delegate-agent-cli 0.31.0__tar.gz → 0.33.0__tar.gz

{delegate_agent_cli-0.31.0 → delegate_agent_cli-0.33.0}/CHANGELOG.md

@@ -5,6 +5,1208 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.33.0] - 2026-10-12
+
+This release adds Muse (Meta's Muse family) as the eleventh harness, at parity with the best-supported engines: safe/work/call modes, structured output, native session followup, and the full effort enum.
+
+### Added
+- **Muse is a Delegate harness.** `delegate muse safe|work|call` wraps
+  Meta's Muse (`muse exec --json`) with Muse family models: prompt-file
+  delivery, a flag-enforced safe lockdown (`--disable-write --disable-shell
+  --disable-web-tools`, sandbox on, workspace untrusted), work mode with the
+  sandbox kept on, native `--output-schema` enforcement, session followup and
+  auto-resume, and the full static effort enum through `ultra`. The `muse`
+  binary accepts unknown model IDs silently, so Delegate records no
+  served-model claim for Muse runs.
+
+### Fixed
+- The test runner (`scripts/test.py`) no longer aborts on hosts where
+  lowering its own priority with `os.nice` is not permitted (sandboxed
+  agent harnesses); it warns and continues under the worker caps.
+
+## [0.32.0] - 2026-10-01
+
+This release adds controls for launching and managing agents and resuming
+workflows: `--force-launch`, `--writable`, `--kill-live`, and `--repin`.
+It also improves progress reports, coordinator mail, failure recovery, and
+write protection, and makes optional local profile tooling work on other
+machines without requiring the maintainer's setup.
+
+### Added
+- **Every work and safe Run carries the lane test rule.** After the operator's
+  task, the framed prompt adds a "Delegate lane test rule" section: lanes run
+  targeted tests only (the files they changed and their neighbours, through
+  `testrun` with worker caps), and the full suite and the project gate stay
+  with the coordinator (Trey, 2026-09-30). Call mode, unmoded prompts, and
+  slash passthrough are untouched; reframing never repeats it.
+- `runs` and `ps` show how long a running Run has left: a running Run with a
+  timeout carries `deadlineAt` (recorded by the runner when its timeout clock
+  starts, after workspace setup) and `remainingSeconds`, and the text listing
+  prefixes `current` with `12m left`. Terminal Runs carry neither.
+- **A live Run shows the tool call it is waiting on.** While a tool call is in
+  flight, `runs` and `snapshot` carry `pendingTool` (`name`, optional
+  `target`, `startedAt`, `seconds`; the oldest pending call, redacted like
+  `current`), and after a minute `current` reads `waiting on tool <name> for
+  13m`. It is refreshed whenever the pending set changes, tracked even with
+  `--stall-minutes 0`, and dropped from terminal records. The stall watchdog
+  still never fires while a tool is pending: a hung tool is surfaced, not
+  killed.
+- A followup or session resume whose child exits non-zero within 15 seconds
+  with no stdout or stderr stays `child_failed`, but the message says the
+  saved native session probably could not be loaded and `nextActions` offers
+  `delegate resume <handle>`.
+- **Early-stop detection.** A succeeded Run whose last sentence announces a
+  next step ("Now let me write my report.") carries `degraded:
+  ended_announcing_next_step`, and a work Run that parks on an approval
+  question with no changed files carries `degraded: ended_awaiting_input`.
+  Status stays `succeeded`; the warning names `delegate resume <handle>`. A
+  finished deliverable that ends with "Should I proceed?" is not flagged.
+- **Unread coordinator mail is surfaced at run end.** A terminal work Run
+  records `unreadMail` (count, up to three id/sender/subject rows, and an
+  `unreadable` count for damaged or non-regular inbox entries) plus a warning
+  on the state, envelope, completion report, snapshot, `wait`, and `cancel`
+  reply. Messages a push hook already injected count as read. The mail prompt
+  suffix now asks lanes to read their inbox before final verification or
+  commit. Launch, dry-run, and manifest carry `mailInbox` (host and mail
+  root).
+- `followup` and `resume` inherit `--mail-push` from the source Run and accept
+  `--no-mail-push`; `followup` also accepts `--mail-push`.
+- **One automatic fresh rerun for transient safe-mode failures.** A `safe`
+  Run that fails with `stream_disconnected` or `provider_unavailable`, or a
+  `safe` launch the broker refuses (`broker_binding_inactive`) with no child
+  output, is rerun once as a new Run recorded under `autoResume` with `kind:
+  "rerun"` and the first attempt's error. The first broker refusal defers the
+  known-bad lane marker (`laneMarkerDeferred: "broker_binding_retry"`). Work
+  Runs are never rerun this way. `providerErrors.autoResume: false` turns it
+  off.
+- **`<engine>.enabled: false`** hides a harness from `models`, `describe`,
+  `capabilities`, and `capabilities refresh`, and any launch of it fails with
+  `harness_disabled` naming the key.
+- **Claude model typos are refused before launch.** A typed `--model` that is
+  a family word plus a version (`opus-5.5`, `Sonnet 5`) or names no model
+  (`claude-`, an empty `[]`) fails with `invalid_alias` and the closest valid
+  values, on the CLI, dry runs, and `run --input-json`. Provider names
+  (Bedrock ARNs, Foundry deployments, gateway strings) still launch, and the
+  version-typo refusal is skipped when a Bedrock, Vertex, Foundry, or
+  `ANTHROPIC_BASE_URL` gateway variable is set.
+- Workflow status says why and what next: a paused workflow carries a `pause`
+  object (gate, actions, last failure, rejection text) or a `softPark` reason
+  naming `delegate workflow resume <wfId>`; agent journal rows always carry
+  label and item, `agent_started` records `timeout` and `deadlineAt`,
+  `agent_timeout` names `nextEngine`, and status lists recent timeouts.
+- Codex structured output: a root-array answer wrapped in a one-key object is
+  unwrapped on the prompt path and journaled as `agent_output_unwrapped`.
+- Worktree warnings name the files: `dirty_source_auto_included_paths`,
+  `dirty_source_included`/`dirty_source_included_paths` for explicit
+  `--include-dirty`, `dirty_source_mirrored` for safe worktree launches, and
+  `dirtySourcePreview` in dry runs (up to five paths each).
+- `workflow resume` and `workflow status` say when a workflow's pinned runtime
+  differs from the live one. The notice names both runtimes (digest, delegate
+  version, and the pin or promotion date), and JSON carries the same facts as
+  `runtimePin` (`differs`, `pinned`, `live`; on a resume the notice text is
+  also in `warnings`). `status` prints no notice for a finished (`succeeded`
+  or `dry_run`) workflow, and a pin that cannot be read reports `checked:
+  false` with the reason instead of blocking the resume.
+- `--repin` on `workflow resume`, `workflow run --resume`, and `workflow
+  approve` is an opt-in that moves a workflow onto the live runtime; a plain
+  resume still keeps the pin. It keeps the journal, step keys, frozen script,
+  arguments, config, personas, and profile identity, moves the old runtime
+  into `runtimeHistory`, and journals one `runtime_repinned` event. The
+  identity check still runs first, and the new pin is written aside and
+  validated before it replaces the old one. A failed validation, a failed
+  launch, or a resume where no supervisor ever starts on the new pin restores
+  the old pin byte for byte and journals `runtime_repin_rolled_back`.
+  `--repin` is refused with `repin_children_running` while a child run is
+  running or still starting, with `invalid_option_combination` on a new run or
+  with `--dry-run`, with `workflow_locked` when another resume holds the lock,
+  and when the existing pin cannot be verified. `WORKFLOW_KEY_VERSION` remains
+  the guard against step-key drift. A script that branches on `capabilities`
+  can take a different branch after a repin, because the map then describes
+  the live runtime.
+- `workflow check` warns about unkeyed steps in a script that keys others.
+  When some `agent()`, `parallel()`, `pipeline()`, or `workflow()` calls pass
+  `key=` and others do not, it emits one `keying warning` per primitive kind
+  with the source lines of the unkeyed calls (at most eight), because those
+  calls still replay by position and prompt and lose settled work when a
+  resumed script shifts. A script that keys nothing is left alone, a call with
+  a `**kwargs` expansion is assumed to carry its key, and `judges()` and
+  `followup()` are never flagged.
+- A run or workflow id that is not in the current workspace is looked up in a
+  small roster of the other workspaces Delegate has launched in
+  (`~/.delegate/registries.json`, private, at most 256 entries, most recently
+  used first; workspaces whose `.delegate` is gone are skipped). `snapshot`
+  and `run-output` read a run id found in exactly one other workspace directly
+  and report `resolutionKind: "cross_registry"`, `resolvedWorkspace`, and a
+  `cross_registry:` warning. `wait`, `cancel`, `resume`, `followup`, and
+  `worktree show` never act across workspaces: they fail with
+  `unknown_handle`, name the workspace, and put the exact `delegate --cwd
+  <workspace> ...` command first in `nextActions`. The workflow read actions
+  `status`, `events`, `watch`, `wait`, and `result` read a workflow found in
+  exactly one other workspace, and `status`, `wait`, and `result` add
+  `resolvedWorkspace`; `approve`, `reject`, `kill`, and `run --resume` fail
+  with `workflow_not_found` and the exact command instead. An id found in
+  several workspaces is listed, never guessed, and a numbered alias is never
+  auto-resolved: the error lists every workspace that has it. Only workspaces
+  used for a launch after the roster shipped are known.
+- OMP `tool_execution_update` records whose `args` or `partialResult` is
+  oversized are shrunk to a `{"delegateCompacted": true, "originalBytes": N,
+  "head": ..., "tail": ...}` stub. The sub-agent `task` tool re-emits its
+  whole shared context on every update; `tool_execution_start` and
+  `tool_execution_end` carry the full arguments and result once and are never
+  touched. `stdoutCapture` (policy `omp-capture-v2`) reports
+  `compactedToolUpdateRecords` and `compactedToolUpdateBytes`, the run gets a
+  warning, and `--raw` cannot recover the compacted text.
+- Tracked Pi, OMP, and OpenCode runs ingest token `usage` from the stream,
+  summed per message or step and not double counted.
+- Run and call envelopes, run summaries, and snapshots carry `servedModel`
+  and, when the harness reports one, `servedProvider`: what the child's stream
+  says actually answered. They sit beside `modelResolved` (the request),
+  repeat inside `modelProvenance`, and are absent when the harness reported no
+  model. A Claude call reports only a per-run `modelUsage` total, so its
+  `servedModel` is set only when exactly one model produced output; with
+  several it is absent and a pinned call warns `pinned_continuity_unverified`.
+  An ungrouped `call` is now held to the same continuity rule as a tracked
+  run: a pinned call whose stream names another model or provider fails with
+  `model_continuity_paused` (text mode prints no answer text for it; JSON
+  keeps any text beside the error), and a fungible or panel call carries the
+  `model_substitution` warning, provider included.
+- A tracked run whose child ends its turn mid-job is flagged as degraded. A
+  headless child ends when its model stops, and background Bash tasks and
+  Monitors die with the session, so a Claude work run that said "Waiting on
+  the full gate" used to be recorded `succeeded` with `ok: true` while its
+  gate never finished. The status stays `succeeded` so the work can be
+  adopted, but the run now carries `degraded: true` (present only when true),
+  a `degradedReason`, `degradedEvidence` (bounded, redacted lines saying what
+  was seen), and a `degraded=...` warning. They appear on the launch envelope,
+  in state.json, on `wait` (JSON, `--structural`, and a `degraded:` line in
+  text), `snapshot`, `runs` and `ps` (the text table prefixes `current` with
+  `[degraded]`; `--structural` omits them), the `run-output
+  --completion-report` view, and, for a workflow child, the `agent_child`
+  journal event and `agent_meta()` (`degraded`, `degradedReason`). Nothing
+  fails a run or a workflow step, and `wait` still exits 0. `degradedReason`
+  is `ended_waiting_on_background_work` or
+  `background_work_unfinished_at_exit`. The first is a final-message check
+  that works for every engine: a short message that is not shaped like a
+  finished report and says the child is waiting on, or will act after,
+  unfinished work of its own. It ignores waiting on the requester ("I'll
+  commit when you approve"), a third party's independent result ("Waiting for
+  CI to post its result"), denials, and quoted text such as a tool's output; a
+  short report-shaped message matches only an explicit present-tense statement
+  that the child's own job is still running; runs with `--output-schema` are
+  not text-checked. The second reads Claude Code's `background_tasks_changed`
+  snapshot at the result event and catches a finished-looking report that
+  abandoned a running task; only Claude emits that event.
+- A provider failure is now data. The failed run's envelope, run state, and
+  completion report carry a structured `providerError` (`status`,
+  `providerCode`, `message`, `engine`, `signature`, `class`, `hint`); the
+  message is bounded, credentials are redacted, and email addresses are
+  masked. `class` is `persistent`, `transient`, or `unknown`, and a persistent
+  signature is either lane-scoped (credentials, billing, or model access are
+  wrong) or request-scoped (this prompt is the problem). One engine-keyed
+  signature table classifies by HTTP status first, then provider code, and
+  uses text patterns only as the fallback, so `failureReason`, `failureKind`,
+  the hint, and the class agree, and an OMP HTTP 400 naming an image count or
+  size limit is `request_image_limit`, never an auth failure. The signature
+  list is in `docs/troubleshooting.md`. Two new `failureKind` values are
+  `lane_known_bad` (a launch refused, below) and `provider_exhausted`
+  (workflow only).
+- A persistent, lane-scoped provider failure (rejected credentials, no credit,
+  usage limit, no access to the model, missing API key) marks its lane
+  known-bad for `providerErrors.knownBadLaneMinutes` (default `15`; `0` turns
+  markers off). Until the marker expires, another launch on that lane is
+  refused in milliseconds, before any worktree or child exists, with
+  `lane_known_bad` and the new exit code `4`; the payload carries `signature`,
+  `class`, `hint`, `expiresAt`, `secondsLeft`, and `markedRunId`. The global
+  `--force-launch` launches anyway (another persistent failure renews the
+  marker), a success clears the marker, and `--dry-run` never refuses.
+  `delegate doctor` lists live markers as `knownBadLanes`. Transient,
+  request-scoped, and unclassified failures never mark a lane, nor do endings
+  Delegate established itself (timeout, stall, output cap, cancel), and a
+  Codex usage limit with `codex.fallbackProfile` set stays with the profile
+  failover. The `providerErrors` config section is new, and an unknown key in
+  it fails as `invalid_provider_errors_config`.
+- A known-bad lane is one engine on one provider, model, and account (the
+  Codex failover identity, `CLAUDE_CONFIG_DIR`, or the auth profile), plus the
+  credentials the child will see: API keys, tokens, and broker, realm,
+  account, and endpoint settings in the environment, and for OpenCode the
+  provider keys, base URLs, and `Authorization` headers inside
+  `OPENCODE_CONFIG_CONTENT`. They are folded in as a salted hash (the salt is
+  `~/.delegate/state/lane-health.salt`, mode 0600), so a bad key on one
+  account never refuses a healthy account on the same model, and no key value
+  is stored or shown. `doctor` and the refusal print only a short `[credential
+  xxxxxxxx]` tag, an account label shaped like an email address is masked, and
+  a success clears its marker even when the marker store's lock is stuck.
+- A Codex or Claude work run that fails with a transient provider drop
+  (`stream_disconnected` or `provider_unavailable`: Codex's websocket closing
+  early, or a 5xx or overloaded Claude reply) and saved its native session is
+  continued once, automatically, the way `delegate followup` continues one:
+  same session, a new run linked to the first by `followupOf`. The
+  continuation's envelope and manifest carry `autoResume` (`automatic`,
+  `attempt`, `of`, `trigger`), and the final result is the continuation's.
+  There is no second automatic attempt, so a drop in the continuation is
+  final. It never applies to safe or call mode, `--pass-through`,
+  structured-output runs (the workflow supervisor owns that retry), runs that
+  saved no session, or runs in a temporary worktree; a worktree run attaches
+  to its own worktree and branch. When the continuation cannot be built the
+  first run's result is returned unchanged with `autoResume` set to
+  `attempted: false` and a `reason`. It is on by default, and
+  `providerErrors.autoResume: false` opts out; workflow children are
+  unresumable unless the call passes `resumable=True`, so it reaches them only
+  then.
+- Workflow `agent()` returns two new typed failure kinds under
+  `on_failure="typed"`: `lane_known_bad` (the child refused to launch because
+  its lane is marked known-bad; workflows never pass `--force-launch`) and
+  `provider_exhausted` (the call was skipped, with no run and a `run_id` of
+  `None`, because its stage already stopped launching on the lane).
+  `AgentFailure.provider_error` carries the child's `providerError` so a
+  script can branch on the signature instead of parsing prose, and
+  `capabilities["providerOutcomes"]` advertises the feature. A stage is one
+  `phase()` label and a lane is one engine on one model. When the first
+  `providerErrors.stageStopAfter` results (default `3`; `0` turns the stop
+  off) of a stage on a lane all fail with the same persistent, lane-scoped
+  signature, the rest of that stage's calls on that lane are not launched,
+  cells already queued behind the agent cap skip too, and a call with an
+  engine fallback chain moves on to its next engine. A success or any
+  different result among the first results means the lane is not uniformly
+  bad, and transient and request-scoped failures never count. The trip is
+  journaled once as `stage_lane_stopped` and each skipped call as
+  `agent_lane_skipped`; a skipped call still counts against the workflow's
+  agent budget.
+- `delegate capabilities refresh` records per-engine auth health. A successful
+  refresh runs the read-only probes named in `providerErrors.authProbes` (by
+  default `estate-cursor status` for `cursor` and `estate-omp usage` for
+  `omp`) and records what they clearly say as `authHealth`, in its JSON and
+  text output and in `~/.delegate/state/auth-health.json`: `ok`, `logged_out`
+  (Cursor reports it is not signed in), or `limit_reached` (an OMP quota
+  window is at 100%). OMP reports quota per provider and account, so its
+  reading also carries `lanes` (`<provider>/account <N>` to `ok`,
+  `limit_reached`, or `unknown`); the engine reads `limit_reached` only when
+  every lane is exhausted, `partial` when some are, and `unknown` for lanes
+  the report does not describe. A probe that is missing, slow, exits non-zero
+  without a recognisable message, or prints something unexpected records
+  `unknown` with a `reason`; `unknown` is never a failure and never refuses a
+  launch, and the probe's raw output is not stored. A subset refresh probes
+  only the named engines and keeps the others' last reading, and `delegate
+  doctor` shows the last reading as `authHealth`. `authProbes` accepts only
+  `cursor` and `omp` (each a command and its arguments, or `null` to turn that
+  probe off), and `DELEGATE_AUTH_PROBES=off` (or `0`, `false`, `no`) skips
+  every probe.
+- A conformance test requires the parser to accept every documented command
+  line. It extracts each `delegate` line from `docs/cli-reference.md` and each
+  usage and example line in `COMMAND_SPECS`, expands the usage synopses into
+  concrete argv lists (minimal, maximal, each alternative alone, and every
+  pair of optional groups), and fails on any the parser refuses, so a synopsis
+  that shows mutually exclusive options as independent cannot drift again. A
+  separate test runs the real launcher on `mail send --to coordinator -` with
+  a piped multi-byte UTF-8 stdin and compares the delivered bytes.
+- The stall watchdog stops runs for named reasons besides idle time. A run
+  that streams roughly 100k tokens of model output with no tool activity stops
+  as `runaway_output`; only model-output payload characters count, and
+  text-stream harnesses such as Devin are exempt. The same tool call failing
+  the same way five times in a row, with nothing else completing in between,
+  stops as `repeated_tool_failure`; each failure counts in exactly one streak,
+  and targets compare whole. A repeated identical call no longer resets the
+  idle clock and time spent inside tool calls no longer counts as idle, so a
+  fast no-op loop is caught while a slow polling loop is left alone. A changed
+  `HEAD` in the execution checkout counts as progress. Every idle stall samples
+  the child's process group and records `childActivity` (`cpu_active`,
+  `waiting`, or `no_processes`) with a process snapshot, and a pending stall
+  kill is re-validated after those blocking diagnostics.
+- A Devin child whose output already ends in a Delegate completion report and
+  then goes quiet is stopped as finished (`stoppedAfterCompletion`) instead of
+  stalled. Only a `Status: completed` report records exit 0; `failed` or
+  `blocked` records a failed run, and a child that echoes the prompt's own
+  template line (`Status: completed / blocked / failed`) stalls as before.
+- Tracked launches take `--stall-minutes`, which pins the stall threshold over
+  config, the silent-harness default, and `DELEGATE_STALL_MINUTES`. The
+  manifest records a pinned value as `stallMinutes`, and `resume` and
+  `followup` pass it to the continuation (config and environment defaults are
+  still re-resolved). Resume refuses an invalid recorded value and followup
+  ignores one, as each already treats `timeoutSeconds`. `describe` lists the
+  flag with the other tracked-only launch options.
+- With `DELEGATE_CHILD_NO_PAGE_ASK=1` in the launching environment, each
+  tracked child finds a stub `ask` first on its `PATH`. The stub prints a
+  refusal and exits 2 (the real `ask`'s relay-down code) instead of paging the
+  operator's phone and blocking. It is written into the run's own private temp,
+  scratch, or run directory; nothing under `$HOME` is written.
+- An `--isolation none` run whose cwd is strictly inside a git work tree
+  records the files it changed elsewhere in that repository as
+  `outsideCwdChanges` (repository, count, examples) with a warning. The before
+  and after snapshots key each path by status, size, and mtime, skip
+  Delegate's own registry, and run git with `--no-optional-locks` so they never
+  rewrite the user's index. A repo-root cwd, a non-git cwd, and paths outside
+  the repository stay undetected, and the warning says so.
+- Safe and dirty-synced workspace copies name, in a run warning, the paths
+  they withhold only because `.git/info/exclude` ignores them. The files are
+  still not copied, since `info/exclude` is where private scratch usually
+  lives.
+- An omp prompt that names image paths warns that omp will not attach them
+  (omp attaches files only from `@path` argv, and Delegate sends the prompt on
+  stdin) and points at omp's read tool. The scan runs in linear time.
+- `runs --summary` and `ps --summary` print counts by status, harness, and
+  group for every matching run, without rows or manifest loads. Each run is
+  counted once across registry roots, the listing's empty-scope and
+  status-filter warnings apply, and `--limit` and `--structural` are refused.
+- `wait --json --structural` reduces each run to identity, terminal status,
+  result quality, and failure fields, and moves the handle-resolution warnings
+  (`bare_handle_stale`, `bare_handle_ambiguous`, `run_target_stale`) to the top
+  level. `ok` and the exit code still come from the full view; text output
+  ignores the flag.
+- `worktree show` and `worktree remove` accept the worktree path as the
+  handle, matched canonically against the records' `executionCwd`; a relative
+  path resolves against the `--cwd` workspace. An unknown path fails with
+  `unknown_worktree_path` and, like an unknown handle, points at
+  `worktree reap --path`. `not_worktree_run` names the run that owns the
+  worktree and puts `worktree show` on it first in `nextActions`.
+- A bare harness handle warns `bare_handle_ambiguous`, naming up to five other
+  runs, when other runs of that harness share its group or are still running.
+- A cursor model that is a bare family word such as `grok`, and is neither a
+  configured `cursor.models` alias nor a catalog selector, resolves to the
+  family's newest selector (highest version, non-fast, balanced tier) from the
+  discovered catalog, or from the bundled table when discovery has none, with
+  a warning. Configured defaults and routes resolve the same way before effort
+  routing.
+- Launches warn when the resolved model id is absent from the discovered
+  catalog, or from the bundled table when discovery is empty; bundled-table
+  warnings fire only for a selector that resembles a listed id. Cursor now
+  uses this shared check, so a misspelled id warns without a discovery
+  snapshot. A Claude `[1m]` suffix compares by its base, and Claude family
+  aliases are exempt. The launch is never refused and the selector never
+  rewritten.
+- The `--forbid-commit` implied-worktree note and a missing `codex.profile`
+  overlay print to stderr when a run launches, not only in the finalization
+  report or `doctor`.
+- A failed safe-mode run whose child reports resolver or reachability errors
+  (`getaddrinfo`, `ENOTFOUND`, `EAI_AGAIN`, and similar) warns that safe mode
+  may block network access and that research belongs in work mode. Only a
+  generic nonzero exit gets the hint; status and failure kind are unchanged.
+- `followup` on a run that a later resume or followup already continued prints
+  a note naming that run and the command that continues from it, unless the
+  later run shares the source's native session.
+- `describe` and `models --json` report `binary` for every engine, droid
+  included. The `models` text view omits a retired droid row that has no
+  configured or discovered models and no configured default.
+- Workspace spec for work lanes in a persistent worktree: `--base REF` cuts the
+  worktree from REF, `--env NAME=VALUE`/`--env-file PATH` set child variables
+  that are recorded privately and re-applied on resume and followup, and
+  `--setup CMD` runs in the fresh worktree before the child. A failed setup is
+  a typed `workspace_setup_failed` error (`failureKind: workspace_setup`) and no
+  child launches. `run --input-json` takes `base`, `env`, and `setup`, and
+  workflow `agent()` takes `base=`, `env=`, and `setup=` (capability
+  `workspaceSpec`). `workflow run --env/--env-file` records a launch env that
+  every resume re-applies.
+- A worktree whose run is not terminal while its launching Delegate process is
+  alive is leased: prune, auto-prune, reap, and remove skip it with
+  `worktree_leased` even when the child pid is dead.
+- `delegate runs` in a repository's main worktree also lists runs registered in
+  its linked worktrees, tagged with `registryWorkspace`.
+- Workflow steps can carry a stable caller-supplied identity. `agent(..., key="...")`
+  replays by that key inside the enclosing named scope instead of by position and
+  prompt text, so a resumed script that skips settled work or embeds new git heads
+  in its prompts still hits its cache. A changed prompt under the same key adopts
+  the recorded result and journals `key_prompt_mismatch`. `parallel`, `pipeline`,
+  and `workflow` accept `key=` to name their scope. Reusing a key within one run
+  raises `WorkflowKeyConflict`. Unkeyed calls keep their positional keys, so
+  existing journals replay unchanged.
+- Gate actions: `park_gate(key, result, actions=[...])` pauses for an operator
+  decision, and `workflow approve <wfId> --gate KEY --action NAME [--note TEXT]
+  [--data JSON]` returns that choice to the script. Undeclared actions are
+  refused with the allowed list. A bare `approve` behaves as before. A recorded
+  action the resumed script no longer declares is not returned: the gate parks
+  again (`gate_action_undeclared`) and asks under the current actions. A second
+  live `park_gate()` with the same key in one named scope raises
+  `WorkflowKeyConflict`.
+- The workflow `capabilities` global adds `agentKey`, `scopeKey`, and
+  `gateActions`.
+- Tracked runs persist the harness-reported token `usage` on the run record, so
+  `snapshot`, `run-output`, and `runs --json` expose it without re-reading the
+  child's stream (previously it reached only call mode's launch response).
+- A fungible or panel run whose harness reports a served model other than the
+  resolved one now carries a `model_substitution` warning naming requested,
+  resolved, and served models. Pinned runs already pause on a switch; the
+  warning closes the silent case for the default continuity mode.
+- `delegate doctor` warns when a configured `<engine>.defaultModel` (resolved
+  through `<engine>.models` aliases first) is absent from the selected profile's
+  discovery catalog, naming the nearest discovered selectors. It checks the
+  unique targets of configured `<engine>.models` aliases the same way, naming the
+  alias key, since a selector an operator wrote down is worth knowing about even
+  when no current launch selects it. A cursor launch
+  adds the same warning for its selected selector, because cursor-agent resolves
+  an unknown selector inside the child. All of them are warnings: an empty or
+  missing catalog stays silent, and no configured value is rewritten or refused.
+- `workflow run` warns when it detects it is running inside a systemd unit whose
+  `KillMode` will reap the detached supervisor (`control-group`/`mixed`), naming
+  the unit and the required `-p KillMode=process`. Previously the unit reported
+  success while the workflow was already dead.
+
+### Fixed
+- Missing local profile directories are silently omitted from write-guard
+  launcher reopens. Failover state uses `~/.delegate/failover` when the optional
+  profile tree is absent, and missing personal profile homes do not read legacy
+  cooldown files. Existing profile trees keep their current behavior. The
+  development-only `delegate-audit` shim names its optional checkout when absent.
+- `worktree reap` removes linked orphans on Linux again. Its process scan
+  refused every removal as `process_scan_unavailable` because Linux hides the
+  working directory of the user's own non-dumpable processes (`systemd
+  --user`, `ssh-agent`, `sshd-session`), which every login session has. A
+  hidden process whose real and effective user and group ids match the
+  caller's is now noted in a warning and does not block (the saved ids may
+  differ, as for set-group-id `ssh-agent` on Debian); one with other ids (a
+  `newgrp` shell) or an unreadable status still refuses. Shells,
+  agents, and bubblewrap-sandboxed lanes stay readable and still block
+  removal. The test helper that runs fake children also writes the script to
+  a file, since Linux caps one argument at 128 KiB.
+- A stale Run's `nextActions` (in `runs` and `snapshot`) now offers `delegate
+  resume <handle>` (not for `call` Runs, which cannot resume). The CLI
+  reference and troubleshooting guide say what killing a launch command does:
+  the launch is the Run's supervisor, the child keeps running on its own until
+  it next writes output and then exits, the Run reads `stale`, and `cancel`,
+  `resume`, or `followup` recover it. Launch each lane from its own background
+  task.
+- The `runs` and `worktree list` text tables head their time-since-activity
+  column `idle`; it was labelled `age`, which agents read as run age. JSON is
+  unchanged.
+- Parallel Runs launched at the same moment (workflow `parallel()` children,
+  a fan-out) no longer fail at random with `unsafe_scratch_directory` ("File
+  exists: 'run-scratch'"). Two launches racing to create the shared scratch
+  root now both use it; the symlink, non-directory, and foreign-owner checks
+  still run on the directory either way.
+- The Claude model-typo refusal is skipped when `CLAUDE_CODE_USE_BEDROCK`,
+  `CLAUDE_CODE_USE_VERTEX`, `CLAUDE_CODE_USE_FOUNDRY`, or `ANTHROPIC_BASE_URL`
+  comes from `--env` or `--env-file`, not only from the launching
+  environment. The env files are read once per launch, so the check and the
+  child see the same values.
+- A Run's `current` no longer keeps showing a provider error after the
+  harness has moved on. Pi and OMP show `retrying after provider error
+  (429)` while they retry and then the new activity; a Codex `turn.started`
+  or OpenCode `step_start` after an error replaces it the same way.
+- `--notify` channel pings work against post 0.9.0, which removed `--anyway`
+  from its help. The notifier sends without it and retries once with
+  `--anyway` only when post refuses the send as `crossed_send`.
+- The setup-command output tail recorded for a worktree Run can no longer
+  reconstruct a secret passed through `--env`/`--env-file`: recorded values
+  and their fragments are masked, generic redaction runs between masking
+  passes, and the whole pass repeats until nothing changes (a tail that never
+  settles is replaced by the mask).
+- The Cursor model-family warning names the selector the operator typed and
+  the routed selector actually passed to Cursor.
+- Every harness caps its map of tool calls still waiting on a result at 256
+  entries (Claude, Kimi, Grok, and Cursor kept them all), and a completion
+  report status line may end in a semicolon (`Status: completed;`).
+- `worktree remove` of a parent no longer orphans worktrees of Runs launched
+  inside it: clean, merged nested worktrees are removed first, and dirty or
+  unmerged ones refuse with `nested_worktrees_block_remove` and a per-nested
+  command (`--force` does not reach them). Reap refuses a pool path holding
+  nested worktrees (`nested_worktrees_present`), a nested Registry that
+  appears mid-removal refuses with `nested_registry_appeared`, and an
+  unreadable nested Registry refuses even with `--kill-live`.
+- A Codex workflow stage whose schema has an object with no declared
+  properties (including through a local `$ref`) no longer fails every
+  attempt: it uses the prompt path instead of strict mode, which closed the
+  object to zero keys. A direct `codex --output-schema` with such a schema is
+  refused at preflight with `invalid_output_schema` naming the path.
+- A dry-run `workflow resume` no longer cancels or reaps a stale scope child,
+  changes status, persists a budget, or records an approval; it only
+  journals. `workflow approve` on a failed workflow points at `workflow
+  resume`, and on a running one says the gate is not open yet.
+- A relative `--prompt-file` falls back to `--cwd`, and the not-found error
+  names both paths tried.
+- The unread-mail scan cannot block on a FIFO named like mail; the shared
+  bounded record reader opens non-blocking.
+- Small surface fixes: the Registry writes `.delegate/.gitignore`;
+  `--include-dirty` is a warned no-op in safe mode and reports `includeDirty:
+  false`; `runs show` names the real readers; a timed-out `wait --json` warns
+  and names `--structural`; `no_matching_worktrees` names the Registry it
+  searched.
+- A `--mail-push` Codex run no longer dies before the model starts. Delegate
+  injected `-c hooks=true`, which Codex 0.157 rejects at config load because
+  `hooks` is a table; it now passes `--enable hooks` (the same as `-c
+  features.hooks=true`) and does not add it twice when it is already present.
+- `--notify` room pings work against post 0.9.0. The notifier no longer passes
+  `--allow-self`, which post now rejects as an unexpected argument, and the
+  message-id match accepts post's room ids (which have no microsecond field)
+  as well as channel ids, so `messageId` is no longer empty for a room ping. A
+  room ping is a workspace fan-out that never reaches its own sender, so
+  `--notify` naming your own room reaches the room's other participants and
+  not the launching session; the troubleshooting guide now says so.
+- On a Python older than 3.11 (Xcode's 3.9, for example), `bin/delegate.py`
+  and the `delegate_agent` package now exit `2` with a message naming the
+  interpreter version and executable they found, instead of a raw
+  `ImportError` from inside the package. The tracked
+  `bin/delegate-profile-shim` picks a 3.11+ interpreter itself (`python3`,
+  then `python3.14` down to `python3.11`, then Homebrew's, then
+  `/usr/local/bin/python3`), honors a validated `DELEGATE_PYTHON` (an override
+  older than 3.11 is refused, not bypassed), and exits `2` with a plain
+  message when none is found.
+- The Codex and `post` argv Delegate builds is now tested against the
+  installed binaries (`tests/test_real_binary_contracts.py`), which is how the
+  two dead flags above shipped. A `codex` or `post` on `PATH` that fails
+  `--version`, times out, or cannot register the throwaway room now fails the
+  suite with its command, exit code, and output instead of skipping it; a
+  class skips only when its binary is absent or
+  `DELEGATE_SKIP_REAL_BINARY_CONTRACTS` is truthy, and says why.
+  `pytest-xdist` workers now see the real HOME through
+  `DELEGATE_TESTS_ORIGINAL_HOME`.
+- A run that fails keeps what the child had produced. A failed, timed-out, or
+  (opt-in) capped run's completion report now quotes the child's last
+  substantive assistant text, bounded and redacted, under "Partial output
+  recovered before the run stopped. This is not a completion report", as a
+  cancelled run's already did. Pi, OMP, and OpenCode keep that text across
+  turns and steps, so a long review followed by a tool turn and a provider
+  error is still recoverable (OpenCode used to clear it at every step). A
+  call-mode timeout or output overflow, including a child that had already
+  exited before Delegate noticed the overflow, returns the buffered draft as
+  `diagnostics` on the error (also flattened into the JSON error):
+  `partialText` (redacted and bounded), `stdoutTail`, and `stderrTail`; text
+  mode prints the partial text to stderr.
+- `followup` errors now say what is true. A source with no recorded native
+  session (launched with `--no-resumable`, before Codex and Claude work runs
+  saved their session by default, or as a workflow `agent()` call without
+  `resumable=True`) is refused with `session-missing` and pointed at `delegate
+  resume <handle>`, no longer told to relaunch with `--resumable`. A session
+  that was saved but cannot be found when resumed fails as `session_expired`
+  (`failureKind: session_lost`); the message names the usual cause, a launch
+  under a different account than the one holding the session, and offers
+  `delegate resume`.
+- `resume` and `followup` refuse a known option of that command that appears
+  in the prompt tail (`delegate followup x fix it --dry-run`) with
+  `option_after_handle` before anything launches, instead of sending it to the
+  child as prompt text while the run launches with the defaults. Put `--`
+  before the prompt to send such a token as literal text. `followup` accepts
+  options on either side of the handle but only before the prompt text, and
+  `resume` only before the handle; an option-shaped token that belongs to
+  another command keeps the existing warning.
+- A workflow structured retry on Codex or Claude whose resumed session cannot
+  be found (`session_lost`, reason `session_expired`) now falls back to a
+  fresh relaunch in the same worktree instead of ending, without spending a
+  retry; the journal records `agent_structured_retry` with `strategy:
+  "relaunch"` and `fellBackFrom: "resume"`. A fresh child redoes the task, so
+  the fallback relaunches only over a worktree known to be untouched, and
+  otherwise the call is refused (`agent_structured_retry_refused`) as
+  `work_changed_session_missing` when an earlier attempt already changed the
+  worktree, or `work_state_unverified` when that could not be checked. The
+  work summary now records `fileInspectionStatus` next to
+  `commitInspectionStatus` (each `verified` or `unverified`), because a failed
+  `git status` used to read as zero changed files; `noChanges` is true only
+  when both are `verified` and show nothing. In work mode both the prior
+  attempt and the resumed attempt must carry a verified summary that reports
+  no changes, and a missing summary, or one from a Delegate that predates
+  `fileInspectionStatus`, counts as unverified. Safe and call children have no
+  summary and keep the fallback.
+- `worktree reap --path P --older-than N --yes --force` now removes a pool
+  entry that has no run record but that Git still links; `reap` used to skip
+  it as `live_backlink` even with `--force`, and the only way out was `git
+  worktree remove --force` by hand. Every check is re-run under the locks
+  immediately before removal. The pool scan must have no warning for the entry
+  (an entry with broken-looking metadata changed within the last 15 minutes,
+  or whose metadata cannot be read, is refused); Git must still list the path
+  as a worktree of its source repository; no Registry may hold a record for it
+  (`record_owns_path`, including a run that claimed it after planning, or
+  `record_in_other_registry` with the `--cwd` to run from); there must be no
+  uncommitted work by the definition above (`dirty`, `dirty_unknown`) unless
+  `--discard-uncommitted` is passed; no process may have its current directory
+  inside the path (`process_cwd_inside`, from one pass over `/proc` or `lsof
+  -d cwd`, never `lsof +D`) unless `--kill-live` is passed; and changed ledger
+  files are saved first. A process scan that cannot run, or cannot read one of
+  your own processes, refuses as `process_scan_unavailable`; other users'
+  processes are noted in a warning and do not block. The branch is kept, and
+  without `--force` the entry is still skipped as `live_backlink`, now with a
+  hint naming `--force`.
+- Persistent worktrees no longer replace committed symlinks with placeholders.
+  The replacement showed up as typechanges that the next `git add -A` would
+  commit. A symlink committed to the repository is left as Git checked it out,
+  absolute or not; only an untracked symlink that points outside the source,
+  or at gitignored content, is replaced by a placeholder as it is mirrored in,
+  and the launch warning names it. Safe mode is unchanged and still blocks
+  every external symlink in its throwaway copy.
+- `worktree show` on a followup, resume, or attached run names the run that
+  owns the worktree, following the lineage up through followups and resumes
+  (up to 16 hops, with a cycle guard) and putting `delegate worktree show
+  <owner>` first in `nextActions`.
+- Two false or misleading model warnings are gone. Cursor labels are compared
+  after the context-window token (`256K`, `1M`) is dropped, so
+  `grok-4.7-xhigh` served as `Grok 4.7 256K Extra High` is the requested model
+  and not a `model_substitution`. A pinned call whose stream named a served
+  model is no longer told it "could not be verified"; that warning now fires
+  only when the stream was silent.
+- Usage synopses in `--help`, `describe`, and `docs/cli-reference.md` now
+  match what the parser accepts; the parser was right in each case. `claude
+  call` takes `[--read-only|--pure]`, not both. `runs` and `ps` take
+  `[--summary | [--limit N] [--structural]]`, because `--summary` prints
+  counts and no rows and is refused with either. `snapshot` and `run-output`
+  take `(<handle>|--latest HARNESS)`. `run-output` takes `[(--stdout|--stderr)
+  [--raw | [--tail N] [--max-chars N]]]`, with a second usage line,
+  `[--no-redact] (--raw | --tail N)`, for the standalone `--raw` and `--tail
+  N` forms. `worktree remove` takes `[--keep-branch | [--force-branch]
+  [--force]]`.
+- `describe --summary` is now described as the command index plus config
+  resolution, launch options, profiles, and workflows, larger than the default
+  and `--overview` views and smaller than `--full`, not as compact.
+- The workflow supervisor relays `SIGINT` to its children the way it does
+  `SIGTERM` and `SIGHUP`, and journals `supervisor_signalled`. `SIGINT` used
+  to reach the interpreter's default handler, which raised `KeyboardInterrupt`
+  and marked the workflow failed without cancelling its children; they ran on
+  unowned until a later resume sealed them.
+- The `agent_timeout` journal row written when a `followup()` call times out
+  now carries `key`, `label`, and `scope`, as the `agent()` timeout row does,
+  so a journal with several follow-ups says which step died.
+- The workflow docs no longer say a resume adopts running children. A resume
+  cancels every child the previous attempt still had running and relaunches
+  that work; adoption covers only children that already finished (or that this
+  supervisor lifetime is itself still launching). Waiting on a live orphan and
+  taking its result is deferred work, not current behavior.
+- `describe --full` documents the workflow DSL the runtime actually injects.
+  Its `globals` list is read from the runtime's new `WORKFLOW_DSL_GLOBALS`,
+  which the injector also checks, so it now names `park_gate`, `reject`,
+  `soft_park` and its helpers, `structured_attempt`, and `dry_run` (aliases in
+  `globalAliases`). `capabilities` is derived from the runtime's capability
+  table, adding the `agentKey`, `scopeKey`, `gateActions`, and `workspaceSpec`
+  entries the old literal lacked, and is also given structured as
+  `capabilityVersions`. The `agent()` signature is rendered from the runtime
+  method, so it gains `resumable`, `on_failure`, `key`, `base`, `env`, and
+  `setup`; the `pipeline`, `parallel`, and `workflow` entries document `key=`,
+  and `judges` documents per-entry dicts.
+- A stdout or stderr line handler that raises (a registry lock timeout while
+  persisting progress, a parser bug) no longer kills the drain thread, which
+  stopped consuming the child's pipe and could strand the child. The drain
+  keeps reading to EOF, logs a `stream.handler_failed` event, and surfaces a
+  run warning that retried attempts carry forward.
+- `cancel` no longer fails with a raw `TimeoutError` while another process
+  holds the registry lock. When the lock wait runs out it reads the record
+  unlocked, re-reads it with any pending finalize WAL overlaid just before
+  signalling, and signals only a launched child generation whose start identity
+  matches the run; a terminal result refuses as `run_already_terminal` and a
+  changed generation as `cancel_target_changed`. It then makes one bounded
+  attempt to record the cancelled outcome, reporting `registryLockBypassed`
+  with an unrecorded warning if the lock is still held, and refuses with
+  `registry_lock_busy` for an unlaunched record, a setup group, or a stale
+  seal.
+- A bwrap safe child in a uv project without a `.venv` gets
+  `UV_PROJECT_ENVIRONMENT` pointed inside the run's own writable temp
+  directory, so `uv run` no longer fails creating `.venv` under the read-only
+  workspace bind. An existing `.venv` or an explicit `UV_PROJECT_ENVIRONMENT`
+  is left alone.
+- Resume onto codex or claude keeps a source run's explicit `resumable`
+  opt-in, so `followup` on the resumed alias works (any other source now takes
+  the resumable-by-default launch setting); a cross-engine resume onto an
+  engine that cannot keep it drops the opt-in and says so.
+- Resume and followup that reuse the source run's auth profile now say the
+  profile was inherited from the source run instead of warning about an
+  `--auth-profile` flag the user never typed.
+- The suite resolves the production compact-temp root the way runs do. On
+  macOS it named `/var/tmp` where runs record `/private/var/tmp`, so six tests
+  failed and every subprocess run's temp directory leaked.
+- A workflow no longer cancels its own live children as stale. Two `agent()`
+  calls from plain script threads could share one positional scope, and the
+  second call cancelled the first's running child. Stale-scope cancellation now
+  targets only children an earlier supervisor lifetime started (`agent_started`
+  records the lifetime's `incarnation`).
+- Workflow adoption relaunches instead of waiting on or failing over a key's
+  latest child run when that run is cancelled, stale, or never launched
+  (`agent_adopt_skipped`).
+- Resume seals a workflow child that never published a pid (stuck at `running`
+  or `creating_isolation`) once it has been idle for 300 seconds and its
+  recorded launcher (`launcherPid`) is dead or its pid was reused, instead of
+  refusing with `workflow_children_unsealed` forever. The runner re-reads the
+  record under the registry lock before every process start, the first included,
+  and publishes the child's pid only over a record that is neither terminal nor
+  cancel-requested, so a sealed launch never gains a child.
+- `workflow run --dry-run` executes the script with its working directory set to
+  the `--cwd` workspace, as a real run's supervisor does. A dry run that times
+  out leaves the workspace as the working directory, because its abandoned
+  script thread may still be resolving relative paths.
+- Persistent-worktree change accounting lists untracked files individually
+  (`git status --untracked-files=all`), matching the per-file launch-seeded
+  digest map. A seeded untracked directory used to be reported as one collapsed
+  entry the seeded filter could never match, so a quiet `work` run claimed a
+  change the child never made and reported success, a structured child with
+  unparseable output was refused as changed instead of relaunched, and the
+  worktree was retained as dirty. `workSummary.changedFiles` and
+  `rawChangedFilesCount` count files rather than directories for untracked
+  trees.
+- A bare `429`/`rate limit` diagnostic classifies as `usage_limit` only when
+  account-context wording (`quota`, `usage`, `billing`, `subscription`,
+  `account`, `credit`) appears on the same line within 80 characters of it, in
+  either order. An unrelated `memory usage: 82%` line or a wrapped command's
+  `usage:` help text no longer pairs with a transient 429, which had marked the
+  run a quota failure, suppressed the structured correction retry, and pointed
+  operators at credential rotation.
+- Codex work runs recover the last substantive agent message as the completion
+  report when the stream never sealed `turn.completed`, instead of classifying a
+  complete report as `resultQuality=empty`. A progress preamble is still not
+  adopted.
+- `run-output` no longer claims no recoverable final message exists while the
+  child wrote stdout; the diagnostic states the byte count and names the command
+  that reads it.
+- Workflow child launches that fail before publishing a run record record the
+  exit code and a bounded, redacted stderr tail on the attempt outcome and on a
+  new `child_stdout_unparsed` event (previously only the JSON decode error of
+  empty stdout was kept). `agent_structured_retry` carries the tail too. This
+  covers a child that exits `0` after writing empty or non-JSON stdout, on both
+  the initial `agent()` launch and `followup`.
+- An empty `runs`/`ps` listing now adds the workspace-scope warning without
+  requiring `--group`/`--harness`, so a bare `runs --running` in a directory
+  with no Registry no longer prints an empty table that reads as dead lanes.
+  `wait --group` on a group stored in another workspace reports the same hint
+  and names the searched Registry.
+- `workflow_not_found` errors for `status`, `run --resume`, and id-based verbs
+  name the searched workflow root and the `--cwd` form, so "stored elsewhere"
+  is distinguishable from "gone". The workflow profile-drift refusal names the
+  differing identity keys with their pinned and current values.
+- `models <engine> --summary` points at `delegate help models`, and the focused
+  help states that `--summary` takes no engine argument.
+- The linked-worktree registry-lock guard verifies suite ancestry before
+  reporting a violation, so a concurrent unrelated Delegate launcher holding the
+  same file is no longer reported as a suite escape.
+- Test bootstrap pins `MISE_DATA_DIR`/`MISE_CACHE_DIR` suite-wide, so a
+  subprocess-bearing test no longer makes the mise python shim download an
+  interpreter into a temporary HOME and pollute stderr.
+- The suite removes the compact child temp directory each tracked run manifest
+  records before it tears that temporary registry down, and asserts no test
+  leaves a net directory under the production owner root. Previously any test
+  that launched a real Delegate subprocess created `/var/tmp/dlg-<uid>/<token>`
+  that only `runs prune` could ever remove, and the temporary registry those
+  paths were derived from was deleted first. The run's own recorded child is
+  settled first: a live child whose command line carries one of the paths its
+  manifest names gets a bounded grace to reach its own exit (so a fixture child
+  writing through `$TMPDIR` finishes), and only then, or after being reaped, is
+  the exact recorded directory removed.
+- `run-output`, `runs`/`ps`, and `snapshot` reconstruct a persisted run's
+  `usage` from one allowlisted normalized shape instead of copying the stored
+  object, so a record rewritten after the run (a non-isolated child shares the
+  workspace) cannot inject unknown keys, an unknown basis, or credential-shaped
+  text into a payload or the `usage:` line. A record whose basis is not one a
+  producer emits contributes no usage at all.
+- The served-model comparison behind the `model_substitution` warning uses the
+  same harness-aware identity rules as the pinned check: OMP's provider-qualified
+  `provider/model` observation, a Cursor display name, and a Claude family alias
+  are the requested model, not substitutions. A clean OMP lane is no longer
+  labelled as substituted.
+- Model warnings redact their model values: `model_substitution`,
+  `pinned_continuity_unverified`, and the configured-model/alias catalog warnings
+  can carry an operator- or provider-supplied selector, and all of them reach
+  `state.json`, `delegate.doctor.v1`, or the completion report. A
+  credential-shaped selector is masked instead of persisted.
+- Workflow child launches that fail before publishing JSON carry the same
+  evidence on the *initial* `agent()` attempt as on followups: the outcome
+  records the exit code and a bounded, redacted stderr tail, and stdout that
+  never parsed emits `child_stdout_unparsed`. An exit-zero child whose envelope
+  is unusable is now reported as `invalid_envelope` rather than `nonzero_exit`.
+- `workflow run` detects the systemd unit from the cgroup component that owns
+  the current process instead of any ancestor `.service` in the path, so an
+  ordinary interactive session under `user@<uid>.service` no longer receives the
+  severe `KillMode` warning. A unit under the per-user manager is queried through
+  `systemctl --user` rather than read as a system-manager lookup failure.
+- The track's child `TMPDIR`/`TMP`/`TEMP` now points at a separate per-run
+  short-path directory (`/var/tmp/dlg-<uid>/<token>`, recorded as
+  `manifest.tempPath`) instead of the run scratch. The scratch path carries the
+  registry hash and run id, so a child binding a Unix socket under it overran
+  `sun_path`; the new root is short by construction, stays owner-only, is granted
+  as a second writable root in the Codex read-only permissions profile, is bound
+  read-write inside the optional bwrap boundary, survives failure and
+  cancellation like the scratch, and is removed only by the same run-owned prune
+  path. Runs recorded without a `tempPath` prune as before.
+- The completion report carries a `model_substitution` warning and the run's
+  normalized token usage in a labelled delegate-authored block above the child's
+  text, and `run-output` (JSON and text) projects the persisted usage. A
+  substituted lane no longer reads as the requested model's clean work in the
+  report artifact, while the child's report text and its
+  `completionReportSource` attribution are unchanged.
+- The `dev` extra ships `setuptools` and `wheel`, making the documented
+  `python -m build --no-isolation` form work instead of failing with
+  `BackendUnavailable`. The isolated build path is unchanged.
+
+### Changed
+
+- The work write guard no longer protects `~/Code` or sibling checkouts by
+  default (`isolation.writeGuard.codeRoot` now defaults to `null`). Named
+  credential stores, profile homes and the installed Delegate runtime retain
+  their existing protection and re-open rules. Set `codeRoot` or `add` to opt
+  in to checkout protection. Codex's native sandbox retains its own write limits.
+- Work-mode prompts gain two sentences saying nobody can approve during a Run
+  and the task is the approval unless the prompt asks only for a plan,
+  review, or read-only answer. Safe and call prompts are unchanged.
+- Runs at `xhigh`, `max`, or `ultra` effort default to a 20-minute stall
+  window instead of 8, unless `--stall-minutes`, config, or
+  `DELEGATE_STALL_MINUTES` sets one; dry run, manifest, and snapshot report
+  `stallWindow` with its source.
+- The `broker_binding_inactive` hint says one refusal while siblings launch is
+  usually launch-slot contention (relaunch once, with `--force-launch` if the
+  lane is marked) and a repeat means the binding is inactive.
+- OMP alias objects with unknown keys name the allowed keys and point effort
+  synonyms at `thinking`; `help omp` carries a valid example. The
+  `cursor_auth_required` hint names the auth realm the Run used and the
+  `--auth-profile` alternative.
+- **The tracked output cap is now off by default.**
+  `<engine>.trackedStreamMaxBytes` used to default to 16 MiB (64 MiB for Pi
+  and OMP) and stopped a run as `output_limit_exceeded` when a stream passed
+  it. It now defaults to `null`: a verbose run is never killed, truncated, or
+  hidden from the parser for its size, and `stdout.log` keeps the whole stream
+  and is flushed on every write, so its size and modification time follow the
+  child. Set a positive integer to opt an engine back into a cap; the
+  `output_limit_exceeded` message then names the key to raise or clear. OMP's
+  256 MiB transport and 16 MiB per-record ceilings apply only with an opted-in
+  cap, and call mode keeps its own 16 MiB caps. Runaway streams remain the
+  stall watchdog's job (`runaway_output`). The 500-line limit in the
+  `events.jsonl` mirror was never a limit on `stdout.log`; its
+  `stream.lines_truncated` marker now says the child keeps running and
+  `stdout.log` keeps the full stream.
+- A Devin answer is held in memory as a bounded excerpt. Devin prints plain
+  lines with no message boundaries, so Delegate treats everything it prints as
+  one running answer; past 30,000 characters that answer is the first 20,000
+  and the last 10,000 with an `[N chars omitted]` marker between them.
+  `assistantText`, the completion report, and a failed run's recovered partial
+  output read the excerpt, `assistantTextChars` keeps the full length, and
+  `stdout.log` keeps the full stream. The answer used to be rebuilt as one
+  string on every line, which was quadratic and, with the cap off, held the
+  whole run in memory.
+- **Codex and Claude `work` runs are now resumable by default.** They save
+  their native session unless the launch says `--no-resumable` (JSON
+  `resumable: false`) or the engine config sets `codex.resumable` or
+  `claude.resumable` to `false` (both default `true`), so `delegate followup`
+  works without remembering `--resumable`. `--resumable` on a launch still
+  beats the config key, and `resume` takes the same default and
+  `--no-resumable`; a resume source recorded as exactly `true` keeps it, and
+  any other source takes the launch default. The default outranks
+  `codex.ephemeral` and `claude.noSessionPersistence`, which now apply only to
+  runs that are not resumable. Safe runs, call runs, `--pass-through` runs,
+  other engines, and workflow `agent()` children (unless the call passes
+  `resumable=True`) are unchanged, and `--no-resumable` is a quiet no-op
+  there. A succeeded persistent-worktree run that is resumable keeps its
+  worktree (`worktreeRetained: "resumable_session"`) instead of retiring it
+  when clean, so `followup` and `resume` can re-enter it; a fan-out of these
+  runs leaves one retained worktree per succeeded run until `worktree prune
+  --merged`, `worktree gc`, or `worktree remove` cleans up. Launch with
+  `--no-resumable` when a run's worktree should retire itself.
+- **`--force` no longer overrides a live run on the worktree commands.**
+  `worktree remove`, `worktree prune`, and `worktree reap` refuse a worktree
+  that a live owner still holds (`run_active`, `run_not_terminal`,
+  `process_group_alive`, `worktree_leased`) even with `--force`, and the
+  refusal names the new `--kill-live`, the only override, which removes the
+  worktree out from under the run. `--kill-live` does not discard uncommitted
+  work or force the branch by itself. Removal is also refused for a running
+  run recorded in the worktree's own `.delegate/` registry
+  (`nested_run_active`) and for a nested registry, or a run in it, that cannot
+  be read (`nested_registry_unreadable`), each overridable only by
+  `--kill-live`. A skipped entry in `prune` and `reap` JSON carries the same
+  hint.
+- Uncommitted work has one definition across `worktree remove`, `prune`,
+  `reap`, and completion retirement: what the lane actually changed. Files the
+  launch seeded from a dirty source that still match their digest, and the
+  ledger paths in `worktrees.retirementIgnoreGlobs` (default `.beads/**` and
+  `.papercuts.jsonl`), do not count, so a worktree that `prune` plans is one
+  `remove` accepts and a refusal names only the lane's own paths. Ledger edits
+  are saved before any removal: changed ledger files are copied and
+  byte-compared into `<Registry>/salvage/<worktree>-<UTC timestamp>/`. The
+  result reports `salvagePath` and `salvagedPaths`, the text output prints a
+  `saved N changed ledger file(s)` line, and completion retirement records
+  `worktreeSalvagePath` on the run. Deleted ledger files and the old name of a
+  renamed one are recorded in a `MANIFEST.tsv` (status, path, old path) in the
+  same directory and reported as `salvageRemovedPaths`. A copy that fails, or
+  a `git status` that cannot run, refuses the removal as
+  `ledger_salvage_failed`. Delegate never deletes a salvage directory, and a
+  source-gone `reap` deletes the path without a copy.
+- **An OMP `provider/model` id you type is now pinned by default.** A
+  `provider/model` given as `--model`, input-JSON `model`, a positional raw
+  id, or a literal workflow `agent(model=...)` behaves as `--continuity-mode
+  pinned` unless you name a mode. Delegate launches it with a private
+  `--config` overlay that sets `retry.modelFallback` and
+  `retry.usageAwareFallback` to `false`, so OMP's own retry chains cannot move
+  the run to another provider (retrying the same model is unaffected, the
+  overlay beats your `config.yml`, and a dry run shows `--config <omp config
+  overlay>`). If another provider or model is served anyway, the run fails as
+  `model_continuity_paused` with a message naming what OMP tried to serve, for
+  example `requested opencode-go/glm-5.3, but omp tried to serve
+  fireworks/glm-5p3`. A delegate alias (a key of `omp.models`) and
+  `omp.defaultModel` stay `fungible`, so multi-subscription failover keeps
+  working; the run records and warns (`model_substitution`) which provider
+  answered, and `--continuity-mode pinned` on an alias pins it.
+  `--continuity-mode fungible` or `panel` on a typed id opts out of the
+  overlay. Workflows have no continuity passthrough yet, so there a literal id
+  is pinned and an alias is fungible.
+- An `omp` model name that is not an `omp.models` alias and not a
+  `provider/model` selector fails with `invalid_alias` once a discovered omp
+  catalog exists, unless it is exactly a catalog model id; the error lists the
+  configured aliases and the nearest catalog selectors. OMP resolves a bare
+  name by fuzzy match against its own catalog and can serve a different
+  provider (a retired alias, `kimi`, resolved to `fireworks/kimi-k3`), so
+  Delegate refuses instead of passing it through. With no catalog the run
+  proceeds with a warning; `delegate capabilities refresh` lets bare names be
+  checked.
+- **Claude `work` runs and their followups now run with background tasks
+  disabled.** Delegate sets `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1` and adds
+  `--disallowedTools Monitor`, because a headless child ends when the model
+  stops and a background task or Monitor dies with the session. As a long gate
+  must then run in the foreground, Delegate also sets
+  `BASH_DEFAULT_TIMEOUT_MS` and `BASH_MAX_TIMEOUT_MS` to the run's own
+  `--timeout`, never below two hours (a run with no `--timeout` gets two
+  hours), so Claude Code's 2-minute default and 10-minute maximum do not cut a
+  foreground command off. `claude.disableBackgroundTasks: false` turns all of
+  it off. An auth profile's `env` or a workspace `--env` cannot undo these
+  variables: Delegate keeps its own values and warns `profile env NAME
+  ignored` or `workspace env NAME ignored` when the value differed. Every
+  framed `work` and `safe` prompt also carries a two-sentence rule that ending
+  the turn ends the run and that long jobs must run in the foreground and
+  finish before the final message; verbatim slash pass-through prompts are not
+  rewritten.
+- **A finished run's scratch is now reclaimed on its own age.** Scratch, its
+  sidecars (for example mail-push engine homes), and the compact child temp
+  used to be removed only when the run record was pruned, so finished runs
+  kept their disk until then. The ambient retention pass now removes them for
+  terminal runs older than `tracking.retention.scratchDays` (default `3`; `0`
+  reclaims as soon as a run is terminal), keeps the run record, and stamps
+  `scratchReclaimedAt` and `scratchReclaimedBytes` into the run state;
+  `snapshot` shows both, and prints a `scratch reclaimed:` line in text.
+  `delegate runs reclaim [--older-than DAYS] [--dry-run]` does the same on
+  demand and lists sizes. Running, stale, and already-reclaimed runs are
+  skipped, and a run that fails is reported without stopping the others.
+  Reclaiming applies the recorded-path and ownership checks that pruning uses,
+  removes entries one at a time without following symlinks, and refuses a tree
+  that holds another owner's entry or crosses onto another filesystem. The
+  ambient pass spends at most 20 seconds, counted inside the walk and the
+  removal; a run it could not finish gets no marker, is reported as
+  `budget_exhausted`, and implicit reclaim then waits ten minutes before
+  continuing. `runs reclaim` has no budget or cooldown, and still works when
+  `tracking.retention.enabled` is `false`, which stops the ambient pass.
+- `--forbid-commit` now works in every isolation mode, including `--isolation
+  none`, which used to be refused; with isolation omitted it still implies
+  `--isolation worktree`. Delegate creates run-owned git hooks (`pre-commit`,
+  `prepare-commit-msg`, `commit-msg`, and `pre-merge-commit`) that refuse, and
+  points `core.hooksPath` at them through one variable,
+  `GIT_CONFIG_PARAMETERS`. Codex's default environment filter drops names
+  containing `KEY`, `SECRET`, or `TOKEN`, which left the indexed
+  `GIT_CONFIG_COUNT` form without its keys and broke every git command;
+  `GIT_CONFIG_PARAMETERS` survives it. The post-exit check stays as the
+  backstop: it fails the run if commits remain ahead of the creation base (the
+  HEAD recorded at launch for `--isolation none`) or if the checkout's own
+  HEAD reflog shows a commit made since launch and left behind, on a side
+  branch or reset away, for in-place and worktree runs. An unreadable reflog
+  with nothing found otherwise leaves the policy unverified, which also fails
+  the run. The hooks are a tripwire, not a wall: `git -c
+  core.hooksPath=/dev/null commit` or `git commit-tree` bypasses them, and the
+  post-exit check can be defeated on purpose too.
+- A mail send that reaches no inbox fails with `mail_not_delivered` (exit 1)
+  instead of returning `ok` with exit 0. The message names each recipient's
+  outcome and reason and states the eligibility rule, the diagnostics carry the
+  `msgId` and ledger rows, and the sent ledger is still written.
+- `--auth-profile` precedence (flag, then environment, then config default)
+  now selects the config file as well as the profile: `--auth-profile
+  work|personal` with an existing overlay selects `config.NAME.json`, its keys,
+  and the child's `AI_PROFILE`, and warns when that replaces an ambient
+  `DELEGATE_CONFIG` or a different `AI_PROFILE`. A flag whose overlay is
+  missing warns that the environment's config and keys stay in effect, and the
+  resolver warns when an inherited detection variable overrides the config's
+  `profiles.default`. The profile shim now finds the flag anywhere before `--`,
+  keeps the last occurrence, and strips whitespace, as the Python parser does.
+- Errors point at the command that does what was asked. `runs`/`ps` given a
+  run id, harness alias, `--id`, or `--alias` point at `snapshot` and
+  `run-output`; unknown `show`, `status`, `info`, `inspect`, `logs`, and
+  `output` subcommands suggest the per-run commands; `mail send --body`,
+  `--message`, and `-m` explain that the body is positional, `--file`, or `-`
+  (a bare `-` now reads stdin, as help already promised); and `followup` given
+  a resume-only option says the option belongs to `resume` and shows the
+  resume form.
+- **Exit-code semantics: a child's exit code 0 no longer means success on its
+  own.** One outcome function now decides every run's `ok`, `status`, exit code,
+  persisted record, `wait` result, and workflow `agent()` result, so these can
+  no longer disagree. A run now fails with a nonzero exit, and `ok: false`, in
+  three cases where it used to report success. The first is a tracked child
+  that exits 0 without assistant text (`failureKind: no_assistant_text`).
+  Before this change the tracked envelope said `ok: true` with exit 0 while
+  state.json said `ok: false`; call runs already failed this case and still do,
+  now with the same `failureKind`. The second is a tracked or call child whose
+  provider's last unrecovered error was a quota or 429 refusal
+  (`provider_quota`). The third is a tracked run whose `--expect-file PATH`
+  deliverable is missing (`deliverable_missing`). Scripts that treated exit 0
+  from an empty tracked run as success will now see exit 1. Every failed or
+  cancelled run carries `failureKind`, a closed enum listed in
+  `docs/cli-reference.md`. A missing `--expect-file` deliverable is reported as
+  `deliverable_missing` even when the run also produced no assistant text: the
+  verdict the caller asked for outranks the no-output label, and both fail the
+  run. Summaries from `runs`/`ps`/`wait` carry `failureKind` whenever the record
+  holds the key, `null` included, so a consumer that derives its verdict from a
+  summary agrees with the envelope instead of falling back to the older
+  result-quality veto (a quiet work run whose changes landed succeeded).
+- **A work run that changed files but ended quietly still succeeds.** A
+  tracked `work` or `followup` run that exits 0 without assistant text, while
+  its work summary shows changed files or commits, is `succeeded` with a
+  `no_assistant_text` warning, and the envelope carries the `workSummary` so an
+  orchestrator can adopt the work. Without changes the same run fails as
+  `no_assistant_text`. Safe and call runs are unaffected. Only persistent or
+  attached worktrees record a work summary, so a quiet run in any other
+  isolation still fails. Pass `--expect-file` for a stricter check.
+- Provider signals are classified from the final attempt only. On the tracked
+  and call paths, quota, provider-error, and unrecovered-error verdicts read
+  only the last attempt's own error events, last error message, and stderr, so
+  an earlier attempt's 429 no longer labels a later attempt that failed for a
+  different reason, and a final attempt's unrecovered quota error survives the
+  retry merge. The final attempt owns the provider terminal state as well: an
+  earlier attempt's `turn.cancelled`, max-turns stop, or refusal-coded failure
+  no longer decides a merged run whose retry or failover answered with text and
+  exited 0. The call path's empty-success retry now joins the thread-retry and
+  auth-fallback merges, so a first attempt's quota line cannot classify a clean
+  retry as `provider_quota`.
+- `wait` reports a running record whose runner process is gone (`staleReason`
+  `dead_pid` or `missing_pid`) as `failureKind: runner_lost` instead of
+  `stalled`. `stalled` is kept for the stall watchdog, which workflows retry as
+  transient; a lost runner is not retried.
+- Workflows: a structured `agent()` call whose work child changed its worktree
+  but returned no valid structured result is retried only by resuming the same
+  session and asking for the structured result alone. When the engine cannot
+  resume, Delegate does not launch a fresh child into that tree; the call fails
+  as `structured_invalid` and the `agent_structured_exhausted` journal event
+  carries the child's `workSummary`. Safe-mode children and work children
+  without changes keep the existing correction retry.
+- Tracked `safe`/`work` launches accept a repeatable `--expect-file PATH`. After
+  the child exits, Delegate checks the child's process group for members that
+  are still alive and records an `orphanedProcesses` warning before it
+  terminates them.
+- Call-mode JSON carries `assistantText`, `assistantTextChars`, and
+  `assistantTextTruncated` on every engine, the same fields tracked envelopes
+  use. `text`, `textChars`, and `textTruncated` stay for one release as
+  deprecated aliases.
+- Workflows: `agent(..., on_failure="typed")` returns a falsy `AgentFailure`
+  when structured retries run out. It carries the last parsed candidate, the
+  attempt count, `failureKind`, the run id, and the served model and provider;
+  the default is still `None`. The new globals are `agent_meta(label)`, which
+  exposes the child's outcome and served model and provider, and
+  `capabilities`, which lets a script detect these features. A failed child no
+  longer erases an earlier attempt's parsed candidate. A child that exits 0
+  without text now receives a structured correction retry. Structured parsing
+  tolerates raw control characters, including inside a prose-wrapped or fenced
+  answer: a candidate the scanner finds is decoded again with the stray
+  characters stripped before a quoted fragment of the damaged document can be
+  returned in its place.
+- Bundled Codex declarations move to the GPT-6 line. `gpt-6-sol` and
+  `gpt-6-luna` replace the `gpt-5.6-sol`/`gpt-5.6-luna` rows and `gpt-5.6-terra`
+  is dropped outright, verified against live `codex` enumeration on both the
+  work and personal profiles (2026-09-22): Sol carries `low`-`ultra` at a
+  `medium` default, Luna carries `low`-`max` at `medium`. The `pi` and `omp`
+  bundled selectors follow to `openai-codex/gpt-6-sol`, and the Codex discovery
+  fixture mirrors the live payload for the new slug. Doc prose that named
+  `gpt-5.6-sol` as the single bundled `max`-capable Codex model was already
+  stale and now names the bundled set (`gpt-6-astra`, `gpt-6-sol`,
+  `gpt-6-luna`).
+- Bundled Claude declarations replace `claude-opus-5` with `claude-opus-5-5`,
+  and the pinned-continuity error prose names the new id.
+- Bundled Grok declarations bumped to 4.7. The Grok CLI now ships `grok-4.7` as
+  its upstream default (bundled rows: `grok-4.7`, `grok-4.6`). Cursor's 4.7
+  ladder drops the `cursor-` prefix the 4.5/4.6 rows carried, so the bundled
+  Cursor rows and the fixed-effort selector table now name `grok-4.7-xhigh` and
+  `grok-4.7-xhigh-fast`; the still-served `cursor-grok-4.6-xhigh*` selectors
+  stay in the fixed-effort table. The Grok discovery fixture mirrors the live
+  `grok models` output, including `grok-4.7-build-fast`.
+- The skill-review preamble is explicitly bounded: read the served skill index
+  once, read only the skills judged relevant, and do not run discovery CLIs to
+  enumerate skills. The requirement stays mandatory; it no longer reads as an
+  open-ended discovery task.
+- `workflow reject`'s `agent_rejected` event records `rejectedBy: "coordinator"`,
+  and the workflow DSL `reject(key, reason, by=...)` accepts `seat`,
+  `merge-gate`, or `coordinator`. Emitters that declare nothing keep the legacy
+  event shape, so a missing `rejectedBy` means unknown, not seat failure.
+- A structured-output resume retry re-renders the target schema into the
+  correction prompt instead of asking the model to recall the shape; both GLM
+  review retries had rebuilt a root-array schema as an object wrapper and failed
+  again.
+
+### Security
+- Native Codex and Claude session files now persist for every work run,
+  because those runs are resumable by default. Codex's rollout under
+  `CODEX_HOME/sessions` and Claude Code's transcript under its `projects`
+  directory hold the prompt as sent, the child's replies, and tool inputs and
+  results (file contents the child read, command output). They live in the
+  harness's own store, outside `.delegate/`, outside Delegate's redaction, and
+  outside `runs prune` and the worktree cleanup commands, and Delegate does
+  not prune them. A profile with a separate `CODEX_HOME` or Claude config
+  directory keeps them in that account's store. Reduce the footprint with
+  `--no-resumable`, `codex.resumable: false`, or `claude.resumable: false`.
+  The untrusted-input boundaries are unchanged: safe runs, call runs (Claude
+  `call --pure` still passes `--no-session-persistence`), `--pass-through`
+  runs, other engines, and workflow children without `resumable=True` never
+  save a session.
+- **Work runs now have a write guard, on by default on Linux.** Work mode runs
+  the child with the caller's own filesystem rights, so one confused lane (`rm
+  -rf ~`, a stray redirect into a sibling checkout) could destroy things
+  nobody can recreate. The guard is a protect-list, not a home allowlist: a
+  named set of irreplaceable paths becomes read-only and everything else stays
+  writable, and reads are never restricted. By default it protects, each only
+  when it exists, the credential stores `~/.ssh`, `~/.gnupg`, `~/.config/gh`,
+  `~/.config/gcloud`, `~/.aws`, `~/.azure`, `~/.kube`, `~/.netrc`,
+  `~/.git-credentials`, and `~/.password-store`; `~/.ai-profiles`; the
+  installed Delegate runtime (`~/.local/bin/delegate` plus `~/.delegate/src`,
+  `releases`, `bin`, and `config*.json`); and the code root (`~/Code`), so a
+  lane in one checkout cannot write into a sibling. Inside those paths the
+  run's own needs are re-opened: the execution root, the git common directory,
+  the run registry, run scratch and compact temp, mail-push homes, and the
+  selected engine's home. `/tmp`, `TMPDIR`, and home caches such as `~/.cache`
+  are not protected. The guard never applies to safe mode, `--pass-through`
+  runs are not guarded, and it does not stop reads, network use, or use of
+  credentials already in the environment.
+- Backends and platform defaults for the write guard. On Linux the child runs
+  under bubblewrap (`bwrap --dev-bind / /` with each protected path bound
+  read-only), preflighted before launch; the execution root is bound as a
+  mount of its own so a lane cannot rename its checkout away, a new hard link
+  to a protected file cannot be made, and writes through symlinks to protected
+  paths are refused. **On macOS the Seatbelt guard is opt-in:** with
+  `isolation.writeGuard.macosSeatbelt` at its default `false`, the guard
+  status is `off` with no warning and no refusal, and setting it `true` opts
+  in to the `sandbox-exec` guard, which then wraps every engine except a Codex
+  lane whose own `workspace-write` sandbox is on (a Codex lane with its sandbox
+  bypassed is wrapped, and that combination is not yet live-tested). To keep the `external-sandbox` policy
+  profile but put Codex's own sandbox back for work lanes, set
+  `policy.harness.codex.work.bypassApprovalsAndSandbox` to `false`; Delegate
+  then emits `--sandbox workspace-write` with `--add-dir` roots for the git
+  common directory, registry, scratch, temp, `--writable` paths, and existing
+  home caches.
+- Configure and inspect the write guard with `isolation.writeGuard`
+  (`enabled`, `onUnavailable`, `macosSeatbelt`, `codeRoot`, `add`, `remove`,
+  `writable`, `homeCaches`; an unknown key or wrong type fails as
+  `invalid_isolation_config`), the `DELEGATE_WRITE_GUARD` environment variable
+  (`off`, `0`, `false`, or `no` disables, `on`, `1`, `true`, or `yes` enables,
+  and it overrides the config), and `--writable PATH` (repeatable, `work`
+  mode, CLI-only), which re-opens an existing path for one run. The plan
+  (backend, protected paths, and each re-open with its reason) is recorded in
+  the run manifest under `writeGuard` and printed by `--dry-run`, and
+  work-mode prompts gain a two-sentence note naming the protected paths so a
+  lane reports a blocked write instead of working around it. When no backend
+  is usable, `isolation.writeGuard.onUnavailable` decides: `warn` (the
+  default) launches unguarded and records a warning, and `refuse` fails the
+  launch with `write_guard_unavailable`. On Linux with `warn`, a bwrap
+  preflight that fails on one unbindable path drops only that path (listed
+  under `writeGuard.unbound`, with a warning) instead of the whole guard; when
+  a protected path was dropped the status is `partial` rather than `enforced`
+  and the warning starts "work write guard is PARTIAL". `refuse` never
+  retries.
+- Only the selected engine's own home variable (`CODEX_HOME`,
+  `CLAUDE_CONFIG_DIR`, `KIMI_CODE_HOME`, or that engine's default directory)
+  can re-open a directory inside a protected path, and only when it is
+  provably one profile. The home must itself carry an identity file
+  (`.claude.json`, `.credentials.json`, or `auth.json` beside `config.toml`),
+  and a bounded scan below it (three levels, no symlinks, at most 2000
+  directories) must finish and find no other profile's home. A parent of
+  profiles, a home that is itself protected, and a scan that hits the cap or
+  cannot list a directory are refused: the directory stays read-only, the
+  manifest lists it under `writeGuard.refused` with the reason, and the run
+  gets a warning. An engine Delegate has no home variable for (droid, for one)
+  gets no automatic re-open; name its profile directory in
+  `isolation.writeGuard.writable` or pass `--writable`. Known limits: a second
+  profile nested deeper than three levels is not found; a hard link that
+  already exists between a protected file and a writable name is the same
+  inode, so a write through it changes the protected file; and a protected
+  path that is itself a symlink is protected at its target while the link
+  stays replaceable.
+- A lane started through an estate launcher (`estate-claude`, `estate-codex`,
+  `estate-omp`, any program named `estate-*`) gets the profiles root
+  (`ESTATE_AI_PROFILES_ROOT`, then `AI_PROFILES_ROOT`, then `~/.ai-profiles`)
+  re-opened, recorded as "estate launcher writes profile state". The launcher
+  picks an account, refreshes its token, and writes session, plugin, and lock
+  state there on every launch, so protecting it stopped `estate-claude` before
+  Claude started. Those lanes can therefore write every profile's files; lanes
+  started any other way keep `~/.ai-profiles` protected, and a Codex lane with
+  its own sandbox on never gets it as a writable root.
+
 ## [0.31.0] - 2026-09-14
 
 ### Harness compatibility audit (2026-09-07)
@@ -1387,7 +2589,9 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
-[Unreleased]: https://github.com/treygoff24/delegate-agent/compare/v0.31.0...HEAD
+[Unreleased]: https://github.com/treygoff24/delegate-agent/compare/v0.33.0...HEAD
+[0.33.0]: https://github.com/treygoff24/delegate-agent/compare/v0.32.0...v0.33.0
+[0.32.0]: https://github.com/treygoff24/delegate-agent/compare/v0.31.0...v0.32.0
 [0.31.0]: https://github.com/treygoff24/delegate-agent/compare/v0.29.1...v0.31.0
 [0.30.0]: https://github.com/treygoff24/delegate-agent/compare/v0.29.1...v0.30.0
 [0.29.1]: https://github.com/treygoff24/delegate-agent/compare/v0.29.0...v0.29.1