners use `master`.
+
+
 ### Hardening (production-readiness pass)
 
 - **Closed a DNS-rebinding path to the admin token.** `GET /api/bootstrap` handed