@piagent/platform 1.41.0 → 1.42.0

package/CHANGELOG.md

@@ -1,2900 +1,1868 @@
 # Changelog
 
-This file records release-facing changes for Pi Agent Platform. Copy the relevant version block into GitHub Releases when publishing a tag.
+Every release of Pi Agent Platform (`@piagent/platform`), newest first. Versions follow semantic versioning; prereleases and builds that were tagged but never published are marked.
+
+This file is generated from `docs-site/releases.json` by `node scripts/build-docs-site.mjs`, which also renders the [Changelog page](https://piagent.io.vn/en/whats-new). Edit the JSON, not this file. When publishing a tag, copy the version's block into the GitHub Release.
+
+## v1.42.0 - 2026-10-25
+
+**A redesigned dashboard and older messages that load without jumping.** The dashboard gets one design scale and every theme everywhere; older messages load as you scroll up and the message you are reading stays put.
+
+### Added
+
+- Older messages load on their own as you near the top, and the message being read no longer moves when a page is added above it.
+
+### Improved
+
+- All 13 colour themes now reach the diff, approval, question and document views; header, sidebar, composer and new chat page are redesigned.
+- A running turn shows one moving indicator at a time: the step's spinner, the streaming caret, or a thinking spinner.
+- New website and README with an Update & uninstall guide; release notes now come from one file that also writes `CHANGELOG.md`.
+
+### Fixed
+
+- History showed raw markdown for a moment and then reflowed; it now appears formatted from the first frame.
+- Loading many older pages silently dropped the newest messages; the window now holds 1,000 items and offers a way back to the newest.
 
 ## v1.41.0 - 2026-10-24
 
-Front-end change reports: before/after screenshots with numbered red frames, business and logic changes and check results, shown in the dashboard.
+**Front-end change reports with before/after screenshots.** A new skill turns a front-end task into a report with framed before/after screenshots, business and logic changes and check results, shown in the dashboard.
 
 ### Added
 
-- **The `fe-change-report` skill.** For a front-end task that asks for a report, the agent captures both versions of the affected pages headless on the same data, frames each change with a numbered red box on both screenshots, runs the project's checks and full E2E headless (baseline failures named as such), and writes what changed for the business, in the logic, and on screen. Its scripts use the project's own Playwright and add no dependency: `capture.mjs` (desktop and phone sizes, masks for clocks and other content that changes on its own, login state, an 8 MB cap per screenshot), `diff-regions.mjs` (proposed frames from a pixel diff that skips masked areas, and a red changed-pixels image) and `build-report.mjs` (one self-contained `report.html` with no scripts, to send to anyone).
-- **Change reports in Documents.** The dashboard draws `reports/fe-change/<slug>/report.json` as the report: summary, business and logic tables, before/after screenshots with the same numbered frames, zoom per frame, other sizes, changed pixels, checks and changed files, with a full-screen view. It is drawn from data, never from the HTML file, so the WebUI still renders no model markup. Screenshots come through a new read, `GET /api/v1/documents/<ref>/assets/<name>` (`document-asset-v1`), which answers only `before-`/`after-`/`diff-*.png` in the `shots/` folder beside a listed `report.json`, refuses links and non-PNG files, and applies protected paths; it works for company conversations through the relay. The listing leaves that `shots/` folder out.
+- The `fe-change-report` skill captures old and new pages headless on the same data and frames each change with a numbered red box on both.
+- The agent runs the project's checks and full E2E headless, naming baseline failures, and writes what changed in business, logic and on screen.
+- Documents draws `reports/fe-change/<slug>/report.json` as the report, with zoom per frame, other screen sizes and a full-screen view.
+- The scripts use the project's own Playwright and add no dependency; they write one self-contained `report.html` with no scripts, to send to anyone.
+
+### Security
+
+- The report is drawn from data, never from the HTML file, and only its PNG screenshots are served, so the dashboard still renders no model markup.
 
 ## v1.40.0 - 2026-10-24
 
-Local projects without a remote are reported to Studio too, every run reports, and the member sees every kind of project warning.
+**Local projects are reported to Studio too.** Company conversations in folders without a remote report a local project to Studio, every run reports, and members see every kind of project warning.
 
 ### Added
 
-- **Local projects are reported too.** A company conversation in a folder without a readable remote now tells Studio about it as a local project (with `managed.workspace.v2`, Agent Studio 0.40.0): a git checkout by its root commit (`local/git/…`, the same on every computer with that history, including clones and checkouts with several remotes but no `origin`), a checkout without commits or any other folder by a hash of the computer's name and path (`local/dir/…`), each with its folder's name; a path never leaves the computer. A folder holding several checkouts reports each (up to six), and a folder with none reports itself.
+- A folder without a readable remote is reported as a local project, by its Git root commit or by a hash; its path never leaves the computer.
+- A Git project's local key is the same on every computer with that history, including clones and checkouts without an `origin` remote.
 
-### Changed
+### Improved
 
-- **Every run reports its projects**, not only the first one of a conversation, so Studio counts each use and knows which computers never report. A Studio without the route is asked once, not on every run.
-- **The member sees a line for every warning Studio returns**: another team's project, one outside the team's list, a project not registered to the team, or a folder Piagent could not read. A local project is named by its folder.
+- Every run reports its projects, not only a conversation's first, so Studio counts each use and knows which computers never report.
+- Members see a line for every warning: another team's project, one outside the team's list, an unregistered project or an unreadable folder.
+- A folder holding several checkouts reports each one, up to six, and a local project is named by its folder.
 
 ### Security
 
-- **Three undici advisories in the Pi host are accepted until 2026-11-07** (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472: denial of service and an integrity-check bypass Pi does not use; no data exposure). Every published Pi host (1.3.0, 1.4.0) pins undici 8.10.2 and is installed globally, so Piagent cannot update it; 8.12.2 fixes them. The runtime advisory check now carries a package flagged only through accepted advisories of its dependencies (the Pi host here) and still blocks it otherwise.
+- Three dependency advisories in the Pi host are accepted until 2026-11-07: denial of service and a check bypass Pi does not use, no data exposure.
+
+Requires: Agent Studio 0.40.0.
 
 ## v1.39.0 - 2026-10-23
 
-Studio learns when a team key works in a repository outside its team, and the dashboard keeps its language and theme across restarts.
+**Warnings when a team key is used outside its team.** Studio learns which repositories a company conversation works in and warns when a team key is used outside its team; the dashboard keeps its language and theme.
 
 ### Added
 
-- **Studio is told when a team key works in a repository outside its team.** At the first model request of a company conversation, Piagent sends Studio the conversation's repositories (`POST /studio/v1/managed/workspace` with the run's token, the same `host/path` keys team memory already sends; a folder without one sends why), only to a Studio that serves it (`managed.workspace.v1`, Agent Studio 0.39.0). Studio's administrators see the warnings in Logs → "Sai project". When Studio says a repository belongs to another team or is outside the team's repository list, the member reads one line above the composer and in `piagent studio`; nothing is blocked, and memory works as before.
+- Company conversations tell Studio their repositories, using the same `host/path` keys team memory already sends.
+- Administrators see the warnings in Logs → "Sai project"; the member reads one line above the composer and in `piagent studio`.
 
-### Fixes
+### Improved
 
-- **The dashboard keeps its language and colour theme across restarts.** The browser stored them per address, and the dashboard's port changes each time it starts, so every restart went back to the defaults. The Gateway now keeps them (`piagent-gateway/ui-preferences.json`, owner-only) behind the browser session and its CSRF token, and applies them once the page is signed in.
+- Nothing is blocked, and team memory works as before.
+
+### Fixed
+
+- The dashboard went back to the default language and colour theme on every restart; it now keeps both.
+
+Requires: Agent Studio 0.39.0.
 
 ## v1.38.2 - 2026-10-23
 
-A folder tree as in VS Code, colour themes, and an editor and terminal that stay in view.
+**Folder tree, colour themes and an editor that stays in view.** The files panel becomes a folder tree, 13 colour themes arrive, and the editor and terminal stay pinned while the conversation scrolls.
 
 ### Added
 
-- **Colour themes.** Settings → Appearance → Color theme, or `Color theme: …` in the command palette (⌘K): Piagent Dark and Light, Dracula, One Dark, Monokai, Nord, Tokyo Night, Catppuccin Mocha, Gruvbox Dark, Solarized Dark and Light, GitHub Dark and Light. A theme colours the interface, the editor's syntax (no longer CodeMirror's light default on a dark page) and the terminal's ANSI palette; Light/Dark switches to that mode's Piagent theme. Kept in this browser like the language.
+- Colour themes in Settings → Appearance or the command palette (⌘K) colour the interface, the editor's syntax and the terminal.
 
-### Changed
+### Improved
 
-- **The editor and terminal stay in view.** On wide screens they are pinned under the header while the conversation beside them scrolls, so a long conversation no longer carries them away; the Files/Terminal switches are pinned too, on every width. A splitter (drag, or ←/→ when focused) sets the editor's width, kept in this browser. On phones the folder tree is narrower and the editor's actions stay on one line.
-- **The files panel is a folder tree, as in VS Code.** Folders open in place under their parent (▸/▾) instead of replacing the list, each read when first opened and refreshed while open; the open file is highlighted and a file opened from search, a link or Cmd/Ctrl+P shows in its folder. **New file** starts in the last folder chosen.
+- On wide screens the editor and terminal stay pinned under the header while the conversation scrolls; a splitter sets the editor's width.
+- The files panel is a folder tree: folders open in place, the open file is highlighted, and New file starts in the last folder chosen.
+- The Files/Terminal switches stay pinned on every width; on phones the folder tree is narrower and the editor's actions fit on one line.
 
 ## v1.38.1 - 2026-10-23
 
-v1.38.0 was tagged but never published: its release checks failed on two tests. This is the same release.
+**Published release of v1.38.0.** v1.38.0 failed its release checks on two tests and was never published; v1.38.1 is the same release with those tests fixed.
 
-### Tests
+### Improved
 
-- `tests/managed-terminal-boundary.test.mjs`: the Linux fixture says it is a Linux boundary, as the real one does (the macOS Seatbelt path was taken on Linux and failed).
-- `tests/managed-network-approval-web.test.mjs`: the approval card gets 30 s to appear on slow runners.
+- Two release tests now pass on Linux and on slow runners, so the editor, terminals, review, checkpoints and Bypass of v1.38.0 ship here.
 
 ## v1.38.0 - 2026-10-23 (not published)
 
-Piagent becomes an editor: files, terminals, inline review and checkpoints in the dashboard, and Bypass that asks nothing (company conversations too, where the Harness allows it).
+**Piagent becomes an editor, and Bypass asks nothing.** Files, terminals, inline review and checkpoints in the dashboard, and a Bypass mode that asks nothing, in company conversations where the Harness allows it.
 
-### Added
+### Breaking changes
 
-- **Bypass, as in Codex.** A new `bypass` permission mode (`/permission bypass`, `piagent-auto --bypass`, `PIAGENT_PERMISSION_PROFILE=bypass`, or **Bypass** in the dashboard's access menu) turns every Piagent gate off in a personal session: nothing is asked or blocked, deletes, pushes, migrations, external sends and protected or read-only paths included. Tool output is still redacted and each turn still gets its `/undo` checkpoint. A policy can forbid it by leaving `bypass` out of `permissionProfiles.allowedModes`. **Full access** (`trusted-full-access`) is unchanged.
-- **Bypass in company conversations, where the Harness allows it.** A company conversation now has three levels: Ask first, **Full access** (what the dashboard called Bypass before: asks only what must be confirmed) and **Bypass**, which asks nothing (internet, Docker, the member's machine, pushes, deploys, migrations) while plain commands stay in the sandbox. Bypass needs the Harness's `bypass_mode` (Agent Studio, on by default; an administrator can turn it off) carried by an Agent Watch that knows the field; without an explicit yes it is not offered, and a conversation left in Bypass after it is turned off applies as Full access. `/bypass on|full|off` in the dashboard and in `piagent studio`.
-- **Editor-like workspace.** Square 2px edges across the dashboard; file and terminal tabs close with their own ×; the files and terminal panels hide with a × of their own; the editor sits above the terminal and both share the window height.
-
-### Fixes
-
-- **A checkpoint that cannot be taken no longer stops the agent's edit.** Personal snapshots failed on a submodule, a file over 16 MB, a tree over 64 MB or a file changing mid-snapshot, and every write was then refused. Snapshots now hash the whole tree in one Git call (about 0.5 s instead of 35 s on a 4,000-file repository), include tracked files of any size, skip untracked files over 100 MB and leave submodules out. A turn whose snapshot fails has no checkpoint and ends the history before it; only another live owner of the session's history makes an edit wait. Company checkpoints get the same snapshot.
-- **Restoring a turn no longer overwrites a file the member saved from the editor during it.** Such files are reported as conflicts by `/undo` and Timeline restore.
-- **Checkpoint snapshots stay out of the project's refs.** They live in a private repository inside the Git directory that borrows the project's objects, so `git push --mirror` cannot publish untracked files; conversations untouched for 30 days lose their checkpoints.
-- **The company explorer, editor and review panels no longer wait behind the agent's running command.** Reads run beside it (three at a time) and the editor's permission poll no longer stacks requests.
-- **A flood of terminal output no longer drops the dashboard connection.** Output is paced at about 4 MB/s, the writer is paused while the browser catches up, output it cannot keep up with is marked as skipped, and a terminal tab never stops rendering for good. Company terminal workers pause instead of exiting when their pipe backs up. A flood of short lines no longer stalls the Gateway: tiny PTY reads are joined before pacing and the replay buffer trims its window once it doubles instead of on every line.
-- Restored files the turn had deleted get a new file's usual mode instead of owner-only.
-- **Company terminals work on macOS.** The company Gateway creates the PTY and starts only the shell under the agent's offline Seatbelt profile, which gains terminal ioctls and `/dev/tty`; opening any other terminal stays denied, and nothing runs on the host. Company terminals also write the project's Git directories and package caches like the agent's offline commands, so `go build` and `git` in a worktree work.
-- **Terminals:** background jobs stop with their terminal (the shell's tree is watched while it runs); actions refused before anything ran are reported as refused, not "may have run"; a stale revision is resent instead of dropping queued keystrokes; `@terminal` naming no open terminal attaches nothing instead of blocking the message; the personal shell no longer inherits the Gateway's `PI_*`/`PIAGENT_*` variables.
-- **Editor:** **Rename** and **Delete** for the open file, applied only to the version shown; new files get the usual mode and their missing folders; creating a file never replaces one that appeared meanwhile; refusals that changed nothing (oversized file, linked folder) are reported as such. Kept hunks survive a page reload in the same browser.
-- **Checkpoints:** a restore that stopped midway finishes what is left instead of refusing its own work; a refusal before any file changed is reported as refused; a file ignored since the turn is refused rather than overwritten; folders the turn created and its undo emptied are removed; any shell command not provably read-only takes the turn's checkpoint; a lock or capture left by a process from before a reboot, or whose number was reused, no longer blocks.
-
-- Company inline review preserves exact agent observations across trusted internal snapshot reads; ordinary shell commands still invalidate attribution.
+- Company conversations have Ask first, Full access (formerly called Bypass) and Bypass, offered only when the Harness allows it.
 
 ### Added
 
-- Timeline checkpoint restoration previews affected files, requires confirmation and reverses safe turns until a member-edit conflict. Personal `/undo` shares the checkpoint service with company mode; personal history is bounded and pins Git trees without changing HEAD or the index. Browser retries retain the same request across tab reloads.
+- The `bypass` mode (`/permission bypass`, `piagent-auto --bypass`) turns every gate off; output is still redacted and `/undo` still works.
+- The dashboard opens, edits, saves, renames and deletes project files, with Cmd/Ctrl+P, search and conflicts when a file changed on disk.
+- Project terminals in the dashboard; company terminals run in the sandbox, on macOS too, and never on the host.
+- Inline review of the agent's hunks with Keep and Revert, and Timeline restore with a preview, sharing checkpoints with `/undo`.
 
-- Company Session Hub terminals run inside the Linux/WSL bubblewrap boundary through the company Gateway and authenticated relay, with no network, credential masking and sandbox process cleanup. Disconnects reconnect for replay without automatically resending commands. Doctor reports prerequisites. The complete browser workflow is qualified on Linux arm64; native Linux x64 and WSL remain unverified.
-
-- Personal Session Hub terminals open up to four project shells with lazy xterm tabs, resizing, Ctrl+C and reconnect replay. Session teardown cleans terminal processes. Explicit `@terminal`/`@terminal:2` sends attach bounded redacted output. Optional native PTY failures leave the dashboard usable and appear in Doctor; company terminals never fall back to host execution.
+### Fixed
 
-- Session Hub reviews exact observed agent hunks inline, with Keep, preview-confirmed Revert, hunk navigation/counts and current/removed-line comments to the composer. Clean tabs refresh after agent changes; dirty drafts retain conflict handling. Company source review and revert run in the existing sandbox. New untracked agent files support review; deletion through hunk revert remains unavailable.
+- A checkpoint that could not be taken blocked every edit; it no longer does, and snapshots take about 0.5 s instead of 35 s on 4,000 files.
 
-- Session Hub edits and atomically saves files with Cmd/Ctrl+S, dirty tabs, new files and digest conflicts (Reload/Compare/confirmed Overwrite). Live permission and protected-path checks apply in personal and company mode. Durable receipts prevent duplicate saves; member edits notify the next agent turn and invalidate stale agent edits.
-- Session Hub opens project files in read-only editor tabs, with Files/Search navigation, Cmd/Ctrl+P, line links from tool calls, source changes and @mentions, and a drawer on smaller screens. Protected files stay locked. Company file reads and searches run inside the session's existing sandbox through its Gateway.
+Requires: Agent Studio 0.38.0 and Agent Watch 0.15.14 (Windows 0.1.17) for the company Bypass level.
 
 ## v1.37.1 - 2026-10-22
 
-Closes, helper reports and team-memory lessons Studio can trust (from the 2026-10-22 upstream audit), and two outbound-address fixes from the 2026-10-22 security review.
+**Run closes and helper reports Studio can trust.** A retried close counts only when it reaches Studio, helpers keep their answers, and outbound requests refuse every IPv6 form of a private address.
 
-### Security
-
-- **`web_fetch` and the package proxy refuse every IPv6 form of a private address.** Both checked IPv4 carried in IPv6 only when it was written dotted, so `https://[::ffff:7f00:1]/` (127.0.0.1) or a NAT64 `64:ff9b::c0a8:101` (192.168.1.1) passed and was dialled; the URL parser even rewrites `[::ffff:127.0.0.1]` to the hex form. One classifier (`managed/ip-policy.mjs`) now judges mapped, compatible, translated, NAT64 and 6to4 addresses by their IPv4, treats Teredo and IPv6 outside `2000::/3` as private, and fails closed on anything it cannot parse. HTTPS certificate checks are unchanged.
-- **With a company upstream proxy (`HTTPS_PROXY`), the package proxy still refuses private destinations.** It handed the host name to the upstream, which resolved it itself, so no address was checked. The name is now looked up and checked here in every mode, and the upstream is asked for the checked address (`CONNECT <ip>:<port>`, or the IP with the original `Host` for plain HTTP); TLS still names the registry end to end. A name this machine cannot resolve is refused like any other refused host; `run_with_network` still reaches it after the member approves.
+### Fixed
 
-### Fixes
+- A close retried after a brief failure could be recorded without reaching Studio; it now counts only when Studio receives it.
+- A helper whose close failed for a moment was turned into a failure; it now keeps its answer, and its report is resent after passing errors.
+- Team memory merged failures of two commands of one executable into one lesson; the whole command is now the key.
+- Skill feedback mixed skills with alike names such as `a/b` and `a_b`; each skill name now keeps its own file.
 
-- **A run's close asked again is recorded closed only when it reached Studio.** After a close failed for a moment, Agent Watch dropped the run, so the close asked again "succeeded" without reaching Studio: Piagent recorded the run closed while Studio kept it active until its lease lapsed and lost the process report. Agent Watch 0.15.11 (Windows 0.1.16) sends it again and says so (`close-retry`); with an older Agent Watch the run now stays "active" here and reopening the conversation recovers or abandons it.
-- **A helper whose close fails for a moment keeps its answer.** A helper role's close goes through the same wait for Studio as the run's; a close that still fails no longer turns a finished helper into a failure, and the role's next helper closes it first. A helper's report to Studio is sent again after a passing failure (no answer, 5xx, 429), never after a refusal.
-- **A repeated tool-error lesson names the right command.** Lessons were keyed on the executable, so `curl service-a` and `curl service-b` failing the same way became one lesson saying the first "failed twice". The whole command (without temporary paths, ids and numbers) is the key now.
-- Skill feedback keeps one file per skill name (`a/b`, `a_b` and `A_B` shared one); notes served under an old key or epoch are forgotten when the scope changes.
+### Security
 
-### Tests
+- The `web_fetch` tool and the package proxy let some IPv6 forms of a private address through; every such form is now refused.
+- With a company upstream proxy (`HTTPS_PROXY`), the package proxy now checks each destination itself instead of leaving it to the upstream.
 
-- `tests/managed-failures.test.mjs`: a close asked again of an Agent Watch with and without `close-retry`.
-- `tests/managed-helper-settlement.test.mjs`: a settlement sent again after a 5xx only; a helper role close asked again and never failing the helper.
-- `tests/managed-memory-lessons.test.mjs`, `tests/managed-skill-feedback.test.mjs`, `tests/managed-memory-outbox.test.mjs`: two commands of one executable, alike skill names, a scope change.
-- `tests/managed-ip-policy.test.mjs`, `tests/managed-coding-tools.test.mjs`, `tests/managed-package-proxy.test.mjs`: hex/dotted mapped, NAT64, 6to4 and Teredo addresses refused; the upstream proxy is asked for the checked address only.
+Requires: Agent Watch 0.15.11 (Windows 0.1.16).
 
 ## v1.37.0 - 2026-10-22
 
-A cut answer no longer stops a long task, and the company Terminal can be driven by a script.
-
-### Fixes
-
-- **An answer Studio's upstream cut mid-stream is asked again.** Found on 2026-10-21 in the long-task soak: Studio's error event for a cut answer ("Request interrupted", code `upstream_interrupted`) reached Piagent without its code, which the provider libraries drop, so it showed "the request could not be sent" and stopped a long task. Studio's own words now name it `upstream_interrupted`: it is asked again and the task goes on by itself. "The answer ran past its output limit" names `output_limit_exceeded`. "Request ended by Studio" is still not asked again.
-- The company Terminal no longer exits with an error when a conversation closes right after a turn while git still answers for the branch status.
+**A cut answer no longer stops a long task.** An answer cut mid-stream behind Studio is asked again and the task goes on, and `piagent studio --rpc` lets a script drive a company conversation.
 
 ### Added
 
-- **`piagent studio --rpc`**: one company conversation over Pi's RPC protocol on stdin/stdout. Several messages in one conversation; `ask_user` arrives as an extension UI select the client answers.
-- **Long-task soak lane** (`evals/long-task-soak-v1`, repository only): a simulated member drives the real company agent through 45–150-minute multi-phase tasks in real repositories (Node, Python, Go in Docker, PostgreSQL, Playwright, a polyglot monorepo) on the Terminal or the WebUI Gateway. It answers only the business decisions it owns, changes a rule mid-task, presses Stop, restarts the Gateway and nudges when the agent stops early; hidden acceptance checks decide whether the work is done.
+- New `piagent studio --rpc` runs one company conversation over Pi's RPC protocol on stdin/stdout, with several messages and `ask_user`.
+- A long-task soak lane in the repository drives the real company agent through 45–150-minute tasks with a simulated member.
 
-### Tests
+### Fixed
 
-- `tests/managed-studio-rpc.test.mjs`: two messages in one conversation, `ask_user` answered through the client, a clean exit.
-- `tests/managed-failures.test.mjs`, `tests/managed-provider-retry.test.mjs`: Studio's words for a cut answer and an over-long answer, asked again; "Request ended by Studio" is not.
-- `tests/long-task-soak.test.mjs`: the simulated member's reading of a turn end, its answers, nudges, phases and stalls.
+- An answer cut mid-stream showed "the request could not be sent" and stopped a long task; it is now asked again and the task goes on.
+- The company Terminal no longer exits with an error when a conversation closes right after a turn while Git still reports branch status.
 
 ## v1.36.1 - 2026-10-22
 
-Agent Watch failing to reach a running Studio for a moment no longer stops a task.
+**A brief Agent Watch failure no longer stops a task.** When Agent Watch briefly cannot reach a running Studio, Piagent asks again for up to 3 minutes instead of stopping the task.
 
-### Fixes
+### Improved
 
-- **A broker failure while Studio answers is asked again.** Found on 2026-10-22: after a long command, renewing the run's grant through Agent Watch failed once with `managed-broker:serverUnavailable` (Agent Watch's way to Studio answered a 5xx; Studio never saw the call). Studio's heartbeat said ready, so the failure was not waited out and a 25-minute task with 2 of 4 steps open stopped at once. Now a `managed-broker` failure on a Studio that answers is asked again, pausing longer each time (2 s doubling), until it has failed for 3 minutes without a request going through; then it fails as before.
-- **Closing the round's run goes through the same wait**, so a passing gateway error does not fail a turn whose work is done.
-- Each wait is in `studio-link.jsonl` and reported to Studio (Logs → "Mất kết nối", cause `broker_offline`). Codes that are not Agent Watch's (a refused key or report, `connector_unavailable` on a running Studio) still fail at once.
+- Each wait is logged locally and reported to Studio in Logs → "Mất kết nối"; a refused key or report still fails at once.
 
-### Tests
+### Fixed
 
-- `tests/managed-failures.test.mjs`: a renew and a close Agent Watch could not send once are asked again and the turn ends well (both fail on 1.36.0).
-- `tests/managed-studio-link.test.mjs`: the retry window, its reset when a request goes through, and codes that still fail at once.
+- One failed grant renewal through Agent Watch stopped a 25-minute task; it is now asked again, waiting longer each time, for up to 3 minutes.
+- Closing the round's run goes through the same wait, so a passing gateway error no longer fails a turn whose work is done.
 
 ## v1.36.0 - 2026-10-21
 
-Team memory learns from what went wrong (needs Agent Studio with the memory feedback loop, protocol 4).
+**Team memory learns from what went wrong.** Memory learns from member feedback and repeated errors, keeps only completed tasks that add something, and proposes failing skills for review.
 
-### Features
+### Added
+
+- What memory hands a round goes back to Studio with it, so Studio rates notes by the member's next words and stops briefing wrong ones.
+- A command that fails the same way twice in a round becomes a lesson that keeps the first error line, with no guessed cause.
+- When 3 of a skill's last rounds failed, Piagent writes a proposal to `.pi/piagent-state/skill-proposals/`, at most weekly; it never edits skills.
 
-- **What memory handed a round goes back with it.** Briefs and `memory_search` answers name what they handed over (`serve_id`). The round that used them sends the ids back with its retain (`serves`), and only to a Studio that speaks protocol 4. Studio then rates those notes by the member's next words, and stops briefing notes members said were wrong.
-- **A command that fails the same way twice in a round is a lesson.** This goes beside check recoveries (`managed/memory-lessons.mjs`). The lesson keeps the first error line, sanitized (temporary paths, ids and numbers taken out of the fingerprint), with no guessed cause.
-- **Repository memory keeps only completed tasks that add something.** Changes only to build output, caches, logs or Piagent's own state are `not_durable`. The same files at the same digests a second time are `already_known` (`completedTaskSkipReason`).
-- **Skills that keep failing are proposed for review.** When at least 3 of a skill's last rounds ended with a failed check or a repeated tool error, Piagent writes `.pi/piagent-state/skill-proposals/<skill>.md` with the evidence, at most once a week. Piagent never edits a skill itself.
+### Improved
 
-### Tests
+- Repository memory skips completed tasks that change only build output, caches, logs or Piagent's state, or repeat files already known.
 
-- `tests/managed-team-memory.test.mjs`: protocol 4 sends the brief's and the search's serves with the round that used them, and protocol 3 sends none.
-- `tests/managed-memory-lessons.test.mjs`: repeated tool errors give one lesson; different errors, successes and timeouts give none.
-- `tests/repository-memory-distill.test.mjs`, `tests/managed-skill-feedback.test.mjs`.
+Requires: Agent Studio 0.37.0.
 
 ## v1.35.1 - 2026-10-21
 
-A passing failure of the model provider no longer stops a long task.
+**A passing model provider failure no longer stops a long task.** A provider error in the middle of an answer is asked again, and a round cut by such a failure goes on by itself after a pause.
 
-### Fixes
+### Improved
 
-- **The provider's own error event in the middle of an answer is asked again.** Found on 2026-10-21: gpt-6-sol sent `api_error` after a tool step, Studio passed it on as it should, and Piagent did not recognise it, so nothing asked again and a long task stopped until the member wrote 8 minutes later. Pi's words for such an event (OpenAI `server_error` / `api_error`, Anthropic `api_error` / `overloaded_error`) are now the code `upstream_server_error`, asked again by the turn's retry (2 and 4 s later).
-- **A round cut by a passing provider failure goes on by itself.** Where the turn's retry does not run (the WebUI does not replay a round once a tool ran) or does not get through, the next round starts after a pause and tells the agent why: for `upstream_server_error`, `upstream_interrupted`, `upstream_incomplete`, `upstream_timeout`, `upstream_unavailable`, `connector_execution_failed` and `output_limit_exceeded`, at most 8 times per member message, 15 s doubling to 5 min (about 23 min in all); a round that ends well resets the count; Stop ends the pause. After the last one the turn fails with the reason, as before.
-- **Every ask again is in the member's local log.** `studio-link.jsonl` now also has `turn_retry` and `provider_retry` lines (and `outcome: "gave_up"`), so why a task stopped or went on can be read back.
+- Where that retry cannot run, the next round starts after a pause and tells the agent why, up to 8 times per member message (about 23 min).
+- A round that ends well resets the count, Stop ends the pause, and after the last attempt the turn fails with its reason.
+- Every retry is recorded in the member's local log, so why a task stopped or went on can be read back.
 
-### Tests
+### Fixed
 
-- `tests/managed-provider-retry.test.mjs`: the provider's words become `upstream_server_error` (Studio's own codes keep theirs), a round that goes on and resets the count, the bounded number of asks, Stop while waiting.
-- `tests/managed-provider-error-resume.test.mjs`: WebUI end to end, the provider's `api_error` event after a tool step; the task finishes without a click and the retry is in the local log.
+- A provider error after a tool step stopped a long task until the member wrote again; it is now asked again 2 and 4 s later.
 
 ## v1.35.0 - 2026-10-21
 
-Long company tasks go on across Studio updates.
+**Long company tasks go on across Studio updates.** When Studio stops, restarts or updates mid-task, Piagent waits for it and goes on instead of failing, and a dashboard turn can run for 24 hours.
 
-### Features
-
-- **Waits for Studio instead of failing.** When a company request cannot reach Studio for a reason that is Studio's or the way to it (Studio stopped, restarting or being updated; a Cloudflare or LAN-edge page instead of Studio's answer, now its own code `studio-gateway-unavailable`; Agent Watch losing Studio during an update), Piagent reads Studio's heartbeat (`GET /v1/heartbeat`, Studio 0.36.0) and asks again once Studio is back, with no limit on how long; Stop ends the wait. A request cut before the model answered is asked again as it was; an answer cut mid-stream is asked again by the turn's retry without its two-try limit; where the WebUI ends that retry (a tool already ran), the next round starts by itself and tells the agent why ("Studio was updated (0.35.3 → 0.36.0) … continue from where you were"). A key, quota or policy failure fails at once as before; Agent Watch or Studio's connector failing while Studio answers here (and was not away in the last 10 minutes) fails at once too, after the usual two asks.
-- **Every wait is logged and reported.** One JSON line per event in `<agentDir>/logs/studio-link.jsonl` (`kind` `studio_wait` / `studio_disconnect`, `cause`, `outcome`, versions, attempts), filterable with `jq`; reported to Studio (`POST /studio/v1/managed/disconnects`), which decides the cause from its own starts and lists it in Logs → "Mất kết nối". A Studio without the route (older than 0.36.0) is not asked again; a Studio without the heartbeat counts as up.
-- **24-hour turns in the WebUI.** The watchdog's ceiling for one member message is 24 hours (it was 6), so a checklist left running overnight is not cut; the 15-minute silence limit stays and each heartbeat read while waiting counts as activity.
+### Added
 
-### Tests
+- When Studio is away, Piagent reads its heartbeat and asks again once it is back, with no time limit; Stop ends the wait.
+- Every wait is logged locally and reported to Studio, which lists it with its cause in Logs → "Mất kết nối".
 
-- `tests/managed-studio-link.test.mjs`: classification, waits, Stop, reports, the unlimited turn retry, a round that resumes, and Agent Watch or Studio's connector failing on a running Studio.
-- `tests/managed-studio-update-resume.test.mjs`: WebUI end to end, a request cut by a Studio update, Studio away for 5 s and back as a new version; the task finishes without a click, the report says `studio_update`, the local log has the wait.
-- Live check on the Mac mini: an 8-step task through Cloudflare while Studio was upgraded from 0.35.3 to 0.36.0; Agent Watch could not renew the grant for 14.7 s, Piagent waited and went on, all 8 steps finished, and Studio recorded the stretch as `studio_update`.
+### Improved
 
-## v1.34.3 - 2026-10-20
+- A round the dashboard cannot replay starts again by itself and tells the agent Studio was updated, so it continues where it was.
+- One member message can run for 24 hours in the dashboard (it was 6); the 15-minute silence limit stays.
+- A key, quota or policy failure still fails at once, as before.
 
-Agent Watch notifies for company conversations.
+Requires: Agent Studio 0.36.0.
 
-### Fixes
+## v1.34.3 - 2026-10-20
 
-- **Company conversation states reach Agent Watch.** The company Gateway wrote each conversation's state under its private session folder, while Agent Watch reads the member's `~/.pi/agent/status`; company conversations never notified. They are now written to `~/.pi/agent/status/company`. Found in the live check: the state went from waiting for an answer to done, in the wrong folder.
+**Agent Watch notifies for company conversations.** Company conversation states were written where Agent Watch does not read, so it never notified; they are now written where it reads.
 
-### Tests
+### Fixed
 
-- `tests/managed-crash-continue.test.mjs` checks the company Gateway writes the conversation's state, without its prompt or answer, under the member's `~/.pi/agent/status/company`.
+- Agent Watch never notified for company conversations; their states now go to `~/.pi/agent/status/company`, without prompts or answers.
 
 ## v1.34.2 - 2026-10-20
 
-Helper outcomes reach Studio.
-
-### Fixes
+**Helper outcomes reach Studio.** In 1.34.1 Studio refused helper reports sent with an outdated token, so no outcome was recorded; reports now go with the current token.
 
-- **Helper settlements are recorded.** A helper sent its report with the first token of its attempt, which Studio had already replaced at a renewal, so Studio refused it (401) and no outcome was recorded in 1.34.1. The report now goes with the role's current token, taken the same way the helper's own requests take theirs. Found in the live check on Agent Studio 0.35.0.
-
-### Tests
+### Fixed
 
-- `tests/managed-delegation-cli.test.mjs` gives each renewal a new token and checks each report goes with a token newer than any the helper's requests used; `tests/managed-helper-settlement.test.mjs` covers the lease.
+- Helper reports were refused after a token renewal and no outcome was recorded; they now use the helper role's current token.
 
 ## v1.34.1 - 2026-10-20
 
-Piagent asks Studio what it serves, helpers report how their work ended, and Agent Watch learns when a conversation needs you (Agent Studio 0.34, Agent Watch 0.15.9 / Windows 0.1.15).
+**Helper outcomes, line review and Agent Watch notifications.** Helpers report how their work ended, line comments on a diff go to the agent, and Agent Watch notifies when a conversation needs you.
+
+### Added
 
-### Changes
+- Each helper reports how it ended: succeeded, failed, cancelled or unverifiable; Studio shows it in Logs → Lượt agent.
+- In Source Changes, click a line number to comment; comments on several files go to the composer as one message with `file:line`.
+- The review helper's findings show under the line they name, and findings without a line under their file.
+- Conversation states are written for Agent Watch notifications, holding only the title and project name, never prompts or answers.
+- The `delegate` tool takes optional target, change, constraints, ownership and acceptance fields, which head the helper's brief.
 
-- v1.34.0 was tagged but never published: its lockfile named a lightningcss version that does not exist. v1.34.1 is the same release with the lockfile fixed.
-- **Studio capabilities.** Piagent asks `GET /v1/capabilities` (Agent Studio 0.34+) once an hour per Studio and key, and keeps the answer in `~/.pi/agent/studio-capabilities.json`. A newer operation is used only when Studio lists it; an older Studio (404) keeps today's behaviour. `memory_ask` is offered unless the list leaves `memory.ask.v1` out.
-- **Structured delegation.** `delegate` takes five optional fields beside the brief: target, change, constraints, ownership and acceptance. They head the helper's brief.
-- **Helper settlements.** Each helper attempt reports once, with its own run token, how it ended: succeeded (answered in the form its role needs), failed, cancelled, or unverifiable (no verdicts or findings, or a stale review). The main agent reads `Outcome: …` first; the receipt line says done, failed, stopped or unverifiable. Studio shows each attempt's ending in Logs → Lượt agent and reads an attempt without a report as unverifiable.
-- **Review on the diff.** In Agent Inspector → Source Changes, click a line number to comment that line. Comments on any number of files go into the conversation's composer as one message with a `file:line` anchor and the code of each line; a comment whose line has changed since is marked. The review helper's findings (blocking, major, minor) show under the line they name, and findings without a line under the file.
-- **Conversation states for Agent Watch.** The dashboard and the company runtime write each conversation's state (working, waiting for an approval or an answer, done, stopped, failed) under `~/.pi/agent/status/`. A file holds the conversation's title and project name, never its preview, prompt or answer. Agent Watch 0.15.9 (macOS) and 0.1.15 (Windows) turn it into notifications.
+### Improved
 
-### Tests
+- Piagent asks Studio hourly which operations it serves and uses newer ones only when listed; an older Studio keeps today's behaviour.
 
-- `tests/managed-studio-capabilities.test.mjs`, `tests/managed-helper-settlement.test.mjs`, `tests/piagent-webui-agent-status-files.test.mjs`, `tests/piagent-webui-line-review.test.mjs`; `tests/piagent-webui-session-hub.e2e.mjs` comments two files and sends them; `tests/managed-delegation-cli.test.mjs` checks both helpers' settlements through the production CLI.
+Requires: Agent Studio 0.34, Agent Watch 0.15.9 (Windows 0.1.15).
 
 ## v1.33.0 - 2026-10-20
 
-Company and personal sessions run on Pi 1.3.0 (from 0.87.1).
+**Company and personal sessions run on Pi 1.3.0.** `piagent-setup` and `piagent-update` move Piagent from Pi 0.87.1 to Pi 1.3.0, which refuses malformed tool calls and retries gateway errors.
 
-### Changes
+### Breaking changes
 
-- **Pi host 1.3.0.** `piagent-setup` and `piagent-update` install Pi Coding Agent 1.3.0. What it brings to Piagent: a tool call whose arguments are malformed JSON is refused and shown to the model instead of running with the fields parsed before the error; gateway errors such as "Unable to forward upstream stream" are retried; internal Pi packages are pinned to exact versions; a resumed session keeps its active tools; switching model drops the previous model's thinking; the terminal reports its state with OSC 7501 (working, waiting for a dialog or sign-in, done, error).
-- Your personal `pi` command is also 1.3.0 after the update. Pi 1.2.0 changed theme `$schema` references and `models.json` overrides of the `kimi-coding` base URL must end in `/v1`.
-- After the update, Agent Watch writes a new binding by itself while it runs; `piagent studio` waits for it.
-- GPT-6.1 Sol keeps its reviewed 272k window in company sessions (Pi 1.3.0's catalog says 500k, which Codex prices at twice the rate above 272k).
-- The three `brace-expansion` advisories accepted until 2026-10-31 are gone: Pi 1.3.0 installs `brace-expansion` 5.0.12.
+- Your personal `pi` also becomes 1.3.0: theme `$schema` references changed, and `kimi-coding` base URL overrides must end in `/v1`.
 
-### Fixes
+### Improved
 
-- Pi 1.2+ calls `before_agent_start` also for a run that a custom message starts (no prompt). Piagent's personal runtime now gives such a run the same system prompt and starts no turn, task or context pack for it.
+- A tool call with malformed JSON arguments is refused and shown to the model instead of running with the fields parsed before the error.
+- Gateway errors are retried, a resumed session keeps its active tools, and switching model drops the previous model's thinking.
+- GPT-6.1 Sol keeps its reviewed 272k window in company sessions, where use above 272k is priced at twice the rate.
 
-### Tests
+### Fixed
 
-- `tests/runtime-session-modules.test.mjs`: a custom-message run records no turn, opens no index and creates no task (fails without the fix).
-- `tests/managed-failures.test.mjs`: Sol keeps 272k on a host whose catalog says 500k.
-- `tests/runtime-advisories.test.mjs` checks the exception rules on a fixture list.
+- A run started by a custom message now gets the usual system prompt and starts no extra turn, task or context pack.
 
-## v1.32.1 - 2026-10-19
+### Security
 
-Bypass is kept after a reload, and a tab in use stays signed in.
+- Three accepted dependency advisories are resolved: Pi 1.3.0 installs the fixed version.
 
-### Fixes
+Requires: Pi 1.3.0.
 
-- Turning on Bypass (or Fast) right after a reply was refused by the Gateway as `session-revision-stale`: the turn had changed the conversation once more as it ended, so nothing changed and a reload showed "Hỏi trước". Access and Fast are now sent again against the latest revision, like a rename.
-- Opening another conversation that was also in Bypass showed "Hỏi trước": the access button was reset for the switch and only followed a change of the choice. The button and Settings → Access now follow the open conversation.
-- A browser session ended 8 hours after its launch even while its tab was in use, so a long or hung turn ended on the expired screen. A request past half the session's time now renews it and sends the cookie again, up to 7 days; only a tab unused for 8 hours signs out.
+## v1.32.1 - 2026-10-19
 
-### Tests
+**Bypass survives a reload, and a tab in use stays signed in.** Bypass and Fast turned on right after a reply are kept, the access button follows the open conversation, and a tab in use is no longer signed out.
 
-- `tests/managed-bypass-switch-reload.test.mjs`: two company conversations turned to Bypass right after their replies, switched between and reloaded, all show Bypass.
-- `tests/piagent-webui-loopback-server.test.mjs`: a session in use is renewed past half its time, within the cap, and the tab gets its cookie again.
+### Fixed
+
+- Turning on Bypass or Fast right after a reply was refused, so a reload showed "Hỏi trước"; it is now resent against the latest state.
+- Opening another conversation in Bypass showed "Hỏi trước"; the access button and Settings → Access now follow the open conversation.
+- A browser session ended 8 hours after launch even while in use; it now renews for up to 7 days, and only a tab unused for 8 hours signs out.
 
 ## v1.32.0 - 2026-10-19
 
-A company stream that fails or is stopped ends at Studio too, so the conversation's account is free for the next request (Agent Studio 0.32.0).
+**Failed or stopped company streams end at Studio too.** When a company stream fails or you press Stop, Piagent asks Studio to end the request, so the conversation's account is free for the next one.
+
+### Improved
 
-### Fixes
+- New failure messages for an over-long answer, a cancelled request and a superseded one; an over-long answer is asked again.
 
-- When a company model stream ends with an error or the member presses Stop, Piagent asks Studio to end that request (`POST /v1/requests/{id}/cancel`, using Studio's `X-Request-ID`, the role's own token, fire and forget, 10 s). Behind Cloudflare a dropped connection may never reach Studio: on 2026-10-19 a degenerate answer kept streaming there for 10 minutes and every retry of that conversation was refused as "account busy". An older Studio answers 404 and nothing changes.
-- New failure words for Studio's `output_limit_exceeded`, `client_cancelled` and `superseded` (roles only, never model names); `output_limit_exceeded` is asked again by the company turn retry.
+### Fixed
 
-### Tests
+- A dropped stream could keep running at Studio for 10 minutes, so every retry was refused as "account busy"; Studio is now told to end it.
 
-- `tests/managed-failures.test.mjs`: a stream cut mid-answer and a stream stopped with Stop are both ended at Studio with the role's token.
+Requires: Agent Studio 0.32.0.
 
 ## v1.31.1 - 2026-10-19
 
-`memory_ask` is there from the first conversation after an update.
+**`memory_ask` is there from the first conversation after an update.** The first company conversation after Agent Studio 0.30.0 arrived had no `memory_ask`; it is now offered whenever the conversation has team memory.
 
-### Fixes
+### Improved
 
-- `memory_ask` was offered only when this Mac had last heard memory protocol 3 from Studio, which it records at the end of a conversation; the first company conversation after Agent Studio 0.30.0 arrived had no `memory_ask`. It is now offered whenever the conversation has team memory; on a Studio without `/v1/memory/ask` it says to use `memory_search`, and memory stays on.
+- On a Studio without it, `memory_ask` says to use `memory_search`, and memory stays on.
 
-### Tests
+### Fixed
 
-- `tests/managed-team-memory.test.mjs`, `tests/managed-memory-p1.test.mjs` updated.
+- The `memory_ask` tool was missing from the first company conversation after a Studio update; it is now offered whenever team memory is on.
 
 ## v1.31.0 - 2026-10-19
 
-Team memory follows the work: team rules first, the current branch and folders preferred, and `memory_ask` answers with sources (Agent Studio 0.30.0).
+**Team memory follows the work.** Team rules lead the brief, memories from the current branch and folders are preferred, and the new `memory_ask` answers with sources.
 
-### Changes
+### Added
+
+- The brief starts with the team's rules, which override recalled memories.
+- The new read-only `memory_ask` tool answers a question from team memory with its sources, for the main agent and helpers.
 
-- Memory protocol 3: each round carries its work context (branch, top-level folders touched, files changed, checks and their result, commit changes). Studio 0.30.0 tags memories with branch and folders, prefers them in the brief and `memory_search`, and marks an agent's "fixed/done" as a claim until a check passes (verified) or git removes the files it named (stale).
-- The brief starts with the team's rules ("Luật của team"), which override recalled memories.
-- New tool `memory_ask` (main agent and helpers, read-only): asks Studio to answer a question from team memory with its sources; off (204/404) when Studio has no memory.
-- A folder with several repositories uses each repository's memory; a repository whose only remote is not named `origin` works; git's "dubious ownership" (often on WSL) is retried; a folder with no repository is reported to Studio instead of turning memory off silently.
-- Check results from piped commands (`cmd | tail`) now count as lessons.
-- Older Studio (0.27–0.29) keeps working: protocol 3 fields are sent only when Studio says it reads them.
+### Improved
 
-### Tests
+- Each round carries its branch, folders, changed files and checks, so Studio prefers memories from the current branch and folders.
+- An agent's "fixed" or "done" is a claim until a check passes, and turns stale when Git removes the files it named.
+- Check results from piped commands such as `cmd | tail` now count as lessons, and Agent Studio 0.27–0.29 keeps working.
 
-- `tests/managed-memory-p1.test.mjs`; new cases in `tests/managed-team-memory.test.mjs` and `tests/managed-memory-lessons.test.mjs`.
+### Fixed
+
+- Folders with several repositories, a remote not named `origin` and Git "dubious ownership" on WSL no longer turn memory off silently.
+
+Requires: Agent Studio 0.30.0.
 
 ## v1.30.1 - 2026-10-18
 
-The company Terminal no longer shows model names, and the home folder says why it cannot open there.
+**Company Terminal hides model names; clear message in the home folder.** The company Terminal shows roles instead of model ids, and `piagent studio` in the home folder now says why it cannot open there and what to do.
 
-### Fixes
+### Improved
 
-- The company Terminal showed the Harness's model ids (header `main gpt-… · review gpt-…`, footer, and the /model and /thinking answers). A member sees roles only: `Main agent (Rất cao) · Subagent review bật`, footer `Main agent • Rất cao`. Pi's start-up warnings are reworded too: the crash notice no longer points at /bug (off in company conversations) and "Could not restore model …" no longer names one.
-- `piagent studio` in the home folder (or any folder that holds `~/.pi/agent/agent-watch-managed.json`) failed with `managed-launch-binding-changed`, which reads "Agent Watch or Piagent changed; import the configuration again", although nothing had changed. The refusal stays (a project's tools must not reach the company configuration); it now reports `managed-project-contains-config` with what to do: open a project folder, or `piagent studio --project <folder>`. The dashboard shows the same words.
+- Pi's start-up warnings no longer point at /bug, which is off in company conversations, or name a model.
 
-### Tests
+### Fixed
 
-- New case in `tests/managed-binding-wait.test.mjs`; `tests/terminal-parity.test.mjs` checks that no model id reaches the header, footer, command answers or Pi's warnings.
+- The company Terminal showed the Harness's model ids in its header, footer and /model answers; it now shows roles, such as `Main agent • Rất cao`.
+- Running `piagent studio` in the home folder wrongly said Agent Watch or Piagent had changed; it now says to open a project folder or use `--project`.
 
 ## v1.30.0 - 2026-10-18
 
-Large conversations reach Studio from slow connections, and the company Terminal reads like the dashboard.
+**Large contexts over slow connections; a clearer company Terminal.** Model calls to Studio are gzip-compressed, about 3x smaller, and the company Terminal shows turn stats, running helpers and the Git branch.
 
-### Changes
+### Improved
 
-- Model calls go to Studio gzip-compressed once Studio says it accepts them (Agent Studio 0.28.2, `X-Studio-Accept-Encoding: gzip`): bodies of 64 KiB or more, about 3x smaller (a 200k-token Codex context is about 1 MB; encrypted reasoning does not compress). With Studio 0.28.2 a slow upload that keeps sending is no longer cut at 15 s.
-- Company Terminal: each turn's end notice adds requests, tokens, time and output speed; the footer shows `Subagent n/m` while helpers run and the git branch; `memory_search` and `memory_page` results stay short (Ctrl+O shows all); "Working" reads "Đang làm…"; `/bypass status` and `/fast on` run on the first Enter; `piagent studio` says it is joining Agent Watch before the Terminal draws.
+- Model calls of 64 KiB or more go to Studio gzip-compressed once Studio accepts it, about 3x smaller.
+- Each turn's end notice in the company Terminal adds requests, tokens, time and output speed.
+- The footer shows `Subagent n/m` and the Git branch; `memory_search` and `memory_page` results stay short, with Ctrl+O to show all.
 
-### Tests
+### Fixed
+
+- A slow upload that keeps sending is no longer cut at 15 s.
+- Commands `/bypass status` and `/fast on` run on the first Enter, and `piagent studio` says it is joining Agent Watch before the Terminal draws.
 
-- `tests/managed-compressed-fetch.test.mjs`; new cases in `tests/terminal-parity.test.mjs`.
+Requires: Agent Studio 0.28.2.
 
 ## v1.29.0 - 2026-10-18
 
-The company Terminal (`piagent studio`) shows what the team's Harness runs and keeps company conversations inside the company.
+**Company Terminal shows the Harness and keeps work inside the company.** The company Terminal gets its own header, footer and plan checklist, blocks commands that send work outside, and Stop no longer breaks the next message.
 
-### Changes
+### Added
 
-- `/share` (a GitHub Gist) and `/bug` (a report to Pi's developers) are refused in the company Terminal with a notice, and Pi's "/bug sends a report to the developers" hint after errors is no longer shown: both sent company conversations and code outside the company.
-- `/login`, `/logout`, `/model`, `/scoped-models`, `/thinking` and `/settings`, and the keys that do the same (Ctrl+L, Ctrl+P, Shift+Tab), say that the team's Harness decides instead of opening Pi's pickers. They stay in the `/` list with Vietnamese descriptions (hiding one let Enter pick a skill and send it to the agent). `/changelog` shows Piagent's latest release notes instead of Pi's.
-- A company header replaces Pi's startup header and the "Model scope: agent-watch-auto (Ctrl+P to cycle)" line: team, Harness main model and effort, review model, Ask first or Bypass, Fast, memory, release.
-- The footer shows the Harness's main model and effort before the first run (it said "medium" while the Harness ran xhigh) and no USD cost.
-- While `ask_user` waits for the member, the loader reads "Đang chờ bạn trả lời" instead of "Working".
-- The plan is drawn as a checklist with each step (☑ done, ☐ open, ⊘ deferred) instead of "Plan updated: 1/3 steps completed". Personal `pi` is unchanged.
+- A company header shows team, Harness model and effort, review model, Ask first or Bypass, Fast, memory and release.
 
-### Fixes
+### Improved
 
-- Stop while a command runs no longer breaks the next message. Stop used to renew the run's token once more after the tool was cancelled, then close the run, and close it again without its report when that failed. With Agent Studio 0.28.1 and Agent Watch 0.15.7 / Windows 0.1.14, a stopped request ends before renewing, a close Studio could not confirm is not sent again, and the next message starts a new run instead of failing with `managed-broker:serverUnavailable`.
+- `/login`, `/model`, `/thinking`, `/settings` and their keys say the team's Harness decides instead of opening Pi's pickers.
+- The footer shows the Harness's real model and effort with no USD cost, and the plan is drawn as a checklist.
+- `/changelog` shows Piagent's release notes, and the loader reads “Đang chờ bạn trả lời” while a question waits.
 
-### Tests
+### Fixed
+
+- Stopping a turn while a command ran could break the next message; with the required Studio and Watch, the next message now starts a new run.
+
+### Security
+
+- `/share` and `/bug` are refused in the company Terminal, since both sent company conversations and code outside the company.
 
-- New cases in `tests/terminal-parity.test.mjs` and `tests/managed-agent-skills.test.mjs`; checked in the real TUI through a pty.
-- `tests/managed-failures.test.mjs`: Stop during a real sandboxed command sends no renew; a close Studio cannot confirm is not sent again, and the next turn works.
+Requires: Agent Studio 0.28.1, Agent Watch 0.15.7 (Windows 0.1.14) for the Stop fix.
 
 ## v1.28.3 - 2026-10-18
 
-Agent Watch updating itself no longer breaks `piagent studio` for a minute.
+**Agent Watch self-updates no longer break the company Terminal.** Right after Agent Watch updates itself on macOS, `piagent studio` and the dashboard wait for the new setup instead of failing for about a minute.
 
-### Fixes
+### Fixed
 
-- Right after Agent Watch updates itself (Sparkle replaces the app), the broker's hash differs from the company binding until Watch writes it again (46–71 s after launch on 0.15.6), and `piagent studio` failed with `managed-launch-binding-changed`. When only the broker's hash differs and the broker is still Agent Watch's own executable (bundle id and `CFBundleExecutable` checked, macOS only), replaced after the binding was written, `piagent studio` and the dashboard now wait for the new binding as they do after a Piagent update; every pinned path and hash is checked again first.
+- `piagent studio` failed for up to a minute after Agent Watch updated itself; it now waits for the new setup and runs.
 
-### Tests
+### Security
 
-- New cases in `tests/managed-binding-wait.test.mjs`.
+- The wait applies only when the changed file is still Agent Watch's own app, and every pinned path and hash is checked again first.
 
 ## v1.28.2 - 2026-10-18
 
-No more "managed-launch-binding-changed" right after an update.
+**No setup error right after a Piagent update.** After a Piagent update, `piagent studio` waits up to 90 seconds for Agent Watch to rewrite the company setup instead of failing at once.
 
-### Fixes
+### Improved
 
-- Right after a Piagent update, `piagent studio` no longer fails with `managed-launch-binding-changed` while Agent Watch has not rewritten the company binding yet. When only the launcher's hash differs and the launcher was installed after the binding, it waits up to 90 s for the new binding ("Agent Watch đang cập nhật cấu hình…", or "Agent Watch không chạy" when the app is not open) and then runs on it; every pinned path and hash is checked again first. Any other difference still fails at once. The dashboard's company start waits as long.
-- When the wait runs out, the reason says whether Agent Watch is running (`managed-binding-update-pending`, `managed-binding-watch-not-running`). The update notes in the Terminal and the dashboard no longer tell members to import the configuration again by hand.
+- While waiting it says “Agent Watch đang cập nhật cấu hình…”, or that Agent Watch is not running; the dashboard waits as long.
+- Update notes in the Terminal and the dashboard no longer tell members to import the configuration again by hand.
 
-### Tests
+### Fixed
 
-- `tests/managed-binding-wait.test.mjs`, a new case in `tests/managed-dashboard-launch.test.mjs`.
+- `piagent studio` failed right after an update while Agent Watch had not rewritten the setup; it now waits, rechecks every hash and runs.
 
 ## v1.28.1 - 2026-10-18
 
-The company Terminal and personal Pi stop stepping on each other.
+**Company Terminal and personal Pi stop stepping on each other.** Personal Pi starts again when Piagent was loaded twice, old company entries are cleaned up, and company conversations stay in the company Terminal.
 
-### Fixes
+### Improved
 
-- Personal Pi no longer refuses to start when Piagent is loaded twice. An extension path into another Piagent copy (beside the Piagent Pi package) registered every Piagent tool twice ("Tool … conflicts with …") and `pi` exited without an answer. `piagent-update` and the installer now remove such entries, with a backup; `piagent-doctor` reports them as an error.
-- Old Agent Watch company entries in personal Pi are cleaned up once the machine has a managed company binding: the `agent_watch_*` providers (a direct key read from Agent Watch), a default model or model list that names them, and the old session-header extension. They sent personal Pi to Studio outside the team's Harness, or failed. The member's own settings, models and packages stay; every changed file is backed up first.
-- `piagent-update --check` reports the installed Pi package version and any personal Pi conflict, instead of "Everything is on the target release" while the package was older.
-- Personal Pi refuses to continue a company conversation (one in Agent Watch's store or carrying its run entries): it would have gone on with personal models, keys and settings. It says to open it with `piagent studio --project <folder>` and `/resume`.
-- The company Terminal says how to reopen a conversation with `piagent studio --project <folder>` and `/resume` when it closes, instead of Pi's `pi --session-dir …`.
-- `/help` in the company Terminal lists its commands and shortcuts without a model request (it used to go to the agent, which even started a review).
-- Stopping `piagent` from outside (a script, an editor, a timeout) stops the company run under it too; it used to keep running in the background.
+- `piagent-update --check` reports the installed Pi package version and any personal Pi conflict.
 
-### Tests
+### Fixed
 
-- `tests/personal-pi-config.test.mjs`, new cases in `tests/terminal-parity.test.mjs` and `tests/update-global.test.mjs`.
+- Personal `pi` exited without an answer when Piagent was loaded twice; `piagent-update` and the installer now remove the duplicate, with a backup.
+- Old Agent Watch company providers and models in personal Pi are removed once a company binding exists; your own settings stay.
+- Personal Pi refuses to continue a company conversation and says to open it with `piagent studio --project <folder>` and `/resume`.
+- `/help` in the company Terminal lists commands locally instead of going to the agent, which even started a review.
+- Stopping `piagent` from a script, editor or timeout now stops the company run under it instead of leaving it running.
 
 ## v1.28.0 - 2026-10-17
 
-Team memory lifecycle v2: every round reaches memory once, the brief comes back after compaction, and observed check recoveries are kept.
+**Team memory v2: each round once, brief restored after compaction.** Each company round reaches team memory exactly once, the brief returns after compaction, and observed check recoveries are kept.
 
-### Features
+### Added
 
-- With Agent Studio 0.28.0, each company round has a stable event ID, its time and its key, written to a private per-Studio/key outbox before it is sent; a lost acknowledgement, a crash or two sessions at once never extract a round twice, and a round is never sent under another key. Retries back off and stop after 30 attempts or 30 days. Older JSONL outboxes are left untouched.
-- After a successful compaction the agent gets a fresh brief for the latest request before its next model call, and the conversation keeps exactly one brief.
-- A round also carries up to three observed check recoveries (a check that failed, a change, the same check passing; redacted, with both tool calls), never a guessed cause, a rerun alone, a narrowed or skipped test run.
-- Counters per round (brief, searches, pages, helper searches, lessons, outbox retries) go to Studio for its System page; never a prompt or tool output.
+- After a compaction the agent gets a fresh brief for the latest request, and the conversation keeps exactly one brief.
+- A round carries up to three observed check recoveries (fail, change, pass), redacted, never a guessed cause.
 
-### Fixes
+### Improved
 
-- A brief that comes back empty, or fails, is not asked again every round of the same context (30 and 5 minutes; compaction asks again).
-- Closing a round (backlog, retain, counters) stays within 4.5 seconds when the memory engine does not answer.
-- On an Agent Studio 0.27.x, rounds still go to memory in the old body, so either release order keeps memory growing.
+- Rounds are queued on disk before sending, so a lost reply, a crash or two sessions never record a round twice or under another key.
+- On Agent Studio 0.27.x rounds still reach memory, so either release order keeps memory growing.
 
-### Tests
+### Fixed
 
-- `tests/managed-memory-outbox.test.mjs`, `tests/managed-memory-context.test.mjs`, `tests/managed-memory-lessons.test.mjs`, and new cases in `tests/managed-team-memory.test.mjs`: durable outbox and claims, compaction refresh and branch entry IDs, lesson evidence rules, empty/failed brief pause, v1 body, close budget.
+- An empty or failed brief is no longer requested again every round, and closing a round waits at most 4.5 seconds.
 
-## v1.27.1 - 2026-10-17
+Requires: Agent Studio 0.28.0.
 
-Team memory keeps working while the agent runs: commits and memory searches no longer fail beside a model request.
+## v1.27.1 - 2026-10-17
 
-### Fixes
+**Team memory keeps working while the agent calls the model.** Commits and memory searches made beside a model request no longer fail, so a repository's commits reach team memory again.
 
-- Every model request renews its role's run token and voids the one before, so the commits sent right after the brief, and a `memory_search` made beside a request, went out on a dead token and Studio refused them (401): in a real company conversation the repository's commits never reached memory. A memory call Studio refuses this way now renews the token (shared with that role's requests, as web search does) and asks once more. Found in the acceptance run on Agent Studio 0.27.1 (0.27.0 was withdrawn).
+### Fixed
 
-### Tests
+- Memory calls made beside a model request were refused on an expired token; they now renew the token and retry once.
 
-- `tests/managed-team-memory.test.mjs`: a memory call on a voided token asks again once with a renewed one, and a token that stays refused is not asked forever.
+Requires: Agent Studio 0.27.1.
 
 ## v1.27.0 - 2026-10-17
 
-Team memory: company agents remember what the team settled in each repository.
+**Team memory: company agents remember what the team settled.** With team memory on, a new company conversation opens with a short brief of the repository's decisions, rules and work in progress.
+
+### Added
 
-### Features
+- New company conversations open with a brief from the team's memory of the repository, kept in the conversation for the prompt cache.
+- Each round (your words, the final answer, changed files; never tool output) goes back to memory redacted, and new commits once.
+- The main agent gets `memory_search` and `memory_page`; helpers get a read-only `memory_search`.
 
-- With Agent Studio 0.27.0 and team memory turned on for the team, a new company conversation opens with a short brief from the team's memory of the repository (decisions, rules, work in progress from earlier conversations and commits), kept in the conversation so the prompt cache holds. Every round goes back to memory on the run's token before the run closes (the member's words, the final answer, the files changed; never tool output), redacted; new commits are sent once when HEAD moved.
-- `memory_search` and `memory_page` for the main agent, and a read-only `memory_search` for helpers (scout, research, verify, review) on their own run token, once Studio has answered memory on this Mac.
-- Memory never fails or slows a turn: every call is bounded, a round Studio did not take waits in a small outbox and goes with the next round, and a Studio or team without memory (204/404) means no memory traffic for 30 minutes and no memory tools.
+### Improved
 
-### Tests
+- Memory never fails or slows a turn: calls are bounded, and a team without memory gets no memory traffic or tools.
 
-- `tests/managed-team-memory.test.mjs`: the brief opens a conversation and stays once, rounds and commits go back on the run token, the outbox drains after an outage, 204/404 turn memory off, a folder without an origin remote sends nothing, a helper searches on its own token and never writes.
+Requires: Agent Studio 0.27.0 with team memory turned on.
 
 ## v1.26.1 - 2026-10-16
 
-A conversation is renamed while its turn runs.
+**Rename a conversation while its turn runs.** Renaming a conversation mid-turn now takes effect, and a rename, fork or archive that fails says why in words.
 
-### Fixes
+### Improved
 
-- Renaming a conversation from its menu while a turn ran (a company conversation in particular) showed `session-revision-stale` and kept the old name: the turn changes the conversation after every step, and the Gateway refused a rename while busy. The rename now lands mid-turn, the dashboard sends it again against the conversation as it is now, and a rename, fork or archive that still fails says why in words, with the code at the end.
+- A rename, fork or archive that still fails explains why in words, with the code at the end.
 
-### Tests
+### Fixed
 
-- `tests/managed-rename-web.test.mjs`: a company conversation is renamed from its menu while idle and while its turn runs, then with `/name`, and the name survives a reload.
+- Renaming a conversation from its menu during a turn showed an error and kept the old name; the rename now lands mid-turn.
 
 ## v1.26.0 - 2026-10-15
 
-Company conversations work the way a developer works in an editor: the Terminal's `/` commands and shortcuts in the dashboard, `/undo` for the agent's last turn, dev servers that stay up across turns, type errors right after an edit. The Harness is now tested where it runs.
+**Dashboard `/` commands, `/undo` and dev servers across turns.** Company conversations gain Terminal-style `/` commands in the dashboard, `/undo` for the last turn, long-running dev servers and instant type errors.
 
-### Changes
+### Added
 
-- Dashboard `/` commands, run in the dashboard and never sent to the model: `/new`, `/fork`, `/name`, `/pin`, `/archive`, `/stop`, `/thinking`, `/model` and `/permission` (personal), `/undo`, `/fast` and `/bypass` (company), `/changes`, `/settings`, `/help`. Full access and Bypass still ask for confirmation. Shortcuts: ⌘⇧O new chat, ⌘/ the `/` commands, Esc stops the running turn.
-- `/undo` (company Terminal and dashboard): the files the agent's last turn changed go back, one turn at a time; it refuses while a turn runs and when a file was changed again since, and never touches the member's index, HEAD or commits. Git repositories only.
-- `start_process`, `process_output`, `stop_process` (macOS): a dev server, watcher or local service runs across turns in the plain sandbox, without network, until stopped, the conversation closes or 4 hours pass.
-- After a write or edit of a TypeScript or JavaScript file the agent gets that file's errors from the project's own TypeScript (5 and 6 through a language service, 7 through its native `tsc`); a syntax error elsewhere that stops `tsc` is named instead of reported as clean.
-- `piagent studio --prompt <text> --json` writes the event stream of `pi --mode json`.
-- A message sent from another tab while a turn runs waits for that turn instead of being refused.
-- The prompt and `run_with_network` no longer send end-to-end tests to approval on macOS: Playwright's Chromium runs in the plain sandbox against a server on the Mac.
-- Ready for Pi 1.2.0 (the pin stays 0.87.1): `@earendil-works/pi-ai` is found where Pi 1.x hoists it, the sandbox reads it there, and Pi 1.x's error results read as the failures they are.
+- Dashboard `/` commands such as `/new`, `/fork`, `/undo`, `/fast` and `/bypass` run locally, plus ⌘⇧O, ⌘/ and Esc shortcuts.
+- `/undo` restores the files the agent's last turn changed, one turn at a time, without touching your index, HEAD or commits.
+- On macOS a dev server or watcher started by the agent keeps running across turns in the sandbox, for up to 4 hours.
+- After editing a TypeScript or JavaScript file, the agent gets that file's errors from the project's own TypeScript.
+- `piagent studio --prompt <text> --json` writes the same event stream as `pi --mode json`.
 
-### Fixes
+### Fixed
 
-- A test's own localhost server blocked while a local proxy listens printed only `fetch failed`; the agent is now told to use `run_with_network`.
-- `gh` and SSH without a sign-in in the sandbox no longer point the agent at `gh auth login`; they name `run_on_host`.
-- `fetch_origin` stopped a repository with many branches after 60 seconds (a team repository of 92 branches takes about two minutes) and failed with `managed-repository-fetch-failed`; the download now has ten minutes.
-- A turn cut off after a check had passed (the next model request interrupted) reported "no check passed on the final code"; the passed check now counts. A failed `fetch_origin` names `run_on_host` as the way on. `E401` and `ENEEDAUTH` are matched as whole words.
+- Fetching a repository with many branches stopped after 60 seconds; the download now has ten minutes.
 
-### Tests and documentation
+## v1.25.0 - 2026-10-13
 
-- The end-to-end Harness tests skipped wherever the Pi host was not under `~/.pi/npm-global`, CI included; they now find it in the npm global root. `docs/harness-conformance.md` maps every Harness setting to who enforces it and the tests that prove it, and a test keeps that page true.
-- `docs/company-dev-commands.md`: what runs in a company session without asking, what names its approval, the dashboard commands and the headless mode.
+**When the machine lacks something, the agent asks and then runs.** A company conversation no longer gives up on a missing runtime, sign-in or stopped Docker: the agent asks for approval and carries on.
 
-## v1.25.0 - 2026-10-13
+### Added
 
-A company conversation no longer gives up when the machine lacks something: the agent asks for the approval that makes the command run, and once the member approves it runs, outside the sandbox when it has to.
+- `run_on_host` runs one approved command on your machine outside the sandbox, such as installing a runtime or `git push`; it always asks.
+- `start_docker` asks to start an installed but stopped Docker and waits for it, so `run_with_docker` works in the same conversation.
 
-### Changes
+### Improved
 
-- `run_on_host`: one command the member approves runs on their machine, outside the sandbox, as them (their files, Keychain and sign-ins), for what the sandbox blocks and no other tool covers: installing a runtime the project needs (`brew install openjdk@21`, `brew install node@22`), `git pull`/`git push` with the member's sign-in, a private registry, a file outside the project. It always asks, Bypass included, and says what Bypass would still have asked about. It runs in a login shell without Piagent's own environment and with no input; a command that needs the member's password (`sudo`, an installer) or an interactive sign-in is not run: the agent asks the member with `ask_user` (the exact steps, "done, continue" or "skip") and carries on after the answer. What it installed is looked up again at once, so a JDK installed through Homebrew (`openjdk@N`, which macOS does not list) is the next command's `JAVA_HOME`.
-- `start_docker`: when Docker is installed but not running, the agent asks to start it (Docker Desktop, OrbStack, Rancher Desktop or Colima on macOS; Docker Desktop from WSL; rootless Docker or Podman on Linux) and waits until the engine answers; `run_with_docker` then works in the same conversation. Bypass starts it without asking. Before, a conversation opened while Docker was off had no `run_with_docker` until a new conversation, and an engine that stopped answering ended the turn with "tell the member".
-- `run_with_docker` is offered whenever the Docker CLI is installed; a stopped engine (Docker Desktop leaves its socket file behind) is found before anything is asked.
-- Every sandbox failure now names the way on instead of "report it and stop": a missing runtime or wrong version (`Unable to locate a Java Runtime`, `command not found`, `invalid target release`, Node `engines`) → `run_on_host` to install it; the member's sign-in (`could not read Username`, `Permission denied (publickey)`, `E401`, a private image) → `fetch_origin` or `run_on_host`; a blocked write outside the project or Keychain → `run_on_host`; Docker stopped → `start_docker`; a host the approved network still cannot reach (VPN, offline) → a question to the member. The Harness check request and the process prompt ask for that approval instead of telling the agent not to install or start anything.
-- `fetch_origin` takes `path`, the repository folder inside the conversation folder, for a workspace folder that holds several repositories; a folder that is not a repository says so and names `path`.
+- Every sandbox failure names the way forward instead of “report it and stop”.
+- Steps only you can do, such as a `sudo` password or an interactive sign-in, are asked with the exact steps and “done, continue” or “skip”.
 
-### Fixes
+### Fixed
 
-- A turn that only read repositories through `git -C <folder> …` (status, log, reflog, `remote -v`, rev-list…) in a folder that is not itself a repository was counted as a code change, so the Harness asked for checks three times on a turn that changed nothing. Git's options before the command are read now, and `./mvnw … compile`/`package` and `./gradlew build` count as checks.
-- `wget: Failed to fetch` (how `./mvnw` downloads its Maven) is read as a blocked download and points to `run_with_network`, instead of a bare exit code.
+- A turn that only read repositories with `git -C` was counted as a code change and asked for checks three times.
 
 ## v1.24.0 - 2026-10-13
 
-Fast mode can be chosen when a company conversation starts, and the switch is easier to see.
+**Choose Fast when a company conversation starts.** The new chat page offers a Fast switch when the team's Harness allows it, and the switch turns amber while on.
+
+### Added
 
-### Changes
+- “Fast: tắt / Fast: bật” next to the company model makes a new conversation run Fast from its first message.
 
-- The new chat page shows "Fast: tắt / Fast: bật" next to the company model when the team's Harness in Agent Studio allows fast mode. A conversation created with it on is on Fast before its first message runs (`session.create` carries `fast: true`); a Harness that does not allow it refuses the create with the company-policy message. Before, the switch appeared only in the header of a conversation that already existed.
-- The Fast switch in a conversation's header turns amber while on, so a member sees at a glance that its calls count 2.5 times toward the quota.
+### Improved
+
+- The Fast switch in the header turns amber while on, since its calls count 2.5 times toward the quota.
 
 ## v1.23.1 - 2026-10-13
 
-An agent's question waits at the end of the conversation, right above the composer, and is easier to read.
+**Agent questions wait at the end of the conversation.** Questions and approvals now sit right above the composer, so a long turn no longer pushes them out of view.
+
+### Improved
+
+- The question card has larger text and roomier options, and “Let the agent decide” no longer outweighs “Send answer”.
 
-### Fixes
+### Fixed
 
-- A question or approval request was drawn above the running turn, so a long turn pushed it out of view: opening a conversation that waited on the member showed its activity, not the question. Questions and approvals now come last in the conversation, right above the composer, and the page goes to them when one comes up or the conversation opens with one waiting.
-- The question card reads more easily: larger question and option text, roomier options, the chosen option's number filled in. In the light theme "Let the agent decide" is an outline button instead of a black one that outweighed "Send answer".
+- A long turn pushed a waiting question out of view; questions now come last and the page scrolls to them.
 
 ## v1.23.0 - 2026-10-13
 
-Fast mode for company conversations where the Harness allows it, failed tool calls reported to Agent Studio, and new company conversations that send their first message again after a Harness change.
+**Fast mode for company conversations, tool failures sent to Studio.** Where the Harness allows it, a Fast switch gets faster GPT answers at 2.5× quota, and failed tool calls are reported to Agent Studio.
+
+### Added
+
+- Fast mode via the dashboard switch or `/fast on|off|status`: same GPT model and thinking, faster, tokens counted 2.5 times.
+- Failed tool calls in company runs are reported to Agent Studio with secrets redacted and no prompts.
+
+### Improved
 
-### Changes
+- On Claude or API-key models Fast adds nothing, and a refused fast request falls back to standard speed with a note.
 
-- Fast mode for company conversations, where the team's Harness in Agent Studio allows it. The dashboard shows a Fast switch in the conversation's header and the Terminal has `/fast on|off|status`; a conversation starts with it off and keeps the member's choice. While on, the main agent's calls ask a GPT (Codex) model for the priority service tier: the same model and thinking level, answered faster, with tokens counted 2.5 times toward the key's quota by Studio. Subagents run as usual. Only the GPT models OpenAI documents for Fast get the tier: on a Claude model (whose fast mode is another protocol, billed outside a subscription) or an API-key vendor model, nothing is added and the turn runs at standard speed. A fast request that Studio or the provider refuses is asked again once without the tier, and the conversation goes back to standard speed with a note, instead of failing the turn. Without the Harness setting there is no switch, and Studio refuses the tier. Needs a Studio with migration 048 and an Agent Watch that carries the Harness's `fast_mode`.
-- A tool call that fails in a company run is reported to Agent Studio (Logs → "Tool lỗi"), so an administrator can read why Docker, a network command or a test failed on a member's machine: the tool, a code, the command or path, the start and end of the error output, the OS and whether the machine has a Docker engine. Secrets are redacted and the home folder is written `~` before anything is sent; no prompt, search query or subagent brief is sent, and a tool the member stopped or declined is not reported. Needs a Studio with migration 047; an older Studio is asked once and not again.
+### Fixed
 
-### Fixes
+- After an admin changed the Harness, a new company conversation never sent its first message; it now starts at an allowed level.
 
-- After an administrator changed a team's Harness in Studio (for example the main agent from thinking level high to a fixed max), a new company conversation from the dashboard was created but its message was never sent, under the notice “Pi received the request and the session is resyncing. Do not resend it”. The new chat page still offered the levels of the Harness before; the runtime took the nearest level the new Harness allows, and the dashboard treated that difference as a create it could not confirm. A company conversation now starts at the level its Harness allows.
+Requires: An Agent Studio and Agent Watch that support the Harness Fast setting.
 
 ## v1.22.1 - 2026-10-12
 
-A project on a slow file system (a Windows drive seen from WSL) no longer leaves the dashboard loading.
+**Dashboard no longer hangs on a slow file system.** A project on a Windows drive seen from WSL no longer leaves the dashboard stuck on “Opening Piagent…”.
 
-### Fixes
+### Improved
 
-- On Windows the dashboard could open and keep showing “Opening Piagent…”. The project was on a Windows drive seen from WSL (`/mnt/d/…`), where Git walks the tree through a slow file system. The company Gateway ran that scan synchronously and without a limit, so it answered nobody meanwhile; the dashboard waited for it, also without a limit, for its conversation list, its live state and its new-chat options. The dashboard now gives a read of the company Gateway 15 seconds, counts the company runtime as connected only once a read is answered, and after a missed read shows its own conversations without the company ones and asks again a minute later. The company entry says the company runtime runs but does not answer, with what to do.
-- A conversation's page gives Git 8 seconds per repository to list the changed files. A repository that takes longer is shown without its changed files and tried again 5 minutes later, instead of stopping the Gateway for every conversation. Completion checks still wait for Git as before.
+- On Windows, keep projects in the Ubuntu file system (`~/projects`); under `/mnt/c` or `/mnt/d` they work but stay slow.
 
-Keep projects in the Ubuntu file system (`~/projects`) on Windows: a project under `/mnt/c` or `/mnt/d` works but stays slow.
+### Fixed
+
+- On Windows the dashboard could stay on “Opening Piagent…”; it now waits 15 seconds for the company runtime and opens anyway.
+- Git gets 8 seconds per repository to list changed files; a slower one is shown without them and retried after 5 minutes.
 
 ## v1.22.0 - 2026-10-09
 
-Attach any source or text file, as coding agents do; a message with files shows once, as typed.
+**Attach any source or text file.** Any text file can be attached under its own name, binaries are refused up front with an alternative, and messages with files show once.
 
-### Changes
+### Added
 
-- Attach any source or text file, as coding agents do: `.html`, `.css`, `.js`/`.ts`/`.tsx`, `.py`, `.go`, `.java`, `.sql`, `.xml`, `.svg`, `.toml` and any other extension, plus files without one (`Dockerfile`, `Makefile`, `LICENSE`). They are sent as text under their own name, so the model sees `index.html`; the host still checks the bytes are text and refuses a binary in disguise. The file picker offers every file. Binary formats are refused before the upload with what to send instead: spreadsheets → export to .csv, slide decks → .pdf, old Word formats → .docx/.pdf/.txt, archives, media and fonts → keep them in the project for the agent's tools.
+- Attach `.html`, `.css`, `.ts`, `.py`, `.go`, `.sql` and any other text file, including `Dockerfile` or `Makefile`, under its own name.
 
-### Fixes
+### Improved
 
-- A message sent with a text file or document from the dashboard showed twice once its turn ended: once as raw text with the file's contents between `BEGIN/END PIAGENT-ATTACHMENT` lines, once as the tidy bubble with the file card. The Gateway joins the typed text and the files into one block, which the transcript did not split. It now reads the fenced files out of that block as cards and shows only what was typed.
-- On the new chat page a binary file (a .zip, a video) is refused by name as it is added, not after the conversation is created.
+- Binary formats are refused before upload with what to send instead, such as .csv for spreadsheets or .pdf for slide decks.
+
+### Fixed
+
+- A message with a file showed twice after its turn, once with the raw file contents; now only your text and the file card show.
 
 ## v1.21.1 - 2026-10-09
 
-Bypass can be turned on while a turn runs, and it stays on.
+**Turn on Bypass while a turn runs, and it stays on.** A company conversation can switch between Ask first and Bypass at any time, and the next commands follow the new choice.
 
-### Fixes
+### Improved
 
-- Turning on Bypass while a command waited for your approval did not take: the Gateway refused to change access while a turn ran, and the error showed in a panel that had just closed, so the switch looked done and a reload showed Ask first. A company conversation now switches between Ask first and Bypass at any time, also mid-turn; access is read at each command, so the next commands follow the new choice. A command already waiting keeps its card (Allow or Deny). The result of a switch shows in a notice at the top.
+- A command already waiting keeps its Allow or Deny card, and the result of a switch shows in a notice at the top.
+
+### Fixed
+
+- Turning on Bypass while a command waited for approval looked done but did not take; it now applies mid-turn and is kept.
 
 ## v1.21.0 - 2026-10-09
 
-The agent's questions and approvals come one card at a time, other conversations announce when they finish or wait for you, and Studio logs each context compaction.
+**Decisions one card at a time, alerts from other conversations.** Questions and approvals show one card at a time, other conversations announce when they finish or wait for you, and Studio logs compactions.
 
-### Changes
+### Added
 
-- What waits for you comes one card at a time. A conversation's questions and approval requests no longer stack down the page: one card shows, with steps above it ("Việc cần bạn quyết · 1/3") that say who asks (main agent or a subagent role), what kind (Hỏi / Duyệt) and let you jump to another. The main agent's come first, since its answer shapes its subagents' work; then subagents in work order (scout, research, verify, review); within one agent, what was asked first. Answering one brings up the next.
-- Several conversations at once: a toast at the top right says when another conversation finishes a turn (Xong), fails or stops, or starts waiting for your answer or approval; "Mở" opens it. A finished turn fades after a few seconds; a waiting decision stays until it is answered or opened. In the sidebar, a conversation waiting for you glows amber and reads "Cần bạn trả lời" or "Cần duyệt", one that finished while you were elsewhere reads "Xong · chưa xem" until you open it, and they move to the top of "Đang chạy · cần chú ý". The tab title counts what waits, e.g. "(2) Piagent". Before, a conversation waiting on a question showed only "Đang chạy"; the Gateway now marks it, so a page opened later still knows.
-- Studio logs each context compaction of a company conversation. The summary calls carry `X-Agent-Compaction` (`<id>;<reason>;<part>`, reason `threshold`, `overflow` or `manual`), and the main agent's next call carries `X-Agent-Compacted` (`<id>;<reason>;<done|failed|aborted>;<tokens before>;<tokens after>;<ms>`, Pi's own counts). Logs → Lượt agent shows "Compact context 244k → 34k · context chạm ngưỡng · 2 lượt tóm tắt". No summary text leaves the machine. Needs Studio with migration 046; an older Studio ignores the headers.
+- A toast says when another conversation finishes, fails, stops or waits for you, and “Mở” opens it.
+- The sidebar marks conversations waiting for you or finished unseen, and the tab title counts what waits.
+- Studio logs each context compaction of a company conversation with its reason and size before and after; no summary text is sent.
+
+### Improved
+
+- Questions and approvals show one card at a time with steps such as “Việc cần bạn quyết · 1/3”, main agent first.
 
 ## v1.20.0 - 2026-10-09
 
-Package installs in the company sandbox no longer ask; a long subagent no longer gets its turn stopped; the review subagent reads work committed in earlier turns.
+**Package installs in the company sandbox no longer ask.** Plain commands reach the usual package registries through a restricted proxy, long subagents keep running, and review reads earlier commits.
+
+### Added
+
+- Installs from npm and other common registries run without approval through a proxy that allows only those hosts.
 
-### Changes
+### Improved
 
-- Company sandbox: package installs from the usual registries no longer ask. A plain command reaches npm, PyPI, the Go proxy, crates.io, Maven Central, Gradle, Google's Maven, NuGet, RubyGems, Packagist, pub.dev, CocoaPods, Hex and public GitHub downloads (release assets, such as the Gradle Wrapper's distributions, and git dependencies) through a proxy that Piagent runs outside the sandbox. The proxy allows only those hosts (and the member's additions in `~/.piagent/sandbox-domains`, one host or `*.domain` per line), on ports 443 and 80, and never an IP address or a name that resolves to this machine or a private network. Any other host is refused, and the command's failure names it and points to `run_with_network`, which still asks. Registry credentials stay out of the sandbox. Subagents that only read keep no network. `piagent studio --doctor` checks npm through the proxy.
-- Bypass runs `run_with_docker` without asking, like `run_with_network`. It no longer asks about containers that mount folders outside the project or run privileged. Only what Bypass asks for any command still asks: pushes, deploys, registry logins, and deletes whose target is known only at run time.
-- Maven and Gradle use the proxy too: the JVM gets the proxy settings, and Maven, which reads its proxy only from `settings.xml`, gets a settings file in the sandbox's own home. A live check ran `./mvnw test` and `./gradlew test`, each downloading its distribution, plugins and JUnit through the proxy, and the next conversation ran `./mvnw -o test` offline from the project's cache.
+- Add your own registry hosts in `~/.piagent/sandbox-domains`, one per line; registry credentials stay out of the sandbox.
+- Bypass runs `run_with_docker` without asking; pushes, deploys, registry logins and unclear deletes still ask.
 
-### Fixes
+### Fixed
 
-- A subagent that worked longer than 15 minutes (a verify running a long test suite while the main agent waited) was stopped with `managed-helper-cancelled`, and the turn ended with "Request was aborted". The dashboard stops a turn after 15 minutes without an event, and a working subagent sent none. While a subagent runs, the turn now sends a beat every minute. A turn is still limited to 6 hours, and each of the subagent's commands has its own time limit.
-- The review subagent said "no patch" when asked to review work committed in earlier turns: it read only the change since the turn began, which was nothing. It now takes `since` (a commit, a branch or `HEAD~N`) and reads the commits after it plus anything not committed yet. When the turn has changed nothing, it reads the branch's commits since it left the default branch (or, on the default branch, its unpushed commits). A `since` that HEAD does not descend from is refused with the reason. The review the harness requires still reads the turn's own change.
+- A subagent working longer than 15 minutes was stopped and the turn aborted; it now keeps running.
+- The review subagent said “no patch” for work committed earlier; it now reads commits since a given commit, branch or `HEAD~N`.
 
 ## v1.19.0 - 2026-10-08
 
-A company task with a checklist is carried to its end, every turn says how it ended, Docker in the company sandbox, and folders that hold several repositories.
+**Checklist tasks carried to the end, Docker in the company sandbox.** The Harness carries a checklist task to its end, every turn says how it ended, Docker is available for approved commands, and multi-repo folders work.
 
-### Changes
+### Added
+
+- When the Harness requires a plan, it sends the agent on to the next open checklist step until done, stopped or stalled.
+- Every company turn ends with a status line such as “Hoàn thành · n/n bước”, with Continue when the task is not finished.
+- `run_with_docker` runs one approved command with internet and Docker, for test databases, builds or container tests.
+- A folder holding several repositories shows “N repo”, with each repository's branch and changed files.
 
-- When the main agent ends its turn while its checklist still has open steps (it often stops between the items it was asked for: "STEP06 done, STEP07 next") and the team's Harness requires a plan, the harness sends it on to the next open step as a new run, as if the member had sent "continue": each round gets its own subagents, checks and review. It stops when every step is completed, when the member stops it or writes, when a round fails, after 2 rounds in a row that finish no step and change no code, or after 30 rounds. The model is told to ask with `ask_user` when it cannot go on without the member, and to put every item the member asked for in the checklist. Studio logs these rounds as "Harness cho làm tiếp" (`X-Agent-Purpose: continue`).
-- A checklist step can be marked `deferred` (left for later at the member's word, or no longer needed). The agent is told never to mark completed a step it did not do: in a live run where the member said to stop after STEP02, the model had marked the other four completed to end its turn; it now defers them, and the turn says "Dừng theo yêu cầu · 2/6 bước xong, 4 bước để sau". Deferred steps are not sent on and are left out of the steps Studio counts.
-- "tiếp tục" (or the Continue button) after a turn that stopped midway takes up the open checklist: the turn's end and the harness rounds follow it even when the agent does not update it again.
-- Every company turn ends with a line under the last answer, in the dashboard and the company Terminal: "Hoàn thành · n/n bước", "Dừng giữa chừng · còn x/y bước" (and why: two rounds without progress, the round limit, or a Harness that does not require a plan), "Lượt dừng vì lỗi" (which role) or "Bạn đã dừng lượt này", with Continue when the task is not finished. The sidebar shows the same for each conversation. The line never reaches the model.
-- A folder that holds several repositories (a workspace with the front end, the back end and other projects side by side) shows "N repo" where a repository shows its branch: in the chat header, the status bar and the sidebar. Its menu lists the repositories found one level down with their branches and changed files, as an editor's source control view does; picking one opens its branches to switch or create one there.
+### Improved
 
-- Company sandbox: Docker for approved commands. When Docker runs on the machine (Docker Desktop, Colima, OrbStack, Podman or the Linux daemon), the agent gets `run_with_docker`: one command the member approves runs with internet and the Docker engine, and nothing else is opened (`docker compose up -d` for a test database, `docker build`, Testcontainers tests). The Docker CLI gets its own settings without registry credentials: public images pull, private registries and `docker push` do not. Bypass still asks when a command or the project's compose file mounts a folder outside the project, mounts the Docker socket, or gives a container the host's processes, network or privileges. A plain command that tries Docker is pointed at `run_with_docker`; `piagent studio --doctor` checks Docker. The dashboard shows these commands as "Chạy với Docker".
-- Company sandbox: `./gradlew` reuses the Gradle distributions already unpacked in `~/.gradle/wrapper/dists`, as `./mvnw` does with Maven, so it runs without asking for network.
+- Steps you postpone are marked deferred, never completed, and `./mvnw` and `./gradlew` reuse distributions already on the machine.
 
-### Fixes
+### Fixed
 
-- A company run that could not be closed (the Mac went to sleep, the network or Agent Watch went away while it ended) threw out of the turn: no answer settled and nothing said what happened. The turn now ends as failed with the reason, the conversation takes the next message, and the run is recovered or abandoned when the conversation opens again.
-- A turn that committed its change (`git commit`) counted as "no code changed": the code was compared with HEAD, which the commit had moved. The code is now compared with the commit the turn started from, so required checks, the review (which reads the committed change) and the process report still apply.
-- Adding a folder failed with "Không thể thêm thư mục" once 200 folders had been added: the list only grew. A full list now forgets folders gone from the disk, then the ones added longest ago, and a folder added again moves to the newest place. The add dialog also says why a folder could not be added (the folder picker did not open, a drive root or a link, too many attempts).
-- Company sandbox: `./mvnw` failed without network ("curl: Failed to fetch apache-maven-…-bin.zip") even when the Maven it wants was already unpacked on the Mac, and a Maven downloaded through an approved command was gone in the next conversation. The Maven Wrapper now reuses the distributions in `~/.m2/wrapper/dists` (read-only) and keeps one it downloads in the project's cache, so `./mvnw -o` runs at once.
+- A turn that committed its change counted as “no code changed”; checks and review now apply to committed work.
 
 ## v1.18.0 - 2026-10-08
 
-Switch the Git branch from the dashboard, retries for passing failures, and Claude Haiku 5.5.
+**Switch Git branch from the dashboard, retries, Claude Haiku 5.5.** The branch in the dashboard becomes a switcher, passing model failures are retried before showing, and Claude Haiku 5.5 is available.
+
+### Added
+
+- The Git branch in the header and status bar lists branches to switch to, or creates a new one from the current commit.
+- Claude Haiku 5.5 can be used in company conversations when Studio offers it, and joins the personal Claude model scope.
 
-### Changes
+### Improved
 
-- Claude Haiku 5.5 (`claude-haiku-5-5`, released 2026-10-07): company conversations can run it when Studio offers it, and `configure-model-scope` adds it to the personal Claude scope at `medium`, with the official numbers (1M context, 128k output, adaptive thinking low to max, $0.10/$0.50 per 1M tokens, five times that above 100k input tokens). The pinned Pi 0.87.1 does not list it yet, so the reviewed catalog supplies it.
-- A company answer that fails for a passing reason after Studio admitted it (the model's stream was cut or came back empty, the model or Studio's model gateway did not answer, Studio could not be reached) is asked again up to twice, 2 then 4 seconds apart, before the failure is shown; the dashboard keeps the turn running meanwhile. The failed attempt is left out of what the model sees and no tool runs twice. Quota, key, policy, rejected or refused requests and closed runs still fail at once. Pi decides by Studio's code, not by the words of the error.
-- Dashboard turns retry a passing failure twice instead of once, and a failure later in a turn is retried too: replay safety is judged on the model call that failed (no text shown, no tool of its own), not on everything the turn did before. Personal sessions get this as well.
-- The Git branch in the chat header and the status bar is a button: it lists the project's branches (local ones, then remote ones with no local branch yet) and switches the folder to one of them, or to a new branch typed in the menu, made from the current commit. A switch waits while any conversation in that folder runs, company ones included, so an agent never finds its files changed under it. Git does the switch itself, so it refuses what it refuses in a Terminal; the menu shows its reason in its own words (for example, uncommitted changes the switch would overwrite) and leaves the files as they were.
+- A branch switch waits while any conversation in that folder runs, and shows Git's own reason when Git refuses.
+- A company answer cut off for a passing reason is retried up to twice before the failure shows; quota or key errors fail at once.
 
 ## v1.17.0 - 2026-10-08
 
-The dashboard shows which Git branch each project is on.
+**The dashboard shows each project's Git branch.** The dashboard shows which Git branch each conversation's project is on, and warns when HEAD is detached.
 
-### Changes
+### Added
 
-- The dashboard shows the Git branch each conversation's project stands on: next to the project name under the chat title, in the status bar, and beside each project group in the sidebar. A detached HEAD shows its short commit in the warning colour, since work there belongs to no branch. The branch is read from the repository's own HEAD file (linked worktrees included), and a branch switched by the agent or in a Terminal shows at the next refresh, or when you come back to the tab.
+- The branch shows under the chat title, in the status bar and beside each project group in the sidebar, worktrees included.
+- A detached HEAD shows its short commit in the warning colour, since work there belongs to no branch.
 
 ## v1.16.3 - 2026-10-08
 
-A dashboard updated from its own button checks for the next release again.
+**Dashboard keeps checking for updates after updating itself.** After an update from the dashboard's button, the dashboard checks for the next release again.
 
-### Fixes
+### Fixed
 
-- The dashboard's update restarted the dashboard with update checks switched off (meant only for the install step), so after an update from the button it never checked the registry again and showed no newer release until the machine restarted. The restart now keeps checks on, and a dashboard started by an earlier release's update job turns them back on, so updating to 1.16.3 from any release fixes it.
+- Updating from the button restarted the dashboard with update checks off until the machine restarted; this is fixed from any release.
 
 ## v1.16.2 - 2026-10-08
 
-The Terminal says what the dashboard says.
+**The Terminal says what the dashboard says.** The Terminal now offers updates, a `/bypass` switch, and the dashboard's explanations for network commands and failures.
+
+### Breaking changes
+
+- The company launcher changed: if `piagent studio` reports the setup changed, import it again in Agent Watch → Studio.
+
+### Added
+
+- `pi` and `piagent studio` offer a new Piagent between turns with “Cập nhật ngay” or “Để sau”; `/piagent-update` checks at once.
+- `/bypass` in `piagent studio` switches between asking first and Bypass, and the footer shows “Bypass” while on.
 
-### Changes
+### Improved
 
-- A new Piagent is asked about in the Terminal too, in `pi` and in `piagent studio`: "Có bản Piagent mới" with **Cập nhật ngay** (runs `piagent-update`, then asks you to reopen) or **Để sau** (asked again after an hour), only between turns, with a footer line until you update. `/piagent-update` checks at once. Before, `pi` printed one line at session start and `piagent studio` said nothing.
-- `/bypass` in `piagent studio` switches the conversation between asking first and Bypass (`on`, `off`, or a choice), kept with the conversation like the dashboard's switch; the footer shows "Bypass" while it is on.
-- A network command in the company Terminal is confirmed with its reason, why Bypass still asks, and what allowing or declining does, as on the dashboard.
-- The company Terminal explains a failed request (quota, account, Harness, refused…) and a runtime that cannot start in the dashboard's Vietnamese words, with the code for support; the Harness's notes (checks, review findings, a subagent's objection, "bạn quyết định") read in Vietnamese.
+- Network command prompts, failed requests and Harness notes read in the dashboard's Vietnamese wording.
 
-### Fixes
+### Fixed
 
 - A slash command of a company Terminal extension was sent to the model as a message.
-- With Agent Watch 0.15.2, a Watch update that needs Keychain access again asks for it in a dialog and refreshes Piagent's company setup at once; before, `piagent studio` stopped with `managed-launch-binding-changed` until the member found the button.
 
-This release changes the company launcher: Agent Watch refreshes Piagent's setup on its next sync (within minutes); if `piagent studio` reports the setup changed, open Agent Watch → Studio and import it for Piagent.
+Requires: Agent Watch 0.15.2 for the Keychain prompt after a Watch update.
 
 ## v1.16.1 - 2026-10-07
 
-New releases are announced in a dialog and checked every hour; a dashboard tab no longer gets stuck signed out.
+**New releases announced in a dialog and checked every hour.** A dialog announces each new release, checks run hourly, and a dashboard tab no longer loses its sign-in to another local Piagent server.
 
-### Changes
+### Added
 
-- When a new Piagent is out, the dashboard opens a dialog with what will change and **Update now**; **Later** asks again after an hour. After the update, the restarted dashboard says it worked.
-- The dashboard checks for a new release every hour (was 6 hours), and the Terminal notice every hour (was a day).
+- A dialog shows what a new release changes with “Update now”; “Later” asks again after an hour.
 
-### Fixes
+### Improved
 
-- A dashboard tab no longer loses its sign-in when another local Piagent server (the company runtime, another launch) signs in: the session cookie is named after its port.
-- A tab whose sign-in is gone (Piagent restarted, older than 8 hours) stops polling every 2 seconds with 401 and says how to open Piagent again (`piagent dashboard` or Agent Watch).
+- The dashboard and the Terminal check for a new release every hour.
+
+### Fixed
+
+- A dashboard tab lost its sign-in when another local Piagent server signed in; each port now has its own cookie.
+- A signed-out tab stops polling and says how to reopen Piagent with `piagent dashboard` or Agent Watch.
 
 ## v1.16.0 - 2026-10-07
 
-Bypass for company conversations; a Harness change never interrupts your work.
+**Bypass for company conversations.** Company conversations can run in Bypass, where network commands run without asking but anything that pushes or deletes still asks.
 
-### Changes
+### Added
 
-- A company conversation can run in **Bypass** (new-chat options or the conversation header; "Hỏi trước" stays the default). In Bypass, commands that need the internet (package installs, downloads, `git pull`, tests with a server or browser) and fetching origin run without asking. You are still asked before anything that pushes or sends data out (`git push`, publish, deploy, uploads, `gh` writes, `ssh`/`scp`, remote `rsync`, cloud and cluster tools, `docker push`), database migrations, deletes whose target is only known at run time, `docker compose down -v`, and `sudo`; the request says why Bypass still asks.
-- Personal sessions with full access no longer ask before a broad `git add`; deletes, migrations and external actions are still asked.
+- In Bypass, installs, downloads, `git pull` and tests with a server or browser run without asking; Ask first stays the default.
 
-### Fixes
+### Improved
+
+- Personal sessions with full access no longer ask before a broad `git add`.
+
+### Fixed
+
+- A helper added to the Harness during a conversation can be used from the next message.
+
+### Security
 
-- A helper the company Harness adds while a conversation is open can be used in that conversation from the next message; with Studio 0.20.1 a run already running keeps going when the Harness is saved.
+- Bypass still asks before `git push`, deploys, uploads, migrations, unclear deletes and `sudo`, and says why.
 
 ## v1.15.2 - 2026-10-07
 
-Long company conversations shrink again, earlier.
+**Long company conversations compact again, and earlier.** Summaries of long company conversations work again and start at 90% of the model's window, never later than 300k tokens.
 
-### Fixes
+### Improved
 
-- A long company conversation could not be summarised: Pi's summary request carried the company provider's placeholder key instead of the run's grant, Studio refused it (401 `authentication_required`, listed as "Chưa chọn tài khoản" / "CLI trực tiếp" in the request monitor) before every step, and the conversation kept growing past the model's window. Summaries now use the run's grant, and Studio logs them as `summary`.
-- A summary that fails is asked again after 1, 2, 4 … minutes (at most 30) instead of before every step.
+- Compaction starts at 90% of the window and never later than 300k tokens, keeping about the last 20k tokens verbatim.
 
-### Changes
+### Fixed
 
-- A company conversation is summarised at 90% of the model's window and never later than 300k tokens, as Codex does: 244.8k on a 272k GPT window (prices double above 272k), 300k on a 1M-token window instead of about 984k. The summary keeps about the last 20k tokens word for word, as before.
+- Long company conversations could not be summarised and kept growing past the model's window; summaries now use the run's grant.
+- A failed summary is retried after 1, 2, 4 … minutes (at most 30) instead of before every step.
 
 ## v1.15.1 - 2026-10-07
 
-Studio sees what each company model call is for; several conversations in one folder keep their changes apart.
+**Studio sees what each company model call is for.** Each company model call tells Studio its purpose, and several conversations in one folder keep their changes apart.
 
-### Changes
+### Added
 
-- Every company model call tells Studio what it is for: the answer to your message, a step after tools (with the tools the answer before it called), a turn the harness started, a summary of a long conversation, a subagent's brief or a web search. A subagent's brief also carries a one-line title of its job (the `delegate` tool takes an optional `title`; otherwise the brief's first line). No other prompt text is sent. Studio 0.20.0 shows them in Logs → "Lượt agent"; older Studios ignore them.
+- Each company model call tells Studio what it is for, such as an answer, a summary or a subagent brief; no other prompt text is sent.
 
-### Fixes
+### Improved
 
-- Several company conversations in one folder no longer take each other's edits for their own: a conversation records the files it changes (writes, edits, and commands compared before and after), and whether the run changed code, whether a check covers it, and what a review reads follow those files only. Before a conversation changes anything, a review reads the whole folder.
-- A new company conversation whose runtime fails to open says why (`company-<kind>`) instead of "resyncing", and Archive and Restart work on it without restarting the dashboard.
-- A build wrapper (`mvnw`, `gradlew`) whose download is blocked in company mode points to `run_with_network`.
-- `piagent doctor` and other `piagent <command>` forms run `piagent-<command>`; an unknown subcommand is named.
+- `piagent doctor` and other `piagent <command>` forms run `piagent-<command>`.
 
-## v1.15.0 - 2026-10-07
+### Fixed
 
-A refused subagent says why; long noisy commands finish.
+- Several company conversations in one folder took each other's edits; checks and review now follow each conversation's own files.
+- A new company conversation whose runtime fails to open says why, and Archive and Restart work without restarting the dashboard.
 
-### Fixes
+Requires: Agent Studio 0.20.0 to see call purposes.
 
-- A company subagent that Studio refuses now says Studio's reason, which Agent Watch 0.15.0 passes along, instead of "the key, harness or run changed in Studio" for every refusal. With Studio 0.19.0, a subagent whose role had no AI account when the run started takes a model that serves when it is called; when none serves, the member reads that no company AI account serves the role's model and an administrator has to link or enable one.
-- A company command that printed for more than about 25 seconds (a test suite, a build) stopped as `managed-tool-output-too-large`, although its result was about 50 KB: the 12 MB limit counted every progress update. The limit now applies to each message.
-- A company command that writes to `/tmp` (read-only on macOS in company mode) is told to use `$TMPDIR` or the project, instead of the general notice about credentials and the network.
-- `piagent-update` started from `npm exec` installs a lasting helper even when the version already matches, and `--no-host` with an incompatible Pi stops before changing either global package. On Windows, Pi is found in custom npm prefixes.
+## v1.15.0 - 2026-10-07
 
-## v1.14.0 - 2026-10-06
+**A refused subagent says why, long noisy commands finish.** A company subagent Studio refuses now gives Studio's reason, and long commands that print a lot are no longer stopped.
 
-Updates keep each member's Pi model choices.
+### Improved
 
-### Features
+- A company command writing to `/tmp` is told to use `$TMPDIR` or the project.
 
-- `piagent-update`, the dashboard's update and `piagent-setup` set Pi's default model and model list (`enabledModels`) only on a first install. Later they keep the member's default model and list, and add only models the release offers for the first time; a model the member removed is not added back. What Piagent offered is kept in `~/.pi/agent/piagent-model-scope.json`. `piagent-update -- --reset-model-scope` applies the preset over the member's choices as every update did before; `piagent-model-scope` run by hand still applies it.
+### Fixed
 
-### Fixes
+- Every refused subagent said the key, Harness or run had changed; it now gives Studio's actual reason.
+- Commands that printed for more than about 25 seconds, such as test suites or builds, were stopped as too large; they now finish.
+- `piagent-update` from `npm exec` installs a lasting helper, and on Windows Pi is found in custom npm prefixes.
 
-- `piagent-update` in WSL2 no longer warns that WSL2 is experimental and not release-gated: since 1.13.0 it is how Windows runs Piagent, and the Windows setup and the bubblewrap sandbox run in CI.
+Requires: Agent Watch 0.15.0; Agent Studio 0.19.0 for model fallback.
 
-### Docs
+## v1.14.0 - 2026-10-06
 
-- Windows installs with one PowerShell command (`irm https://raw.githubusercontent.com/Vt-mmm/agentwatch/main/windows/setup.ps1 | iex`): WSL2 and Ubuntu when missing, Piagent in Ubuntu, Agent Watch and the company key, and a Piagent Start-menu entry; running it again updates. The docs site has a "Cài trên Windows" page with the fixes for failed installs, and the Windows guide leads with the command.
+**Updates keep each member's Pi model choices.** Updates set Pi's default model and model list only on first install, then keep yours and add only newly offered models.
 
-## v1.13.1 - 2026-10-06
+### Added
 
-### Fixes
+- `piagent-update -- --reset-model-scope` applies Piagent's preset over your choices.
+- Windows installs with one PowerShell command, and the docs site has a Windows install page with fixes for failed installs.
 
-- Opening a conversation no longer jumps to its first message. Each conversation keeps the place it was left while the dashboard stays open; one opened for the first time, or left at its end, opens at its newest message and follows an answer as it streams.
-- Text the agent writes between tool calls, and earlier answers of a turn, are formatted like the final answer instead of showing their markdown (`**`, backticks, `#`, `-`) as plain text. The first answer after opening the dashboard no longer shows as plain text for a moment.
+### Improved
 
-Updating from 1.13.0 needs no new Agent Watch import; from 1.12 or earlier, import again as described for 1.13.0.
+- `piagent-update`, the dashboard update and `piagent-setup` keep your default model and list; a model you removed is not added back.
 
-## v1.13.0 - 2026-10-06
+### Fixed
 
-Piagent on Windows through WSL2, with company conversations in a bubblewrap sandbox; personal mode on Windows itself as a preview.
-
-After updating, each member imports the Piagent configuration again in Agent Watch (macOS: Studio → Apply for Piagent; Windows: Connect Piagent in WSL). The company launcher changed, so the earlier import no longer verifies, and the dashboard says so.
-
-### Features
-
-- Company conversations run on Linux, and so in WSL2 on Windows, with a bubblewrap sandbox that keeps the macOS promises:
-  - The project, its package cache and a private temporary folder are writable.
-  - The member's other folders are readable for reference, read-only; the home folder's hidden entries are not there at all.
-  - Credential files read as empty.
-  - A command without approval gets its own network namespace: it reaches only the servers it starts itself.
-  - A command's processes end with it.
-  - Windows programs cannot be started from inside.
-  - `piagent studio --doctor` checks each of these.
-- Agent Watch for Windows binds Piagent in WSL. Piagent keeps WSL's interop variables when it starts the Windows broker, and keeps the company store in `$XDG_DATA_HOME/agentwatch` (`~/.local/share/agentwatch`) on Linux.
-- On Windows itself (preview of personal mode; `piagent-update` does not run there yet):
-  - The dashboard's project picker is Windows' folder dialog; from WSL it is that dialog too, with the answer converted to a WSL path.
-  - Links open in the Windows browser from WSL.
-  - @ suggestions find `fd`/`fdfind` and git on PATH.
-- When the company runtime cannot start from WSL, the dashboard and `piagent studio` say what to do in Agent Watch for Windows instead of pointing at macOS Keychain.
-- [Windows](docs/en/windows.md) is the setup guide. A Windows workflow runs the guard, dashboard and path tests on Windows, and the Ubuntu job runs the Linux sandbox.
-
-### Fixes
-
-- On Windows the guard treated a path on another drive (`D:\x`) as a project path, and `~\` was not the home folder; `AppData` is closed to reference reads like `~/Library`.
-- On Windows a command ending in `2>/dev/null` counted as a write (Git Bash's `/dev/null` is the null device), so read-only commands needed approval.
-- On Windows the dashboard, `piagent` and the update job could not start their TypeScript loader (a `C:\…` path given to `--import` reads as a URL scheme).
-- On Windows saving a task's journal or state failed: a file was flushed through a read-only handle, and a folder was flushed, which Windows refuses.
-- On Windows a second dashboard start could not take over from an earlier release's Gateway (its control pipe was linked like a Unix socket), and `piagent` could not register a `C:\…` project with the dashboard.
-- On Windows the dashboard did not find a globally installed Pi: npm keeps it in `%APPDATA%\npm\node_modules` or beside `node.exe`.
-- On Windows an image path such as `C:\Users\me\shot.png` or `.\shots\a.png` in a message was not attached.
-## v1.12.1 - 2026-10-06
+- `piagent-update` in WSL2 no longer warns that WSL2 is experimental.
 
-### Fixes
+## v1.13.1 - 2026-10-06
 
-- A forked company conversation takes messages again. The fork was written where Pi keeps personal conversations, outside the member's company session folder, so the dashboard listed it but every message to it returned "The message was not sent". Forks made with 1.12.0 or earlier stay unreachable: fork the source conversation again after updating.
+**Conversations keep their place, agent text is formatted.** Reopening a conversation no longer jumps to its first message, and text between tool calls is formatted like the final answer.
 
-## v1.12.0 - 2026-10-06
+### Improved
 
-@ in the dashboard picks any file or folder on the Mac, and the agent reads folders outside the project for reference.
+- Updating from 1.13.0 needs no new Agent Watch import; from 1.12 or earlier, import again as for 1.13.0.
 
-### Features
+### Fixed
 
-- Typing @ in a conversation or a new chat offers the project's files and folders, matched loosely by name with git-ignored ones left out, and after `~/`, `/` or `../` any folder on this Mac. Arrow keys move, Enter or Tab picks, Escape closes. A folder stays open for the next name, and a path with spaces is quoted, as in Pi's terminal.
-- Company conversations read the folders a member points to outside the project — an @ mention, or "read ~/Documents/old-shop" — with read, ls, grep, find and commands. Those folders are read-only: changes go in the project only. Hidden files and folders of the home folder (shell files, histories, tool settings), `~/Library` and credential files (`.env`, `.npmrc`, `credentials`, `auth.json`) stay closed, and a command the member approved for network still reads the project only.
-- Personal conversations read those folders too, with read, ls, grep and find; protected paths are still refused.
-- A message typed and not sent stays where it was written — in each conversation and in the new chat — when another conversation is opened, and in this browser across a reload. Staged files and a send still being confirmed come back with it. Creating the chat or sending the message clears it.
-- Skills and commands kept for coding agents are Piagent's too: the project's `.claude/skills`, `.claude/commands`, `.codex/skills`, `.agents/skills` and `.pi` folders (from the project up to its repository root) and the member's `~/.claude`, `~/.codex`, `~/.agents` and `~/.pi/agent` ones. The model sees each skill by name and description; `/command`, `/skill:name` and `/skill-name` expand in company and personal conversations; a / at the start of a message lists them in the dashboard; the chat shows a skill call as typed. In company conversations the sandbox reads a skill's folder where it is installed, and nothing else of those folders.
-- Tests of the common languages run in company conversations:
-  - Package caches (npm, pnpm, yarn, bun, deno, pip, uv, poetry, Go, Cargo, Gradle, Maven, NuGet, Composer, pub, gems) are kept per project under `~/Library/Caches/Piagent/sandbox`, so after one approved install, tests run offline. The member's own Go, Gradle, Maven and NuGet caches are read-only sources.
-  - A test's own server and a local database on this Mac are reachable without approval — unless a local proxy (the system's, `*_PROXY`, or a proxy or VPN client's usual port) listens, since it would carry a command to the internet; the error then says to ask for approval.
-  - JDKs under `~/Library/Java`, the Android SDK, the system Ruby gems, MacPorts and Playwright's browsers are available without approval; `JAVA_HOME` and `ANDROID_HOME` are set.
-  - The sandbox uses the developer tools selected with `xcode-select`, so Swift package tests find XCTest; SwiftPM and xcodebuild run without their own nested sandbox, and xcodebuild builds into the project cache.
-  - An approved command can restore .NET packages (TLS through the macOS Security framework); offline, .NET reads the packages the member already restored.
-  - `piagent studio --doctor` lists the languages installed on the Mac and checks localhost and the package cache.
-  - Docker and the iOS Simulator remain unavailable in the sandbox.
+- Opening a conversation jumped to its first message; it now keeps its place, or opens at the newest message.
+- Text between tool calls showed raw markdown; it is now formatted like the final answer.
 
-### Fixes
+## v1.13.0 - 2026-10-06
 
-- In personal conversations the guard checked a path such as `~/notes.md` or `@~/notes.md` as if it were inside the project, while Pi's tools opened it in the home folder, so an edit there was allowed outside the project. The guard now checks the path the tool opens.
-- In company conversations a path starting with `~/` named the sandbox's own empty home folder; it now names the member's.
+**Piagent on Windows through WSL2.** Company conversations run on Linux and WSL2 in a sandbox with the macOS guarantees; personal mode on Windows itself is a preview.
 
-## v1.11.1 - 2026-10-05
+### Breaking changes
 
-Updates now end on the new release's dashboard, whichever way they ran.
+- After updating, each member imports the Piagent configuration again in Agent Watch, since the company launcher changed.
 
-### Fixes
+### Added
 
-- An update started from the dashboard installed the new release but could not restart the dashboard: the restart ran without the package's TypeScript loader, which an npm install needs under node_modules. It now starts the dashboard the way the `piagent` command does.
-- After `piagent-update` (or any reinstall), `piagent dashboard` reused the dashboard still running the earlier release, which kept showing that release's pages. A dashboard from another release is now stopped and started again on the installed one, and `piagent-update` says so when it finishes.
+- The Linux sandbox keeps the project writable, other folders read-only, credentials empty and unapproved commands offline.
+- Agent Watch for Windows binds Piagent in WSL, and `piagent studio --doctor` checks each sandbox guarantee.
+- From WSL, the folder picker is the Windows dialog and links open in the Windows browser.
 
-## v1.11.0 - 2026-10-05
+### Fixed
 
-The dashboard keeps Piagent and Pi up to date itself, and works like an editor:
-a status bar, a command palette and Settings that can be searched.
+- Several Windows path, loader and file-saving bugs that stopped the guard, dashboard and `piagent` are fixed.
 
-### Dashboard
+## v1.12.1 - 2026-10-06
 
-- Updates: the dashboard checks the registry when it opens and every 6 hours (the Gateway asks npm in the background; a source checkout and the company runtime never do). A newer release shows in the status bar ("Cập nhật Piagent X") and as a dot on Settings. Settings → Cập nhật shows Piagent and Pi as installed and as offered, when it last checked, and "Kiểm tra ngay".
-- One click updates Pi and Piagent together with `piagent-update`, after a confirmation that lists the change. Pi only ever moves to the version the new Piagent pins; a newer Pi is shown as not yet compatible. The button is locked while a conversation runs, and the update runs apart from the dashboard: when done, the dashboard restarts on the new release and opens in a new tab. Its output goes to `~/.pi/piagent-update-job.log`; a failure or an interrupted run is reported for a day. A release that changed the company launcher asks to connect the company key again in Agent Watch.
-- Status bar (wide screens): Gateway state, running conversations, the release and its update, and the command palette.
-- Command palette (⌘K / Ctrl+K): new chat, updates, the Workspace panel, Source Changes, theme, language, refresh, every Settings section and every conversation by name; matching ignores case and Vietnamese accents. ⌘, / Ctrl+, opens Settings.
-- Settings: a search box that finds a setting by what it does, sections grouped (Chung, Agent, Công cụ, Thông tin), a Shortcuts section, a description under each appearance setting, and the release at the foot of the list.
+**Forked company conversations take messages again.** A forked company conversation now accepts messages; forks made with 1.12.0 or earlier must be forked again.
 
-## v1.10.0 - 2026-10-05
+### Breaking changes
 
-A helper may object to the brief the main agent gave it. The main agent
-decides and has to answer; the same disagreement a second time goes to the
-member.
+- Forks made with 1.12.0 or earlier stay unreachable: fork the source conversation again after updating.
 
-### Managed team harness
+### Fixed
 
-- Every helper (scout, research, verify, review) reads the member's request verbatim, and the current plan, above the main agent's brief. A short follow-up such as "tiếp tục" brings the earlier message that states the task. Before, a helper saw only the brief, and a brief that dropped part of the request could not be seen to drift; the harness's own review after "tiếp tục" was told the request was "tiếp tục".
-- A helper ends its answer with `brief_issues` (wrong premise, conflicts with the request, ambiguous, out of scope), each with evidence. It objects only when acting on the brief as written would give a wrong or wasted answer; a guess the brief marks as a guess ("if any", "for example") is not an objection. The harness shows the objection in the conversation and adds a note to the main agent: answer it with a corrected brief, another approach, or a reason. An objection that no corrected brief followed is asked about once before the turn ends.
-- Objections to a brief the harness wrote itself (its review, its re-check) are not relayed: they only restate the member's request.
-- A second objection from the same helper for one message ends the exchange: the member decides, and the helper is refused (`managed-helper-disputed`) until the member's next message.
-- With a required review, an agent that answers a blocking finding instead of changing the code has its answer judged by the reviewer, who keeps or withdraws the finding. A kept finding goes to the member. A re-review after a fix also reads the answer that came with it.
-- With a required verify, a claim the verify helper marked failed goes back to the agent once, then the verify helper checks it again with the agent's answer. A claim outside the member's request that the result does not depend on is set aside as unverifiable; a claim that still fails goes to the member.
-- A turn whose disagreement went to the member ends as `disputed`, with or without a code change. Process report version 3 adds `objections`, `objections_answered` and `disputes`; a Studio or Agent Watch that does not list it receives version 2 with the outcome it had before.
+- Every message to a forked company conversation returned “The message was not sent”; forks now work.
 
-- The main agent asks the member when the request leaves a decision open (`ask_user`): 1–4 questions, each with 2–4 numbered options and "Other" in the member's own words. It waits for the answer, then goes on with it. In the Terminal each question is a selector; with no screen to ask on, the agent states the assumption it makes and goes on.
-- A question the member stopped before answering (or whose screen went away) tells the agent the decisions are still the member's: on "tiếp tục" it asks again instead of choosing for them. The tool also says not to add an "Other" option of its own.
-- A helper's receipt (its tokens, the patch it read) stays in the conversation for the member but is no longer part of the main agent's context, where it read as a message from the member ("you sent a line 'Review: … tokens'").
-- A check command that fails by returning an error result, rather than throwing, counts as a failed check (main agent, network commands and helper checks), so a required check never passes on a failing run.
-- A helper refused for its account's usage, resting, or whose account went away starts once more, and Studio gives it the next model of its role (a Harness "Model dự phòng").
-- A patch larger than one reviewer reads (120 KB) is reviewed in parts of whole files, one after another under the review grant, and the findings merge. A file too large to read, or a repository cloned inside the project, is named as not read instead of stopping the review.
-- Requests of one role running side by side share one grant renewal, so none voids another's token. The main agent's prompt cache key follows the conversation, not the turn.
+## v1.12.0 - 2026-10-06
 
-### Dashboard
+**@ any file or folder, skills with /, tests in the company sandbox.** @ picks any file or folder, agents read outside folders read-only, existing skills work with /, and common test suites run in the sandbox.
 
-- A question from the main agent is a card above the conversation: numbered options with their meaning, "Khác" with a text field, "Để agent tự quyết" and "Gửi câu trả lời". Number keys choose, Enter sends; the turn shows "chờ bạn trả lời câu hỏi" while it waits. A company conversation's question is read and answered through the company Gateway; a card answered in another tab, or withdrawn, leaves within seconds. A waiting question keeps the turn alive past the 15-minute silence limit.
-- A tab whose browser session was replaced by a newer launch in the same browser (Agent Watch's WebUI button clicked again) no longer has every change refused: a refused change reads the browser's current session once and is sent again.
-- Objections, the reviewer judging an answer, failed claims and disagreements appear in the turn; the conversation row says "Cần bạn quyết". A step that asks nothing of the agent no longer hides its last answer behind "this turn has no answer".
-- Harness roles are named Subagent scout, research, verify and review, and process notes keep the usual English terms (check, fix, blocking, claim, plan).
+### Added
 
-## v1.9.3 - 2026-10-03
+- Typing @ offers the project's files and folders, and after `~/`, `/` or `../` any folder on this Mac.
+- Agents read folders you point to outside the project, read-only; hidden home files, `~/Library` and credential files stay closed.
+- Skills and commands in the project's and your agent folders, such as `.pi` and `.agents/skills`, work with `/command` or `/skill:name`.
+- Tests of common languages run in company conversations, with per-project package caches and local servers reachable.
 
-Typing Vietnamese no longer sends or creates twice, and helpers read less of
-each web page.
+### Improved
 
-### Dashboard
+- An unsent message stays in each conversation and the new chat across switching and reloads.
 
-- An Enter that commits text from an input method (Vietnamese Telex/VNI and others; Safari reports key code 229) only finishes the word and never sends. Shift+Enter is still a new line.
-- Pressing Enter twice, or Enter and the send button, before the page re-renders creates one conversation and sends one message. Before, a second press could start a second identical conversation, and a member saw two created two seconds apart.
+### Security
 
-### Managed team harness
+- Personal conversations could edit `~/` paths outside the project; the guard now checks the path the tool actually opens.
 
-- A helper reads at most 20,000 characters of a web page, and 12,000 unless it asks for more. The main agent keeps 30,000 and 100,000. A helper's pages stay in its context for every later request of its run: a news question had read 217,000 tokens in a single research request. The tool description asks for the page or section that answers the question rather than a whole site.
+## v1.11.1 - 2026-10-05
 
-## v1.9.2 - 2026-10-03
+**Updates end on the new release's dashboard.** Whether started from the dashboard or `piagent-update`, an update now ends with the dashboard running the installed release.
 
-Web work in company sessions goes to the research helper, search results name
-their engine, and sending a message no longer jumps the dashboard to the top.
+### Fixed
 
-### Managed team harness
+- An update from the dashboard installed the release but could not restart the dashboard on npm installs; it now restarts.
+- After `piagent-update`, `piagent dashboard` reused the old release's dashboard; it now restarts on the installed one.
 
-- With a research helper in the Harness, the web is the helper's work. The main agent has no `web_search` or `web_fetch`: searches and pages are read on the research model, and only its summary with sources reaches the main agent. Before, a question about the news ran search and page reading on the main model.
-- Without a research helper, the main agent keeps its own web tools.
-- A search result now names the engine that answered: Tavily, Exa or Parallel through the company search pool, or the model provider's own search. Before, the agent told the member it did not know which engine it used.
-- The agent introduces itself as Piagent, the company coding assistant, even when the model account's system line gives another product name.
+## v1.11.0 - 2026-10-05
 
-### Dashboard
+**One-click updates and an editor-style dashboard.** The dashboard checks for and installs Piagent and Pi updates itself, and gains a status bar, a command palette and searchable Settings.
 
-- Sending a message in a long company conversation no longer jumps the page to the top. When a turn started, the "company mode is off" check remounted the whole history, even though company mode was running, and the page lost its height for a moment. That check now reloads the history only when company mode comes back after being seen down, and the reload keeps the history on the page until the new read arrives.
-- The helper count in the conversation header and the Workspace panel shows the number of helpers the Harness enables (up to four) instead of a fixed 2. A Harness without helpers shows no count.
+### Added
 
-## v1.9.1 - 2026-10-03
+- The dashboard checks for a new release on open and every 6 hours, and shows it in the status bar and Settings.
+- One click updates Pi and Piagent together, with Pi kept on the version Piagent pins; it is locked while a turn runs.
+- A command palette (⌘K / Ctrl+K) reaches actions, settings and conversations by name, ignoring Vietnamese accents.
+- Settings can be searched by what a setting does, with grouped sections and a Shortcuts section.
 
-Two more company helpers (scout and verify) and web search for every company
-role through the team's search pool. The company sandbox now runs type
-checks, Vitest and end-to-end suites that it used to stop. The installer no
-longer advertises commands 1.9.0 retired.
+## v1.10.0 - 2026-10-05
 
-### Install
+**Agent asks when unclear, subagents can object to a brief.** The main agent asks you numbered questions when a decision is open, and subagents can object to a brief with evidence.
 
-- `piagent-install` no longer ends its next steps with `/workflow task Implement <task>`, a command 1.9.0 retired; typed in Pi, it would have reached the model as a message and started a paid turn. Work is requested in plain language.
-- `/subagents-doctor` is listed in those next steps only when the install includes pi-subagents, which provides it: `piagent-install` adds it only with `--with-subagents` or when it is already installed.
-- `piagent-setup` lists `/mcp` and `/subagents-doctor` in its next steps only when that run installed them (not with `--no-mcp`, `--no-subagents` or `--project-only`), and no longer lists the retired `/onboard` and `/onboard run`; its daily flow says to ask in plain language instead of `/workflow task`. `piagent-init` no longer lists `/onboard` either. A test checks that no install script prints a command 1.9.0 retired.
+### Added
 
-### Managed team harness
+- The main agent asks 1–4 questions with numbered options and “Other” when the request leaves a decision open, then waits.
+- Subagents read your request verbatim and can object to a brief with evidence; a second objection goes to you.
 
-- Two more helpers when the company Harness enables them, beside research and review. **Scout** reads the project only (no web, no commands) and answers with `file:line` facts. **Verify** checks a result on its own: it runs the repository's checks and confirms claims against the code and primary sources, then answers pass, fail or unverifiable for each claim, with evidence. Its commands run offline, and the project is read-only for them.
-- A check that verify ran and passed counts toward the turn's process, the same as one the main agent ran.
-- The main agent is offered only the helpers its Harness enables, and the prompt says when to use each one. With scout enabled, research is meant for questions that need the web. A call to a helper that the Harness lacks fails at once (`managed-helper-not-configured`).
-- The dashboard counts running helpers against the number enabled, not against two.
-- Every company request names the client to Studio as `piagent/<version>` (model requests and web search), so Studio's reports show Piagent and its version instead of an unknown tool.
-- Company `web_search` asks Studio's search pool first, for every role: the team's search keys, then keyless providers. A Claude or Codex role falls back to its provider's own search tool when the pool is missing (an older Studio) or finds nothing. A role on an API-key vendor model (DeepSeek, MiMo and others), which has no search tool of its own, can now search. The pool request carries the run token and the role id, never a model or effort.
+### Improved
 
-### Company sandbox
+- A subagent out of quota or whose account is resting runs again on the Harness's fallback model.
+- A patch larger than 120 KB is reviewed in parts and the findings merge, instead of stopping the review.
 
-- `auth.json` is blocked only at the project root and in dot folders, where credentials live (Composer, `.codex`). A translation file such as `src/locales/en/auth.json` is readable, so type checks of i18n projects pass.
-- Credential files (`.env*`, `credentials*`, `.npmrc`, `.netrc` and those `auth.json`) are hidden as well as unreadable. A tool that loads them when present (Vite, Vitest, Next) runs without them instead of failing with `EPERM`.
-- Committed templates (`.env.example`, `.env.sample`, `.env.template`, `.env.dist`, `.env.defaults`) are ordinary files.
-- In a folder that is not a git repository, a command that only reads (`ls`, `cat`, `grep`, `git status`…, with nothing written to a file) no longer counts as a code change, so a turn that only read files and ran checks no longer reports "code changed". A command that writes still counts.
-- End-to-end tests run through `run_with_network`. An approved command may start a local server and drive Playwright's Chromium against it, using:
-  - listening on loopback;
-  - the member's Playwright browsers;
-  - Chromium's own rendezvous services.
+### Fixed
 
-  Other system services, Keychain among them, stay closed. The sandbox cannot tell loopback from all interfaces, so the approval card says that a server the command starts accepts connections while it runs.
-- A command's own timeout, up to 30 minutes, now extends the 10-minute limit, so a build followed by an end-to-end suite fits.
+- A check that returns an error result now counts as failed, so a required check never passes on a failing run.
 
-## v1.9.0 - 2026-10-02
+## v1.9.3 - 2026-10-03
 
-Freeform sessions and the managed team harness. This release retires the task
-contract and the workflow commands; work is requested in plain language and the
-guard checks every tool call.
+**Vietnamese typing no longer sends twice, helpers read less.** Enter used by an input method no longer sends, a double Enter sends once, and helpers read less of each web page.
 
-### Freeform sessions
+### Improved
 
-- Retired the task contract: a session no longer creates a contract, declared scope, work plan, acceptance receipt, completion gate or recovery handoff, and no write waits for one. Task records written by earlier releases under `.pi/piagent-state/tasks` stay readable as history.
-- Retired `/workflow`, `/fresh` (and `/fresh-*`), `/onboard`, `/onboard-project`, `/commands`, `/piagent-commands`, `/model-options`, `/profiles`, `/profile-tech` and the prompt-template aliases (`/task`, `/scout`, `/be-to-fe`, `/plan`, `/discuss`, `/review`, `/commit`, `/pr`, `/platform-improve`). Pi no longer loads `packages/piagent-core/prompts`. Project onboarding is a plain request recorded with `piagent_project_onboarding_record`.
-- Retired the task-bound tools `piagent_task_start`, `piagent_task_progress`, `piagent_task_gate_check`, `piagent_context_record`, `piagent_verify_record`, `piagent_trace_record` and `piagent_memory_citation_record`; a tool group never re-activates them. `piagent_document_read` and `piagent_source_checkout` remain.
-- The input hook passes text through unchanged: pasted checklists are no longer collapsed and long prompts are not stored in a task inbox.
-- Delegation allows up to two fresh read-only helpers; token-saving estimates are telemetry, not an admission gate (bounded-delegation-v2).
-- Kept for freeform turns: protected and read-only paths, permission profiles, the context budget for large files, confirmation for destructive and external-provider actions, and the stale read-to-edit check, which was keyed to the task run and now uses the session.
+- A helper reads at most 20,000 characters of a web page (12,000 by default), cutting token use on research.
 
-### Managed team harness
+### Fixed
 
-- Added the managed harness for company sessions imported by Agent Watch (`piagent studio`, `--web`): Studio chooses the main, research and review routes; tools run in a sandboxed worker with per-run authority.
-- Per-turn process from the team's Harness in Studio: plan, checks and review, each `suggest` or `require`, with bounded fix loops. A plan guard refuses edits (including shell edits) until a plan exists and reports `planSkipped` after three refused answers; invented tool names are counted.
-- Process report v2 (`plan_skipped`, `unknown_tools`) is negotiated: Studio lists `process_versions`, Agent Watch advertises `process-v2`.
-- Detached processes are stopped at turn end; stopping during a helper reports `aborted`/`managed-helper-cancelled` instead of a send failure.
+- An Enter that commits text from a Vietnamese input method sent the message; it now only finishes the word.
+- Pressing Enter twice could create two identical conversations; it now creates one and sends one message.
 
-### Security and fixes
+## v1.9.2 - 2026-10-03
 
-- The runtime dependency audit accepts three denial-of-service advisories in `brace-expansion` 5.0.9 (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p) until 2026-10-31: every published Pi host, 1.0.0 included, pins that version through its npm-shrinkwrap, so no Piagent change can update it. The exceptions live in `scripts/runtime-advisory-exceptions.json`, apply only at the Pi host's own copy, print on every audit and end on their own; any other finding still blocks.
-- Redacted Agent Studio credentials (`as_live_`, `as_device_`, `as_run_`). Write/edit previews and runtime command output are redacted before they are split or truncated, the gateway stream no longer flushes half a credential on a long line, and the client live file label recognises Studio tokens.
-- A shell command can no longer create a new file in a shared source-checkout cache by spelling the path through an alias such as `/var` for `/private/var`.
-- WebUI approvals: an allowed decision is now consumed by the guard, so the decision request receives its receipt and the approval leaves the queue. Before, every decision without a task stayed pending and could fill the broker.
-- Removed the WebUI runtime actions that still sent `/commands` and `/onboard ...`; with those commands gone they would have reached the model as a message and started a paid turn. A test now ties every WebUI runtime action to a registered command.
-- `piagent-explain` no longer lists task-contract, task-scope or lifecycle gates.
-- The sandbox allows signals within the same sandbox, which fixes `grep` EPERM, timeouts and orphaned cancelled commands.
-- The dashboard relay no longer freezes when `project.paths` exceeds the default control response limit.
+**Web work goes to the research helper, chat stays in place.** With a research helper, web work runs on its model and only a summary reaches the main agent; sending no longer jumps the page.
 
-### Dashboard and company mode, from live runs
+### Improved
 
-- A company turn now settles once, after its harness rounds (the check request, the review, the fixes). Before, the dashboard treated the turn as finished at the first answer: Stop disappeared, the later rounds were not streamed, and for a moment the turn read "no answer yet, press Continue".
-- `run_with_network` works: the network sandbox now allows the system resolver socket, so an approved command can resolve host names. Before, every approved network command failed with `ENOTFOUND`. When an approved command still cannot reach the network, the agent is told the network is unreachable instead of being pointed back to `run_with_network`.
-- The header and the Workspace panel show a review subagent while it runs ("Subagent 1/2"); its start and end now refresh the conversation.
-- A company conversation opened while company mode is not running (after a restart, a crash or an update) says so and offers Reconnect in place. Reading still never starts company mode, since starting may ask for Keychain access.
-- A conversation whose history cannot be read no longer shows the previous conversation's messages under its title.
-- Approval cards: the network approval shows the exact command; task, tool-call and provider references are gone; paths inside the project are shown relative to it (the project folder reads "The whole project folder"); known reasons and consequences are shown in Vietnamese. The exec-policy reason now reads "Confirmation required: the command runs git push" instead of naming a "legacy policy pattern".
-- An `apply_patch` step is shown as an edit of its files with the patch's diff, like `edit`, in the history and while it runs.
+- With a research helper in the Harness, searches and page reads run on its model and only its summary with sources returns.
+- Each search result names the engine that answered it.
 
-### Many members at once, from a 20-developer run
+### Fixed
 
-- A company request that Studio refuses because every company model account that can serve the conversation is busy (`session_account_busy_retry_later`, `session_account_not_ready_retry_later`, `concurrency_limit`, `account_capacity_unavailable`, `request_rate_limit`) now waits in line and is asked again, for up to 20 minutes. These refusals come before any model is asked, so nothing is sent twice; a failure after admission is still never replayed. The wait is a step of the running turn in the dashboard ("Wait for a free company account") and the working line in the Terminal; Stop ends it. Before, the turn failed after Studio's 30-second wait.
-- Dashboard commands are outdated only when their own conversation changed. Before, any change to any conversation made every other command stale, so with several conversations running a new conversation could fail with `session-revision-stale`. A failure to create a conversation is now shown as a sentence instead of a code. Stop no longer fails while the agent works through quick steps: a running turn changes its conversation after every step, so Stop is bound to the operation it names, not to the page's last read; if Stop still fails, the dashboard says so instead of doing nothing.
-- A company request refused before the model did any work because the account's sign-in was being renewed (`upstream_auth_required`, `execution_precondition_failed`) is asked again up to three times, 3, 6 and 9 s apart; an account that really has to sign in again still says so.
-- Opening a company conversation, starting a run and granting a subagent ask Studio again when it is too busy to answer in time (`serverUnavailable`), as does a request Studio could not check in time (`operation_unavailable`). Under load, most company conversations opened from the dashboard used to fail to open, and most required reviews ended as "review could not run". A review that still cannot run keeps its reason as a code in the conversation file.
-- The dashboard stays fast with many conversations: listing them read every session file in full on every catalog (863 conversations: about 4 s each time, far more under load, so pages waited 30–40 s and timed out). Unchanged files now keep what was read before and only changed ones are read again, by Pi itself (44 ms instead of about 4 s).
-- A member's session can read the skills Pi lists for it where they are installed (the package's and the user's); the guard used to refuse that read as "outside the project". Writes there stay refused.
-- A new conversation whose creation takes longer than the dashboard's 30-second answer (the first one after the Gateway starts, a company runtime opening) is no longer reported as "could not be created" while it is created and runs: the page sends the same command again, which waits behind the create and returns its receipt, for up to two minutes; if it still has no answer it says the conversation may exist. Before, a member who believed the message was lost sent it again and two runs edited the same project.
-- A dashboard message that stays unconfirmed is released after two minutes: its command now expires then, so it can no longer run, and the draft is kept to send again. Before, the composer stayed locked until the page was reloaded.
-- Company sessions recover after the Mac sleeps: a run grant that lapsed under a request (Studio's clock catches up at once after a sleep, and grants last two minutes) is renewed and the request asked again, and an Agent Watch helper killed by a request that outlived the sleep is replaced when the next turn starts. Before, every company conversation failed with `invalid_run_grant` or "the Agent Watch helper stopped" until it was reopened.
-- A request the model's provider declines under its usage policy (seen when a member asked to print an `.env` file encoded in base64) is reported as such, with its own dashboard copy ("ask in a different way"), instead of "the request could not be sent".
-- An answer stream that ended with nothing in it ("stream ended without a stop reason") is reported as "the model returned no response" (`upstream_incomplete`) instead of "the request could not be sent"; it is not sent again, and "tiếp tục" continues. A company failure no code names keeps its own words, redacted, in the conversation file (not shown) so it can be told apart later.
-- Two project folders with the same name (two clones of one repository) show where each one is in the new-conversation menu.
-- A message sent right after Stop reaches the conversation on a busy machine. Every catalog the dashboard built opened and parsed every conversation file to learn its model and thinking level (929 files, 140 MB: about a second of blocked Gateway each time, 1–6 s under load); a Stop then took up to 50 s and the next messages stayed unconfirmed with the composer locked for minutes. A file's facts are now kept until its size, modification time or inode changes: catalogs take 0.1–0.5 s under the same load, and a stop-then-send probe that failed 3 of 4 times passes.
-- A Gateway that is busy is no longer replaced by a second one. `piagent dashboard open` and the company launch took a Gateway that did not answer within 1.5 s for gone and started another; the new one took over the control socket while the first kept running unreachable, serving its pages and holding its conversations (three were found running at once). A Gateway that answers late is waited for (up to 30 s), only a socket nobody listens on is replaced, and an old Gateway that exits no longer removes the running one's socket.
-- `piagent-doctor` lists `enabledModels` patterns that match no model Pi knows (Pi warns about each on every start), and `piagent-model-scope --prune` removes only those; patterns of a provider that is only signed out are kept.
-- Public text names no other agent product or project; the wording check enforces it across docs, the docs site and the core package.
+- Sending a message in a long company conversation jumped the page to the top; the history now stays in place.
+- The helper count shows the number the Harness enables instead of a fixed 2.
 
-### Experiment loops and test audits
+## v1.9.1 - 2026-10-03
 
-- The guard covers experiment-loop tools that an optional Pi package can add. `run_experiment` runs its command through `bash -c` itself, so the guard checks that command like `bash` (protected paths, the exec policy, confirmations, read-only profiles). `log_experiment` commits every change when an idea is kept and erases every uncommitted change otherwise, outside the guard, so `init_experiment` and `log_experiment` run only on an `experiment/` branch or a linked worktree, and `init_experiment` only with nothing uncommitted outside `.auto/`. A loop config that moves the commands to another folder is refused. The dashboard shows an experiment run as the command it runs.
-- New packaged skill `test-audit` (`/skill:test-audit`, also chosen by the model when it writes or changes tests): decide whether a new test earns its place, and find tests that cost more than they protect, with a read-only review table before any edit.
+**Scout and verify helpers, web search for every company role.** Two more company helpers, web search for every role through the team's search pool, and type checks and end-to-end tests in the sandbox.
 
-### Guard cleanup
+### Added
 
-- Removed the guard code that only ran with a task contract: the completion hook, task change and verification recording, the task-bound branches of tool authorization (read-only task rules, opaque-shell rule, semantic repair, phase decisions, performance review), and the phase-tool, semantic-repair and independent-acceptance runtimes it created. The guard went from 4993 to 4139 lines; protected and read-only paths, permission profiles, the context budget, the stale-edit check and confirmations are unchanged.
-- Reopening a session that ran a task before 1.9.0 no longer resumes, re-binds or warns about that task; its records stay as history.
+- Scout reads the project only and answers with `file:line` facts; verify runs checks offline and rates each claim with evidence.
+- Company `web_search` uses the team's search pool for every role, so roles on API-key models can search too.
 
-### Models
+### Improved
 
-- Added reviewed Sonnet 5.5 metadata to explicit Claude/full model-scope setup on Pi 0.87.1: native 1M context, 128K output, adaptive thinking, no unsupported off/minimal modes or temperature override. Existing custom endpoints and model entries are preserved. This does not establish account entitlement.
-- Included Sonnet 5.5 and Opus 5.5 in model selection presets. Agent Watch can supply the same model through a Studio key without changing personal authentication.
+- A command's own timeout, up to 30 minutes, now extends the 10-minute limit.
 
-### Tests and evidence
+### Fixed
 
-- Retired the test suites that only exercised the task contract (task lifecycle, acceptance gating, workflow dispatch and the scripted production journeys that asserted task records); they remain at commit 85f76db. Security assertions that used a task as setup were rewritten to run without one, and the reconnect, lost-receipt and single-turn HTTP/WebSocket journeys now run as freeform turns.
-- The historical P3 phase-tool counterfactual reports `counterfactual-baseline-retired` instead of a ratio, because its baseline tools no longer exist.
-- Benchmark and journey results published for earlier releases were measured with task contracts and are historical.
-- Live verification on the installed release: 9 personal dashboard scenarios and 4 company scenarios (plan, checks and review; Stop during the review; a network install after approval; a message sent during a turn) pass; 27/27 browser tests.
-- A busy test fixture that ignores SIGTERM now exits when its test runner is killed, instead of spinning a CPU core.
-- Docs site: an Ecosystem page (Piagent, Agent Watch, Agent Studio), a 1.9.0 What's new with dashboard screenshots, and pages that still described the task contract updated. The screenshots are served by the site and not shipped in the npm package.
+- Type checks, test runners and end-to-end suites that the sandbox used to stop now run, with credential files hidden.
+- `piagent-install` and `piagent-setup` no longer suggest commands that 1.9.0 retired, which would have started a paid turn.
 
-### Install and update
+## v1.9.0 - 2026-10-02
 
-```sh
-npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.87.1
-npm install -g --ignore-scripts @piagent/platform@1.9.0
-piagent-install --stable
-piagent-doctor --offline
-```
+**Freeform sessions and the team Harness.** The task contract and workflow commands are gone: you ask in plain language, the guard checks every tool call, and company mode runs the team's Harness.
 
+### Breaking changes
 
-## v1.8.0 - 2026-09-23
+- Retired the task contract and `/workflow`, `/fresh`, `/onboard` and related commands; ask in plain language instead.
 
-- Pinned Pi host and Pi AI to 0.87.1 so Codex-authenticated sessions and the WebUI can list GPT-6 Astra, Sol, and Luna. Pi's authenticated catalog remains the authority for availability and supported thinking levels.
-- Added a new parent-routing map: Luna Medium for bounded work, Sol Medium/High for everyday and higher-risk work, and Astra Extra High for broad ambiguous work. Parent routing stays off by default; explicit model pins remain unchanged. If a GPT-6 target is unavailable, the router records a legacy 5.6 fallback instead of silently substituting it. The historical v1 mapping and benchmark corpus remain frozen.
-- New setup and WebUI sessions prefer GPT-6 Sol High when authenticated. Existing sessions and explicit user settings are not rewritten by the package. Astra's unsupported `off` level is omitted from WebUI choices.
-- Verified the release without paid provider turns; the prior 108-session comparison is historical evidence for v1.7.1, not a GPT-6 performance or token-saving claim.
+### Added
 
-### Install and update
+- Company sessions run the team's Harness from Studio: plan, checks and review each turn, suggested or required, with bounded fix loops.
 
-```sh
-npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.87.1
-npm install -g --ignore-scripts @piagent/platform@1.8.0
-piagent-install --stable
-piagent-doctor --offline
-```
+### Improved
 
-## v1.7.1 - 2026-09-23
+- When every company model account is busy, a request waits in line for up to 20 minutes instead of failing.
 
-The v1.7.0 tag was not published: both tag workflow attempts reached the
-40-minute macOS job limit during offline verification, even though the same
-commit passed the pull-request matrix. v1.7.1 keeps the runtime and benchmark
-boundary below and raises that CI limit to 75 minutes. No additional provider
-sessions were run.
-
-### Session recovery, context, and accounting
-
-- Updated the supported Pi host to 0.86.1. Preserved the selected model and
-  thinking level while correcting SDK lifecycle, usage, and WebUI settlement.
-- Added `piagent_wait` for requested pauses inside an open session. The local
-  timer does not call the model while waiting; cancellation, session changes,
-  and replay retain explicit interrupted or pending state.
-- Bound task usage, edit/verifier timing, and context delivery to the active
-  task. Filtered unsupported context files before selection and kept scoped
-  native-read recovery when no context pack can be delivered.
-- Extended source-bound acceptance and bounded executor checks, preserving
-  rejection of verified failures and finite handoff for unsupported work.
-- Set acceptance proof to diagnostic by default. Unproved criteria remain
-  pending with an explicit no-quality-claim completion note; task contract,
-  scope, passing verification, and trace remain hard gates. Reviewed package
-  policies can select strict `enforce` mode when required.
-
-### Diagnostic benchmark closure
-
-- Separated recovered command errors from terminal failures in the controlled
-  comparison collector and added exact failed-attempt selection for diagnostics.
-- Clarified three public task contracts and verification examples, and corrected
-  reconnect grading to compare public state while allowing internal cleanup.
-- The historical 108-session run remains 49/54 Piagent PASS and 45/54 comparison
-  PASS. A separate selected rerun passed all 14 formerly failed attempts;
-  the other 94 attempts were not rerun. Inputs changed for three scenarios, so
-  these results are not combined into a new 108-session score.
-- The selected rerun used 640,121 fresh tokens and 3,010,425 including cache.
-  Fresh usage increased 23.0% across that subset. This release makes no new
-  aggregate token-saving or production-performance claim. The operator closed
-  the paid benchmark cycle; release validation does not open provider sessions.
-
-### Install and update
-
-```sh
-npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.86.1
-npm install -g --ignore-scripts @piagent/platform@1.7.1
-piagent-install --stable
-piagent-doctor
-```
+### Fixed
 
-## v1.7.0 - not published
+- Approved network commands always failed with `ENOTFOUND`; `run_with_network` now resolves host names.
+- The dashboard was slow with many conversations and left messages sent after Stop unconfirmed; both are fixed.
 
-The annotated tag exists, but its macOS tag gate timed out twice at 40 minutes.
-The publish job was skipped, and no `@piagent/platform@1.7.0` npm package or
-GitHub Release was created. Use v1.7.1 for installation.
+### Security
 
-## v1.6.1 - 2026-08-26
+- Agent Studio credentials are now redacted in edit previews, command output and the gateway stream.
 
-### Runtime continuity and truthful WebUI state
-
-- Kept queued same-session work under one operation identity and prevented a
-  pending durable task from emitting a completed message or a success bubble.
-  Final-looking drafts remain hidden until the task reaches a terminal state,
-  preserving user-message then assistant-response ordering without a stale
-  processing indicator.
-- Reconciled Activity from canonical tool evidence. Handled multi-target search
-  warnings finish normally, nested result envelopes are classified correctly,
-  and rejected or evidence-free helper calls remain visible as failures instead
-  of later replaying as passed.
-- Captured the latest real operator request for model-owned task startup while
-  bounding and redacting the durable copy, so attachments and workflow wrappers
-  no longer replace the user's actual intent.
-
-### Safe external source review
-
-- Detects GitHub, GitLab and Bitbucket references and activates only the minimal
-  source-checkout surface needed for a review. A successful checkout grants
-  session-scoped read access to that exact canonical tree, with an eight-source
-  bound and automatic cleanup at session end.
-- Preserved protections around shared caches, sibling paths, symlink escape,
-  credentials, `.env`, `.git` and all mutation paths. Read-only inspection may
-  use bounded `read`, `grep`, `find` and `ls` flows without widening the project
-  mutation contract.
-
-### Solo-first cost and context controls
-
-- Added direct subagent preflight with a one-helper ceiling, bounded calls,
-  turns and runtime, read-only role enforcement, no automatic retry/fork/worker
-  expansion, and truthful durable helper usage. Repeated helper results are
-  compacted without changing the model or thinking level.
-- Hardened adaptive context accounting, exact verifier reuse, task-evidence
-  refresh and bounded runtime emission so token-saving decisions fail closed
-  when evidence is incomplete and cannot be relabeled as a Codex-relative cost
-  claim.
-
-### Benchmark assurance
-
-- Added provider-free runtime-conformance and Codex-relative efficiency gates,
-  bound token/cost evidence to exact workload and provider attempts, and kept
-  the historical v1.6.0 production result explicitly separate from any new
-  subscription-spend or 30–40% cost claim.
-- Preserved the 108-session production gate as an operator-authorized quota
-  step; this release ships runtime and benchmark safeguards without claiming a
-  new provider-backed result.
+Requires: Pi 0.87.1.
 
-## v1.6.0 - 2026-08-24
+## v1.8.0 - 2026-09-23
 
-### Context efficiency and source safety
-
-- Replaced overlapping automatic discovery and criterion snapshots with one
-  criterion-aware initial pack. It prioritizes explicit targets and their
-  linked tests, excludes unrelated graph-only files, uses bounded snippets for
-  large files and records content/payload receipts for every injected item.
-- Corrected context-efficiency accounting so exact repeated reads are measured
-  only within a session/task/model/thinking partition, missing evidence remains
-  visible as unavailable, fallback rereads do not reward retrieval ranking, and
-  tool-schema share is reported against the complete system-plus-tool prefix.
-  Duplicate-output and retrieval-confidence rates now exclude unclassified
-  historical rows and expose their partial coverage instead of treating them
-  as zero waste. The aggregate context-waste score is now `null` unless every
-  weighted telemetry lane is complete; partial data is labeled only as a
-  diagnostic estimate.
-- Sanitized automatic source snapshots before provider injection while
-  preserving pure dynamic credential references. Sensitive literals, including
-  short values and numeric fallbacks, are redacted in common source syntax and
-  structured YAML, XML, HTML, CSS and Objective-C inputs with line-count-
-  preserving receipts. A redacted item retains only a digest of the sanitized
-  text; neither the raw-content digest nor another guessable verifier for the
-  original bytes is persisted. Sanitization of deeply nested calls is bounded.
-- Preserved one planned criterion source and its focused test when retrieval is
-  unavailable or stale, and retained complete per-item receipts for automatic,
-  command and tool-delivered context packs.
-- Cleared task identity, repeated-result state and pending context delivery at
-  terminal boundaries while preserving terminal-turn usage attribution. A new
-  request or workflow in the same session now starts clean, including after a
-  missing binding or terminal session restart.
-
-### Forty-percent benchmark contract and spend control
-
-- Raised the canonical production-v1 contract to require a fixed-workload,
-  family-clustered fresh-token upper-95 ratio at or below `0.60`. The estimator
-  includes all three predeclared attempts per surface in every family, including
-  exact provider-started failed-attempt usage, and does not condition token
-  measurement on task outcome. Every declared scenario/repeat must still have
-  an exact finite grade pair with no Piagent quality regression, and all Piagent
-  sessions must satisfy the independent continuity gates.
-- Added a separate GPT-5.6 Luna API-equivalent text-token cost diagnostic. It
-  prices exact text-token buckets, remains distinct from OAuth/provider billing,
-  and does not block the token-focused production claim.
-- Added duration comparison globally, by workload band and by family as
-  observational evidence. The canonical contract allows Piagent to be slower
-  when fresh-token, paired-intelligence and task-continuity gates still pass.
-- Froze production-v1 to Luna Medium and a ledger-bound S0/12/36/72/108 spend
-  sequence. Only S108 is claim-eligible; every earlier pause recomputes a
-  provider-free diagnostic and prints the exact bounded resume command.
-- Bound seed, surfaces, model, thinking, repeats, zero retries, paired terminal
-  stop and clean source identity before paid work. Reserved built-in suite IDs
-  cannot be impersonated by external suites, including through direct report
-  summarization.
-- Added a privacy-safe causal context receipt for every Piagent measurement.
-  The receipt binds telemetry provenance, current prompt/terminal order and the
-  exact offer/delivery/injection lifecycle before dropping paths, hashes and
-  identifiers. Missing, malformed, orphaned or mismatched evidence preserves
-  the paid ledger row but blocks S12 advancement and the final token claim.
-  S12 now reports aggregate pack tokens, zero-selection reasons, managed-prefix
-  compaction, successful direct fallback reads and shell-call exposure.
-- Reconstructs a missing terminal stop from the accepted ledger before any paid
-  resume, so a crash between the durable append and stop marker cannot spend the
-  rest of an authorized window.
-- Finalizes a complete ledger or valid final post-guard WAL without live auth,
-  provider preflight or installed Pi/Codex executables. Finalization rehashes the
-  current candidate, suite, runtime-dependency tree and ledger while reusing the
-  frozen command/auth/preflight identities bound to the accepted measurements.
-- Preserved the completed 108-session r3 ledger as observational evidence under
-  its original successful-pair contract. It is not retroactively promoted: only
-  a new provider run on the exact final candidate, after this estimand and suite
-  digest are frozen, can approve a 40% claim.
-
-### Runtime intelligence and context integrity
-
-- Bound context evidence to the exact turn, session and task run that observed
-  it. Planning selections no longer masquerade as delivered context, and stale
-  evidence cannot cross a task boundary or complete a later task.
-- Added bounded context-efficiency telemetry, delivery qualification, prefix
-  accounting and provider-wire fingerprints without exposing prompts,
-  credentials or raw provider payloads.
-- Preserved authenticated Codex model identifiers and supported reasoning
-  levels end to end. New installations default visibly to GPT-5.6 Sol with
-  High thinking while still allowing the user to choose another available
-  model for any message or session.
-- Added one fail-closed CAP-12 correction after a current exact verifier when
-  the model discovers an omission in a file it already authored in the same
-  task/run/session. The runtime opens repair only after an exact structured
-  mutation succeeds, permits no second source edit, and requires the exact
-  verifier again before completion.
-
-### WebUI continuity and operator clarity
-
-- Added a canonical live-state bootstrap and replay-gap recovery path so reloads
-  and multiple browser tabs agree on the running operation before reporting the
-  Gateway as live.
-- Added inactivity, absolute-runtime, termination and projection watchdogs.
-  Concurrent Stop requests share one termination, and uncertain ownership is
-  quarantined instead of being projected as an idle session.
-- Kept the conversation surface success-only: drafts, tool failures, retries,
-  completion-gate work in progress and abort details stay in Activity. Empty or
-  non-rendering provider output can no longer create a blank success bubble.
-- Made operation settlement first-terminal-wins and retained recent failures
-  independently from high-volume event traffic, preventing a retry or catalog
-  refresh from presenting contradictory outcomes.
-
-### Deeper benchmark and assurance contracts
-
-- Expanded the deep-logic benchmark with a multi-package temporal billing close
-  problem, stricter held-out variants, provider-wire checks, usage provenance,
-  statistical comparison gates and explicit Codex CLI controls.
-- Hardened benchmark accounting so unknown usage, infrastructure retries or an
-  unmatched provider attempt cannot support a token or production claim.
-- A provider-backed token-reduction claim is published only when a complete
-  zero-retry 108-session run passes on the exact clean tagged candidate. An
-  interrupted, historical or different-SHA run remains diagnostic evidence.
+**GPT-6 Astra, Sol and Luna models.** Pins Pi to 0.87.1 so authenticated sessions and the WebUI can list GPT-6 Astra, Sol and Luna, and adds a GPT-6 routing map.
 
-## v1.5.5 - 2026-08-21
+### Added
 
-### WebUI command execution hotfix
-
-- Fixed provider tool-call identifiers containing characters outside the
-  public WebUI reference alphabet. Gateway approvals now bind those opaque
-  identifiers to private deterministic references instead of falling back to
-  a terminal confirmation that does not exist in WebUI.
-- Prevented search commands such as `rg` and `grep` from being mistaken for
-  migration execution merely because their search arguments contain
-  `migrate`. Real migration commands still require explicit confirmation.
-- Made Stop cancel the exact pending approval before aborting the model
-  operation, so a session cannot remain stuck waiting for an approval after
-  the user stops it. Gateway approval failures now deny immediately rather
-  than waiting indefinitely.
-- Corrected activity reporting so a tool call remains requested until native
-  execution actually starts, and strengthened Dashboard restart to wait for
-  the previous process to exit instead of silently reusing a hung instance.
+- GPT-6 Astra, Sol and Luna appear in authenticated sessions and the WebUI; Pi's catalog decides availability.
+- New parent-routing map: Luna Medium for bounded work, Sol Medium/High for everyday work, Astra Extra High for broad work.
 
-## v1.5.4 - 2026-08-20
+### Improved
 
-### WebUI workflow hotfix
-
-- Fixed new WebUI sessions incorrectly reporting
-  `session-command-effect-unknown` even though Pi had accepted the selected
-  workflow and started the model turn. The Gateway now retains operation
-  ownership across Pi's deferred workflow dispatch and settles it only after
-  the nested agent turn reaches its canonical lifecycle boundary.
-- Added a fail-safe reconciliation path when the Gateway can identify the
-  created session but cannot yet prove the command effect. The UI opens the
-  known session, explains that synchronization is in progress, and explicitly
-  prevents a blind resend that could run the same request twice.
-- Localized internal uncertainty status and reconciled workflow-prefixed
-  persisted messages with their optimistic UI form so completed turns no
-  longer appear twice in the transcript.
-- Prevented a slow background model-catalog refresh from replacing a model or
-  thinking choice the user had just made. Session-option controls now reject
-  stale responses, and the browser regression test deliberately reproduces the
-  delayed-response ordering that previously left the change button disabled.
+- Parent routing stays off by default and explicit model pins are unchanged.
+- New setup and WebUI sessions prefer GPT-6 Sol High; existing sessions and explicit settings are not rewritten.
+- If a GPT-6 target is unavailable, the router records a 5.6 fallback instead of substituting it silently.
 
-## v1.5.3 - 2026-08-20
+Requires: Pi 0.87.1.
 
-### WebUI and Terminal parity
-
-- Brought the Terminal workflow surface into Session Hub with ten explicit
-  per-message workflows. A workflow no longer binds the whole session: after a
-  message is sent, the composer returns to Freeform so the same conversation
-  can move to a different task under the user's control.
-- Simplified the new-session composer around the essential project, model and
-  send controls. Advanced workflow, thinking, permission and attachment choices
-  now sit behind a progressive `+` control, while the default is named
-  explicitly as GPT-5.6 Sol with High thinking.
-- Added typed Project Controls for runtime and usage inspection, onboarding and
-  profile state, Context Engine, memory and MCP governance. Read-only actions
-  do not open a model turn; mutating and semantic-compaction actions require an
-  explicit confirmation and retain the existing session and revision guards.
-
-### Deeper logic evaluation
-
-- Added the `deep-logic-v1` diagnostic suite: six generated-variant, large
-  problems covering event reconciliation, dependency scheduling, layered
-  policy, context graphs, resumable streams and transactional configuration.
-  Its default paired run uses Piagent and `codex-cli` on GPT-5.6 Luna Medium for
-  24 model sessions.
-- Expanded `capability-v1` from four to six multi-component families, including
-  durable session control and causal timeline recovery, with 28 contract
-  clauses and 69 atomic checks plus stronger mutation and equivalent-solution
-  validation.
-- Added a provider-free WebUI parity benchmark for workflows, runtime controls,
-  contracts, security, Chromium flows and bounded performance stress before
-  any model quota is spent.
+## v1.7.1 - 2026-09-23
 
-## v1.5.2 - 2026-08-18
+**Pi 0.86.1, requested pauses and diagnostic acceptance.** Replaces the unpublished v1.7.0, updates Pi to 0.86.1, adds a wait tool for requested pauses and makes acceptance proof diagnostic by default.
 
-### Fixed
+### Added
 
-- The new-chat composer now accepts a dragged or pasted document, not only one
-  chosen through the paperclip. The file picker already carried attachments into
-  a new session; drag and drop was the one entry point that silently did
-  nothing, so a document dropped on that screen was lost with no message.
-- A dropped file that misses the composer no longer navigates the Gateway away
-  from the page, matching the guard the session composer already had.
+- Added a wait tool for pauses you request inside a session; it does not call the model while waiting.
 
-## v1.5.1 - 2026-08-17
+### Improved
 
-### Release repair
-
-- Supersedes v1.5.0, which was tagged but never published: its release matrix
-  failed on macOS, so the publish job never ran and the registry stayed on
-  v1.4.1. The content of this release is v1.5.0's, plus the fix below.
-- Fixed a race in the WebUI composer end-to-end test. Changing the model right
-  after changing thinking acknowledged the effect scope without waiting for the
-  panel to clear it, so on a slower runner the reset landed afterwards and left
-  the confirm button permanently disabled.
-
-## v1.5.0 - 2026-08-17
-
-### Document workspace and attachments
-
-- Added a bounded document workspace to the Session Hub for project Markdown,
-  text, PDF and DOCX material, including safe extraction, redaction,
-  truncation, protected-path enforcement and readable in-browser previews.
-- Added document and image attachment staging to New chat and active-session
-  composers. Sent files remain visible as compact durable cards instead of
-  dumping extracted document bodies into the conversation.
-- Moved attachment storage and validation into the shared core runtime so the
-  terminal package and WebUI use one authority boundary, one reservation
-  protocol and the same session identity rules.
-
-### Conversation and session experience
-
-- Replaced large tool-result blocks in chat with a compact live activity
-  timeline for file reads, image inspection, commands, edits, search, context
-  optimization and verification. Raw tool labels remain available on demand in
-  the Activity inspector.
-- Added deterministic, zero-model-turn session titles and previews. Internal
-  fresh-session routing commands are hidden from the transcript and catalog,
-  while user-visible titles stay bounded and preserve redaction markers.
-- Hid delegated runtime helper sessions from the user conversation catalog and
-  kept attachment metadata, live events and resumed session projections bound
-  to the exact public session.
-
-### Project import and capability visibility
-
-- Hardened native project-folder selection across macOS and Linux, including
-  multi-folder import and fail-closed cancellation or unsupported-host results.
-- Added exact Web search and image-input capability facts to Providers & models
-  without copying provider credentials or adding a model turn to dashboard
-  inspection.
-
-### Contracts, security and release coverage
-
-- Added the versioned document-workspace contract and extended attachment,
-  transcript, session-command and capability contracts with bounded additive
-  fields and generated TypeScript projections.
-- Added regression coverage for large/invalid documents, attachment claim and
-  retry, stale session revisions, Linux project import, hidden helper sessions,
-  durable file cards and live tool activity.
-- Kept every browser-facing file, title, provider fact and tool label behind the
-  existing redaction, protected-path, schema and capability-integrity gates.
+- Updated Pi to 0.86.1, keeping the selected model and thinking level while correcting usage and WebUI settlement.
+- Acceptance proof is diagnostic by default: unproved criteria stay pending; strict mode remains available by policy.
+- Task usage, timing and context delivery are bound to the active task, and unsupported context files are filtered out.
+- The release CI limit is raised to 75 minutes after the v1.7.0 macOS gate timed out.
 
-## v1.4.1 - 2026-08-17
+Requires: Pi 0.86.1.
 
-- Local installs now synchronize the terminal helper and WebUI Gateway from the same checkout before registering the Pi package, preventing a stale global Gateway from enforcing older session/task lifecycle rules.
+## v1.7.0 - not published
 
-### Integrity boundary
+**Not published; use v1.7.1.** The tag exists, but its macOS gate timed out twice at 40 minutes, so no npm package or GitHub Release was created.
 
-- The runtime integrity graph skipped shell entrypoints entirely, so a pinned command could execute an unpinned program: `piagent-usage` ran a 567-line reader of `~/.pi/agent/sessions/**` that the lock had never seen, because the path was built from `$SCRIPT_DIR` and the repository-relative literal never appeared in the source. Shell sources are now scanned, and a sibling reached through a computed directory is followed.
+### Improved
 
-- The published package ships the built browser bundle and not the sources it came from, so on an installed platform that 725 KB of JavaScript could not be regenerated or checked against anything — while it runs inside the origin that holds the session cookie and the CSRF token, with the authority to drive session commands, source mutation and provider auth. The server that serves it was pinned; what it served was not. The served bundle is now pinned, document included, because the document names which script runs.
+- No `@piagent/platform@1.7.0` package exists; install v1.7.1 instead.
 
-- A TypeScript module imported by its emitted name — `./x.js` for `x.ts`, the ordinary TypeScript convention — resolved to nothing and was dropped in silence. No module was outside the lock because of it, but a module that decides what the guard enforces could have been, while the graph still claimed to be complete.
+## v1.6.1 - 2026-08-26
 
-### Agent control
+**Truthful WebUI state and read-only source review.** The WebUI no longer shows success before a task ends, Git host links can be reviewed read-only, and subagent use is capped at one helper.
 
-- Command-only test/build/typecheck/package requests now enter an execution-capable governed task even when the operator forbids source edits; read-only remains a strict inspection mode instead of failing halfway through the first verifier command.
+### Added
 
-- A terminal Task Contract used to terminate the conversation with it: WebUI swallowed the next operator message before Pi persisted it, the Gateway could only report `session-command-effect-unknown`, and `piagent_task_start` then demanded a fresh Pi session. Conversations may now bind sequential Task Contracts. The closed task remains immutable, paused/stopping tasks remain closed, and the terminal boundary admits only new conversation input plus the exact successor-task start transition.
+- A GitHub or other Git host link can be checked out for read-only review, up to eight sources, cleaned up at session end.
 
-- `OwnedWorkCeilings` advertised eight limits and six of them were never read: the per-role ceilings were real but fixed at one apiece, so raising `maxScoutPasses` in a profile did nothing while `maxTotalHelpers` beside it took effect. Half-honoured configuration reads as working configuration. The ceilings are now read from the object the caller passes; every default is one, so no shipped behaviour changes, and automatic mode is pinned against widening.
+### Improved
 
-- A blocked tool call is the only conversation most operators have with this policy, and it was one-sided: of 43 distinct refusals, three said what to do next. Remedies are now attached at the single point every decision leaves through, so a refusal added later is answered without anyone remembering to. The refusal that stops the whole session says which command explains it.
+- Subagents are limited to one read-only helper with bounded calls, turns and runtime, and no automatic retry.
 
-- `piagent explain '<command>'` reports conclusive static refusals and the guard readers that found them. A static pass is now explicitly `indeterminate` until the live Pi runtime evaluates Task Contract, scope, permission, lifecycle, approval and budget state; the standalone CLI can no longer issue an "exact allow" that the real guard later blocks. `--scope` lists the static boundary in effect.
+### Fixed
 
-### Redaction and evidence
+- A pending task could show a completed message or success bubble; drafts now stay hidden until the task ends.
+- Rejected or evidence-free helper calls could later show as passed in Activity; they now stay visible as failures.
+- Attachments and workflow wrappers no longer replace your actual request when a task starts.
 
-- An npm token was recognised only where something named it, so `//registry.npmjs.org/:_authToken=npm_…` — the whole of an `.npmrc`, and what a failing publish prints — went through unredacted. Every other provider here is matched by the shape of its token.
+## v1.6.0 - 2026-08-24
 
-- Redaction runs before tool-result compaction, and that order was the only thing keeping a credential out of the capture written to project state. Nothing pinned it; reversing the two calls would have written credentials to disk and passed every test.
+**Leaner context, redacted snapshots, steadier WebUI.** One criterion-aware context pack replaces overlapping discovery, source snapshots are redacted before reaching the model, and the WebUI recovers after reloads.
 
-- An observation that states neither an exit code nor an error flag no longer satisfies a claim of success. It is unreachable through the recorded shapes, but a reader of the function that guards forged verification should not have to prove that.
+### Improved
 
-### Cost and clarity
+- One criterion-aware initial context pack replaces overlapping discovery and puts explicit targets and their tests first.
+- New installations default to GPT-5.6 Sol with High thinking; you can still pick another model per message or session.
+- Reloads and multiple browser tabs agree on the running operation, and concurrent Stop requests share one termination.
+- A token-reduction claim is published only after a complete zero-retry 108-session run on the exact tagged release.
 
-- `piagent-usage` reports fresh tokens and the cache hit rate, using the benchmark's own definition of a fresh token so the terminal and the published measurement cannot mean two different things. The rate is reported beside the count and never instead of it: in the published benchmark the baseline surface held the higher hit rate while spending more than twice the fresh tokens.
+### Fixed
 
-- Capability verification derived the ancestor set on every cache hit, which at 296 pinned files cost more than every `lstat` it performed put together. Deriving it once per snapshot took a hit from 4.28 ms to 1.61 ms with no loss of tamper detection.
+- Empty provider output could create a blank success bubble in the conversation; it no longer does.
 
-- The WebUI opens in the language the browser asked for instead of always starting in Vietnamese; the confirmation for full access focuses the safe choice, so a reflex Enter dismisses it rather than granting it; and the file a diff shows is derived from the list that is loaded, so no later clear can leave the pane asking for a file beside a list holding one.
+### Security
 
-### Install and uninstall
+- Automatic source snapshots are redacted before reaching the provider, including short and numeric secret values.
 
-- Running the documented two-command install downgraded the machine-wide Pi package to whatever pin the project being initialised happened to carry, including a project the operator only meant to open once. One resolved value served both scopes and read the project pin first, so a pin that is authority over its own project quietly became authority over the machine. The two scopes now resolve separately: the global install takes the running helper, the project keeps its pin, an explicit `--package-source` still beats both, and a divergence between them is printed instead of silently resolved.
+## v1.5.5 - 2026-08-21
 
-- Uninstall removed nothing on any machine whose helper sits under a non-default npm prefix — the fallback the installer takes when the configured global root is not writable, and whatever `piagent-update --npm-prefix` was given. `npm uninstall -g` resolves against the configured prefix, so the run exited `0` and reported completion over an install that was still there. The prefix is now derived from where the running helper actually is, the same way the updater derives it, and the follow-up command printed for the operator to copy carries that prefix too. An npx cache root is still never claimed, because it owns no bin on anyone's PATH.
+**WebUI command execution hotfix.** Fixes approvals that fell back to a missing terminal prompt, search commands mistaken for migrations, and sessions stuck after Stop.
 
-### Agent control coverage
+### Fixed
 
-- A stop request only counts as pending if its `commandId` is truthy, so an empty one records the stop and then reports nothing pending — the single outcome an operator pressing stop must never get. The journal writers never check the shape, and the only thing preventing it was a regex in the browser command validator that no test named. Malformed identifiers are now pinned as rejected at that boundary, together with the proof that a well-formed one still passes, so the guard cannot be loosened or widened into blanket refusal without a test failing.
+- Some tool calls fell back to a terminal confirmation that does not exist in the WebUI; they are now approved in the WebUI.
+- `rg` and `grep` with `migrate` in their arguments were treated as migrations; real migrations still need confirmation.
+- Stop could leave a session waiting on an approval; it now cancels the pending approval first.
+- Dashboard restart could silently reuse a hung instance; it now waits for the old process to exit.
 
-### The dashboard starts without the MCP adapter
+## v1.5.4 - 2026-08-20
 
-- `piagent dashboard` could not start on any machine where `pi-mcp-adapter` was not installed under the agent directory — an install run with `--no-mcp`, or anyone trying the package through `npx` before setting anything up. The gateway is spawned with `PIAGENT_PINNED_TS_TRANSFORM_ROOT` pointing at that adapter, and the TypeScript loader called `realpath` on it before deciding anything. That function answers one question — is the file being loaded inside the pinned adapter — and it threw instead of answering "no", so the throw escaped the loader on the first `.ts` file of any kind and killed the process. It now answers "no", which falls back to `strip`: the stricter of the two modes, so this can only ever refuse a transform, never grant one. The exception for the reviewed adapter, its exact version, and containment within its root are all unchanged.
+**WebUI workflow hotfix.** New WebUI sessions no longer report an unknown command effect after the turn started, and completed turns no longer appear twice.
 
-- The failure was also unreadable. The gateway child was spawned with its stderr discarded, so a process that died on its first line looked exactly like a slow one: twelve seconds of waiting, then `gateway-start-timeout` and nothing else. The child's stderr is now kept, bounded, and reported, an early exit stops the wait instead of running out the clock, and the two cases are named differently — a process that died and a process that never answered are different problems.
+### Improved
 
-### Bilingual documentation
+- While sync is still in progress, the UI opens the known session and blocks a resend that could run the request twice.
 
-- The language gate proved a Vietnamese peer existed, which is not the same as saying the same thing: editing the English side and forgetting the other passed every check in this repository, and left a reader with a document describing a design that had changed. Each pair now records the content digest of both sides as of the last time somebody confirmed them consistent, and a side that moves alone fails the gate naming the file that has to follow. A two-sided edit is reported separately, because it is probably a paired edit and calling it drift would teach people to skip the gate. What it cannot do is read the two documents and decide they agree; it records that a human looked.
+### Fixed
 
-### Google Workspace and document conversion
+- New WebUI sessions reported an unknown command effect although Pi had started the turn; this is fixed.
+- Completed turns appeared twice in the transcript; they now appear once.
+- A slow model-catalog refresh could undo a model or thinking change you just made and leave the button disabled.
 
-- Added Google's own remote MCP servers for Drive, Gmail, Docs and Sheets, one per product rather than a single server holding every scope, because that separation is the point: reading a spreadsheet should not cost a grant over Drive and every document in it, let alone the mailbox. Each has its own preset, so the narrowest useful grant is always available.
-- Google Workspace MCP is Developer Preview and has no credentialed Pi OAuth E2E proof in this release. The four entries are marked experimental, print that status through catalog/preset output, and stay out of the generic `documents` preset as well as every default preset. Official endpoints and readonly scopes remain available through explicitly named Google presets for controlled testing.
+## v1.5.3 - 2026-08-20
 
-- None of them appear in `core` or `popular`. `core` is what an install writes when nobody names a preset and `popular` is what people pick without reading the list, so an entry in either would hand an operator mail and file access they never chose. A test fails if one leaks in, if a catalog server exposes direct tools instead of going through the approval gate, or if a server that needs credentials ships without saying so.
+**WebUI and Terminal parity.** The Session Hub gains ten per-message workflows, a simpler new-session composer and Project Controls, plus a new deep-logic benchmark.
 
-- Connecting Gmail changes the threat model rather than extending it: until now the untrusted input reaching an agent was source code, and it becomes any mail anyone can send. The approval gate still stands between a message and an action, but the documentation now states plainly what the product cannot prevent, and recommends read-only scopes and the narrowest preset.
+### Added
 
-- Added MarkItDown for converting local `.docx`, `.xlsx`, `.pptx`, `.pdf` and `.html` to Markdown. It runs offline for `file:` URIs, which is the reason to prefer it: a document worth converting is usually one worth not uploading. It is pinned at its published alpha, and needs `uv`.
+- The Session Hub offers ten per-message workflows; after sending, the composer returns to Freeform.
+- Project Controls cover runtime, usage, onboarding, Context Engine, memory and MCP; changes ask for confirmation.
+- Added the `deep-logic-v1` benchmark: six large problems, run with Piagent and `codex-cli` on GPT-5.6 Luna Medium.
 
-### Adoption measurement
+### Improved
 
-- GitHub serves repository traffic as a rolling 14-day window and discards everything older, with no endpoint that returns it. `traffic-snapshot` archives clones, views, referrers and paths daily into growing CSV files on a separate `traffic-data` branch, so the history survives and the product branch is not buried under a row a day. A day still filling when the run happens is overwritten by the next run rather than frozen partial, and a gap under 14 days loses nothing. The traffic endpoints need push access, so a 403 names the exact fix — a fine-grained token with `Administration: read` stored as `TRAFFIC_TOKEN` — instead of leaving a nightly job red.
+- The new-session composer shows project, model and send; advanced choices sit behind a `+` control.
+- `capability-v1` grows from four to six families with 69 atomic checks.
 
-- The documentation site now carries Vercel Web Analytics, which is cookieless and stores no browser identifier, so the site still owes no consent banner. The snippet is emitted from the site shell rather than any page, so both locales and every future page inherit it, and a test fails if a generated page ships without it or if a script from another origin appears. The runtime remains free of any network call: `telemetry()` writes locally and the package has no install hook.
+## v1.5.2 - 2026-08-18
 
-### Documentation parity
+**Drag and drop in the new-chat composer.** A document dragged or pasted onto the new-chat composer is now attached instead of being silently lost.
 
-Four documents restated something the code already knew, and each had drifted. They are now checked against their source, so the next drift fails a test instead of reaching a reader.
+### Fixed
 
-- `install-global.sh --help` omitted `--default-model` and `--subagents-model-scope`, which had been accepted for four releases. The help text now carries every flag with its valid values, and the parity check reads the flag list out of the parser.
+- A document dropped or pasted on the new-chat screen was silently lost; it is now attached.
+- A file dropped outside the composer no longer navigates the page away.
 
-- The `piagent-usage --json` documentation described two of the six top-level keys. `scope`, `projects`, `tools` and `generatedAt` were undocumented, including the record of which filters produced the report — without which a saved report cannot explain itself. All six are documented with their fields, and compared against the emitted object in both directions.
+## v1.5.1 - 2026-08-17
 
-- The architecture documents listed nine physical layers while `architecture/layers.json` enforced fifteen: every WebUI layer was enforced and undocumented, in both languages. The seven are now described with what they own and may not own, alongside why they form a second dependency spine rather than a branch of the first.
+**Release repair for v1.5.0.** Publishes the content of v1.5.0, which was tagged but never published, plus a fix for a composer test race.
 
-- The team release history stopped at `1.2.11` while releases continued to `1.4.0`, and `1.1.1` had been skipped earlier. Twelve entries were added, and the list is now checked against the changelog from its own oldest entry forward, so a gap anywhere in it fails.
+### Improved
 
-- The repository layout in the README showed one package where there are two, leaving `piagent-webui` — the dashboard, its client, server, gateway and ownership layers — invisible to anyone reading the map before the tree.
+- Ships everything from v1.5.0, whose macOS release matrix failed before publishing.
 
-## v1.4.0 - 2026-08-15
+### Fixed
 
-### Local Session Hub and WebUI
-
-- Added a local, one-per-profile Gateway and `piagent dashboard` experience for
-  creating, reopening, resuming, renaming, pinning, archiving, unarchiving, and
-  forking durable Pi sessions without starting an extra model turn for views.
-- Rebuilt the browser client as a conversation-first MUI application with a
-  compact composer, project and model controls, light/dark themes, Vietnamese
-  and English UI, responsive layouts, and an Agent Inspector for tasks, source
-  changes, activity, verification, usage, and handoff evidence.
-- Added exact Gateway-owned chat streaming, held-message queues, bounded
-  attachments, model/thinking controls, lifecycle controls, and Pi-owned
-  approval cards while preserving one authoritative writer per session.
-
-### Source review, recovery, and security
-
-- Added Task Changes, Working Tree, and Staged projections with bounded diffs,
-  provenance, criterion/verifier links, protected-path enforcement, and guarded
-  stage, unstage, revert, and editor handoff actions.
-- Added durable session leases, terminal compatibility ownership, restart and
-  stale-owner recovery, idempotent command receipts, replay/resync, doctor with
-  explicit repair, and corrupt-state fail-closed behavior.
-- Hardened the TypeScript loader, local control socket creation, runtime
-  integrity inventory, browser authentication, redaction, event bounds, and
-  provider/MCP credential handling.
-
-### Documentation and release gates
-
-- Classified every root operating document by language, retained canonical
-  English/Vietnamese entry points, and added a gate that rejects unclassified
-  or unindexed Vietnamese documentation.
-- Added a provider-neutral product-language gate while retaining third-party
-  names only where they describe real integrations, dependencies, or operator
-  commands.
-- Added the executable WUI5-18 release matrix covering durable sessions,
-  ownership, recovery, approvals, protected data, transport validation,
-  accessibility, themes, and zero-model-turn navigation.
+- Fixed a WebUI composer test race that left the confirm button disabled on slower runners.
 
-## v1.3.1 - 2026-08-13
+## v1.5.0 - 2026-08-17 (not published)
 
-### Security and reliability hardening
-
-- Extended the capability integrity inventory to include the TypeScript loader,
-  CLI dispatcher, and the remaining task-state, verification, and backend
-  decision modules that can affect runtime enforcement.
-- Replaced repeated full-file capability hashing on every tool call with a
-  fail-closed metadata cache. Session start may re-pin an unchanged grant to a
-  new installed build; build drift discovered during a running session blocks
-  that session until restart instead of silently rewriting its lock.
-- Removed shell interpolation from the `pdftotext` availability probe while
-  preserving the existing PDF extraction behavior.
-- Made local JSONL state locks publish their complete owner atomically and
-  recover a hard-killed normal writer without exposing an empty lock. Recovery
-  ownership is deliberately fail-closed: if that recovery process itself is
-  killed, an operator must remove its `.recovery` lock before writes resume.
+**Document workspace and attachments.** Adds a document workspace, attachments and a compact activity timeline to the Session Hub; tagged but not published, shipped as v1.5.1.
 
-## v1.3.0 - 2026-08-12
+### Added
 
-### Stable Intelligence Engine release
-
-- Promoted the exact IE9 product tree to stable without changing model-facing
-  runtime behavior. The Criterion Graph, bounded current-source context,
-  stable tool surface, one-continuation ceiling, current-tree verification,
-  durable resume/handoff and conservative broad defaults remain unchanged.
-- Published the first stable package with Pi host `0.84.1` and installed-package
-  parity for every terminal command. Stable installs use npm `latest` and the
-  pinned Git tag `v1.3.0`; prerelease `next` remains historical.
-- Preserved the completed 108-session Luna Medium IE7 run as exact
-  public-regression evidence for the unchanged product runtime. It is not
-  relabelled as an exact v1.3.0 measurement and does not prove private-holdout
-  generalization, field stability or real-model long-horizon performance.
-- Kept solver and phase tools in shadow, acceptance and performance assurance
-  advisory, semantic repair off, helpers recommend-only, parent routing off,
-  recovery on and a maximum of one system continuation for broad defaults.
+- A document workspace in the Session Hub for Markdown, text, PDF and DOCX, with redaction and in-browser previews.
+- Attach documents and images in New chat and in active sessions; sent files show as compact cards.
+- Session titles and previews are generated without a model turn.
 
-## v1.3.0-ie.9 - 2026-08-12
+### Improved
 
-### Installed-package runtime parity
-
-- Added a package-owned TypeScript loader for terminal entry points so the npm
-  installation can load the same audited TypeScript runtime that Pi loads,
-  even when the package lives under `node_modules`.
-- Made the global benchmark helper use the matching exact Pi package Git source
-  installed by `piagent-install --stable`. It refuses to invent Git identity or
-  run against a mismatched helper/package version.
-- Replaced the symlink-only binary smoke with a real packed-and-installed test:
-  all global commands print help from `node_modules`, and the installed benchmark
-  completes a provider-free dry run from an exact temporary Git source.
-- Preserved IE8 as the first successfully published package. Its helper,
-  installer, doctor and capability commands work, but the route and benchmark
-  binaries cannot load TypeScript from `node_modules`; IE9 supersedes it on the
-  npm `next` channel. Product/model behavior remains unchanged from IE7/IE8.
+- Large tool-result blocks in chat are replaced by a compact live activity timeline.
+- Project folder import is more reliable on macOS and Linux, including several folders at once.
+- Providers & models shows whether each model supports web search and image input.
 
-## v1.3.0-ie.8 - 2026-08-12
+## v1.4.1 - 2026-08-17
 
-### Reproducible prerelease publishing
-
-- Made the tag-driven publish job fetch the complete Git/tag history required
-  by rollback tests and install the same `ripgrep` prerequisite used by the
-  native Ubuntu verification lane.
-- Preserved `v1.3.0-ie.7` as immutable failed-before-publish evidence. Its
-  workflow stopped during deterministic tests, before `npm publish`, so the
-  registry was not modified.
-- Kept the product runtime identical to IE7. The completed 108-session Luna
-  Medium benchmark remains exact IE7 runtime evidence and is not relabelled as
-  an exact IE8 benchmark; IE8 is a distribution-only correction.
-
-## v1.3.0-ie.7 - 2026-08-12
-
-### Source-derived public return-contract guidance
-
-- Extended the bounded return-representation classifier to recognize helper
-  parameters seeded from object properties, including stable graph traversals
-  that call `visit(item.name)` and later push that name into the public result.
-- Surfaces the existing names-versus-objects representation in the first model
-  turn before mutation. This preserves the public API without enabling a hard
-  semantic gate, adding a continuation, or changing the benchmark prompt,
-  variant, grader, outcome floor, or measured IE6 evidence.
-- Preserved the terminal IE6 production run as immutable NO-GO evidence. IE7
-  uses a new candidate digest and production seed and must pass a single paired
-  workspace-order canary before another full release benchmark is authorized.
+**Integrity, redaction and install fixes.** Closes gaps in the runtime integrity lock, redacts npm tokens, fixes install and uninstall bugs, and lets the dashboard start without the MCP adapter.
 
-## v1.3.0-ie.6 - 2026-08-12
+### Added
 
-### Candidate-only finite benchmark stop
+- Added Google Drive, Gmail, Docs and Sheets MCP servers as experimental, kept out of every default preset.
 
-- Aligned the paired terminal stop with the production evaluator: a Piagent
-  outcome below the frozen floor stops after its pair, while a Codex-only miss
-  remains candidate-only dominance and does not prevent later coverage.
-- Kept helper wall-clock timing observational under parallel host load; exact
-  retrieval, token reduction, lifecycle, writer and privacy invariants remain
-  the release-gating properties.
-- Preserved the terminal `v1.3.0-ie.5` canary as immutable evidence; it is not
-  resumed or relabelled after this correction.
+### Fixed
 
-## v1.3.0-ie.5 - 2026-08-12
+- The two-command install could downgrade the global Pi package to a project's pin; the two scopes now resolve separately.
+- Uninstall did nothing under a non-default npm prefix yet reported success; it now uses the helper's actual prefix.
+- `piagent dashboard` failed to start when the MCP adapter was not installed; it now starts.
 
-### Finite release benchmark and prerelease publishing
+### Security
 
-- Added a release-only paired outcome stop that finishes the current Piagent/Codex
-  pair, records a terminal non-resumable receipt, and starts no later provider
-  session after an outcome falls below the frozen suite floor.
-- Bound prerelease packages to the npm `next` dist-tag in both package identity
-  and the tag-driven publish workflow, preserving `latest` for stable releases.
-- Preserved the failed `v1.3.0-ie.4` measurement as immutable evidence; no suite,
-  grader, prompt, or measured result was rewritten for this candidate.
+- The integrity lock now covers shell entrypoints and the served WebUI bundle, which could previously run unpinned code.
+- npm tokens in `.npmrc` lines and in publish output are now redacted.
 
-## v1.3.0-ie.4 - 2026-08-11
+## v1.4.0 - 2026-08-15
 
-### Symmetric native CI prerequisites
+**Local Session Hub and WebUI.** Adds `piagent dashboard`: a local Gateway and browser client to create, resume and review Pi sessions without extra model turns.
 
-- Installed the exact ripgrep test prerequisite on both Ubuntu and macOS CI.
-  This keeps the helper evaluation identical across native platforms; no
-  product gate, benchmark evaluator, or provider behavior was relaxed.
-- Kept the integration waits finite while giving the full parallel suite room
-  for native filesystem contention. The helper and immutable-snapshot product
-  assertions remain unchanged; only their test-harness deadlines moved.
+### Added
 
-## v1.3.0-ie.3 - 2026-08-11
+- `piagent dashboard` opens a local Gateway to create, reopen, resume, rename, pin, archive and fork sessions.
+- A conversation-first browser client with light and dark themes, Vietnamese and English UI, and an Agent Inspector.
+- Streaming chat, held-message queues, attachments, model and thinking controls, and approval cards in the browser.
+- Task Changes, Working Tree and Staged views with bounded diffs and guarded stage, unstage and revert actions.
 
-### Deterministic cross-platform helper gate
+### Improved
 
-- Kept helper retrieval timing as an observational metric, but made the release
-  gate depend on exact retrieval correctness, model-visible token reduction,
-  lifecycle, budget, writer and privacy invariants. This removes filesystem and
-  process-startup timing noise from native Linux CI without weakening the
-  product property the helper is intended to provide.
+- Sessions recover after restarts and stale owners, and corrupt state fails closed.
 
-## v1.3.0-ie.2 - 2026-08-11
+### Security
 
-### Runtime and release-gate refresh
+- Hardened the TypeScript loader, local control socket, browser authentication, redaction and credential handling.
 
-- Raised the exact Pi Coding Agent and Pi AI host pin to `0.84.1` and TypeBox
-  to `1.3.7`. The new host tree audits clean at moderate and above, replacing
-  the expired `0.82.0` advisory exception; provider-free host compatibility,
-  package lifecycle and release identity are re-gated on the new pin.
-- Scoped CodeQL away from the byte-pinned Hono benchmark fixture while keeping
-  all Piagent product and benchmark harness code analyzed, and made Ubuntu CI
-  install the ripgrep dependency exercised by helper evaluation.
+## v1.3.1 - 2026-08-13
 
-## v1.3.0-ie.1 - 2026-08-11
+**Security and reliability hardening.** Widens the integrity inventory, speeds up per-call integrity checks with a cache, and lets local state locks recover safely.
 
-### Intelligence-engine candidate
-
-- Added a deterministic Criterion Graph projection and bounded current-source
-  context delivery so Luna Medium can plan against operator criteria without a
-  repository-index dependency or an extra model turn. Mechanical task truth,
-  exact verification, current-tree evidence and permissions remain unchanged.
-- Kept every advanced capability in the package while broad defaults leave
-  solver and phase tools in shadow, acceptance and performance assurance
-  advisory, semantic repair off, helpers recommend-only and parent routing off.
-- Added a fail-closed IE6 release protocol for Piagent versus controlled Codex
-  CLI on Luna Medium: 18 production families, three repeats, two surfaces, 108
-  sessions, six-session inspected chunks, retry zero and explicit platform,
-  cohort, private-holdout, long-horizon and operator gates.
-- Preserved RC.1 and RC.2 as immutable historical NO-GO evidence. The IE train
-  uses its own prerelease identity and does not relabel or resume either RC.
+### Improved
 
-## v1.3.0-rc.2 - 2026-08-11
+- Integrity checks use a metadata cache instead of rehashing files on every tool call; build drift mid-session blocks until restart.
 
-### Finite FS6 correction
+### Fixed
 
-- Added one intake-only efficiency correction after the exact RC.1 Migration
-  gate: map every operator criterion to implementation and focused-test
-  coverage, batch independent operations, and perform one criterion review
-  before the first exact verifier. No completion gate, continuation budget,
-  capability mode, benchmark evaluator, or scenario behavior was relaxed.
-- Bound the pinned Hono 4.13.1 zero-install E2 fixture into the clean source and
-  package, excluded the test-only `core-services.js` barrel from distribution,
-  and made the control-byte gate accept valid empty upstream JavaScript files
-  without weakening checks for non-empty binary source.
+- A hard-killed writer no longer leaves a state lock stuck; if recovery itself is killed, remove its `.recovery` lock.
 
-## v1.3.0-rc.1 - 2026-08-11
+### Security
 
-### Operator product journey
-
-- Added deterministic parent model routing with versioned
-  `low|medium|high|ultra` capability bands, explicit pin/default provenance,
-  intelligence/balance/cost objectives, exact authenticated-catalog matching,
-  and fail-closed shadow/recommend/auto modes. `piagent-route` provides the only
-  explicit prelaunch enforcement path; extension auto does not mutate the Pi
-  user default or switch models mid-conversation.
-- Added a bounded retrieval route (read-only grep/find/read, up
-  to eight parallel searches and four rounds, recommendation-only), a 240-case
-  offline routing gate, and a resume-locked 144-session static-versus-adaptive
-  protocol dry-run. No authenticated benchmark is implied by these local gates.
-
-- Extended task preflight with stable human/JSON projections for intent, risk,
-  scope, runtime provenance, solver route, phases, tools, helper budget,
-  execution boundary, readiness, approvals, and blockers. Read-only and
-  authorization-sensitive requests never display implementation permission.
-- Extended `/piagent-status` with persisted task, trajectory, checkpoint,
-  verifier, recovery, helper, resume, terminal receipt, and bounded efficiency
-  evidence. Completion remains hard-gate dependent and same-runtime evidence is
-  described as operational assurance, not independent audit.
-- Added one `/piagent-inspector` namespace with an automatic compact status line
-  below Pi's native TUI footer and
-  menu views for task-versus-working-tree diff, test files and line counts,
-  tool/command outcomes, safety warnings, verifier evidence, and context budget.
-  It reuses existing lifecycle hooks, does not call a model, marks mixed dirty
-  baselines explicitly, and never invents per-tool token attribution.
-- Hardened terminal receipts to fail closed unless the current-tree completion
-  gate passes, and hardened RC local readiness so every published routing,
-  safety, helper/writer, recovery, phase-tool, and host-boundary gate is
-  decisive. The RC matrix pins each P0-P6 evidence input by SHA-256 and the
-  generated report records the verified bytes and composite input digest.
-- Extended offline doctor readiness and `/usage efficiency` with install/update
-  recovery guidance and exact-or-unavailable task metrics joined through hashed
-  session/task/run identity. Raw task text and child output are not retained;
-  unmeasurable time, tokens, cost, and invocation counts remain null.
-
-### Durable runtime evidence
-
-- Fixed automatic long-prompt intake, repository-aware scope resolution,
-  idempotent bounded task IDs, runtime verifier defaults, and full-prompt
-  acceptance extraction. Phase enforcement now uses dependency-ready work-plan
-  evidence, keeps provider tool schemas cache-stable, treats `shell`/`exec` as
-  `bash`, and applies one phase decision to direct, shell, patch, and MCP
-  mutation carriers. Manual/high-risk planning and every read-only task remain
-  mutation-free; exact verifiers and bounded repair retain their intended path.
-- Recalibrated the public capability suite around explicit contracts and 47
-  weighted critical atomic checks across 16 prompt clauses. Each clause has a
-  named killed mutation and sensitivity rationale; independently shaped search
-  and migration implementations pass without object-identity, module-provenance,
-  fixture-name, or representation coupling. Historical benchmark evidence is
-  retained unchanged and is not regraded as a new performance claim.
-- Hardened Piagent-versus-Codex benchmarking with named, candidate-only runtime
-  treatments preserved across dry-run, resume, replay, and reports. Token-saving
-  claims now fail closed unless controlled Codex isolation, model/thinking pins,
-  randomized paired order, and exact treatment provenance pass; reports expose
-  paired resolved/quality/safety outcomes and token ratios by benchmark band.
-- Stabilized Task Contract v2 with identity-bound journal checkpoints, strict
-  acceptance receipts, current-tree verification evidence, bounded retries, and
-  immutable terminal outcomes. Journal hashes and receipts are operational
-  evidence produced by the same runtime, not independent attestation.
-- Added adaptive context planning, cited repository-memory hints, model
-  capability facts, verification intelligence, and a fail-closed execution
-  backend descriptor. The parent model remains operator-pinned, no solver or
-  automatic parent routing is shipped, and unavailable isolation adapters do
-  not silently fall back to host mutation.
-- Added benchmark measurement schema v1 with exact-or-unavailable context usage
-  and bounded task/acceptance evidence. Route, phase, and helper measurements
-  remain absent until their later schemas and runtime behavior are implemented.
-- Extracted bounded registration adapters and operator catalogs from the Pi
-  composition root, locked the root against growth, and extended runtime
-  integrity/package coverage for the new modules.
-
-### Controlled RC readiness
-
-- Added a pinned RC evaluation matrix and local-only readiness evaluator across
-  quality/routing, security/privacy, reliability/performance, and disposable
-  install/migration/rollback gates. It records candidate content and catalog
-  digests without storing credentials or gaining release-write capabilities.
-- Added cross-process helper lock waiting/stale-lock recovery and synthetic
-  disk-full/permission-denied state tests after the concurrency gate exposed an
-  immediate-lock-failure race.
-- Retained conservative defaults: solver and phase tools stay shadow, recovery
-  stays on, helpers stay recommend, and parent routing/automatic workers stay
-  off. GA remains blocked on controlled cohorts, human usability, Linux,
-  candidate benchmark, RC package/identity, and explicit operator approval.
-
-### Bounded recovery and handoff
-
-- Added deterministic failure classification and a cross-attempt recovery
-  matrix with one source repair or exact transient retry ceiling. Environment,
-  provider, permission, policy, scope, and unknown failures never gain source
-  mutation authority; `PIAGENT_AUTO_RECOVERY=off` preserves the prior handoff
-  path.
-- Added owner-only Handoff v1 projections and safe resume reconstruction bound
-  to task/session identity, journal integrity, trajectory phase, the actual
-  current tree, and exact verifier evidence. Stale passes are invalidated;
-  corrupt or symlink-unsafe state blocks mutation.
-- Extended acceptance receipts with optional runtime-observed recovery
-  provenance. Criteria/status truth is unchanged and the receipt stores only
-  bounded digests, counts, dispositions, and state references rather than raw
-  logs or source.
-
-### Role-bound helpers
-
-- Added strict RolePolicy v1 and HelperRequest v1 contracts for retriever,
-  scout, planner, worker, reviewer, Oracle, and researcher roles. Requests bind
-  hashed parent identity, bounded scope/tools/model/effort/budgets/output/stops,
-  cannot broaden parent authority, and never delegate approvals.
-- Added deterministic authenticated-catalog role binding that preserves the
-  user-pinned parent and reports unavailable instead of silently substituting a
-  model or effort. Worker remains disabled by default.
-- Added owner-only Piagent-owned helper budgets with two-concurrent/three-total,
-  per-role and one-writer ceilings, deduplication, orphan recovery, terminal
-  cancellation, and digest-only usage receipts. `PIAGENT_HELPERS_MODE` defaults
-  to `recommend`; automatic worker delegation is not enabled.
+- The integrity inventory now covers the TypeScript loader, the CLI dispatcher and the remaining enforcement modules.
+- Removed shell interpolation from the PDF tool availability check.
 
-## v1.2.17 - 2026-08-03
+## v1.3.0 - 2026-08-12
 
-### Bilingual public documentation
+**First stable intelligence engine release.** Promotes the ie.9 tree to stable with Pi 0.84.1 and unchanged runtime behaviour; stable installs come from npm `latest`.
 
-- Added a complete English peer for all 17 public documentation pages under
-  `/en`, while preserving existing Vietnamese URLs at the site root.
-- Added same-topic VI/EN switching, localized navigation and copy feedback,
-  canonical URLs, and `hreflang` metadata without adding a client-side i18n
-  framework or language bundle.
-- Extended build, release-identity, scaffold, link-integrity, and locale-parity
-  gates to cover all 34 generated pages.
-- Fixed the multi-page grid breakpoint that kept desktop sidebar and TOC
-  columns active on mobile, restoring a single-column content layout.
+### Added
 
-## v1.2.16 - 2026-08-03
+- First stable package with Pi 0.84.1, where every terminal command works from the installed package.
 
-### Codex default
+### Improved
 
-- Changed the default Codex configuration to `openai-codex/gpt-5.5:high`
-  across setup, global install, model-scope configuration and the global
-  settings template. Explicit `xhigh` selections remain supported.
-- Changed the no-thinking-suffix fallback to `high` and added an executable
-  regression test covering default settings, scoped models and explicit
-  `xhigh` overrides.
+- Stable installs use npm `latest` and the Git tag `v1.3.0`; the prerelease `next` channel is now historical.
+- Runtime behaviour is unchanged from ie.9, with conservative defaults: parent routing off, recovery on, one continuation.
+- The 108-session Luna Medium run from ie.7 is kept as evidence and not relabelled as a v1.3.0 measurement.
 
-## v1.2.15 - 2026-08-03
+Requires: Pi 0.84.1.
 
-### Global update reliability
+## v1.3.0-ie.9 - 2026-08-12
 
-- Fixed stable updates from machines whose existing Piagent registration is a
-  local path. Pi displays user-local sources relative to its agent directory,
-  while `pi remove` resolves input from the caller's working directory; the
-  installer now removes the discovered registration by its absolute path.
-- Added a regression assertion that fails if the installer passes Pi's displayed
-  relative path back to `pi remove`, covering updates launched outside the Pi
-  agent directory.
+**Installed-package runtime parity.** Commands installed from npm can now load the TypeScript runtime, fixing the route and benchmark commands that failed in ie.8.
 
-## v1.2.14 - 2026-08-03
+### Improved
 
-### Runtime architecture
-
-- Split session lifecycle, input routing, context usage, tool-result filtering,
-  tool activation and task intake out of the guard entrypoint into focused
-  runtime modules while preserving the existing behavior and command surface.
-- Added machine-enforced architecture layers, dependency directions and file
-  size budgets so new runtime code cannot silently grow back into the guard.
-- Extended capability integrity locks to pin every extracted runtime module;
-  the test suite now rejects any runtime file omitted from that trust boundary.
-- Added paired English and Vietnamese maintainer documentation with a language
-  parity gate. Vietnamese docs preserve operational terms such as agent,
-  terminal, workflow, MCP, session, token, model and benchmark.
-
-### Session and migration reliability
-
-- Stopped registering a custom `/name` command so Piagent no longer shadows
-  Pi's native session command. Native rename events continue to update task
-  bindings and Agent Watch records; `/setname` remains a compatibility alias.
-- Hardened legacy task migration so long task identifiers retain a unique hash
-  suffix, the source contract is archived before the v2 write, and path aliases
-  cannot delete a newly written current contract on macOS.
-- Added integration, runtime isolation, migration-collision, architecture and
-  documentation tests for the extracted boundaries and release behavior.
+- The global benchmark helper uses the exact Pi package source installed by `piagent-install --stable`.
+- A packed-and-installed test now checks that every global command prints its help.
 
-## v1.2.13 - 2026-08-03
+### Fixed
 
-### Benchmark evidence
-
-- Published a dedicated static benchmark page with the verified production-v1
-  scores, median usage, paired fresh-token comparison, confidence interval,
-  category coverage and release provenance.
-- Added lightweight CSS charts for score bands, token usage and paired wins;
-  the page has no charting dependency or client-side data fetch and remains
-  readable on desktop and mobile.
-- Added the sanitized v1.2.12 production snapshot to the benchmark guide and
-  README while keeping the raw report private because its root seed can
-  reproduce synthetic secrets.
-- Documented that the full model run measured the release candidate before its
-  metadata bump, and kept the claim scoped to the controlled public suite
-  rather than presenting it as a universal model or repository result.
+- In ie.8 the route and benchmark commands could not load TypeScript from `node_modules`; they now work.
 
-## v1.2.12 - 2026-08-03
+## v1.3.0-ie.8 - 2026-08-12
 
-### Production benchmark
-
-- Added `production-v1`, a 108-session release benchmark covering 18 independent
-  scenario families across backend, frontend, data, platform, reliability and
-  security, with small/medium/large tasks, five profiles, cold-start and
-  steady-state lifecycles, generated variants and private hidden oracles.
-- Added category/profile/lifecycle/difficulty bands, Wilson quality intervals,
-  complete-family efficiency evidence and a scenario-clustered 95% confidence
-  interval for paired fresh-token ratios. Production claims now require all 18
-  families, three repeats, quality/reliability/workflow/category scores of at
-  least 9, perfect safety and an upper token-ratio bound no greater than 1.
-- Added controlled `codex-cli` comparison with a fresh private `CODEX_HOME` for
-  every measured session and retry, paired seeded execution blocks, strict JSONL
-  usage parsing, bounded diagnostics and streaming required/forbidden output
-  checks.
-- Added infrastructure-only retries for zero-usage process failures. Timeout or
-  any run that consumed provider usage remains a measured reliability result;
-  retries are recorded separately and cannot improve task scores silently.
-- Validated the release candidate with 108/108 resolved sessions against Codex
-  CLI on the same model/thinking configuration. Piagent reached 10.00 quality,
-  safety, reliability and efficiency, 9.58 workflow and 9.92 overall; the
-  paired fresh-token estimate was 51.11% lower with a 95% ratio interval of
-  0.3809 to 0.6276.
-
-### Harness refinements
-
-- Kept automatic bounded intake for safe prompts while exposing explicit task
-  intake when a legitimate high-risk request mentions a protected path.
-- Rendered every verifier as a separate shell call throughout intake, recovery,
-  compaction and final-gate guidance. Recovery now reports only verifier commands
-  whose observed passing evidence is missing, avoiding accidental pipelines and
-  repeated successful checks.
-- Documented the distinct smoke and production workflow thresholds while keeping
-  every failed workflow check visible in JSON, text and HTML reports.
+**Reproducible prerelease publishing.** Fixes the publish job that stopped ie.7 before publishing; the runtime is identical to ie.7.
 
-## v1.2.11 - 2026-08-02
+### Improved
 
-### Breakthrough task harness
-
-- Added Task Implementation Contract schema v2 with unique `taskRunId`, Pi
-  `sessionId`/`sessionName` binding, `source-change` versus `read-only` mode,
-  bounded attempts, prior failure summaries, work-plan progress, and baseline,
-  observed, final and declared changed-file evidence.
-- Enforced one Pi session per task. Session rename updates the bound contract;
-  resume maps legacy state only when Pi custom trace identifies the task. Retry
-  starts in a fresh session, inherits prior evidence and cannot raise the limit
-  fixed by attempt one.
-- Source mutation now requires a task, a Git working tree, declared scope and a
-  meaningful verifier. Read-only inspection remains available before a task and
-  in scout mode. Terminal contracts are immutable.
-- Final completion now requires every exact verify command to have a passing Pi
-  bash observation after task start. The gate reconciles changed-file claims
-  against Git baseline digests and tool results, rejects out-of-scope files and
-  records both source and destination of staged renames. The assistant
-  completion hook catches a premature DONE claim even when the agent skips the
-  explicit gate call.
-- Added `piagent_task_progress`, failed work-plan steps, dependency/cycle checks,
-  failure phase/reason/ruled-out evidence and deterministic retry handoff.
-
-### Context and performance
-
-- Replaced routine model-driven intake/context/evidence/trace/gate choreography
-  with lifecycle hooks. Runtime now creates bounded task contracts before the
-  first model turn, deriving path/glob scope from the request and bounded Context
-  Engine navigation. Broad, high-risk, ambiguous, or protected-path requests
-  fail over to explicit intake instead of silently widening scope.
-- Automatic source tasks expose zero Piagent management schemas and need no
-  `task_start` round trip. Manual intake validates every scope entry as a
-  project-relative path/glob, keeps the active tool surface cache-stable, and
-  adds recovery schemas only when the selected lane requires them.
-- Routine tasks no longer advertise the duplicate `piagent-ops` skill to the
-  model. Runtime states that root project instructions are already loaded, so
-  the agent does not spend tool calls re-reading platform policy or root
-  `AGENTS.md`; the skill remains available for explicit manual/recovery use.
-- A bounded automatic task can receive a current-turn Context Engine snapshot
-  of relevant source/tests before its first model action. The snapshot is capped
-  at 900 estimated tokens, restricted to source/test roots, filtered by the
-  active exclusion policy and skipped for stale/low-confidence indexes; the
-  agent re-reads only missing regions or edit mismatches.
-- Node-family runtime intake resolves the generic verifier to concise existing
-  package scripts such as `npm test`, while preserving the profile's fail-closed
-  command when package metadata is absent or invalid.
-- Removed the Piagent tool-loader schema from the default session and task
-  surface. Prompt classification activates the required group directly, while
-  explicit diagnostics can still request the loader; ordinary turns therefore
-  carry no unused management schema.
-- Verification evidence is bound to a SHA-256 digest of the current working
-  tree. A later edit invalidates prior proof; running a verifier no longer looks
-  like a mutation. Files edited and restored to their baseline digest do not
-  satisfy the final changed-file gate.
-- Added one bounded automatic continuation for automatic/assisted tasks when an
-  agent stops with missing evidence, including the “existing tests pass but no
-  relevant diff” case. The continuation uses Pi `followUp`, never loops, reports
-  projected final-gate reasons, and recognizes Vietnamese completion wording.
-  Set `PIAGENT_AUTO_RECOVERY=off` for rollback.
-- Added lifecycle-native read-only plans: tiny scouts complete from observed
-  reads, normal scouts retain one explicit evidence review, and high-risk or
-  custom plans keep manual checkpoints.
-- Auto Context Engine packing now skips follow-up turns once a task is active,
-  avoiding repeated navigation payloads during verification or recovery.
-- Automatic navigation also skips prompts that already name a concrete path,
-  including protected dotfiles such as `.env`; the agent reads the bounded
-  target directly instead of paying for an unrelated context pack.
-- Benchmark workflow scoring accepts exactly one persisted intake source:
-  runtime intake with zero model calls, or manual intake with one `task_start`.
-  It still requires zero routine context/evidence/gate choreography and exposes
-  failed checks instead of awarding 10/10 to expensive management loops.
-
-- Auto-context is cached by project, session and prompt. A repeated prompt in
-  one session is not reinjected; a manual pack with the same query returns a
-  compact reuse marker unless refresh is requested. Another session still gets
-  its own pack.
-- Reduced automatic/manual context budgets, kept dynamic tools/default-on
-  telemetry, added conservative UTF-8 token estimation and verified accented or
-  unaccented Vietnamese retrieval.
-- Profile source verifiers now fail closed instead of printing a successful
-  placeholder. Node-family profiles run configured checks; DevOps verification
-  cannot hide one failing verifier behind another passing tool.
-- Added `piagent-benchmark`, a one-command paired Raw Pi versus Piagent runner.
-  It creates isolated Git fixtures, alternates execution order, grades hidden
-  correctness/scope/safety and Piagent workflow evidence, reads exact usage from
-  Pi session JSONL, and emits private JSON, HTML, text, and JSONL reports.
-- The same command can now compare `piagent` with `codex-cli`. Controlled mode
-  runs Codex ephemeral in a workspace-write sandbox and a private temporary
-  Codex home, excluding global `AGENTS.md`, user config/rules, hooks, plugins,
-  sessions, and caches while linking the existing credential without copying it;
-  disables available optional integrations discovered from that CLI version,
-  requires command-line-pinned model/thinking parity, and keeps native mode as
-  an explicit full-product comparison.
-- Added fail-closed streaming parsing for Codex exec JSONL, including UTF-8
-  chunk boundaries and output larger than the retained log tail. Fresh input
-  excludes cached input, reasoning is not counted twice, full stdout is hashed
-  without being stored, and unavailable OAuth currency cost remains `n/a`.
-- The automatic benchmark prepares Piagent fixtures as initialized, onboarded
-  steady-state projects before the measured model run. It no longer charges
-  every task repeat for one-time onboarding, while post-baseline context/index
-  mutations remain visible to the scope gate.
-- Benchmark reporting separates hidden correctness from scope and end-to-end
-  reliability, shows median usage across every measured run, and records only
-  tool-name histograms so failed expensive runs cannot disappear from the
-  headline while tool arguments and outputs remain private. These orthogonal
-  metrics are emitted as benchmark report schema v2.
-- Benchmark score bands cover quality, safety, reliability, workflow and fresh
-  token efficiency. A token-saving verdict requires quality/reliability at
-  least `9/10`, perfect safety/workflow, non-inferior quality, at least three
-  same-model successful usage pairs, and a paired geometric-mean fresh-token
-  ratio below `1`. The report keeps marginal medians as diagnostics, and adds
-  pair wins plus median paired delta so task scale cannot silently reverse the
-  conclusion. Manual benchmark recording remains backward compatible.
-
-### State, migration and security
-
-- `piagent-update` now keeps host and helper updates in the writable npm prefix
-  that owns the active command. This prevents an `/opt/homebrew` installation
-  from being shadowed by a second copy under `/usr/local` or a user fallback
-  when `npm config get prefix` points somewhere else.
-- Added idempotent v1-to-v2 task migration to session startup and
-  `piagent-update --project`. Preflight refuses corrupt state before project
-  writes; v1 is archived only after v2 exists. Existing onboarded projects keep
-  their grants and do not need onboarding again.
-- Added a shared local-state path boundary for task state, Context Engine,
-  telemetry, bash evidence, traces and captures. It accepts a project opened
-  through a legitimate cwd symlink but refuses `.pi` or any descendant ancestor
-  symlink that escapes the project.
-- JSONL state is owner-only, size bounded and rotated under a cross-process
-  lock. Oversized records become audit markers. Tool-result captures are pruned
-  to 500 files, 128 MiB and 30 days; readers/pruners tolerate concurrent
-  rotation and deletion.
-- Task v2 readers reject unknown fields, malformed timestamps, invalid nested
-  plans, dependency cycles and taskRunId/filename mismatches. Git snapshots now
-  remain truthful in unborn repositories and across staged renames.
+- The runtime is unchanged from ie.7; this release corrects distribution only.
 
-## v1.2.10 - 2026-07-31
+### Fixed
 
-### Security
+- The tag-driven publish job now fetches the full tag history and installs the test prerequisites it needs.
 
-- `contextIndexV2Status` giờ yêu cầu `excludePatterns` tường minh như năm
-  Context Engine API còn lại. Status không còn báo `policyStale: false` khi
-  caller chưa cung cấp policy để đối chiếu, nên caller mới không thể vô tình bỏ
-  qua rebuild của index được tạo bằng luật yếu hơn.
+## v1.3.0-ie.7 - 2026-08-12 (not published)
 
-- Đã xóa fallback đọc exclusion list từ metadata cũ. Active policy luôn đến từ
-  caller đã resolve project policy; index metadata chỉ còn là giá trị stored để
-  so digest.
+**Return-shape guidance before the first edit.** The first model turn now shows whether a public result returns names or objects, so edits keep the public API intact.
 
-- Context index storage giờ dùng directory mode `0700` và mode `0600` cho
-  SQLite database, WAL và SHM. Mỗi connection bật cả SQLite core
-  `secure_delete` lẫn FTS5 `secure-delete`, nên source bị xóa trong refresh bình
-  thường không còn nằm lại trong raw index bytes.
+### Improved
 
-- Exclusion policy version `2` buộc index cũ tự migrate một lần khi mở bằng
-  policy hiện hành. Migration dựng lại toàn bộ FTS index từ content table đã
-  lọc, checkpoint WAL rồi `VACUUM` để purge cả tombstone FTS và free-page bytes
-  được tạo bởi bản cũ. Digest mới và `purgePending: 1` được commit cùng nhau
-  trước pha purge; cờ chỉ clear sau khi toàn bộ chuỗi thành công. Nếu app hoặc
-  máy dừng giữa chừng, lần mở sau tự retry.
+- Detects whether helper results return names or objects, including graph traversals, and shows it before the first edit.
+- No hard gate, extra continuation or benchmark change is added.
 
-- Full FTS rebuild và `VACUUM` chỉ chạy khi exclusion digest đổi hoặc một purge
-  cũ còn pending. Incremental rebuild cùng policy không nhận chi phí này.
+## v1.3.0-ie.6 - 2026-08-12
 
-- Image path trong chat giờ chỉ được auto-attach khi target thật nằm trong
-  project hoặc `additionalReadRoots`, không khớp protected path, nằm trong
-  capability read scope hiện hành và có bytes đúng định dạng ảnh. Symlink ra
-  ngoài root, ảnh trong `.pi/piagent-state/**` và file giả đuôi `.png` đều bị
-  từ chối trước khi nội dung được đưa vào model.
+**Benchmark stop aligned with the evaluator.** The paired benchmark stops only when a Piagent outcome falls below the floor; a miss by the baseline alone no longer ends coverage.
 
-- MCP approval gate và `piagent-mcp doctor` giờ nhận diện cả `directTools` đặt
-  trên từng server. Repository server bật direct tool trong khi
-  `toolPrefix: "none"` sẽ fail-closed vì tên tool không còn mang server origin.
+### Improved
 
-- `piagent-reviewer` giờ là read-only thật: manifest chỉ cấp `read`, `grep`,
-  `find`, `ls`; autofix phải chuyển sang `piagent-worker`. Test package ghim
-  mọi subagent có `acceptanceRole: read-only` vào allowlist read-only.
+- A Piagent outcome below the frozen floor stops the run after its pair; a baseline-only miss does not.
+- Helper timing under parallel load is observational; correctness, token reduction and privacy gate the release.
 
-## v1.2.9 - 2026-07-31
+## v1.3.0-ie.5 - 2026-08-12
 
-### Security
+**Finite release benchmark and `next` publishing.** Benchmark runs stop after a below-floor pair, and prerelease packages publish to npm `next`, keeping `latest` for stable releases.
 
-- Context Engine CLI và runtime giờ dùng chung một policy resolver. Base policy,
-  profile `extends`, `protectedPaths`, `shellProtectedPaths`, `readOnlyPaths` và
-  custom context-index path cùng tạo ra một canonical exclusion list; context
-  search/pack không còn đọc một view khác với guard.
+### Added
 
-- Context index metadata ghi versioned exclusion digest. Search, pack, impact và
-  auto-context rebuild incremental khi digest hiện hành khác digest đã build,
-  đồng thời lọc lại candidate ở read time. Index cũ tạo bằng luật yếu hơn vì vậy
-  tự loại nội dung protected trước khi model nhận context.
+- A release benchmark stops after the current pair once an outcome falls below the floor, starting no new paid session.
 
-- Context Engine từ chối source-shaped symlink và canonical path đi ra ngoài
-  project ở cả build, stale check và pack read.
+### Improved
 
-- API build, ensure, search, pack và impact giờ fail-closed nếu caller không
-  truyền `excludePatterns` tường minh. `[]` vẫn được hỗ trợ cho low-level tool
-  chủ ý chạy không loại trừ; caller mới không còn vô tình quay về permissive
-  default.
+- Prereleases publish to the npm `next` dist-tag; `latest` stays reserved for stable releases.
 
-### Fixed
+## v1.3.0-ie.4 - 2026-08-11
 
-- `piagent-update --dry-run --project ...` báo trực tiếp khi helper thiếu project
-  migrator thay vì chạy Node rồi trả stack `MODULE_NOT_FOUND`.
+**Matching CI prerequisites on Ubuntu and macOS.** CI installs the same search tool on Ubuntu and macOS and gives integration waits more room; no product gate was relaxed.
 
-### Documentation
+### Improved
 
-- Tài liệu ghi rõ dynamic tools, auto context và Context Engine telemetry bật mặc
-  định; telemetry vẫn chỉ lưu metadata/hash đã redact, không lưu prompt hay tool
-  output thô.
+- CI installs the same test prerequisite on Ubuntu and macOS, and integration test deadlines allow for filesystem load.
 
-## v1.2.8 - 2026-07-31
+## v1.3.0-ie.3 - 2026-08-11
 
-### Changed
+**Deterministic cross-platform helper gate.** The release gate now depends on helper correctness and token reduction, not on timing that varied on Linux CI.
 
-- Global setup/update now installs `pi-web-access@0.17.0` by default so builtin researcher subagents can browse/search/fetch external sources instead of being limited to local repo/docs. Machines that cannot use web research can opt out with `--no-web-access`.
+### Improved
 
-### Fixed
+- Helper timing stays as a metric, but the release gate checks retrieval correctness, token reduction and privacy.
 
-- Global install/update now removes older platform-owned `pi-web-access` registrations before installing the reviewed exact version, forcing Pi's shared npm package tree to refresh stale transitive dependencies.
+## v1.3.0-ie.2 - 2026-08-11
 
-## v1.2.7 - 2026-07-31
+**Pi 0.84.1 host pin.** Raises the Pi host pin to 0.84.1, which passes the dependency audit and replaces an expired advisory exception.
 
-### Security
+### Improved
 
-- Updated the pinned MCP and subagent add-ons to `pi-mcp-adapter@2.15.0` and `pi-subagents@0.38.0`. Their resolved runtime tree uses patched `fast-uri@3.1.4`, `@hono/node-server@2.0.12`, and MCP SDK `1.30.0`; a clean resolution reports no add-on advisories.
+- Pi Coding Agent and Pi AI are pinned to 0.84.1, with host compatibility and package lifecycle checked again.
 
-- Raised the runtime release gate from high/critical to moderate/high/critical. The only remaining accepted finding is the separately documented `brace-expansion` denial of service pinned inside Pi host `0.82.0`.
+### Security
 
-### Fixed
+- The new host tree audits clean at moderate and above, so the expired 0.82.0 advisory exception is removed.
 
-- Global install/update now removes older registrations for platform-owned MCP and subagent add-ons before installing their reviewed exact versions. This forces npm to refresh stale transitive dependencies instead of retaining a vulnerable version from an older shared Pi package lock.
+Requires: Pi 0.84.1.
 
-- An existing `pi-subagents` installation is detected and upgraded during a normal platform update. Clean machines still require `--with-subagents`, and `--no-subagents` remains an explicit opt-out.
+## v1.3.0-ie.1 - 2026-08-11
 
-## v1.2.6 - 2026-07-31
+**Intelligence engine candidate.** Adds a Criterion Graph and bounded current-source context so Luna Medium can plan against your criteria without an extra model turn.
 
 ### Added
 
-- Added Pi Context Engine v2: a local incremental SQLite FTS5 index with symbol and import extraction, hybrid Reciprocal Rank Fusion and personalized PageRank retrieval, hard-budget context packs, reverse-import test impact, and the `piagent-context` terminal command.
+- A Criterion Graph and bounded current-source context let the model plan against your criteria without a repository index.
 
-- Added Agent Watch compatible context telemetry keyed by Pi session ID and session name. It records model/thinking metadata, active tool counts, usage, retrieval confidence, context-pack utilization, duplicate reads/output, and transparent context-waste metrics without duplicating raw prompts or tool output.
+### Improved
 
-### Changed
+- Advanced capabilities ship but stay off or advisory by default; verification and permissions are unchanged.
+- rc.1 and rc.2 remain historical evidence; the ie line uses its own prerelease identity.
 
-- Piagent now starts with a one-tool loader and activates governance, policy, code retrieval, knowledge, onboarding, and usage groups by task shape. Tiny tasks expose 11 of 30 Piagent tools and ordinary tasks expose 15, while runtime guards remain active regardless of the visible tool schema.
+## v1.3.0-rc.2 - 2026-08-11
+
+**Criterion coverage before the first verifier.** Before the first verifier, the agent maps each criterion to implementation and tests, batches independent steps and reviews once.
 
-- Task and scout workflows are risk-adaptive. Unfamiliar work receives one bounded Context Engine pack, low-confidence retrieval permits at most one read-only finder pass, repeated read/search results collapse to a delta marker, and session compaction preserves task state instead of raw logs.
+### Improved
 
-- Quality benchmarks now record fresh input, output and cache-read tokens, first-correct-edit time, rework count, and a context-efficiency snapshot so token savings are compared against acceptance and verification quality.
+- The agent maps every criterion to code and focused tests, batches independent steps and reviews once before verifying.
 
 ### Fixed
 
-- Release installation now removes an older local `@piagent/platform` registration as well as older Git registrations before installing the pinned release, preventing the local checkout and released package from loading together.
+- A test-only file is no longer shipped in the package, and valid empty JavaScript files pass the source check.
 
-## v1.2.5 - 2026-07-30
+## v1.3.0-rc.1 - 2026-08-11
 
-### Fixed
+**Routing, inspector, recovery and helpers.** Adds prelaunch model routing with `piagent-route`, a `/piagent-inspector` view, richer `/piagent-status`, bounded recovery and role-bound helpers.
 
-- `piagent-update` now accepts npm 12's singleton-array `npm view --json` output when resolving the target helper version and its pinned Pi host peer dependency. Empty or multi-entry metadata still fails closed, so the updater never guesses which release or host to install.
+### Added
 
-## v1.2.4 - 2026-07-30
+- `piagent-route` picks a model by capability band before launch; it never switches models mid-conversation.
+- `/piagent-inspector` adds a status line and views for diffs, tests, tool outcomes, warnings and context budget.
+- Failures are classified with at most one source repair or retry; `PIAGENT_AUTO_RECOVERY=off` keeps the old handoff.
+- Role-bound helpers with budgets and a single writer; `PIAGENT_HELPERS_MODE` defaults to `recommend`.
 
-### Changed
+### Improved
 
-- `piagent-update` remains a global machine update first; optional `--project <path>` now runs a post-update legacy project migration and strict-share doctor when a maintainer wants that extra check.
+- `/piagent-status` shows task, checkpoint, verifier, recovery, helper and resume evidence.
 
-- Documented the global `npm exec --package @piagent/platform@X.Y.Z -- piagent-update ...` bootstrap command for machines that do not have the global `piagent-update` helper yet.
+### Fixed
 
-- `piagent-update` now falls back to a user-writable npm global prefix when the default prefix is locked by the OS, avoiding `/usr/local/lib/node_modules` permission failures during team rollout.
+- Fixed long-prompt intake, scope resolution and verifier defaults; read-only tasks stay free of edits.
 
-## v1.2.3 - 2026-07-30
+## v1.2.17 - 2026-08-03
 
-### Added
+**English documentation for every public page.** All 17 documentation pages now have an English version under `/en`, with VI/EN switching and Vietnamese URLs unchanged.
 
-- Added short runtime command namespaces for team use: `/commands`, `/usage`, `/context`, `/permission`, `/memory`, `/onboard`, `/name`, and `/fresh`.
+### Added
 
-- Added a compatibility rewrite for `/piagent-workflow` so older muscle memory routes to `/workflow` instead of becoming a normal agent prompt.
+- Added an English version of all 17 public documentation pages under `/en`.
+- Each page links to the same topic in the other language, with localized navigation.
 
-### Changed
+### Fixed
 
-- Consolidated workflow launchers under `/workflow ...` and fresh-session launches under `/fresh task|scout|be-to-fe ...`, reducing accidental scout/log chatter before a user reaches the menu.
+- On mobile the docs kept desktop sidebar columns; the layout is now a single column again.
 
-- Updated onboarding, quickstart, operator, deployment, and docs-site command references to separate Pi native commands from PiAgent runtime commands. Pi native `/model`, `/session`, `/resume`, `/compact`, and `/mcp` remain unclaimed by PiAgent.
+## v1.2.16 - 2026-08-03
 
-### Removed
+**GPT-5.5 with high thinking becomes the default.** Setup, global install and the settings template now default to `openai-codex/gpt-5.5:high`; explicit `xhigh` still works.
 
-- Removed prompt-file versions of runtime help commands that should execute locally rather than asking the agent to inspect docs.
+### Improved
 
-## v1.2.2 - 2026-07-29
+- The default model is now `openai-codex/gpt-5.5:high` across setup, global install and model scope.
+- A model without a thinking suffix now falls back to `high`; explicit `xhigh` selections are kept.
 
-### Added
+## v1.2.15 - 2026-08-03
 
-- Added compact tool-result rendering for oversized Pi outputs. Small results still pass through unchanged; large redacted outputs now show a bounded preview in Pi and are captured under `.pi/piagent-state/tool-results/` with an `index.jsonl` for offline Agent Watch/reporting.
+**Stable updates work from local-path installs.** Updating a machine whose Piagent was registered from a local path no longer fails when started outside the Pi agent directory.
 
-- Added `/piagent-logs`, a local slash command that shows the compact-log policy and recent oversized output captures without calling the model or tailing logs in realtime.
+### Fixed
 
-- Added `/setname <task/session name>` so an already-open Pi session can be renamed for resume lists, Agent Watch mapping, and weekly reports without restarting Pi.
+- Stable updates failed on machines with a local-path Piagent registration; the installer now removes it by absolute path.
 
-### Changed
+## v1.2.14 - 2026-08-03
 
-- `/piagent-usage` and `/task-preflight` now render concise status lines instead of long markdown reports while keeping structured details available to the runtime.
+**Runtime split into modules and native `/name` restored.** The guard is split into focused, integrity-locked modules, and Piagent no longer hides Pi's own `/name` command.
 
-- Workflow prompts and Vietnamese operator docs now tell agents and team members to summarize verify/build failures, quote only relevant lines, and use `/piagent-logs` or narrower commands instead of pasting full terminal dumps into the session.
+### Improved
 
-## v1.2.1 - 2026-07-28
+- Session, input, context and task intake logic moved out of the guard into modules, with behavior unchanged.
 
 ### Fixed
 
-- The approval gate never covered direct MCP tools. It looked for a tool named `mcp__<server>__<tool>`; the adapter builds a name by joining the server's own name to the tool's, so `github` exposes `github_create_issue` and nothing ever matched. Every server was reachable with one `directTools` setting, which `piagent-mcp add --direct-tools` offers and the docs recommend for small servers. Attribution now runs against the configured server names across every prefixing mode.
+- Piagent registered its own `/name` and shadowed Pi's command; Pi's `/name` works again and `/setname` stays as an alias.
+- Legacy task migration keeps long task ids unique and can no longer delete a newly written contract on macOS.
 
-  A repository-carried config that sets `directTools` with `toolPrefix: "none"` leaves no evidence of a server in any tool name, so there is nothing to check a decision against. Every tool call in that session is refused while the setting stands. Refusing only the `mcp` proxy, as the first fix did, closed nothing: the proxy is the one form that still names its server, and the bare names it was protecting went straight through.
+### Security
 
-  The v1.2.0 notes, `docs/mcp-and-tools.md` and the documentation site all stated the direct form was covered. It was not, and the test that asserted it asserted the same invented name shape.
+- Capability integrity locks now pin every extracted runtime module.
 
-- A repository could reach servers the gate never enumerated through the adapter's `imports` key. `.mcp.json` naming `vscode` pulls servers out of `.vscode/mcp.json`, which travels with the clone, while the gate reported no repository servers at all. Servers reachable through a repository-relative import are now collected and gated whichever layer declares the import, and a repository scope that imports any kind has those servers gated too. `piagent-mcp doctor` names the file and the kinds, and reports a config layer it cannot parse instead of counting it as empty.
+## v1.2.13 - 2026-08-03
 
-  One kind cannot be enumerated at all: `codex` keeps its servers in TOML, and nothing here parses TOML. Listing the servers of the five readable kinds says nothing about that one, so a repository declaring it has every tool call refused rather than the servers that happened to be readable gated and the rest let through.
+**Dedicated benchmark page.** A static benchmark page shows the verified production-v1 scores, token usage and paired comparison with simple charts.
 
-- `piagent-mcp doctor` and `list` reported "No MCP servers configured" and exited 0 in exactly the states where the guard was refusing every tool call, and `list` went on to suggest seeding a baseline. Both now report the config that stopped the session and exit 1. The condition is decided in one place that the guard and the CLI both read, because the two disagreeing is what turned a blocked session into an unexplained one.
+### Added
 
-- A server imported from a repository-relative file was reported `ready` when a global config declared the import, while the gate treated it as a repository server awaiting approval. Scope answers which layer named the import, not where the definitions came from; a `global` config importing `vscode` reads them out of the clone. Whether a server needs approval is now decided where servers are collected, so both surfaces give the same answer, and the reason names the file the definition actually came from.
+- Published a benchmark page with production-v1 scores, median usage, paired token comparison and confidence interval.
 
-- `piagent-capability vendor` emptied its destination before checking containment and only tested the immediate parent for a symlink. A repository shipping `.pi` as a symlink had the recursive delete and the fetch land outside the project. The whole path is now verified against the resolved project root before anything is created or removed.
+### Improved
 
-  Emptying the destination first was also not recoverable: a fetch that failed for any reason — no network, a hostile archive rejected by the symlink check — left the project with neither the new source nor the reviewed one it had been running on. The fetch now lands beside the destination and moves into place only once it has passed every check, so a failed re-vendor leaves the working tree exactly as it was.
+- Charts are plain CSS with no charting library or data fetch, and read well on desktop and mobile.
+- The claim is scoped to the controlled public suite, not presented as a universal result.
 
-- The shell guard followed nested interpreters four levels deep and then stopped looking, so a payload wrapped in five layers of `bash -c` was permitted on the strength of a level nobody read. The walk now goes to sixteen levels and refuses a command that nests past it, rather than falling silent.
+## v1.2.12 - 2026-08-03
 
-- An artifact shipped by a vendored capability source could change content while the lock still classified as `repin`. Artifact bytes stay on the build side for packs the platform ships — pinning them would stop a policy correction reaching the projects that reference it — but that reasoning does not transfer to a source the project vendored in, whose manifest digest pins the artifact list rather than its contents.
+**Production benchmark with 108 sessions.** A 108-session benchmark across 18 scenario families measured Piagent at 9.92 overall and about 51% fewer fresh tokens than `codex-cli`.
 
-- A credential in an MCP server URL was stored and displayed in clear text. `add` now refuses userinfo and credential-shaped query parameters the same way it refuses them in `--env` and `--header`, and `list` and `get` mask a URL already on disk.
+### Added
 
-- `piagent-mcp approve`, `reject` and `reset` reported success when the approval store could not be written, leaving the operator waiting on a gate that was still blocking. All three now fail with the path that could not be written.
+- Added `production-v1`: 108 sessions over 18 scenario families, three task sizes, five profiles and hidden oracles.
+- Added a controlled comparison against `codex-cli` on the same model and thinking, isolated per session.
 
-- A server using `bearerTokenEnvVar` reported `ready` with the variable unset. The field names its variable directly rather than through a `${VAR}` reference, so the scan that finds referenced variables never saw the one setting that guarantees a credential is needed.
+### Improved
 
-- A capability pack could declare `activation.mode: "profile"` with no profiles list and crash resolution with a TypeError. The validator requires the list, the same way it already required triggers for trigger activation.
+- Piagent scored 9.92 overall with a paired fresh-token estimate 51.11% lower (95% ratio 0.3809 to 0.6276).
+- Recovery guidance now lists only verifier commands still missing passing evidence, each as a separate shell call.
 
-- Every script that takes `--flag <value>` read the next argument without checking it was a value. `--preset full --settings --dry-run` wrote a settings file named `--dry-run`, exited 0 and reported success, having skipped the dry run it was asked for and never touched the real settings file. `init-project.sh` and `setup.sh` checked only that an argument was present, which catches a flag at the end of the line and nothing else. All eight scripts now refuse a flag-shaped value, and the suite asserts it for every value-taking option in `scripts/`, including ones added later.
+## v1.2.11 - 2026-08-02
 
-- The shell guard did not see a path reached through an inline interpreter script, an unbalanced quote, or a shell variable with a default. `node -e "require('fs').readFileSync('.env')"`, `cat .env'` and `cat .${X:-env}` all read a protected path without matching one. Literals inside an inline script are now extracted, tokenizing survives a quote with no partner, and a variable's default value is expanded when nothing else defines it.
+**Task harness v2: one session per task, evidence-gated completion.** Tasks bind to one Pi session, completion requires passing verify evidence, and routine tasks start with no management round trips.
 
-- ANSI-C quoting hid a path from the guard entirely. `$'...'` decodes its escapes before the word is passed on, so `cat $'\x2eenv'` opens `.env` while the guard saw the literal `x2eenv`; a redirection target was not handled at all, so `printf x >$'.env'` truncated a protected file. The same trick reached the exec policy: `rm -rf $'\x2f'` was permitted, having been read as a removal of something called `x2f`. Escapes are decoded — hex, octal, short and long unicode, and the named ones — in tokenizing and in redirection targets alike.
+### Added
 
-- The destructive-command checks read raw shell words, so a catastrophic target written as a substitution was compared as literal text and matched nothing. `rm -rf /` was refused while `rm -rf $(printf /)`, `rm -rf $(echo /)`, `` rm -rf `printf /` `` and `find $(printf /) -delete` were all permitted; nothing downstream caught them either, since `/` is not a protected path. `printf` and `echo` with literal arguments are pure text and are now evaluated, so those resolve and the same refusal applies, and a variable holding the target (`D=/; rm -rf "$D"`) is expanded the way the path checks already expand it.
+- Each task is bound to one Pi session; a retry starts a fresh session and inherits prior failure evidence.
+- Completion requires every verify command to pass after task start, and changed files are checked against Git and scope.
+- Added `piagent-benchmark`, a one-command paired comparison of raw Pi, Piagent or `codex-cli` with private reports.
 
-  A target only the shell can produce — `rm -rf $(mktemp -d)`, `find $(mktemp -d) -delete` — is a confirmation rather than a refusal: refusing outright takes a common idiom away, and permitting silently is how the check above was walked around.
+### Improved
 
-  Evaluation is also limited to the `printf` formats the renderer reproduces: `%s` with no flags, width, precision or positional argument, and a format with no conversions at all. Everything else transforms its argument rather than printing it — `%.0s` truncates it away and prints the rest of the format, `%*s` consumes an argument as the width, `%q` requotes, `%b` decodes — so substituting the raw argument produced a value bash never printed. `rm -rf $(printf %.0s/ x)`, `$(printf %*s 0 /)`, `$(printf %.*s 1 /)` and `$(printf %q /)` are all `/` in a shell and were all permitted. `%%` and a format with more arguments than conversions (which bash reuses and this does not) are excluded for the same reason.
+- Runtime creates bounded task contracts before the first model turn, so routine tasks need no setup tool calls.
+- One automatic follow-up runs when an agent stops with missing evidence; set `PIAGENT_AUTO_RECOVERY=off` to disable.
 
-  The same renderer fed the protected-path scan, so `cat $(printf %.0s.env x)` and `printf data > $(printf %.0s.env x)` reached `.env` without matching it. A `printf` format's literal text arrives in its output whatever the conversions do with the arguments, so it is now read as a path candidate in its own right — with the conversions taken out and what is left closed up, because a conversion that prints nothing lets the text on either side meet: `.e%.0snv` is `.env`, and reading the pieces separately gave `.e` and `nv`, neither of which is a file anybody protects. `printf %.0s.env x` on its own stays permitted, because printing a name is not opening it.
+### Fixed
 
-  Single quotes suspend substitution, and quoting is gone by the time a word is tokenized, so `rm -rf '$(printf /)'` — a file with an awkward name — was refused as a root removal. Whether the segment contains a substitution the shell would actually run is now read from the raw text, and the scan that reads substitution bodies skips single-quoted text as well: `rm -rf $(printf /) '$(a;b)'` really does remove `/`, and reading the literal beside it as a body made the whole segment unevaluable, dropping a refusal to a confirmation.
+- `piagent-update` could install a second copy under another npm prefix; it now stays in the prefix that owns the command.
 
-  Evaluation is limited to a substitution body that is one plain command and its literal operands. A separator puts a second command after the one being read, so `$(printf /; echo)` is `/` and `$(printf /; printf /)` is `//` however little `printf /` says so; a nested body cannot be located by pattern at all, since a pattern for `$(...)` matches the inner half of `$(printf $(printf /))` and describes a substitution nobody asked about; and quoting is applied before a word is tokenized, so `$(printf '\x2f')` arrives here as `$(printf x2f)`, which evaluates to a value the shell never had. Permitting on a wrong value is worse than not resolving, so any body carrying a separator, a nested substitution, a redirection, a variable, quoting or an escape gives up on evaluation and asks. A substitution still present after the resolution is not treated as resolved.
+## v1.2.10 - 2026-07-31
 
-  Every round of this so far reported a `printf` format, and reading one operand shape per round is how the same class kept coming back. Four more forms are closed together. Brace expansion runs before every other expansion and was not modelled at all, so `rm -rf {/,}` removed root and `cat {.env,}` opened a protected file while both read as ordinary words — the empty alternative is the whole trick, making a one-word expansion out of a form that does not look like one; it is now performed, and only where the shell would perform it, since quoting suspends it and `"{/,}"` really is one awkwardly named file. `--` ends `printf`'s options, so `$(printf -- /)` prints `/` while the format was read as `--`; any other `printf` option is now treated as one this does not model, since `-v NAME` assigns the result and prints nothing. A target that is nothing but a parameter expansion can be any value, root included: `${HOME:0:1}` is `/`, substring expansion is not modelled, and the word stayed exactly as written — so the shape decides rather than the operator, and a recursive removal of an unresolved whole-word expansion is asked about instead of permitted, while `$TMPDIR/build` is untouched because it cannot become root. And escapes are decoded inside a substitution body the same way they already were elsewhere: `$(echo -e '.en\x76')` and `$(printf %b '.en\x76')` both print `.env`, and the backslash is gone by the time the body is tokenized, so it is read back off the raw text.
+**Context index hardening and read-only reviewer.** The context index is owner-only and purges deleted source, image auto-attach is scoped, and `piagent-reviewer` is now truly read-only.
 
-  The `printf` renderer substituted the raw argument for every conversion and ran the format once, so its output was not what `printf` writes and the protected-path scan never consulted it at all — it was offered the format's literal text and the raw arguments separately. A name assembled out of both went unseen: `.e%.1sv` with `nv` is `.env` while the pieces on offer were `.ev` and `nv`, `au%.2s.json` with `thX` is `auth.json`, and because bash reuses a format while arguments remain, `%s` with `.e` and `nv` is also `.env`. `cat $(printf .e%.1sv nv)`, `printf data > $(printf %s .e nv)` and `printf %s au th.json | xargs cat` all reached a protected file with nothing matching. The renderer now applies precision, width and format reuse, and its output is a path candidate in its own right; printing a name on its own stays permitted, as before.
+### Security
 
-  Because the rendering is now accurate for those formats, the destructive check no longer merely asks about them: a constant precision or width and format reuse are reproduced byte for byte, so `rm -rf $(printf %.0s/ x)` and `rm -rf $(printf %s / /)` are refused rather than confirmed — they are `/` and `//` in any shell. `*` stays a confirmation even though the renderer now follows one: the width it consumes has its own rules, and a modelling slip there becomes a refusal of something nobody asked for. `%q`, `%b`, the numeric conversions and `%%` are unchanged and still confirmed.
+- Context index files are owner-only and securely delete removed source; older indexes migrate once to purge leftovers.
+- Images named in chat are auto-attached only from allowed, non-protected project paths and must be real images.
+- `piagent-reviewer` now has only read tools; autofix moves to `piagent-worker`.
+- MCP approval and `piagent-mcp doctor` now detect `directTools` set on individual servers.
 
-  Brace expansion was applied to the operands and nowhere else, but the shell performs it before it decides what the command even is. The command name, the flags and the `xargs` payload could all be assembled by it, and each read here as the text the author typed: `r{m,} -rf /` is `rm r -rf /` to the shell and a command called `r{m,}` to this, `rm {-rf,} /` lost the `-rf` the same way, and `fi{nd,} / -delete`, `find / {-delete,}` and `echo / | xargs rm {-rf,}` all went through. The whole word list is expanded now, before anything reads a command name or a flag. `find` also read only its first path operand, so `find fi / -delete` was judged on `fi` — every leading operand is a starting point and all of them are checked.
+## v1.2.9 - 2026-07-31
 
-  The `xargs` producer reads its own tokens rather than going through the shared candidate path, so the brace expansion done there never reached it: `printf {.env,} | xargs cat`, `printf .{en,}v | xargs cat` and `echo auth{.json,} | xargs cat` each opened a protected file with nothing matching. Quoting still suspends the expansion in both places, so `printf "{.env,}" | xargs cat` names the file it literally names.
+**Context Engine follows the same policy as the guard.** Context search and packs now use the guard's exclusion rules, so protected content never reaches the model through old indexes.
 
-  Expanding braces inside the destructive checks fixed those checks and left every other reader on the raw text, which is not what the shell does — it expands once, before it decides what the command is. So `git reset --har{d,}` passed a legacy pattern, `docker volume pr{une,}` an exec-policy rule, `git p{ush,}` a confirmation pattern, and `{bash,} -c '...'` the nested-interpreter scan, each of them reading the words as typed. The word list is now built in one place and every reader takes it from there. Ranges are expanded as well: they look like they only enumerate counters, but `{n..n}` is a single letter with the braces removed, so `r{m..m}` is `rm`, `fi{n..n}d` is `find` and `.e{n..n}v` is `.env`.
+### Fixed
 
-  Two things the expansion then exposed. `find` takes its own options before the paths start, and the target scan stopped at the first `-`, so `find -H / -delete` was judged with no target at all; `-H`, `-L`, `-P`, `-O<level>`, `-D` and `--` are skipped now. And a lone `-` between `-c` and the script ends the option list without being the script, so `bash -c - 'rm -rf /'` runs the removal while the scan read `-` and found nothing — which is exactly the shape `bash -{c,} '...'` takes once expanded.
+- `piagent-update --dry-run --project` showed a stack trace when the project migrator was missing; it now says so directly.
 
-  Two readers were still on the raw words after that. The `xargs` producer identified its command as written, so `{printf,} .e%.1sv nv | xargs cat` found no producer at all — the output was never rendered and the `.env` it prints was never offered; the same held for a producer inside a substitution, and for the escape decoding, which is gated on the producer's name too. The producer's *name* now comes from the expanded list while its operands stay on the raw tokens, which are the only thing that still knows where the quotes were.
+### Security
 
-  And the path candidates expanded braces unconditionally, which was the conservative half of the same problem: `cat "{.env,}"` opens a file with that literal name, and offering `.env` for it refused a command that touches nothing protected. The tokenizer already decides whether the shell would expand a word, and that verdict is now carried to the candidate list instead of guessed at — including for redirection targets, where the scanner reports it alongside the path.
+- Context Engine and runtime share one policy for protected, read-only and excluded paths.
+- Indexes built under weaker rules are rebuilt automatically and filtered again at read time.
+- Symlinks and paths leading outside the project are refused when building and reading the index.
 
-  Expanding into a *word list* while still reading operands off the raw tokens left one word doing two jobs. A brace word can produce the command and its arguments together: `{cat,.env}` is `cat .env`, and taking the name from the expanded list and the arguments from the unexpanded one saw a `cat` with no operands at all. The same shape hid a producer's format — `{printf,.e%.1sv} nv` prints `.env` — from the renderer. The expansion now produces a token *stream*, and command, flags and operands all come off it.
+## v1.2.8 - 2026-07-31
 
-  Quoting is tracked per character rather than per word, because one word can hold both: `"{.env,}"{,}` is the literal `{.env,}` twice, and a single flag for the token could only say "expand it all" or "expand none of it" — the first refused a command that opens nothing protected. Each piece of the syntax is decided on its own, so a quoted opening brace, a quoted comma, and a backslash in front of either each stop the expansion exactly where the shell stops it.
+**Web research for researcher subagents by default.** Setup and update now install the web access add-on so researcher subagents can search and fetch external sources.
 
-  The regression test for this class no longer enumerates formats. It builds the word list `bash` actually builds for each expansion form and requires the policy to agree about what that list contains, in both directions — a catastrophic target must not be permitted, and a protected path must be seen — so a form nobody thought to write down is still compared against the shell rather than against an expectation.
+### Added
 
-  That test now generates the forms instead of listing them: it assembles spellings out of the pieces a shell composes — quotes, escapes, ANSI-C, braces, ranges, `printf`, parameter expansion — and puts each one in front of several readers. It found three misses on its first run, and one of them was the cause of the other two. A brace group holding a parameter expansion closed on the wrong brace, because the scan for the closing `}` counted the one that ends `${...}`: `{cat,${X:-.env}}` became `cat}` and `${X:-.env}`, so the command was not `cat`, the operand was not a path, and `{rm,-rf,${X:-/}}` was permitted outright. The brace boundaries are now read with the same per-character record of what is syntax and what is text that the alternatives were already split by.
+- Global setup and update install `pi-web-access@0.17.0` by default; opt out with `--no-web-access`.
 
-  A word that is nothing but an unresolved parameter expansion is now refused wherever the command says the word is a file. `cat ${HOME:+.env}` opens `.env`, and every check here read it as a word naming nothing. A command substitution in the same position is left alone deliberately: it carries a command that the nested scan classifies, so `cat $(gh issue create ...)` is still answered as an external write rather than with a vaguer reason. Two expansions with nothing between them are treated as a name being assembled, the same as literal text beside one, because `$(printf %.1sen .Z)$(printf %.1s vZ)` spells `.env` and neither half contains it.
+### Fixed
 
-  And a pipeline is judged as a pipeline. `echo $F | xargs cat` opens whatever `$F` names while neither segment shows it — the producer only prints, and the consumer's operand list is empty because the filename arrives on stdin. A producer feeding an `xargs` that opens files is now judged against the command at the far end of the pipe. A producer holding no expansion is unaffected, so `git diff --name-only | xargs cat` is untouched.
+- Older web access registrations kept stale dependencies; install now removes them before installing the reviewed version.
 
-  What kept this class alive for so many rounds was never the spelling. A segment had a dozen readers and each derived its own view of it, so closing a form for one reader left it open for the other eleven — and each round closed the reader that had just been reported. The generated corpus was then only generating *operands*, which is why it came back clean while the command name was still being read as written: `rm -rf $(printf /)` was refused because the destructive check resolved its own target, and `r$(printf %s m) -rf /` — the same removal with the name assembled the same way — was permitted by every check in the file.
+## v1.2.7 - 2026-07-31
 
-  Substitution resolution has moved to where brace expansion already was, so the shell's order — braces, then parameters, then substitutions — is performed once and every reader takes the result. That closed the command name, the `find` and `xargs` operands, the interpreter name in `$(printf %s ba)$(echo -n sh) -c '...'`, the `xargs` consumer in `echo .env | xa$(printf %s rgs) cat`, and the redirection target of a data-only command, which no reader had covered because `printf`'s own arguments are not files even though what `>` names always is.
+**Patched MCP and subagent add-ons.** The pinned MCP and subagent add-ons move to versions whose dependency tree reports no advisories, and the audit gate is stricter.
 
-  Where a name still cannot be resolved, it is now treated as the unknown command it is. `${X:+r}m -rf /`, `${X:+b}ash -c 'cat .env'` and `${X:+cat} ${X:+.env}` are each that command whenever the variable is set, and each read as something harmless with an odd name. A name carrying an expansion no longer has to match a known command for the destructive checks, the interpreter scan or the file-operand net to look at it. A named command with a literal operand is untouched, so `grep -r TODO src` and `npm run $SCRIPT` keep their answers.
+### Improved
 
-  The corpus that found all of this generates the cross product the bugs actually live in — expansion form × position × reader — putting each spelling in the command name, the operand, a flag's argument, a redirection target, a pipeline producer, an `xargs` consumer and an interpreter payload. It ran clean at 36,000 commands with no missed protected path, no permitted removal of root, and nothing reported for a command that touches neither.
+- An existing `pi-subagents` install is upgraded during a normal platform update.
 
-  One reader was named in that change and not moved: the glob candidates were still read off the words as typed. That mattered more than it looked, because a pattern is the one thing the literal check cannot answer for — `.env*` matches no protected literal, so the glob reader is all that stands between it and the file. `{cat,.env*}`, `{grep,-f,.env*,README.md}`, `cat $({echo,.env*})`, `{bash,} -c 'cat .env*'`, `bash -{c,} 'cat .env*'` and `echo .env* | xargs cat` each read a protected file with no candidate produced at all. It now takes the same word list as everything else, descends the brace-expanded text, and follows a pattern printed into an `xargs` that opens files.
+### Fixed
 
-  Brace expansion carries its per-character record out with each word instead of dropping it, because one token can produce words that are not the same kind of thing: `{cat,.env*}` is a command and a pattern, and inheriting the token's verdict got one of them wrong. Whether a word is matched against filenames is now decided per word, so `{".env*",x}` names a file and globs nothing, exactly as the shell has it.
+- Updates could keep a vulnerable transitive version; old add-on registrations are now removed before reinstalling.
 
-  The same record fixes the redirection scanner, which kept one flag for the whole target. `printf x > "{.env,}"{,}` is an ambiguous redirect that writes nothing, and expanding the quoted group anyway offered `.env` for a file the command never touches.
+### Security
 
-  That fix reached the literal reader and stopped at the glob reader, which was still holding the target as typed and answering on the pattern inside it, so the same three commands stayed blocked on `.env` while writing no file at all. Both readers now apply the rule bash applies: a redirection opens its target only where it expands to exactly one word, and answers `ambiguous redirect` otherwise. `> {.env,other}` and `> .en{v,w}*` were the same false positive unreported, while `> {.env,}` really does truncate `.env`, because an empty alternative is dropped rather than counted. A word that can still disappear — an unset variable, or a pattern under `nullglob` — leaves the count unknowable, so those keep every candidate. The flag the scanner used to report beside the mask is gone; a flag for a whole word is what went wrong here to begin with, and two records that can disagree is one too many.
+- Updated to `pi-mcp-adapter@2.15.0` and `pi-subagents@0.38.0`, which resolve patched dependencies.
+- The release gate now also blocks moderate advisories; one documented dependency advisory in the Pi host remains accepted.
 
-  The generated corpus asserted off the word list bash builds, which for a redirection over-states what it opens — that is how it demanded an answer for `printf x > ".e"{,}nv`, a command that writes nothing. The oracle now asks whether bash opens the target, not what it expands to.
+## v1.2.6 - 2026-07-31
 
-  The corpus had no `*` in it, which is why it reported clean while all of this was open — a spelling axis missing from the grammar is a class of defect the generator cannot reach. Patterns are now generated too, expanded in a scratch directory holding names a protected pattern matches, since that is the only way to tell an active glob from a quoted one.
+**Context Engine v2 and task-shaped tool loading.** A local code index builds bounded context packs, and Piagent exposes only the tools a task needs while guards stay active.
 
-- A finding's strength depended on how its sentence started. The exec-policy decision was derived from the prose of each reason — "Refusing", "Forbidden", "Prompt" — rather than from the action the check had already recorded, so a finding whose wording did not begin with one of those words was recorded, displayed, and then counted as `allow`. The decision now reads the recorded action, with the prose test kept for the legacy confirmation patterns, which record a reason and no action.
+### Added
 
-- The MCP gate is cached per project and recomputed when a signature over the files behind it changes. That signature was written out by hand from the repository layers, while the check it guards had grown to read merged settings from all four scopes and to stat import targets outside the repository. Adding `directTools: true` to a personal global config while a repository set `toolPrefix: "none"` therefore left an already-loaded guard permitting tool calls that `piagent-mcp doctor` was reporting as blocked, until the module happened to be reloaded; an `imports: ["codex"]` declaration behaved the same way once the codex config appeared. The file list now comes from the same traversal the readers use, absences included, so a reader that starts consulting a new file is watched for it without a second list needing to be updated to match.
+- Added Context Engine v2: a local incremental code index with budgeted context packs and the `piagent-context` command.
+- Added Agent Watch compatible context telemetry by session, without storing raw prompts or tool output.
 
-- The shell guard read `>|` as a pipe. Splitting there made the file being truncated the first word of a second command, where it read as an executable name, so `printf x >| .env` overwrote a protected path without matching one. `>&word` opens that word for writing unless a digit or `-` follows, and the whole form was skipped; a redirection can also precede its command, where it was read as the command name. Paths carried as an operand value (`dd if=`, `--file=`), inside an array literal, or rewritten by a parameter operator (`#`, `%`, `/`) were not resolved either, and a word was split at the space inside `$( )`, so the filename being assembled was never a single token.
+### Improved
 
-  Where a filename still cannot be resolved — literal text glued onto a substitution, as in `cat .en$(echo v)` — the command is refused and the word that caused it is named. Matching the literal half against the protected patterns answers a different question than the one being asked.
+- Tools load by task shape: tiny tasks see 11 of 30 Piagent tools, ordinary tasks 15; guards apply regardless.
 
-- `piagent-mcp list --json` reported `servers: []` and exited 0 while the guard was refusing every tool call, so a caller scripting against it read the blocked state as an empty one. Its exit code now answers whether MCP can work here rather than whether any rows printed, and the JSON carries the reason. The in-session `/piagent-mcp status`, `doctor` and menu report it too: all three surfaces now read one shared state instead of assembling their own from a different subset of the same calls.
+### Fixed
 
-- The adapter merges `settings` across all four config layers into one session-wide block. `directTools` set in one file and `toolPrefix: "none"` set in another therefore produced a session with neither property visible to a check that read either file on its own — the exact combination that leaves the approval gate nothing to check. Settings are now read merged, and the report names both files, since editing either one fixes it.
+- A local checkout and the released package could load together; install now removes older local registrations.
 
-- `remove`, `enable` and `disable` on a server reached through `imports` wrote to a file the adapter does not read for that server, so the command reported success and the next tool call still reached it. Worse, the file it located was the other tool's config: the write would have rewritten somebody's Cursor or VS Code file in this platform's format. All three now refuse and name the file that actually defines it.
+## v1.2.5 - 2026-07-30
 
-- The menu and the detail view decided whether a server needed approval from its scope. A repository-relative import declared by a `global` config carries the scope `global` and a definition read out of the clone, so the servers whose origin is hardest to see were the ones never offered a decision. Both now use the same rule the gate uses.
+**`piagent-update` works with npm 12.** The updater now reads npm 12's registry output when resolving the target version and its Pi host.
 
-- Approving showed the fragment the repository layer contributed rather than the definition that runs. The adapter merges a same-named server key by key across layers, so a repository declaring only `{"args": [...]}` inherits its command from a lower layer, and the operator was consenting to a command line they were never shown. The preview is now the merged entry; the digest stays over the repository's own fragment, so editing a personal global config does not return a server to pending.
+### Fixed
 
-- A repository importing `codex` had every tool call refused whether or not that config existed on the machine. An import of a kind nothing here can parse is a hole only when the file it names is actually there; otherwise it is a config to clean up, not a session to stop.
+- `piagent-update` failed to read npm 12 version metadata; it now accepts it and still refuses ambiguous results.
 
-- An MCP config that parses but is not a JSON object was read as empty, so the next write replaced it with this tool's shape and destroyed whatever the document had been. It is now refused. A write also no longer follows a symlink at the config path, drops `imports` kinds this version does not recognise, or hides an import target that exists but cannot be parsed — that last one reported as no servers, which is indistinguishable from a tool that defines none.
+## v1.2.4 - 2026-07-30
 
-- The approval store could not tell absent from unreadable. Both read as pending, which is right for the gate and wrong for a write: recording one decision on top of a store this process could not parse discarded every decision in it, including the ones for other projects, whose only symptom would be returning to pending one at a time. Writes now refuse when the store could not be read.
+**Smoother team rollout for `piagent-update`.** Updates fall back to a user-writable npm prefix, and `--project` adds an optional migration and doctor check.
 
-### Changed
+### Improved
 
-- `docs/mcp-and-tools.md` records the config path and server key each supported import kind actually uses, against what the adapter reads. Three of the six disagree, so the platform reads the union: listing a server that never loads costs one approval, missing one costs the gate.
+- Optional `--project <path>` runs a legacy project migration and doctor after the global update.
+- Documented an `npm exec` bootstrap command for machines without the global `piagent-update` helper.
 
-- `verify` refuses a source file carrying a control byte. Three files held a raw NUL inside a string literal — used as a key separator, and as ZIP magic in a test fixture. They ran correctly, but Git classified them as binary, which took them out of every grep-based gate in `verify`, including the wording checks, and out of the diff a reviewer sees on a pull request. The bytes are written as escapes now.
+### Fixed
 
-## v1.2.0 - 2026-07-28
+- Updates failed with permission errors when the npm prefix was OS-locked; they now use a user-writable prefix.
 
-### Added
+## v1.2.3 - 2026-07-30
 
-- `piagent-mcp` manages servers instead of only seeding presets: `add`, `remove`, `get`, `list`, `enable`, `disable` and `doctor`, across the four config layers via `--scope`. `add` reports which scope it wrote and the exact file it changed, so nobody has to guess which layer is in effect. A server added by hand keeps surviving `piagent-update`, because a preset only rewrites the server IDs it owns.
+**Short runtime commands.** Short commands such as `/usage`, `/context` and `/permission` were added, and workflows moved under `/workflow` and `/fresh`.
 
-- A server a repository defines is not usable until somebody on this machine approves it. `.mcp.json` and `.pi/mcp.json` travel with a clone, and opening a session in one should not hand its author a process here with this operator's credentials. `piagent-mcp approve` prints the definition before recording the decision, `reject` and `reset` are the other two answers, and the decision is stored in `~/.pi/piagent-mcp-approvals.json` rather than in the repository — a repository that can approve its own servers has not been gated.
+### Added
 
-  The record pins the digest of what was approved. Approval is consent to what the server runs, so changing its command, URL or arguments returns it to pending, which is the same split the capability lock draws between consent and build.
+- Added `/commands`, `/usage`, `/context`, `/permission`, `/memory`, `/onboard`, `/name` and `/fresh`.
 
-  Enforcement is in the guard's `tool_call` hook. As shipped in this version it covered the `mcp` proxy only — the direct-tool branch matched a name shape the adapter does not emit, so it never fired. See v1.2.1. The adapter owns the connection and the extension cannot prevent one being opened, so what is stopped is every tool call, not the connection itself. Servers in the global layers are not gated: nothing a repository contains can put a server there.
+### Improved
 
-- MCP is a command inside a session, not a request to the model. `/piagent-mcp` on its own opens a menu, because a surface only helps if it can be found without already knowing the subcommand. The menu is built from what the project has: approving is not offered when nothing is waiting on a decision, and each entry carries its own count. Picking an action that needs a server asks which one, unless there is only one it could be.
+- Workflow launchers are grouped under `/workflow`, and `/piagent-workflow` still routes there.
+- Docs now separate Pi native commands such as `/model` and `/resume` from Piagent commands.
 
-  Every entry is also typeable — `status`, `get`, `doctor`, `approve`, `reject`, `reset`, `enable`, `disable` — and both paths run the same code, so the menu teaches the direct form instead of replacing it. Subcommands and server names autocomplete. Where no prompt can be answered, in print and JSON mode, the report and the subcommand list are printed rather than blocking on a question nobody can answer.
+## v1.2.2 - 2026-07-29
 
-  Typing the shell command mid-session asked the model to run bash, read the output and report back — three model turns for a question this process answers from files it has already read, and a different summary each time. Pi dispatches a registered command straight to its handler, so the model is not involved at all.
+**Compact output for large tool results.** Oversized tool output shows a bounded preview and is saved locally, and `/setname` renames an open session.
 
-  Adding and removing a server stay in the terminal: `add` carries shell quoting, `${VAR}` references and a `--` command line. Those already have one correct parser, and it is the shell; a slash command that re-implemented it would be a second, worse one. `/piagent-mcp add` prints the terminal command rather than guessing at one.
+### Added
 
-  Both surfaces read the same module, so the two cannot disagree about whether a server is usable. Remedies name the form that works where they are read: the session prints `/piagent-mcp approve <name>`, the terminal prints `piagent-mcp approve <name>`.
+- Large tool results show a bounded preview and are saved under `.pi/piagent-state/tool-results/`.
+- Added `/piagent-logs` to see recent oversized output captures without calling the model.
+- Added `/setname` to rename an open session for resume lists, Agent Watch and reports.
 
-- `piagent-mcp doctor` and `piagent-doctor` say what each configured server still needs — a referenced variable that is not exported, an executable that is not on PATH, a decision that has not been made, the Docker daemon not answering. Counting configured servers, which is what the doctor did before, says nothing about whether any of them can answer. A session start names the ones that are definitely stuck; `PIAGENT_NO_MCP_NOTICE=1` switches that off.
+### Improved
 
-### Changed
+- `/piagent-usage` and `/task-preflight` now print short status lines.
 
-- `piagent-mcp add` refuses to write a credential into MCP config and prints the reference form to use instead. The check reads both the field name and the value, so `--env CONFIG=ghp_...` is caught as well as `--env GITHUB_TOKEN=...`, and it covers `--header` too. `--url` accepts https, or http only on loopback. `list` and `get` mask values while leaving `${VAR}` readable, because that is a variable name rather than its contents.
+## v1.2.1 - 2026-07-28
 
-  OAuth is not automated and no token is stored by this platform. Pi already owns that flow — `/mcp-auth <server>` — and a third credential store holding other people's credentials would be worse than either of the two that already exist.
+**MCP approval gate and shell guard fixes.** The MCP approval gate now covers direct tools and imported servers, and the shell guard reads commands the way the shell expands them.
 
-- `scripts/configure-mcp.sh` is replaced by `scripts/mcp-manage.mjs`; the pinned server catalog moved into `packages/piagent-core/mcp/`, where the capability lock pins it. The `piagent-mcp` command is unchanged. The three MCP files that decide which servers a session may call are now part of the locked runtime set.
+### Fixed
 
-- The docs site is one page per topic instead of a single file, grouped in the sidebar as Get started, Build, MCP and Operate. MCP has four pages of its own, since it now has a command surface, an approval decision and an auth story to explain. Each page carries a table of contents and previous/next links.
+- `piagent-mcp doctor` and `list` reported no servers while every tool call was blocked; they now name the cause and exit 1.
+- A failed `piagent-capability vendor` could delete files outside the project or leave none; it now changes nothing on failure.
 
-  Pages are generated by `scripts/build-docs-site.mjs` from a content fragment each, plus shared `docs-site/assets/docs.css` and `docs-site/assets/docs.js`. The generated HTML is committed, because the site is served as static files with no build step, and `npm run verify` fails when the committed output no longer matches its source. `npm run site:preview` serves the result the way the deployment does — the site relies on clean URLs, so an ordinary static server answers 404 for every internal link.
+### Security
 
-- Public text describes this platform on its own terms rather than against named competing products. The page that compared feature tables now states what the platform takes on and what it leaves to the host, and is called Phạm vi platform rather than carrying two other products' names in the sidebar of every page. The same wording pass covers the MCP pages, `docs/mcp-and-tools.md` and a design-rationale comment in `document-intake.ts`.
+- MCP approval never applied to direct MCP tools; every server is now gated whatever tool naming mode it uses.
+- Servers pulled in through a repository's `imports` setting are now listed and require approval.
+- The shell guard now resolves braces, quoting, `printf` and substitutions before checking protected paths and deletes.
+- `piagent-mcp add` refuses credentials in server URLs, and `list` and `get` mask them.
 
-  Where "Codex" and "Claude" mean model families they are now labelled as such, with their provider ids, so a reader cannot mistake a model choice for a different tool. `--model-scope` and `--preset` say "model families" in their help text for the same reason.
+## v1.2.0 - 2026-07-28
 
-  The wording gate in `npm run verify` only read `README.md`, `docs/`, the prompts and the project template, which is why the site and the runtime strings were never checked. It now also reads `docs-site/content`, the site builder — navigation labels live there, not in a fragment — and the `mcp` and `extensions` directories that print to an operator.
+**MCP server management with repository approval.** `piagent-mcp` now manages servers, and servers defined by a repository need local approval before use.
 
-## v1.1.9 - 2026-07-28
+### Added
 
-### Fixed
+- `piagent-mcp` gains `add`, `remove`, `get`, `list`, `enable`, `disable` and `doctor` across config layers.
+- `/piagent-mcp` opens an in-session menu for status, approval and diagnostics without a model turn.
 
-- The update notice reaches the install path people actually use. v1.1.8 decided a platform tree was a maintainer's working copy when it found a `.git` directory in it — but `pi install git:...` clones the repository, so an ordinary install carries a `.git` and every other file a working copy carries. There is no mark inside the tree that separates them, which meant the notice never appeared for anyone who installed the documented way.
+### Improved
 
-  What separates them is where they sit: Pi puts packages it installed under its own agent directory, and npm puts the global helper under `node_modules`. A tree anywhere else is a working copy and is still told nothing. `PI_CODING_AGENT_DIR` is honoured, and both paths are resolved before comparison, because a home reached through a symlink is ordinary — macOS reaches `/var` that way — and comparing a real path against a symlinked one made an install look like it was somewhere else.
+- The docs site is split into one page per topic, with four pages for MCP.
 
-## v1.1.8 - 2026-07-28
+### Security
 
-### Added
+- Servers defined in a repository need `piagent-mcp approve` on this machine; changing their command resets approval.
+- `piagent-mcp add` refuses to write credentials into MCP config and shows the reference form to use.
 
-- Pi says when a release is out, and names the command that takes it. The notice appears in the session-start line as `Piagent update available: 1.1.7 -> 1.1.8. Run \`piagent-update\` to move this machine to it.` Nobody has to remember to go and check, which until now was the only way to find out.
+## v1.1.9 - 2026-07-28
 
-  It costs the session nothing. The session reads a cache and, when that cache is older than a day, leaves a detached `npm view` behind to refresh it — so the first session after a release may still be quiet and the next one carries the notice. This is the only network traffic the guard originates, it sends nothing about the project, and the registry's answer reaches the terminal only if it is exactly `MAJOR.MINOR.PATCH`, so neither a hostile registry nor an edited cache can put chosen text in front of an operator. A checkout is never told to update. `PIAGENT_NO_UPDATE_CHECK=1` switches it off.
+**Update notice reaches ordinary installs.** The update notice from 1.1.8 was hidden on installs cloned by Pi; it now appears for every non-development install.
 
-## v1.1.7 - 2026-07-28
+### Fixed
 
-A platform update is one global install. It was not behaving like one: every project that selected capability packs stopped working after a release until its profile was reapplied by hand, and the policy a release corrected never reached a project that had already onboarded.
+- Installs from Git were mistaken for working copies and got no update notice; they now see it.
 
-### Changed
+## v1.1.8 - 2026-07-28
 
-- A capability lock that is behind the installed platform is re-pinned instead of refusing the session. The lock pinned two different things and gave them one answer. What the project consented to — which packs, from where, and how far they may reach — still blocks: a grant that widens, a protection that disappears, a pack that changes identity. Which build produced the resolution — package version, runtime file digests, artifact content — moves on every release, and blocking on it put a per-project chore behind a global update while not defending against the case it resembles, since the code that verifies the lock is itself one of the files the lock pins. A build move with an unchanged grant is recorded and reported.
+**Pi tells you when a release is available.** The session-start line now shows when a newer Piagent is out and names `piagent-update` as the command to run.
 
-- Artifact content is part of the build, not part of consent. Adapter policy files, base policy, prompts, skills, subagents and recipes all ship as pack artifacts, so pinning their bytes meant a corrected policy could never reach a project referencing it. Nothing is given up: which artifacts a pack provides is declared in its manifest and the manifest digest is still pinned, so an artifact that appears, disappears or moves still blocks — and a policy artifact that weakens still blocks, because the permissions it resolves to are compared directionally.
+### Added
 
-- A project profile can name the adapter it takes its policy from instead of copying it. `{"extends": "web-frontend", "projectId": ..., "displayName": ...}` keeps the project's identity and overrides in the project, and resolves the rest from the installed platform at runtime. Any key the project states replaces the adapter's key whole; a profile without `extends` keeps working exactly as before, self-contained. `init-project.sh` and `/onboard-project` write this form when the profile comes from a built-in adapter, so onboarding stays the one per-project step and updating stays global.
+- The session-start line shows an update notice naming `piagent-update` when a new release exists.
 
-  A profile naming an adapter that is not installed refuses rather than falling back to something weaker.
+### Improved
 
-## v1.1.6 - 2026-07-27
+- The check reads a cache refreshed in the background at most daily, so sessions do not wait on it.
 
-Monorepo fixes found auditing how the platform scopes itself to a project. Every case was reproduced against a real directory tree before it was changed.
+## v1.1.7 - 2026-07-28
 
-### Fixed
+**Projects keep working after a platform update.** Capability locks behind the installed platform are re-pinned instead of blocking the session, and policy fixes reach every project.
 
-- `be-readonly-fe` keeps the backend read-only in a monorepo. Its `readOnlyPaths` and `shellProtectedPaths` were anchored at the repository root, so `backend/**` and `apps/api/**` covered a backend sitting at the top of the tree and nothing else. Choosing the profile on a repository whose backend lives in `packages/api`, `apps/backend` or `services/payments` produced a profile that announced the backend was read-only while leaving every file in it writable — the one guarantee the profile exists to make. The backend directories under `apps/`, `packages/` and all of `services/*` are covered now.
+### Added
 
-  They are enumerated rather than matched with `**/api/**`, which would have swept in `packages/web/src/api/` — the frontend's own HTTP client — and frozen the half of the repository the profile is meant to leave writable.
+- A project profile can `extends` an adapter instead of copying its policy.
 
-- The frontend verify command finds a frontend that is not at `frontend/` or `apps/web/`. It fell through to the repository root, where a workspace root has no `type-check` script, so verification reported success having run nothing. `apps/frontend`, `packages/web`, `packages/frontend` and `client` are looked at too.
+### Improved
 
-- `apps/backend` is read as a backend. `apps/frontend` counted as a frontend marker while only `apps/api` and `apps/server` counted as backend ones, so a repository that named both halves symmetrically was detected as frontend-only and offered `web-frontend`. `client/` and `server/` at the root were not markers either.
+- Policy, prompt and skill content now follows the installed platform, so corrections reach existing projects.
 
-- Frontend and backend are detected inside declared workspaces. Nothing read the `workspaces` field or `pnpm-workspace.yaml`, and nothing looked under `packages/`, so a pnpm monorepo fell through every marker to `generic`. Each declared package is now read through its own manifest and layout, which is what identifies `packages/storefront` and `packages/gateway` as the two halves of a fullstack repository. Only a trailing wildcard is expanded, absolute and `..` patterns are refused, and at most 64 packages are read.
+### Fixed
 
-### Changed
+- Projects with capability packs stopped working after each release until reapplied; the lock is now re-pinned automatically.
 
-- Profile detection lives in `packages/piagent-core/extensions/project-shape.js`. `piagent_profile_options` and `scripts/init-project.sh` each carried their own copy of the rules and had drifted; the `apps/backend` gap above was present in both, and a fix to either would have left the other wrong. The file is covered by the capability lock, because steering which profile a project is offered is a way to choose what the guard ends up enforcing.
+## v1.1.6 - 2026-07-27
 
-## v1.1.5 - 2026-07-27
+**Monorepo detection and scoping fixes.** Profiles now detect and scope frontend and backend packages correctly in monorepos and workspaces.
 
-### Added
+### Fixed
 
-- `piagent-update` moves a machine from one release to the next in one command. A release is three independently versioned things — the Pi host, the npm-global terminal helper, and the Pi package — and they have to move in that order, because `piagent-install` refuses to run against a host that does not match the version its own package.json pins and does not install one itself. Doing it by hand is three commands and one ordering rule that fails late when it is got wrong.
+- `be-readonly-fe` left nested backends writable in monorepos; they are now read-only.
+- Frontend verify ran nothing and reported success when the frontend sat elsewhere; it now finds the right package.
+- Packages declared in `workspaces` or `pnpm-workspace.yaml` were ignored; detection now reads them.
 
-  Every version the run needs is resolved from the registry before anything is installed, including the host version taken from the *target* helper's published metadata rather than the running one, so `--check` and `--dry-run` describe exactly what a real run would do. After the helper replaces itself the run confirms that the version on disk is the one it asked for, and stops before touching the Pi package if it is not. Running it from a git checkout is refused rather than replacing that checkout's commands with a published build.
+## v1.1.5 - 2026-07-27
 
-  `--check`, `--dry-run`, `--version X.Y.Z`, `--force`, `--project <path>`, `--no-host`, `--no-package`, and pass-through to `piagent-install` after `--`.
+**One-command update with `piagent-update`.** `piagent-update` moves the Pi host, helper and Pi package to the next release in the correct order.
 
-### Fixed
+### Added
 
-- `docs/release-install-policy.md`, `docs/team-onboarding.md` and `docs/command-reference-vietnamese.md` described the manual update sequence without saying why its order is mandatory. `piagent-install` fails on a host mismatch; the auto-install of a matching host lives in `setup.sh` and does not apply to that flow.
+- Added `piagent-update`, which updates the Pi host, terminal helper and Pi package in order.
+- `--check` and `--dry-run` show exactly what a real run would install, resolved before anything changes.
 
 ## v1.1.4 - 2026-07-27
 
-### Fixed
+**Redaction of credentials in command options.** Credentials passed as command-line options or `Authorization` headers are now redacted reliably.
+
+### Security
 
-- A credential passed as a command-line option is recognised as one. `--token=abc123`, `--token abc123`, `--password`, `--api-key`, `--client-secret` and the rest went unrecognised because the assignment patterns require a key that starts with a letter, and `-` is not one. v1.1.3 made the redactor's verdict the gate that decides whether a command may serve as verify evidence, so anything it missed was stored in the clear *and* accepted as proof — the same invariant v1.1.3 was written to enforce, defeated by the syntax most command-line tools actually use. Env-style assignments were the only shape covered.
-- An `Authorization` header is redacted wherever it sits among the arguments. The value ran to the end of the line, so the same credential survived or not depending on how much text happened to follow it: `curl URL -H "Authorization: Token abc123"` left the header value one character under the length bar, while moving the header ahead of the URL swept the URL into the value and pushed it over. The value is now the single whitespace-free token that follows the scheme, and under a known authentication scheme its length is not consulted at all. Prose such as `Authorization: not required for local runs` is still left alone.
+- Options such as `--token`, `--password` and `--api-key` were not redacted; their values are now hidden.
+- `Authorization` header values are redacted wherever they appear in the arguments.
 
 ## v1.1.3 - 2026-07-27
 
-Fixes for defects found reviewing v1.1.2 after it shipped, including two introduced by v1.1.2 itself. Every fix was reproduced first.
+**Fixes for issues found reviewing 1.1.2.** Short secrets are redacted, verify evidence identifies commands exactly again, and document reads no longer hang on pipes.
 
 ### Fixed
 
-- Verify evidence identifies the command exactly again. v1.1.2 moved the digest onto the redacted text to stop it confirming guesses at a secret, and in doing so gave every secret the same identity: an observation of `DATABASE_PASSWORD=CorrectHorse42 npm test` satisfied a claim about `DATABASE_PASSWORD=DifferentHorse99 npm test`, so a run against one database could be recorded as proof for another. That contradicts the exact-match rule the gate is built on. Neither text is safe to hash, so a command with anything to redact now gets no digest at all and cannot be evidence; the gate says so instead of matching loosely. Commands with no secret in them — every legitimate verify command — are identified by their own text as before.
-- A document replaced by a named pipe is refused instead of hanging. The identity check that would have rejected it runs after the file is opened, and opening a pipe waits for a writer, so the substitution did not have to defeat the check — it only had to stop it from running. The read blocked indefinitely. The file is now opened without blocking and without following a symbolic link at the final component.
-- Short credentials are redacted. Values under a key that names a secret outright were kept in the clear below eight or twelve characters, so `TOKEN=hunter2` was stored verbatim in the evidence ledger. Length is only ambiguous after a bare `:`, where English uses the same shape — `password: short` is prose, and `Authorization: Token abc` puts a scheme name where a value would go. Under `=`, inside quotes, in a query string, or as a field in a structure, any value that is not a placeholder is now redacted at any length.
-- A redirect must land on the page being verified. `npm run site:check` compared the hostname, scheme, port and credentials of the redirect target but not its path, so `/missing` or `/?release=old` passed while the run only ever fetched `/`.
-- `piagent-install` reports a missing Node runtime as a missing Node runtime. Validating the MCP preset early, added in v1.1.2, put a Node script ahead of the Node version check, so on a machine without Node the installer failed with `node: command not found` and blamed the preset.
+- Verify evidence gave commands with different secrets the same identity; each command is identified exactly again.
+- Reading a document replaced by a named pipe hung; it is now refused.
+- `piagent-install` showed `node: command not found` without Node.js; it now reports the missing runtime clearly.
 
-### Changed
+### Security
 
-- `docs/release-install-policy.md` named the wrong release for the code-scanning gap. A pull request last merged with a failing CodeQL check and an open high alert on `v1.1.0`; on `v1.1.2` the results gate blocked the pull request until the alerts were cleared.
+- Short secret values such as `TOKEN=hunter2` were stored in clear text; they are now redacted.
 
 ## v1.1.2 - 2026-07-26
 
-Security and release-gating fixes found reviewing v1.1.1 after it shipped. Every fix in this release was reproduced as a working exploit or failure first.
+**Security and release gating fixes.** Document reads close a file-swap race, evidence no longer hashes unredacted commands, and publishing waits for all checks.
+
+### Improved
+
+- Publishing now waits for the full verification matrix to pass.
 
 ### Fixed
 
-- `piagent_document_read` no longer re-opens the file by name after checking it. Containment in a granted root, the extension, the size limit, and the guard's protected-path check were all decided from one `realpath` and `stat`, and then `readFileSync` resolved the name a second time. Replacing the checked file with a symbolic link in between returned the contents of a file outside every granted root — reproduced end to end. The file is now opened once and read from the descriptor, and the descriptor's device and inode must equal the file that passed the checks or nothing is read. `pdftotext` is handed the same descriptor on standard input instead of a path, so the converter cannot be pointed elsewhere either.
-- The evidence ledger no longer stores a digest of the unredacted command. It wrote a redacted command such as `export TOKEN= [REDACTED_SECRET] && npm test` beside a SHA-256 of the real line, so the redaction published the template and the hash confirmed guesses against it: the only unknown left was the secret, and SHA-256 is fast enough to walk a candidate list offline. A three-candidate list recovered the test secret. The digest now covers the redacted text, which is exactly what the file already shows, and command matching is unaffected because both sides redact before hashing. The CodeQL alert covering this line was dismissed as a false positive in v1.1.1; that dismissal was wrong and has been reversed.
-- `npm run site:check` no longer waits indefinitely on a peer that answers slowly. The request timeout measures socket inactivity, not elapsed time, so a server sending one byte per second reset it forever — a probe was still pending after 40 seconds and would have held the release gate open indefinitely. There is now a wall-clock deadline for the whole request.
-- A redirect that keeps the hostname is no longer accepted whatever else it changes. Only the hostname was compared, so a redirect to plaintext HTTP, to another port, or to a URL carrying credentials passed as if it were the site being verified.
-- A document path containing a control character is refused. Refusal messages and the read header quote the path back outside the data region, so a file named with an embedded newline wrote its own lines there, at instruction level. Paths in the header are additionally escaped when printed.
-- `.docx` text is decoded strictly. The strict decoding added in v1.1.1 covered plain text only, so a `.docx` whose `word/document.xml` was not valid UTF-8 still returned `ok` with replacement characters in the extracted prose.
+- An unknown `--mcp-preset` failed only after a partial install; it is now rejected before anything is installed.
 
-### Changed
+### Security
 
-- Publishing now waits for the full release matrix. `publish.yml` and `verify.yml` were independent workflows triggered by the same tag and raced: v1.1.1 finished publishing at 08:03:43Z while the Ubuntu verify job ran to 08:03:48Z and macOS to 08:03:54Z. A macOS-only failure, a runtime audit finding, or a release-identity mismatch would have been reported after the version was already on the registry, where it cannot be withdrawn. `verify.yml` is now a reusable workflow that `publish.yml` calls and depends on.
-- An unknown `--mcp-preset` is rejected before anything is installed. The preset was read only at the final configuration step, so a typo failed after the platform package and the MCP adapter had already been installed, leaving a half-configured machine — and the dry run exited `0` because it never reached the check.
-- `piagent-setup --no-mcp --mcp-preset <name>` fails instead of succeeding with the preset dropped. `piagent-install` already rejected that pair, but setup never forwarded both flags, so the check could not see it.
+- `piagent_document_read` could read a file swapped in after its checks; it now reads the file it checked.
+- The evidence ledger no longer stores a hash that could confirm guesses at a redacted secret.
 
 ## v1.1.1 - 2026-07-26
 
-Fixes for defects found reviewing v1.1.0 after it shipped.
+**Fixes for issues found reviewing 1.1.0.** `piagent-setup --no-mcp` skips MCP again, the site check no longer hangs or passes falsely, and binary documents are refused.
 
 ### Fixed
 
-- `piagent-setup --no-mcp` installs no MCP again. Setup only ever appended `--with-mcp` and relied on the installer defaulting MCP off; v1.1.0 changed that default to on, so the opt-out reached the installer as silence and the installer's default overrode the operator's explicit choice. It now passes `--no-mcp` through. The other install flags stay one-sided because the installer still defaults them off, which is the condition that made the pattern safe in the first place.
-- `npm run site:check` no longer hangs when a response exceeds the 4 MB body cap. Hitting the cap destroys the response, and a destroyed response emits neither `end` nor `error` — it goes to `aborted` and `close` — so the promise stayed pending forever, and the request timeout could not rescue it because the socket was already gone. A release gate that hangs is worse than one that fails, because nothing reports it. A body cut short is also now reported as cut short rather than as a page that does not mention the version, which is a different claim.
-- `npm run site:check` no longer exits `0` when it could not check an address. Unreachable addresses were printed as `UNVERIFIED` and then the run still ended in `PASS`, so a gate that verified fewer addresses than it resolved reported that it had verified them all. An unchecked address now ends the run; `--allow-unverified` accepts the gap deliberately and names it in the summary.
-- `piagent_document_read` refuses bytes that are not valid UTF-8 or UTF-16 instead of decoding them into replacement characters. The binary check was a scan for a NUL byte, which plenty of binary formats do not carry in their first bytes, and everything past it was decoded leniently — so a binary file renamed to `.txt` came back as content-shaped garbage and was handed to the model. Decoding is now strict in both encodings, which is what the surrounding code already claimed to do.
-- Two CodeQL high alerts came from building a regular expression out of a version string and escaping only `.`. Those assertions were comparing literal text, so they are substring checks now and need no escaping at all. Two further alerts were reviewed and dismissed with written reasons: extracting `&lt;script&gt;` from a document as `<script>` is the required result and the sink is a terminal tool result, not HTML; and the SHA-256 over a normalised shell command is a content identifier, not a password hash.
-
-### Changed
-
-- The release checklist now requires the **Code scanning results** check on the `main` ruleset, separately from the `analyze (...)` jobs. Requiring those jobs proves only that the analysis ran and uploaded its results — they succeed just as well when the analysis found new high-severity alerts, which is how v1.1.0 merged green with open ones.
+- `piagent-setup --no-mcp` still installed MCP; it installs none again.
+- `npm run site:check` could hang on large responses or pass with unchecked addresses; both are fixed.
+- `piagent_document_read` decoded binary bytes into garbled text; it now refuses invalid text.
 
 ## v1.1.0 - 2026-07-26
 
-A document downloaded outside the repository can now be read by the agent, and the two documented install commands stop disagreeing about MCP.
+**Read documents from outside the project.** The agent can read a downloaded document outside the repository, and both install commands now install MCP by default.
 
 ### Added
 
-- Added `piagent_document_read`, which reads a document from a directory outside the project. Downloading a spec to `~/Downloads` and then having no way to hand it to the agent was a dead end with no workaround short of copying the file into the repository. A directory is granted through `additionalReadRoots` in the project profile or the `PIAGENT_ADDITIONAL_READ_ROOTS` environment variable, and the grant widens only where documents may come from. It is read-only. It accepts `.md`, `.markdown`, `.txt`, `.text`, `.csv`, `.tsv`, `.json`, `.yaml`, `.yml`, `.pdf`, and `.docx`, and refuses every other extension sitting in the same directory. `protectedPaths` still wins over it, matched against both the absolute and the project-relative form of the path so that root-anchored patterns are not silently skipped, and a capability pack that narrows filesystem read scope still narrows it for documents inside the project. Both the containment check and the extension check are made against the canonical path, so a link named `notes.md` cannot hand over the key file it points at.
-- `.docx` is read without a dependency, from a bounds-checked archive reader that names what was wrong with a malformed file rather than reporting every failure as a missing document. Text struck out by an unaccepted tracked change is dropped instead of being spliced onto its replacement, tab-stop declarations no longer emit tab characters, field instruction codes are not read as prose, and a character reference outside the Unicode range is left as written rather than ending the read. `.pdf` goes through `pdftotext`, under a timeout, and a missing binary is reported as missing rather than as an empty document. Byte-order-marked UTF-16 is decoded rather than rejected as binary. Returned text is redacted and enclosed in a data region delimited by a marker the document cannot predict, because a downloaded document is exactly the kind of file that carries both a pasted key and a sentence addressed to an agent.
-- Added `npm run site:check`, which verifies the published documentation site at every address it resolves to instead of once through whichever address a browser happened to pick. It requires each address to return the released version, reports a redirect from an address back to its own host as a loop rather than following it, and reports an address the machine cannot route to as unverified rather than as a pass. Release checklist step 8 was a manual look, and a manual look cannot see a partial outage.
+- Added `piagent_document_read` to read a document from a granted directory outside the project, including `.docx`.
 
-### Changed
+### Improved
 
-- Raised the pinned Pi Coding Agent and Pi AI host from `0.81.1` to `0.82.0`. `typebox` stays exactly `1.1.38` across both, so the pin moves without a compatibility change. `npm run audit:runtime` on the `0.82.0` tree reports one high advisory, the same already-accepted `GHSA-mh99-v99m-4gvg` under review by 2026-08-25, and no critical. Verified against a real `0.82.0` host: runtime policy smoke and `team-doctor --strict-share` both pass with no warnings.
-- `piagent-install` now installs the MCP baseline by default, the same as `piagent-setup` already did, and both accept `--no-mcp` to skip it. The two documented entry points disagreed: `piagent-setup` defaulted to installing MCP and `piagent-install` defaulted to not installing it, so a newcomer who followed the team onboarding document ended up with no MCP at all — and was then told to run `/mcp`, because the installer printed that next step whether or not it had installed anything. That next step is now printed only when MCP was installed, and `--mcp-preset` combined with `--no-mcp` fails instead of being accepted and quietly dropped.
-- Cut the command count in the three places a new user actually lands. The README went from 28 shell blocks to 4 and now opens with install rather than four variants of a wrapper for software the reader has not installed yet; the Vietnamese quickstart went from 23 to 7 and its install step from 120 lines to 28; the documentation site's onboarding flow went from eight install command cards to one. Pinned rollouts, updates, rollback, the `--dev` channel, and per-tool command lists were not deleted — every one of them already had a dedicated document, and each is now linked from where it used to be inlined.
+- `piagent-install` now installs the MCP baseline by default like `piagent-setup`; both accept `--no-mcp`.
+- The pinned Pi host moves from 0.81.1 to 0.82.0.
 
 ### Fixed
 
-- Writing MCP server definitions now says what each server still needs before it can connect: Chrome for the Chrome DevTools server, Docker plus `GITHUB_PERSONAL_ACCESS_TOKEN` for the GitHub server. Servers connect lazily, so a successful install proved nothing about whether they would work, and the Docker requirement existed only in a description string visible under `piagent-mcp --list`. The note goes to stderr so the report on stdout stays machine-readable, and `--list` now carries the same requirements as data.
-- An advisory tool-registry verdict is now shown. `toolRegistry` defaults to `advisory` and the evaluation returned a `warn` decision, but the hook acted only on `block`, so the verdict was computed and discarded — advisory mode was indistinguishable from off, and the documentation said the agent received a warning. The notice is emitted once per tool per session, because one on every call would be noise rather than a warning.
-- `piagent-uninstall --with-addons` now reports the MCP baseline file that install actually writes. It named the Pi-global override path while install writes the shared global path, so an operator following the printed advice inspected the wrong file — usually an empty one, which reads as "already clean".
-- Project onboarding now says that the `.mcp.json` files it writes are empty on purpose and that the shared baseline lives in the global config. An empty file in a fresh project reads as a failed install.
-- Documented that `mcpCapabilities` in a project profile, the `github` key in the policy tool registry, and the `github` MCP server are three unrelated things that share a name. No code maps a capability name to an MCP server, so declaring `github` in a profile does not enable the GitHub server and never did.
-- `piagent-init` running from an installed package now writes `npm:@piagent/platform@<version>` into project settings, matching what `piagent-setup` already did. It is the second way a project gets its settings written, and it still wrote the directory the platform happened to be installed in — a value that means nothing on a teammate's machine, in a file meant to be committed.
-- Documentation-coverage checks in the local gate now name the term that went missing and the files searched. They were bare `grep >/dev/null` calls under `set -e`, so dropping a term from a document failed the gate with exit 1 and no output at all. The gate's `npm test` and `npm run typecheck` steps had the same defect from the other direction — their output went to `/dev/null` on every run, so a failing test ended the gate with no indication of which test failed. Both now stay quiet on success and print what they captured on failure.
-- Documented that `piagent-setup` installs the Herdr Pi integration when `herdr` is on `PATH`, and that installing Herdr afterwards needs `piagent-setup --global-only` to pick it up. The behaviour has always been the default and the skip is only a warning on stderr, so the ordering was discoverable only by reading the installer. Herdr is also now named as the way to run several Pi panes at once in the README, the quickstart, and the documentation site, none of which mentioned it, and every one of those places now carries the install command itself rather than a link to go find it. The `brew` form is listed beside the `curl` form that herdr.dev leads with, because piping a fetched script to a shell is worth an alternative in a project that pins everything else it installs.
-- Folded a stale `Unreleased` section into v1.0.0, where its contents actually shipped. It had been left behind by the namespace rename and still described tools as `company_orchestration_policy`, `company_profile_tech_options`, `company_profile_tech_apply`, `company_profile_tech_context_record`, and `/company-orchestration`, none of which exist.
+- Advisory tool-registry warnings were computed but never shown; they are now displayed.
+
+Requires: Pi 0.82.0.
 
 ## v1.0.2 - 2026-07-25
 
-Install and uninstall become two commands each. The five-command sequence was never the shortest path; it was the only one that produced a project configuration a teammate could use.
+**Two-command install and `piagent-uninstall`.** Install is now `npm install -g @piagent/platform` plus `piagent-setup`, and `piagent-uninstall` removes the package cleanly.
 
 ### Added
 
-- Added `piagent-uninstall`, which removes the Pi package this platform registered and nothing else. It reports by default and only acts on `--apply`, matching how install and migration already work. `--with-addons` also removes the pinned add-ons, `--with-host` the Pi host, and `--project <path>` a project's profile, lock, and runtime state. It recognises every source shape the platform has been installed as, including installs from before the namespace rename, so an old registration still comes out. Credentials, trust decisions, sessions, todos, and project memory are never removed at any flag combination; files written from templates and then edited are reported rather than deleted, and only the entry pointing at this platform is dropped from a project's `.pi/settings.json`.
+- Added `piagent-uninstall`, which reports by default and only removes the package with `--apply`.
 
-### Fixed
+### Improved
 
-- `piagent-setup` running from an installed package now writes `npm:@piagent/platform@<version>` into project settings instead of the directory it happens to be installed in. Project settings are meant to be committed, and an install path means nothing on a teammate's machine. A working checkout has no published identity to point at, so it still falls back to the local path and still says so.
+- Docs now lead with `npm install -g @piagent/platform` followed by `piagent-setup`.
 
-### Changed
+### Fixed
 
-- Documentation now leads with `npm install -g @piagent/platform` followed by `piagent-setup`, which installs the pinned Pi host itself. The five-command sequence remains, described as the explicit path for a reviewed team rollout rather than as the only way in.
+- `piagent-setup` wrote a local install path into project settings; it now writes the npm package version.
 
 ## v1.0.1 - 2026-07-25
 
-Documentation release. v1.0.0 reached the npm registry but no document told anyone it was there, so every install instruction still pointed at the Git source.
+**Install from the npm registry.** Documentation now installs the terminal helper from npm instead of the Git source.
 
-### Changed
+### Added
 
-- The terminal helper now installs from the registry: `npm install -g --ignore-scripts @piagent/platform@1.0.1`. This replaces the `github:Vt-mmm/piagent#vX.Y.Z` form in the README, the docs site, and every install, update, and rollback flow. Installing from Git still works and produces the same files; the registry path additionally carries a provenance attestation npm can verify.
-- Added an `npm` release channel with a real source, and narrowed `enterprise-npm` to what it actually describes: a fork published under a different scope.
-- Recorded why `stable` still resolves the Pi package to a commit SHA rather than an npm version. Tag-to-SHA resolution is checked against `PIAGENT_EXPECTED_RELEASE_COMMIT`, and a registry version range cannot express that check, so pointing `stable` at npm would remove it rather than replace it.
-- Aligned `repository.url` in both manifests with the form npm stores. Publishing rewrote the field and warned, which left the manifest in the repository disagreeing with the manifest on the registry.
+- Added an `npm` release channel.
 
-## v1.0.0 - 2026-07-25
+### Improved
 
-Breaking release. The `company` namespace is replaced by `piagent` with no alias layer, and `apiVersion` becomes a stable contract. Existing projects convert their local state with one migration command; both names never work at once.
+- Install, update and rollback docs use `npm install -g --ignore-scripts @piagent/platform@1.0.1`.
 
-### Added
+## v1.0.0 - 2026-07-25
 
-- Added `capabilitySources` to project profiles so a project can use capability packs it does not own without forking the platform. A source is either a directory inside the project or an exact npm or git release vendored into it.
-- Added `piagent-capabilities vendor`, the only command that reaches the network. It fetches a declared remote source into `.pi/capability-vendor/`, refuses a tree containing symbolic links or no packs, and reports digests for review before the result is committed.
-- Added `piagent-migrate` to convert `.pi/company-profile.json`, its lock, and `.pi/company-state/` to the new names. Dry-run by default, with an explicit flag to write and a separate flag to remove the old files.
-- Added `piagent-import-instructions` to import `CLAUDE.md`, `.claude/rules/`, `.cursor/rules/`, and `.github/copilot-instructions.md` into `AGENTS.md`. Dry-run by default, with a deterministic conflict report; imported text is quoted as data and never alters protected paths, permission profile, or verify commands.
-- Added skill wiring for `.claude/skills` and `.codex/skills` at project scope and their home-directory equivalents at global scope, plus doctor checks that report skill directories present on disk but not declared, and instruction files written for other agents.
-- Added a golden enforcement suite covering protected paths, protected paths reached through the shell, destructive shell decisions, verification evidence, context budget ceilings, and secret redaction, with a valid and an invalid fixture for every shipped schema.
-- Added contributor documentation: `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, pull-request and issue templates.
-- Added a tag-driven publish workflow with npm provenance and pinned action revisions.
-- Added a solo-first orchestration policy covering bounded subagent usage, review lenses, Field Guide status, and model-role guidance, surfaced by `piagent_orchestration_policy` and `/piagent-orchestration` so status reads without a model follow-up. Task contracts gained `workPlan`, `reviewLenses`, and `orchestration` snapshots to record it.
-- Added select-style profile tech setup through `/profile setup` and `/profile tech setup`, including fullstack frontend, backend, and database selections. `piagent_profile_tech_options`, `piagent_profile_tech_apply`, and `piagent_profile_tech_context_record` produce Context7-ready stack manifests and per-tech snapshots.
+**Piagent 1.0: new namespace and stable API.** The `company` namespace becomes `piagent` with no alias, `apiVersion` is stable, and one command migrates existing projects.
 
-### Changed
+### Breaking changes
 
-- **Breaking.** Renamed the namespace to `piagent` throughout: tools `company_*` to `piagent_*`, commands `pi-company-*` to `piagent-*`, package `pi-agent-platform` to `@piagent/platform`, `packages/pi-company-core/` to `packages/piagent-core/`, environment variables `PI_COMPANY_*` to `PIAGENT_*`, and project state to `.pi/piagent-profile.json`, `.pi/piagent-profile.lock.json`, and `.pi/piagent-state/`. There is no alias layer; a session started against unconverted state warns and names the migration command.
-- **Breaking.** Promoted the manifest `apiVersion` from `piagent/v1alpha1` to `piagent/v1`. This is the point at which external packs can pin it, so it is a contract from here on.
-- The capability lock now records where each pack came from, so a pack that moves between sources reads as a substitution rather than an update.
-- The package is now published rather than private, scoped as `@piagent/platform` with public access and provenance.
-- Split shell and external-action classification, shared types, and filesystem helpers out of the guard into their own modules. Behaviour is unchanged.
-- Onboarding now names instruction files written for other agents, states plainly that their rules are not in effect, and offers the import; anything inside them is treated as data.
-- `/task`, `/plan`, `/review`, the subagent prompts, and the team docs now prefer one parent agent plus bounded scout, planner, and reviewer usage instead of broad swarm-style delegation.
-- Onboarding and docs treat profile family and project tech stack as explicit operator selections rather than long model explanations, and `/profile` status and list output stay compact around the single namespace and the next exact command.
-- Runtime support is stated across macOS Apple Silicon, macOS Intel, Linux x64 and ARM64, native Windows, and WSL2, and the installer and doctor report the runtime surface they are actually on.
+- Tools, commands, package and files are renamed from `company` to `piagent`; run `piagent-migrate` on existing projects.
+- Manifest `apiVersion` moves from `piagent/v1alpha1` to the stable `piagent/v1`.
 
-### Fixed
+### Added
 
-- Fixed a capability policy that declares only some of its allow-lists: the missing lists now deny, instead of failing with an internal error.
-- Fixed capability source resolution under a symlinked project parent, where a contained directory could be misread as escaping the project.
-- Excluded maintainer working notes from the published tarball. The `files` allowlist takes precedence over `.npmignore`, so the exclusions live in `files`.
-- Fixed the package manifest declaring its extension entry points as a directory glob. Pi calls the default export of every path the field matches, so once the guard's helpers moved into modules beside it, the glob offered Pi two modules that export helpers and no extension factory. The manifest now names the guard, and the package still carried the old `@pi-agent/core` name the namespace rename was meant to retire.
-- Fixed the verify workflow, which had been unparseable since the runtime-platform step was added and so had not run at all. A single-line `run:` value containing `": "` ends the YAML scalar early; GitHub reports that as an instant failure with no job, so the gate was absent while still appearing present. The local gate now refuses that shape.
-- Fixed orchestration config normalization so a malformed numeric setting falls back to a safe value instead of producing invalid policy state.
-- Fixed tag CI verification, which checked tag object type and peeled commit identity without first fetching the annotated release tag ref.
-- Profile doctor and team doctor now warn on entries that appear only in `shellProtectedPaths`. Those paths block shell access alone; write protection requires `protectedPaths` or `readOnlyPaths`, and the warning names the move.
+- Projects can use capability packs from other sources, fetched for review with `piagent-capabilities vendor`.
+- Added `piagent-import-instructions` to import instruction files written for other agents into `AGENTS.md`.
 
-### Security
+### Improved
 
-- The runtime host audit now names the one advisory it accepts instead of running at a blanket severity threshold. `GHSA-mh99-v99m-4gvg` (`brace-expansion`, denial of service) is accepted with its reasoning recorded in `scripts/check-runtime-advisories.mjs`: the Pi host publishes an `npm-shrinkwrap.json` that pins the affected version, a published shrinkwrap takes precedence over consumer overrides, and every released host carries a high `brace-expansion` advisory, so no host version and no change in this repository can resolve it. Every other high or critical advisory still fails the audit, the entry expires on a review date, and it fails once the advisory stops being reported so it cannot outlive the problem.
+- The package is now published on npm as `@piagent/platform` with provenance.
 
 ## v0.4.8 - 2026-07-22
 
+**Release channels, trusted profiles and stricter guards.** Install channels and rollback are documented, project profiles load only in trusted projects, and external writes need confirmation.
+
 ### Added
 
-- Added release/install policy docs covering stable, exact, dev, local, update, and rollback flows.
-- Added `pi-company-install` channel options and dry-run preview for stable, exact, dev, and local installs.
-- Added a package-root dispatcher for global `pi-company-*` terminal commands.
-- Added `readOnlyPaths` to project profiles for read-only contract areas such as backend code in `be-readonly-fe`.
-- Added regression tests for untrusted project profiles, profile-apply confirmation, shell/exec aliases, external-provider write confirmation, BE-readonly/FE-write paths, package distribution, and installer edge cases.
-- Added tag-triggered CI verification with immutable GitHub Action revisions on both Ubuntu and macOS.
-- Added release identity verification across root/core manifests, package lock, capability lock, changelog, docs badge, tag, and checked-out commit.
-- Added a separate high-severity dependency audit for the exact Pi host and pinned optional add-ons instead of relying only on the helper package lock.
-- Added a public threat model and `SECURITY.md` with private vulnerability reporting, supported-version, disclosure, and scope guidance.
-- Added weekly Dependabot checks for npm and GitHub Actions plus pinned CodeQL v4 analysis for JavaScript/TypeScript and workflow code.
-- Added a fail-closed Vercel project-link preflight so a stale local `.vercel` link cannot silently deploy docs to the wrong project.
-
-### Changed
-
-- Clarified in the public docs where this platform sits relative to a general agent coding CLI: Pi Company Platform brings similar governance concepts into Pi and packages them for team workflows.
-- Reworded security docs to describe the guard as an application-level policy enforcement layer, not a complete security boundary or OS sandbox.
-- Split install guidance so production/team setup uses pinned `v0.4.8` or resolved commit sources, while latest is reserved for personal/sandbox use.
-- Clarified that redaction benchmarks and internal review are not equivalent to an external security audit.
-- Raised the supported Node.js runtime contract to `>=22.19.0`.
-- Raised the pinned Pi Coding Agent and Pi AI compatibility from `0.80.10` to `0.81.1`, retaining exact `typebox` compatibility and removing the known high-severity transitive finding present in the previous host tree.
-- Updated CI to verify on Ubuntu and macOS with Node.js 22.19.0.
-- Documented the three-component Pi-host/helper/Pi-package lifecycle, exact rollback flow, supported operating systems, and post-tag Vercel promotion gate.
-- Made setup install or upgrade to the exact Pi host required by the release and made package installation reject an incompatible host version.
-- Expanded runtime dependency verification from the Pi host alone to the exact host plus all pinned optional add-ons.
-
-### Fixed
-
-- Hardened local profile loading so `.pi/company-profile.json` is ignored until the project is trusted, unless an operator explicitly sets `PI_COMPANY_PROFILE`.
-- Hardened `pi-company-install --stable` so it resolves the release tag to a commit SHA before install and fails closed when resolution is unavailable.
-- Bound the deterministic capability lock to `packages/pi-company-core/policies/base-policy.json`.
-- Fixed `be-readonly-fe` so backend paths are readable through safe path tools but remain blocked for writes and shell access.
-- Applied shell protected-path checks consistently to `bash`, `shell`, and `exec` tool aliases.
-- Inspected complete structured shell invocations, including `command`/`cmd` plus `args`, and rejected conflicting, malformed, oversized, or unbounded carriers before execution.
-- Added a generic human confirmation gate for external-provider write or ambiguous tools while preserving known safe reads such as `get_release`.
-- Rejected conflicting installer package selectors before any install command can run; the first explicit CLI selector now cleanly overrides environment defaults.
-- Routed global commands through a package-root dispatcher and converted missing shell-runner failures into controlled errors.
-- Isolated runtime-evidence test ledgers so test runs no longer leave new `pi-ledger-*` temporary directories.
-- Decoded the extension module URL before locating its package policy so installs under paths containing spaces or other URL-encoded characters load the intended policy.
-- Made project init resilient to npm package tarballs that omit its `.pi/.gitignore` dotfile by shipping an explicit fallback template.
-- Prevented project init from creating `.pi/.npmignore`, which could override repository ignore rules and re-include local Pi auth, trust, ledger, or database state in an npm package.
-- Applied provider confirmation and path policy to the default serialized MCP proxy carrier, including bounded JSON parsing and fail-closed malformed/deep payload handling.
-- Closed MCP path-policy bypasses across common aliases such as `filename`, `rootPath`, `source`, `cwd`, and `workingDirectory`; copy sources now use read scope while destinations use write/read-only scope, without treating provider metadata as a local path.
-- Applied protected-path checks to camelCase patch carriers and shell proxy variants such as `run`, `execute_process`, and command-bearing aliases before an operator confirmation can allow execution.
-- Added confirmation gates for shell-launched GitHub CLI writes and non-read-only HTTP client operations, including wrappers, executable aliases, line continuations, dynamic command construction, `xargs`, and FTP/SFTP quote commands, while keeping recognized reads and argument-only substitutions non-interactive.
-- Made every packaged `pi-company-* --help` command succeed without requiring a project path or creating project state.
+- Added stable, exact, dev and local install channels with dry-run preview, plus rollback docs.
 
-### Security
+### Improved
 
-- Project-local profiles are not trusted before Pi project trust is active.
-- Capability locks now detect base policy tampering, not only runtime source-file changes.
-- Tool-based profile apply requires operator confirmation before writing `.pi/company-profile.json` and `.pi/company-profile.lock.json`.
-- External provider writes are treated as human-gated actions even under `trusted-full-access`.
-- Unknown MCP/provider actions fail closed to operator confirmation; explicit safe reads remain non-interactive.
-- Release tags are verified in CI, installer stable channels resolve tags to commit SHAs, and dependency setup actions are pinned by commit SHA.
-- Tag CI binds stable resolution to the exact release commit and rejects environment attempts to substitute the helper's package-derived release tag.
-- Tag CI now requires an annotated tag whose peeled commit is the exact verified release commit; repository ruleset requirements are documented for immutable `v*` tags.
-- Release CI includes redaction, release identity, dependency, CodeQL, package-content, and cross-platform policy gates; Actions are pinned to reviewed commit SHAs.
-
-### Verification
-
-- `npm run verify`: pass.
-- `npm test`: 224/224 pass.
-- `npm run typecheck`: pass.
-- `npm run smoke`: pass.
-- Helper dependency audit (`npm audit --audit-level=high`): 0 vulnerabilities.
-- Exact Pi 0.81.1 host + pinned add-on audit (`npm run audit:runtime`): 0 high/critical findings; npm reports 11 moderate dependency paths across two upstream advisory families (`@hono/node-server` encoded-backslash traversal on Windows and `protobufjs` parser DoS).
-- `npm run benchmark:redaction`: pass.
-- `npm pack --dry-run --json`: 144 packaged files; required runtime files present and local trust/secret state excluded; all 12 installed terminal binaries pass `--help` from the built artifact.
-- Docs browser/runtime check: 0 duplicate IDs, broken anchors, broken images, unsafe blank targets, or console errors; mobile viewport has no horizontal overflow.
+- Requires Node.js 22.19.0 or newer and Pi 0.81.1; setup installs the exact Pi host.
 
-## v0.4.7 - 2026-07-22
+### Security
 
-### Added
+- Project profiles are ignored until the project is trusted, and applying a profile needs confirmation.
+- External provider writes and unknown MCP actions now require human confirmation, even in full access.
 
-- Added `/commit` as a guarded local commit workflow:
-  - inspect status and diff before staging;
-  - stage explicit reviewed files only;
-  - run relevant verification before commit;
-  - never push from `/commit`.
-- Added `/pr` as a guarded pull request preparation workflow:
-  - inspect branch, status, upstream, and remote;
-  - require a clean committed branch before PR work;
-  - require explicit operator confirmation before `git push` or GitHub write actions.
-- Added an exec-policy confirmation rule for broad Git staging, including `git add .`, `git add -A`, `git add --all`, `git add -- .`, `git add :/`, and `git -C <repo> add .`.
-- Added regression tests for the new Git workflow prompts and broad-staging policy.
-- Added canonical public docs metadata for `https://piagent.io.vn`.
+Requires: Pi 0.81.1, Node.js 22.19.0.
 
-### Changed
+## v0.4.7 - 2026-07-22
 
-- Install docs now default to latest:
-  - `pi install git:github.com/Vt-mmm/pi_agent`
-  - `pi update --extensions`
-- Pinned install examples use placeholders such as `vX.Y.Z` and `x.y.z` instead of hardcoding an old release.
-- Runtime smoke verification now reads the current package version from `package.json` instead of hardcoding a tag.
-- Docs site, README, package metadata, and Vercel docs now point to `https://piagent.io.vn`.
+**Guarded `/commit` and `/pr` workflows.** New `/commit` and `/pr` workflows review changes before staging and ask before any push, and broad staging needs confirmation.
 
-### Security
+### Added
 
-- Git remains a normal guarded capability, not a privileged `/git` bypass.
-- Broad staging requires confirmation so unrelated or private files are not committed silently.
-- Protected paths, sensitive-output redaction, capability lock integrity, and destructive/external confirmation gates remain active in every permission profile.
+- Added `/commit`, which stages only reviewed files, runs checks and never pushes.
+- Added `/pr`, which requires a clean branch and confirmation before `git push` or GitHub writes.
 
-### Verification
+### Security
 
-- `npm run verify`: pass.
-- `bash scripts/runtime-policy-smoke.sh`: pass.
-- `npm test`: 185/185 pass.
-- `npm run typecheck`: pass.
+- Broad staging such as `git add .` or `git add -A` now asks for confirmation.
 
 ## v0.4.6 - 2026-07-22
 
-### Added
-
-- Added the static HTML documentation site under `docs-site/`.
-- Added Vercel static-site configuration and deployment documentation.
-- Added project logo, favicon, GitHub link, and Facebook link to the docs site.
+**Documentation site.** A static HTML documentation site was added, with shorter command docs for daily use.
 
-### Changed
+### Added
 
-- Streamlined command documentation for lower-token daily usage.
-- Removed the `SHIP` sidebar section from the docs site.
-- Centered the docs layout and tightened the visual structure for wide screens.
-- Documented latest global install and pinned project setup separately.
+- Added a static HTML documentation site under `docs-site/`.
 
-### Verification
+### Improved
 
-- `git diff --check`: pass.
-- Package verification remains covered by `npm run verify`.
+- Command documentation is shorter for lower-token daily use.
+- Global install and pinned project setup are documented separately.
 
 ## v0.4.5 - 2026-07-22
 
-### Added
+**Direct `/profile` commands.** Profile commands apply immediately without a model follow-up, and routine status output is compact.
 
-- Added direct profile commands that apply immediately without model follow-up:
-  - `/profile`
-  - `/profile`
-  - `/profile list`
-  - `/profile <profile>`
-  - `/profile auto`
-- Added short profile aliases such as `fe`, `be`, `full`, `be-fe`, and TypeScript-oriented aliases.
+### Added
 
-### Changed
+- Added `/profile`, `/profile list`, `/profile <profile>` and `/profile auto`, applied without a model turn.
+- Added short profile aliases such as `fe`, `be` and `full`.
 
-- `/company-status` and `/company-memory` now return concise local summaries instead of prompting verbose model/tool follow-up.
-- Profile status output is intentionally compact to reduce token burn in routine checks.
+### Improved
 
-### Security
-
-- Direct profile apply still regenerates the deterministic capability lock and does not relax protected paths, secret redaction, or capability integrity checks.
+- `/company-status` and `/company-memory` now return short local summaries.
 
 ## v0.4.4 - 2026-07-21
 
+**Session permission commands.** Slash commands switch the session between read-only, workspace-write and full access, with a clear precedence order.
+
 ### Added
 
-- Added session-local permission slash commands:
-  - `/permission-status`
-  - `/read-only`
-  - `/workspace-write`
-  - `/full-access`
-  - `/full-access <task>`
+- Added `/permission-status`, `/read-only`, `/workspace-write`, `/full-access` and `/full-access <task>`.
 
-### Changed
+### Improved
 
-- Permission resolution precedence is explicit: launch environment override, then session command, then project profile, then policy default.
-- `/full-access <task>` switches the session and forwards the task text as the next request.
+- Permission order is explicit: launch override, then session command, then project profile, then default.
 
 ### Security
 
-- `trusted-full-access` remains guarded. It relaxes selected autonomy checks for trusted workspace work but does not disable protected paths, secret redaction, capability lock integrity, or destructive/external confirmations.
+- Full access still keeps protected paths, secret redaction and destructive or external confirmations.
 
 ## v0.4.3 - 2026-07-21
 
-### Added
-
-- Added runtime permission profiles:
-  - `read-only`;
-  - `workspace-write`;
-  - `trusted-full-access`.
-- Added `PI_COMPANY_PERMISSION_PROFILE` for trusted one-run permission override.
+**Runtime permission profiles.** Three permission profiles were added: read-only, workspace-write and trusted-full-access.
 
-### Security
+### Added
 
-- Invalid permission override values fail closed.
-- The profile system is a runtime policy layer, not an operating-system sandbox.
+- Added `read-only`, `workspace-write` and `trusted-full-access` permission profiles.
+- Added `PI_COMPANY_PERMISSION_PROFILE` for a one-run override; invalid values fail closed.
 
 ## v0.4.2 - 2026-07-21
 
-### Added
-
-- Added sensitive-data redaction benchmark coverage for contextual secrets, benign preservation, structured payloads, and large output.
-- Added release gates for redaction recall and false-positive control.
+**Better secret redaction with a benchmark.** Redaction covers more credential shapes and nested data, measured by a new benchmark and release gate.
 
-### Changed
+### Added
 
-- Improved sensitive-data redaction for common credential shapes and nested structured data.
-- Kept unlabeled high-entropy strings observational instead of redacting indiscriminately.
+- Added a redaction benchmark: 52/52 secrets detected with 0/30 false positives on benign text.
 
-### Verification
+### Improved
 
-- Frozen-tree redaction baseline: 52/52 contextual cases detected, 0/30 benign false positives, 8/8 structured sensitive values redacted, and 7/7 structured benign values preserved.
+- Redaction now catches more credential shapes and secrets inside nested structured data.
 
 ## v0.4.1 - 2026-07-21
 
-### Fixed
-
-- Hardened shell secret protection against glob expansion targeting protected files.
-- Hardened shell protection for bare-word aliases and symlinks resolving to protected paths.
-- Added sensitive bash output redaction before tool results reach the model.
-- Covered attached redirections such as `cat<.env` and similar shell forms.
+**Stronger shell protection for secrets.** The shell guard blocks more ways of reaching protected files, and bash output is redacted before the model sees it.
 
 ### Security
 
-- Static shell protection is stronger, but the guard still does not claim to be an OS sandbox.
-- Protected-path blocking and output redaction are separate defense layers.
+- Globs, aliases, symlinks and redirections such as `cat<.env` can no longer reach protected files.
+- Sensitive bash output is redacted before tool results reach the model.
 
 ## v0.4.0 - 2026-07-21
 
+**Governed capability packs with integrity lock.** Capability packs are resolved per profile into `.pi/company-profile.lock.json`, and tampering with the lock fails closed.
+
 ### Added
 
-- Added governed capability packs with deterministic catalog generation.
-- Added profile capability resolution and `.pi/company-profile.lock.json`.
-- Added lock integrity checks for package source, artifact digests, capability scope, and runtime enforcement files.
-- Added atomic profile/lock write behavior with rollback on failure.
+- Added governed capability packs resolved per profile into `.pi/company-profile.lock.json`.
 
 ### Security
 
-- Lock tampering fails closed.
-- Core protected paths include `.pi/settings.json` and `.pi/company-profile.lock.json`.
-- Capability scope can only narrow access; protected paths remain denied before allow-scope checks.
+- The lock checks package source, artifact digests and capability scope, and tampering fails closed.
+- `.pi/settings.json` and the lock file are protected, and capability scope can only narrow access.