OhMyOpenCode Files

Reading the end of a long session takes 42 ms and 68 MB instead of 40 s and 1.8 GB. session_read, session_search and session_info page through OpenCode's message API instead of loading the whole session: on a 23,000-message session, session_read with limit: 2, from_end: true dropped from 39.6 s and 1,848 MB peak memory to 42 ms and 68 MB, and a search that runs out its 60-second timeout now stops reading when it returns, where it used to read another 228 MB in the background (#10738, #10741).

OmO's extension no longer carries an LSP engine it never runs. The native LSP tools and post-edit diagnostics already go through the packaged LSP daemon, but the formatter's import pulled lsp-core's whole in-process engine into omo.js; importing only the helpers it uses shrinks the extension by about 82 KB, with no change in behavior. (#10659)

Every session start reads about 33 KB less of omo.js: eleven memory slash commands and memory sync's device account load on first use (#10902, #10860). The commands (/memory, /remember, /init, /recompile, /memory-repository, /sleeptime, /reflect, /dream, /search, /facts, /agreements) still appear at startup with the same names, descriptions and hints; their handlers load from extensions/omo-memory-commands.js. The signed-in device account loads from extensions/omo-device-account.js the first time a session resolves its sync, and if that file cannot load, memory sync reports sync-unavailable with the reason instead of looking signed out.

ulw-research ships a fact ledger, a fidelity state file and a claim index for research reports. They give each research run a machine-readable record of its facts and verified claims; nothing in the CLI uses them yet. (#11046, part of #11009; batch #11148)

Child-task, workflow and workpool wake sources report kind children. (#11114, part of #10782)

An unreadable workpool store no longer drops or falsely clears the children wake source. (#11118, part of #10782)

The children wake source reads the workpool store once per snapshot. (#11124, part of #10782) (batch #11148)

Child results waiting in the wake queue keep the parent from reading as done. (#11115, part of #10782)

The wake-queue count can no longer cost a delivery receipt and is re-published per session generation. (#11121, part of #10782)

A receipt that throws no longer leaves the wake-queue count up. (#11122, part of #10782)

Delivery receipts are isolated from each other, on retire too, and no receipt error is dropped. (#11123, part of #10782) (batch #11148)

A wake-queue flush settles each receipt and the child count once, and a throwing onReceiptError no longer stops the rest. (#11137, part of #10782) (batch #11148)

Windows helper tree kills are guarded against recycled parent PIDs. A QA helper no longer stops an unrelated process tree that reused a parent's PID. (#11007)

A task that a quitting session suspended says why it is still running. Quitting the owning session parks every live child, but the parked record kept its bare running status with no reason, so a restart that never resumed that session read as a running task that nothing would ever move. The quit shutdown now records session_quit on the parked record, which task_output and the task snapshot present as "resuming (session quit)", and a later resume whose reconcile defers the revival replaces it with the deferral's own reason. (senpi#3493, #10533, thanks @Bearmancer)

A project's skills can no longer reach outside the project, and their MCP servers no longer get your whole environment. A skill link in a project that points outside it is refused, and the reason shows in the skill tool's result and in OpenCode; links into skill folders you configured yourself still work. MCP servers that come from a project's skills start with a small safe base (paths, home, temp, locale, CA paths) plus the variables they declare. When one asks for a variable it didn't get, the result names it with the exact /omo-mcp-env-grant command that saves the grant for that server declaration; only names are stored, in the same file the engine uses. Skills you installed yourself, including paths in your global OpenCode configuration, keep today's environment. Task discovery keeps nested reference documents out of skills and allows links between packages in the same repository. Unreadable or missing skills report their actual file error rather than a security block. Replaced or evicted grant commands expire, and reopening the server provides a fresh command when needed. (#10716)

Computer use explains a refused macOS launch context instead of reporting a closed engine. Initial activation and later restarts now report COMPUTER_LAUNCH_CONTEXT_REQUIRED with recovery instructions when the actual engine child refuses to start. Permission errors, desktop handover, and the native launch gate keep their existing behavior. (#11073, #11086)

Thread tools check that an RPC host is the one they selected before changing a session (#10712). The client proves the host's key with a challenge-response and attaches the selected session by its durable id on the same connection, so a host that reused a routing id cannot receive another session's mutation. A draining host answers with a retryable host_draining error instead of failing the call, and a change that took effect is never reported as failed.

The build now records which files each bundled artifact is built from. packages/omo-senpi/bundle-inputs.json lists every repo file the generators of the committed bundles read. The list is traced from the recipe itself, and CI checks that it is current. Merge tooling can now tell that a skill-only change leaves the bundles untouched (#11079, #11084).

A session with telemetry off clears leftover session summaries as soon as it starts. Summary files a crashed session left behind used to stay on disk until a later session with telemetry on picked them up. A session with telemetry off now deletes them at startup when omo.json turns telemetry off for their project; an opt-out set only through an environment variable such as DO_NOT_TRACK applies to that session alone and leaves other sessions' summaries in place. Turning telemetry off in omo.json takes effect on the very next turn instead of up to five seconds later. A summary whose project cannot be told apart is never sent. (#10234) (#10267) (batch #11148)

Session summaries survive a crash at any step and are never counted twice. Each summary window now has its own id, sent as the event id, and is written to a local pending file before it is sent; the file is deleted only after delivery is confirmed, and a later OmO start re-sends anything left over under the same id. A window left open by a killed process is sent once, only after that process is gone and its once-a-minute heartbeat has stopped for 5 minutes, so a sleeping laptop keeps its own window. The session sequence survives restarts and counts within a random per-run summary_epoch, and a session continued or recovered by another process starts a new one, so two processes writing one session never send the same (epoch, sequence) pair even when one of them is wrongly taken for dead, costs are added as whole 1/10,000 USD units (cost_1e4) so summaries and raw turns agree exactly, and dropped_events counts what had to be discarded after 14 days. telemetry.rawTurnSampleRate (or OMO_TELEMETRY_RAW_TURN_SAMPLE_RATE) sets the share of sessions that also send raw turn rows, 0.05 by default. (#10198, #10225) (batch #11148)

Every session event says whether it came from a session you opened or one OmO spawned. session_started, turn_completed and session_summary carry session_role (root, child or unknown), so a delegated child's usage is not counted again on top of its parent. (#10198, #10225) (batch #11148)

Raw turn rows keep the name of a public model reached through your own gateway. turn_completed masked the model to custom whenever the provider was not one OmO ships, while session_summary and every other event already kept a published model id regardless of the routing provider. The gateway name itself is still never sent. (#10198, #10225) (batch #11148)

Plan review keeps working after a restart or a restored session (#10558). plan-consultant and plan-reviewer only spawn after you asked for ulw-plan and a plan file exists. That state used to live only in memory, so after a restart, a desktop restore or a resumed session the gate was empty and plan review was refused until you asked again. The gate is now rebuilt from the session's own transcript when it starts: plan file reads and writes count again, and a request counts only when the engine recorded you typed it (senpi 2026.10.21-2 and later), so text injected by an extension still never opens it. State handed over by a reload is kept as well (#10378).

The engine moves to senpi 2026.10.23-1: scheduled prompts and /loop ticks reach an open session mid-turn, the footer shows what subagents spent, and compaction works again on very long sessions and turns (#11126). A scheduled prompt now arrives in its open session, steered into the running turn when the agent is working, and a /loop tick that comes due mid-turn is read at the next step. Each session remembers the thinking level per model. Stop pauses the session until you type or /resume. An HTTP MCP server with no saved sign-in no longer freezes the process for up to 30 seconds, a background usage check no longer locks a healthy Claude login on a network error, and a models.json entry without a price keeps the built-in price instead of billing $0. The built-in /llama llama.cpp integration is removed upstream; a saved llama.cpp provider is ignored.

Bun-installed omo keeps its command links intact so later upgrades can succeed. Launches still start directly on Bun, and a new-version launch restores older generated wrappers to symlinks. This fixes recurring EEXIST failures on Bun 1.4.4; the first upgrade from an old wrapper may need the one-time removal described in the PR. (#11024)

The engine moves to senpi 2026.10.21-3: long 1M-context conversations stop re-writing their cached prefix, Anthropic subscription context is counted once, and "No credential slots available" no longer locks every account out (#10965). When context reduction trims a long conversation on a 1M window, the reduced prefix now stays identical and keeps its cache checkpoint, so each step writes only what changed. Anthropic subscription turns with internal SDK re-requests no longer double the context percentage or start compaction early, and a configured compaction model now does threshold, speculative and idle compaction while your session provider is healthy. The subscription lane is the only layer that picks its accounts, so one revoked or briefly rate-limited account no longer blocks the rest until you log in again. Every turn end says what happens next, a turn-end report names the hold your queued message released, the trailing "Anything else? (optional)" card is gone from clients without native questions, and moving a session between machines runs through one implementation. Forced recovery after a context overflow no longer picks the same compaction cut again when an invisible entry leads the session; an overflow still never moves a task to its next fallback model.

Tasks honour a -fast model alias that the provider config pairs with a model. Kibitzer no longer stops at a model whose start is refused; it falls back to the next one. (#10538, fixes #10536)

Child startup failures keep their cause. When a task child exits while the parent writes to stdin, its own typed failure is reported instead of a broken-pipe error. (#11097, fixes #11096)

The side panel says, once, that its column needs the fullscreen TUI. side_panel.enabled renders its right-hand column only in the fullscreen TUI (--tui-mode fullscreen, or tuiMode in senpi's settings); in the default regular mode the sections stay a block above the editor. The docs now say so at the top of the side_panel table, and the first regular-mode run with the panel on shows a one-time notice naming both ways to switch. (#10560, #10565)

A background task that wakes itself up, or reconnects after the task host restarts, keeps the right finished/running mark on the host (#11094). A task that started a new run on its own just as its previous turn finished could stay marked as finished, so a replaced task host might drop it while it was still working. A finished task whose host restarted could lose its finished mark, so the new host might reopen it. Both now keep the correct mark. (#11092)

The side panel shows subscription usage when you are signed in but the engine is serving through an environment token (#10564). It used to show nothing in that case; it still never shows a different signed-in account's numbers. (#11101)

The one-line Linux installer picks the glibc build on glibc hosts that also have the musl package installed. install.sh used to treat any /lib/ld-musl-*.so.1 loader as proof of a musl system, so Debian or Ubuntu hosts with musl-tools or musl-dev installed downloaded omo-linux-x64-musl and recorded it for later updates. A glibc host (one where getconf GNU_LIBC_VERSION answers) now always gets the glibc build. The musl check also reads ldd --version in a way that still matches under pipefail, since musl's ldd exits 1 after printing its version. (#10562, #10612)

bun run lint runs the copy check again, and Bun no longer warns on every process in the repo. The root package.json had two "lint" scripts after a merge, so the copy check was silently skipped and Bun printed a "Duplicate key" warning to stderr each time it started, which failed tests that expect a quiet child. One lint script now runs both checks, and a test rejects repeated keys in any package.json. (#11108)

Memory notes keep their exact line endings on Windows. Git for Windows converts line endings by default, so a note committed with LF or mixed endings came back with CRLF in a reflection worktree, and the description preflight that must keep every non-description byte failed there. Every memory repository now pins core.autocrlf=false, and opening an older repository restores only the working copies whose sole difference from the committed note is the converted line endings. (#11112, fixes #11109) (batch #11148)

Memory reflection and dream runs trim oversized note descriptions before completion validation. The note body is preserved, instead of the run failing again and again and parking the identity. (#10999)

The frontend skill now decides what a screen leaves out before drawing it, and visual QA proves a redesign improved and stops after a few rounds (#11023). Before code, every screen names one primary action, its information priorities, what it leaves out on purpose, and the content it must keep; after the draft renders, a subtraction pass removes what the user does not need and checks nothing required was dropped or merged. Small changes now read the project's design file and at most one reference instead of the whole library, and atmosphere and award-grade styling are built only when the brief asks. Visual QA gains a before/after mode that captures fixed cases before the first edit and compares them side by side, and its review loop now ends after 2-3 rounds: layout, function, accessibility and missing-content defects earn another round, taste notes are recorded and stop it.

Computer use refuses input while the stop chord cannot be heard. On macOS, a password field or Secure Keyboard Entry turns on Secure Event Input, which hides key presses from the stop chord's listener; computer use kept running anyway, so the chord could not stop it. Input is now refused with StopPathUnavailable (secure-input-active) until secure input ends, and resumes by itself. A type in progress now stops at the next character when the stop path stops authorizing input, instead of finishing the text, and the Linux X11 listener refuses to arm on an XInput 2.0 server, where a keyboard grab would swallow the chord. Plain Esc stays an ordinary key. (#10534, #9651, #10537)

The frontend draft guard now catches promotional copy, emoji icons, hype badges and vanity stats, not only accent stripes (#11022). One command, check-draft-guard.ts, runs the accent-stripe rules plus four checks on visible markup text: promotional filler in English and Korean copy, an emoji used as an icon, a badge whose only content is a hype label such as "New" or "AI-powered", and a stat tile holding a marketing-form number such as "10x", "500+" or "24/7"; a measured figure such as "42%" or "1.2k" passes. Code (TypeScript generics and comparisons included), scripts, styles, comments, hidden elements, bound values and badges that carry a state attribute are not flagged. React component tags such as <Badge> and <Stat value="10x">, cn() class lists, and announced attributes such as aria-label and placeholder are checked too. The frontend and visualize skills now run it before visual QA in place of check-accent-stripes.ts, which still works on its own. Both commands now skip a dangling symlink in a scanned folder instead of crashing, and report an unreadable path given on the command line with exit 2.

A memory sync that stops working now says so in the TUI, with what to do. When a sync cycle failed, the error went only to the log, and the status kept reporting the last successful sync. Now the memory footer shows sync blocked while sync is failing, and one notice says why and what to do: /memory unlock <path> for a git lock left behind by a crashed writer, sign in again for an expired sign-in, or check your connection when the sync service cannot be reached. A single dropped request still retries quietly; the offline notice appears only after three failed cycles in a row. When sync recovers, a notice says so and the footer clears. (#10637, #10958)

Store extensions can expose session-callable ops as real tools, and their worker no longer drags a schema library into every store. A store extension's sessionCallable declaration can now carry a toolName, description and JSON Schema parameters per op: the session's engine registers it as ext_<extension>_<toolName>, the tool takes the calling session's durable id from the engine (never from arguments), and the worker stamps caller_session_durable_id and, when the caller thread_create'd the target, caller_created_target inside the op's own transaction. Args naming either caller field are refused before validation; the public extensionCall channel refuses every declared session op. The worker validates op arguments itself against a JSON Schema subset (type, properties, required, additionalProperties true/false, enum, const, pattern, length/item/number bounds, items, anyOf), and register() refuses any other keyword, so no constraint is skipped - which also removed typebox/value from the store worker: its bundle drops from 206 KB to 115 KB and every worker spawn (and idle-retire respawn) stops paying for its module graph. A declared await with statusOp/expireOp/timeoutMs arms a wake-file wait, and thread_creations records who created which session durably across host restarts. (#9551)

Product copy uses clearer punctuation instead of em dashes (#10994). Agent prompts, notices, memory recall openers, and web metadata now use commas, colons, or parentheses, and an empty-value placeholder uses a hyphen. A source AST check prevents new em dashes in product strings, template elements, and JSX text while leaving comments, regexes, tests, generated code, and vendored sources alone. The same check now requires lint and TypeScript suppressions to explain why, inline or in the comment directly above, including Biome ignores.

Inside OmO Desktop the browser skill works as in the terminal, plus the app's built-in browser. The agent's browsers (your own through BrowserSkill, or one it starts itself) are no longer refused or changed inside the app, and connectBuiltinBrowser() adds the thread's tab in the app's built-in browser, which you can watch beside the chat (#11066).

A session in the OmO desktop app's Built-in browser mode can ask the app for its in-app browser. The browser skill told the agent to use the app's in-app browser tools, but an OmO session had none, so agents reached for whatever outside browser the machine had (sisyphuslabs/omo-desktop-app#3292). A new eval-only omo_desktop_toolkit tool asks the app for a toolkit it hosts for the session's thread, and connectBuiltinBrowser() in the browser skill uses it to attach OmOWright to that thread's tab. The app's grant names a loopback endpoint and a token file, so the token never appears in a tool result; an app that offers no toolkit is answered at once, and one that does not answer within 15 s gets a timeout. Works once the desktop app ships its side. (#10602, fixes #10601)

Parked facts leave the active queue without losing their contents. Existing backlogs migrate once, manual retry restores them, and turn-end scans read only active entries. (#11038)

The side panel's usage section reads the subscription limits the engine already keeps, so it shows the same numbers as the desktop, before the first turn, and makes no network request of its own (#10553). senpi now polls each signed-in Claude and ChatGPT subscription itself ([code-yeongyu/senpi#3687](https://github.com/code-yeongyu/senpi/issues/3687)); the panel only picks the serving account and draws its record. A rotation to an account the engine has not read yet shows nothing rather than the previous account's numbers. side_panel.usage_poll_seconds is retired: still accepted, now ignored.

A finished background task no longer wakes up on its own after the task host restarts (#11083). A task that ran on the shared task host kept its session loaded there after it finished, with nothing saying it was done. When the host was replaced, the new host reopened it, and the task's own follow-ups could run again with nobody watching, spending usage. The task now marks its session as finished on the host as soon as it finishes, and again before it lets go, so the new host leaves it closed even if the parent session crashed. A finished task you continue with task_send is marked running again before your message is delivered; a dropped connection that reconnects does not change the mark. (#10778)

The web-terminal visual QA driver can wait for text before it types. A slow-starting TUI used to lose its first keystrokes to the fixed start delay. Put {WaitFor:<text>} in --input and the driver polls the rendered xterm buffer until <text> appears, then continues; if it never appears within --wait-for-timeout-ms (default 10000) the capture fails with an error naming the text and the timeout, and an empty {WaitFor:} is refused. Thanks to @cynkai. (#9583, #9666)

git-master credits sisyphus-dev-ai on its commits again, once per commit, and you can turn it off. Every commit git-master writes ends with Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>. Git adds the trailer itself (git -c trailer.ifexists=addIfDifferent commit --trailer), so amending or rewording a commit that already carries it keeps a single copy, and after a squash git-master rewrites the joined message once. This needs git 2.32 or newer. git_master.include_co_authored_by in omo.json is a working switch again and defaults to true; set it to false to leave the trailer out. The commit footer stays opt-in, your own git author and committer are unchanged, and the GIT_MASTER=1 prefix applies to the commit command as before. This works the same in the Native harness (reading the skill or load_skills) and the OpenCode plugin (#10713, #10715).

The count of undelivered messages matches the messages actually dropped (#10987). When a stopped parent cancelled a task, or a task that could not be resumed was closed, its queued messages were dropped with a note saying how many. That count came from a read taken just before the queue was cleared, so a message sent in between was dropped without being counted. The count now comes from the same write that clears the queue. (#10866)

A relaunched task records its own session id, not the previous run's (#10985). When a task restarted on a new transcript (a model fallback or a revive) and its new session's first state read failed, the task kept the previous run's session id, so anything that looks a task up by its session id, such as the task tree or the cleanup when a parent stops, found the old session. The first id the new run learns now replaces it. (#10892)

The footer shows what your subagents are spending, live, next to the session's own cost (#10730). The session cost only counted the session itself, so the number stood still while subagents worked. The footer now adds the whole subagent tree's spend as (+$X), including nested children and revived runs, and updates as tasks report instead of polling ([code-yeongyu/senpi#2471](https://github.com/code-yeongyu/senpi/issues/2471)).

Subagent rows no longer show $0.0000 when the provider sent no usage (#10727). A turn whose provider streamed no usage block came back with an all-zero usage, and the task row counted it as a real $0, with no tok/s. Such a turn now counts as "cost not reported", so the row shows no amount, and a run where only some turns reported a cost is marked partial (#10724).

Internal: a telemetry spool lock this process could not delete no longer blocks its batch until the 14-day age limit. After a transient file error (for example on Windows), the sweep reclaims the lock once the claim lease has passed, while a lock for a move still in progress is kept (#10951).

Internal: every assistant turn opens one omo.turn OpenTelemetry span, and events emitted during the turn carry its trace and span ids. On a transport with a span sink (the OTLP collector transport; the PostHog transport has none) the Senpi adapter starts the span at turn_start and ends it ok, or error for a failed or abandoned turn, so a turn_completed row, its span and an error event join on the (trace_id, span_id) pair. A process child launched by the task engine continues the delegating turn's trace. The traceparent header goes only to our own hosts, never to a model provider, and nothing is started or written while telemetry is off. (#10358)

Internal: the telemetry spool recovers and bounds itself on every sweep, and a stalled sender never re-sends a batch it lost. Every live collector transport sweeps the spool on start and every 60 s: it recovers expired claims and the files of dead processes, applies the 5 MB cap to everything in the directory (not only to what it sealed itself), and replays oldest first; when consent has ended the sweep deletes the spool instead. Before every send attempt the sender renames its claim to a fresh lease, so a process that stalled past its lease and lost the batch to another process stops instead of sending it again, and a batch claimed when consent is withdrawn is deleted unsent. Nothing is wired to a product yet. (#10355)

The engine publishes its OpenTelemetry schema artifact. telemetry-schema.json describes exactly what an OTel client of the engine may send, generated from the event schemas and kept byte-exact by a drift gate, so the telemetry collector can pin and enforce it. It is separate from the anonymous PostHog events, which are unchanged (#10980).

The frontend skill picks a layout pattern for every layout change, and visual-qa checks it. Any change to a screen's structure (a new region, panel, split, list, sticky bar or scroll container) now fetches the matching StyleGallery pattern and writes one Layout: line in DESIGN.md naming the pattern, the element that owns the scroll and the pattern's anti-patterns, including in a project that already has a DESIGN.md. visual-qa's new A12 item checks the build against that line, with a probe for the element that really scrolls. Apple HIG hit targets, hierarchy, states, keyboard and motion are now rules for the first draft in the frontend skill, not only items in the QA checklist. (#10684, #10685)

New TypeScript and JavaScript projects default to oxlint and oxfmt. The programming skill now ships strict OXC configs and the t3code copy rules: product strings, templates, and JSX reject em dashes, and lint/type suppressions require an explanation. Existing repository toolchains are respected. (#11030)

Account commands no longer repeat a failed keychain operation while reporting the error. A native storage failure or timeout now returns exit 9 with {"error":"store-unavailable"} instead of attempting another store read, which could add a second 25-second wait. Existing success and locked-keychain outcomes are preserved; no new deadline or lock change is introduced (#11040, #11049).

A removed device ends its local account session on refresh. When the service refuses a renewal with device_revoked, omo account token clears the saved credential and returns exit 5 with that code; omo account show then reports signed out. Unknown refusal codes still retain the credential as uncertain (#11041, #11048).

Project memory reads work on Windows when a path uses a short user-directory name. Read grants now compare native canonical paths on both sides, accounting for Windows case and separator differences without granting sibling memory repositories. A granted repository that is later replaced by a link elsewhere is no longer covered, and a note that does not exist yet is still allowed so the read can report it missing. (#10982)

Each model family's current default is named once. Every builtin default, fallback rung, category gate, Claude Code alias and migration target that means "the newest Opus / Sonnet / Haiku / Fable / GPT / GLM / Kimi / Gemini" now reads its id from one table, so the next model bump is one edit. Resolved models stay the same, with one exception: the Claude Code sonnet alias now means the current Sonnet (claude-sonnet-5-5) instead of claude-sonnet-4-6. (#10483, #10141)

A builtin model profile can run on your own provider. When the only provider serving a profile's model is one you declared in models.json (for example an API-key proxy serving claude-opus-5-5), Daily · Normal and the other builtin lanes now pick it instead of reporting that no model is available. Only the models you declared for that provider count, the lane's own providers still come first, and gateways you never declared still never serve a builtin lane. Reported by 채완. (#10493, #10485)

/mass-ulw and run mass ulw ... now enter the mode instead of offering a pointer the model could skip. The slash command (/mass-ulw, /mulw, /ulw-research) or a prompt that starts with run, start, use, do or execute followed by the keyword (run mass ulw research on <link>; in Korean, mass ulw 돌려줘 or 실행해줘) now carries a binding instruction: read the skill before any other tool call, and run mass-ulw as workflow runs. Before, the hint asked the model to decide whether you meant it, and in a real run it skipped mass-ulw and started no workflow. Any other mention, including a prompt that only ends with mass ulw research or asks a question, still gets the hint, and quoted, relayed, negated and delegated mentions never arm it. A single-quoted name ('omo-senpi ultrawork ...') and a relay header naming several recipients ([a -> b + c]) now count as quotes and relays for ulw too, so they no longer arm ultrawork (#10810, #10822).

A session can consult the memory of a project it touches. The first successful read, edit or write under a child project with existing memory lists its note paths and descriptions, without injecting note bodies. Linked projects in a non-git workspace and linked worktrees follow the session's auto_identity mode. Kibitzer ranks up to three recently touched projects separately from the session's own notes, reserves up to half its seats for them, and uses the same persisted search-term cache for each repository. Project notes receive read-only grants; their system/ tree, git metadata, writes and enumeration remain denied. Both memory.project_scope.nudge and .recall default to true and can be disabled separately. (#10044, #10921)

omo.json can say which workspace a session belongs to (#10852). provenance.workspaces lists workspaces by name with optional git_owners and paths; messages between sessions use it to show where the sender works (#10794).

Messages between sessions start with the sender's workspace and project (#10853, #10794). The sender's environment, git owner or configured paths decide it, never the message text; older stored messages say provenance was not recorded (#10794).

A memory git command that hangs past its timeout can now leave evidence behind. With OMO_GIT_TIMEOUT_DIAGNOSTICS_DIR set, a timed-out git records the running process table (and on Windows the stuck git's thread wait states) in that directory before it is stopped; unset, nothing changes. Windows CI uses it to diagnose a rare stalled git add. (#10821, #10914)

Stopping a task no longer risks matching a task with the same id from another task store (#10903). When a task's session shuts down, it finds its own task by the task id in its session context. Task ids are unique only within one task store, so that id is now trusted only when the session's state folder is exactly this store's folder for that task; otherwise the session falls back to matching by its session id. (#10881)

Anonymous usage stats now count each person once. The anonymous id is kept once per user instead of per agent directory, so runs that use their own agent directory, and the CLI next to OmO Desktop, no longer show up as separate people; runs in CI, under a test runner, or with a temporary home directory send nothing by default (OMO_TELEMETRY_ALLOW_AUTOMATION=1 opts back in). This also holds on Windows: a temporary home folder there is recognised too, a home folder that cannot be found turns usage stats off rather than on, and a real profile under the users folder is never treated as temporary. On some machines the anonymous id changes once with this update (#10935).

Refused child tasks report startup failure without waiting for slow teardown. Shutdown still waits for pending cleanup (#10988, fixes #10402).

Fixed

• Memory facts extraction no longer loops until its deadline when a model fills the optional person field on a project fact with an empty placeholder: the placeholder is dropped and the fact is recorded, while a project fact naming a real person is still refused. A model that resends a refused record_fact call unchanged now ends the run with the facts it already recorded, and a parked queue entry no longer holds back that conversation's later entries (#10918). (#10924)

• 1b6b9d0d6c test(telemetry): name summary files with "/" on every platform (#11171)

• 8fe953b367 chore(lint): lower the ratchet baseline for memory-core git/exec.ts (5 -> 4)
• 326ae00390 Merge remote-tracking branch 'origin/dev' into rs-5145
• bf748ed461 Merge pull request [#11148] from code-yeongyu/batch/memsync-coord-9
• efc8aa2197 docs(batch-9): changelog line for [#11046] (batch [#9] review LOW)
• a02bbb6a8c docs(batch-9): link the batch PR from every added Unreleased paragraph (changelog gate)
• 6f4eb05bc4 Merge remote-tracking branch 'origin/dev' into rs-5145
• 974374f73c chore(batch-9): regenerate generated artifacts after all cars landed (pair eed6ca13cdf8212d)
• 5011feb60c Merge omo#11145 @dcaa160efa into batch [#9]
• 1d6558bbdb docs(batch-9): changelog line for [#11137]; drop the duplicated [#11024] paragraph (batch [#8] review LOW)
• fe95a3e76a Merge omo#10267 @7a33d9e1b1 into batch [#9]
• 4a50fc2903 Merge omo#11137 @a66e7406f8 into batch [#9]
• fa4f71a00b Merge dev 9c44de3470 (batch [#8] merged) into batch [#9]
• 9c44de3470 Merge pull request [#11127] from code-yeongyu/batch/memsync-coord-8
• dcaa160efa test(memory): read the second launch's run by what it created, not by name order
• c218ea296a Merge batch [#8] head 474411c85a into batch [#9]
• 0b691dc50c batch8: merge [#10716] @6cca8b4ae5 (env-grants drift fold)
• 076ab2e614 Merge remote-tracking branch 'origin/dev' into b8
• a68c8cff6f Merge pull request [#10558] from code-yeongyu/fix/10378-plan-gate-replay
• de74e11791 Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
• 59183d4d2a Merge batch [#8] head df21ed05f4 into batch [#9]
• 943a2cd594 Merge remote-tracking branch 'origin/dev' into b8
• 6f8a2553a5 Merge pull request [#11132] from code-yeongyu/test/10402-start-refusal-ordering
• e8fd6052aa batch8: merge [#10712] @8786644d5f (win32 occupancy test fold)
• 8786644d5f test(rpc): released-host occupancy expects no probe frame on win32
• 368edf49c6 Merge remote-tracking branch 'origin/dev' into b8
• 40d260574b Merge omo#10225 @29d3ca4ca3 into batch [#9]
• a1d2aa0a28 fix(telemetry): the live QA keeps an env-only opt-out's hands off the queue; both purges fail closed without a cwd (#10234)
• e7dd81f54c Merge feat/telemetry-summary-crashsafe (29d3ca4ca3) into fix/10234-telemetry-optout-purge
• 42164bc85c docs(batch-9): changelog lines for [#11123]/#11124 and the per-batch measured bundle ceiling rule
• 1817b96ba7 Merge omo#11046 @05aaa355ad into batch [#9]
• ca49dd8891 Merge omo#11124 @c8c4c021e5 into batch [#9]
• 9ce24b7674 Merge omo#11123 @71ae4167b4 into batch [#9]
• e2fb287d56 Merge omo#11112 @5d94a4a064 into batch [#9]
• 123cc20fca test(telemetry): spool-bounds fixtures carry a cwd, since a record with no stored cwd fails closed (#10234)
• b21e168aaa Merge feat/telemetry-summary-crashsafe (b83dd2f130) into fix/10234-telemetry-optout-purge
• b83dd2f130 fix(telemetry): an unreadable session context never stops registration; schema artifacts carry session_role
• d2cbb62a52 Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
• 19e417f0c6 fix(telemetry): one opt-out purge, entry bundle first, sidecar only for liveness leftovers (#10234)
• b8560a2011 Merge feat/telemetry-summary-crashsafe (fe7783db49) into fix/10234-telemetry-optout-purge
• fe7783db49 fix(telemetry): turn spans mask provider and model independently, like turn rows
• 75d565f39c Merge origin/dev into feat/telemetry-summary-crashsafe
• 5d94a4a064 fix(memory): report a non-EPIPE git stdin error instead of dropping it
• 3b202fff37 chore(bundle): regenerate the bundle-inputs map for batch [#8] (bun run bundle-inputs)
• 88b5b1c550 fix(memory): an EPIPE on a git command's stdin never crashes the process
• 1a45afbe28 batch8: merge [#11084] @a49614b70f
• a49614b70f Merge remote-tracking branch 'origin/dev' into takeover/11084
• 1a62c298d2 Merge pull request [#11024] from code-yeongyu/fix/11019-bun-bin-ownership
• 595eb05d23 Merge branch 'dev' into fix/11019-bun-bin-ownership
• 430c439005 fix(memory): a rejected git call in the line-ending repair never fails init()
• 8beac35aeb chore(bundle): regenerate generated artifacts for batch [#8] at 6852f70f3c
• b6a37a7f88 chore(deps): regenerate the bundles on the merged dev
• 47f67b72b0 Merge remote-tracking branch 'refs/remotes/origin/dev' into HEAD
• 05aaa355ad test(ulw-research): type the ledger grammar and kinds property tests so lint:ratchet passes (Part of [#11009])
• 6852f70f3c fix(lint): drop the non-null assertions [#10712]'s tests add (batch [#8] integration)
• 8fe891713f fix(lint): drop the non-null assertions [#10716]'s tests add (batch [#7] integration)
• ab8046ed98 docs(changelog): batch [#8] [Unreleased] entries; drop the duplicated long-session paragraph
• 2e14a3b241 batch8: merge [#10712] @b580fae73a
• 7c31fecef4 batch8: merge [#11086] @640d2240c7
• 33f11c90e0 batch8: merge [#11007] @354d6fb235
• ea5fc87c96 batch8: merge [#10716] @e186191f55
• 4dda93df60 batch8: merge [#10533] @af5f15bf12
• af19255460 batch8: merge [#11122] @fdab5cb236
• e9c3ab3648 batch8: merge [#11121] @a3f874a80e
• 185a82cdbd batch8: merge [#11115] @e5c8b55fb4
• 7229e6b308 batch8: merge [#11118] @d4e7f6738c
• 5ab42d5486 batch8: merge [#11114] @3ffbafbca7
• c6da7b20e3 batch8: merge [#11111] @05b1711288
• b41b721b4c Merge remote-tracking branch 'origin/dev' into takeover/11084
• 0afffdcf0b Merge pull request [#11105] from code-yeongyu/batch/memsync-coord-7
• fde0dc8064 batch7: merge dev ac8e749031
• ac8e749031 Merge pull request [#9666] from cynkai/fix/9583-web-terminal-waitfor-token
• bd22aa9b39 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
• 9076304851 Merge remote-tracking branch 'origin/dev' into takeover/11084
• 0003dc736f Merge pull request [#11047] from code-yeongyu/feat/11009-t3
• f0b1149246 batch7: merge [#11038] @012e6e768e (test-only pollution fix)
• 012e6e768e test(memory): count facts entry reads with a per-test spy, not a module mock
• aa06aba123 chore(bundle): regenerate generated artifacts for batch [#7] at 1a1b87275f
• 67ac721742 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
• 65f99f8300 Merge branch 'dev' into fix/11019-bun-bin-ownership
• 2027acce68 batch7: merge dev 9cc6b1dde4
• af7536601e Merge remote-tracking branch 'origin/dev' into takeover/11084
• 0c3d01d379 Merge remote-tracking branch 'origin/dev' into fix/9583-web-terminal-waitfor-token
• 9cc6b1dde4 Merge pull request [#11120] from code-yeongyu/fix/11009-ratchet
• e186191f55 test(skills): skip the mode-000 containment case on Windows
• 1a1b87275f batch7: merge dev 0e2ed1ac99
• c8ee072a9b docs(changelog): drop the duplicated OpenTelemetry paragraph, unfuse two paragraphs, link [#10402] (batch [#7] review fold)
• 83ae04e5d9 docs(changelog): add the [#10538] entry (batch [#7] integration)
• 7805664966 batch7: merge [#10538] @500007ad35
• 10b1d45405 docs(changelog): link [#11101] in its paragraph (batch [#7] integration)
• 50a6e1dcf1 batch7: merge [#11101] @55fbc2c7ed
• d33cf90d93 batch7: merge [#11094] @13b44dd2cc
• 6139be87ca batch7: merge [#10565] @9347fee45e
• 2c3f62958c docs(changelog): fold the [#11038] and [#10988] "### Fixed" bullets into [Unreleased] paragraphs (batch [#7] integration; [#11038] review LOW)
• 353933b163 batch7: merge [#11038] @ec6378a304
• e2036b4e36 fix(ulw-research): drop the non-null assertions [#11045] added to two tests so dev passes lint:ratchet again (Part of [#11009])
• 4054064bf3 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
• 0e2ed1ac99 Merge pull request [#11050] from code-yeongyu/test/10972-accurate-teardown-comments
• 2b73ce9d67 fix(ulw-research): derive every per-kind ledger rule from one table that renders the grammar and drives the validator (review fold 6, Part of [#11009])
• e55fef2923 Merge pull request [#10976] from code-yeongyu/fix/telemetry-spool-recovery-test-full-proof
• e09c1e9b1b Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
• d62d16e423 Merge branch 'dev' into fix/11019-bun-bin-ownership
• e1cd57b233 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
• b41a4f7637 Merge pull request [#11037] from code-yeongyu/test/10925-dump-host-commands-on-relist
• abc39e2713 Merge remote-tracking branch 'origin/dev' into fix/9583-web-terminal-waitfor-token
• 297493afbd Merge remote-tracking branch 'origin/dev' into takeover/11084
• 028285e322 Merge remote-tracking branch 'origin/dev' into test/10925-dump-host-commands-on-relist
• 5d75beb058 Merge pull request [#11054] from code-yeongyu/feat/11009-t1
• 209041bfdc Merge remote-tracking branch 'origin/dev' into feat/11009-t1
• 3991737255 Merge pull request [#11045] from code-yeongyu/feat/11009-t2
• 1165be73e4 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
• 769bab36d2 Merge pull request [#11044] from code-yeongyu/feat/11009-t4
• 8dc166f15e fix(memory): the line-ending repair never fails opening a repository
• f88d445d56 Merge remote-tracking branch 'origin/dev' into feat/11009-t1
• 15179e2b9d Merge remote-tracking branch 'origin/dev' into feat/11009-t3
• bc14bed0c8 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
• c4120796b3 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
• f647997149 Merge remote-tracking branch 'origin/dev' into feat/11009-t4
• d669951cb8 Merge remote-tracking branch 'origin/dev' into feat/11009-t1
• c27c8b5e89 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
• 1a65a99280 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
• ae7bb96301 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
• 12b5d3b4f0 Merge pull request [#10612] from cynkai/fix/10562-installer-glibc-musl-detect
• f88fb6535c Merge remote-tracking branch 'origin/dev' into feat/11009-t4
• d613eeef62 Merge branch 'dev' into fix/11019-bun-bin-ownership
• 354d6fb235 Merge branch 'dev' into fix/helper-tree-kill-audit
• 5af19030c5 Merge pull request [#11043] from code-yeongyu/feat/11009-t17
• 74df4cb6a1 Merge branch 'dev' into fix/10562-installer-glibc-musl-detect
• cbfc39dc21 Merge remote-tracking branch 'origin/dev' into feat/11009-t1
• 624230bfe1 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
• 42a41b5f65 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
• 39e01d6bb6 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
• c5303c60bd Merge remote-tracking branch 'origin/dev' into feat/11009-t4
• 6f65a0fd1d Merge remote-tracking branch 'origin/dev' into feat/11009-t17
• af302c4bce Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
• 4878487076 Merge remote-tracking branch 'origin/dev' into test/10925-dump-host-commands-on-relist
• 1209d8ec71 Merge remote-tracking branch 'origin/dev' into test/10972-accurate-teardown-comments
• 86a7f79eac Merge remote-tracking branch 'origin/dev' into takeover/11084
• 1b19dd64cf Merge pull request [#11108] from code-yeongyu/fix/11106-duplicate-lint-key
• dcbb591bba fix(memory): repair converted copies that the stat cache calls clean
• 024c463dfb fix(lint): make dev pass lint:ratchet again (drop 4 files' non-null assertions)
• 66d450fefc docs(changelog): link [#11112] from its Unreleased entry
• 5ac9aa511a fix(memory): pin core.autocrlf=false in every memory repository
• 1379f7ea75 docs(changelog): note the single lint script (#11108)
• c82c1cf070 fix(ci): keep one "lint" script so bun stops warning on every child start (#11106)
• 8aa46e1e10 Merge remote-tracking branch 'origin/dev' into test/10972-accurate-teardown-comments
• b8a4e86af6 Merge remote-tracking branch 'origin/dev' into takeover/11084
• b41eda80e6 fix(lint): drop the non-null assertions the oxlint ratchet rejects (batch [#7] integration)
• 9347fee45e docs(changelog): move [#10565] entry back under [Unreleased]
• b3fddc6c81 batch7: merge dev 985654bd7f
• 985654bd7f Merge pull request [#11032] from code-yeongyu/chore/oxlint-phase1
• ec6378a304 Merge origin/dev (batch [#6], 1458e30d5e) into fix/11002-facts-parked-dead-letter
• 8f53dfa46d batch7: merge [#10988] @5bb22c3fa3
• 79a18b925d docs(changelog): link [#10602] and add the [#11097] entry (batch [#7] integration)
• 55fbc2c7ed fix(side-panel): show the env record for a stored login the engine serves by env token; drop dead retryAt (#10564)
• 054c563dd5 Merge origin/dev (batch [#6], 1458e30d5e) into fix/10560-side-panel-tui-notice
• 13b44dd2cc Merge remote-tracking branch 'origin/dev' into fix/11092-task-status-windows
• 385d9f249f batch7: merge [#11097] @b98cd82d3e
• 1c97c325f9 batch7: merge [#10602] @8208a551d2
• 1458e30d5e Merge pull request [#11095] from code-yeongyu/batch/memsync-coord-6
• a7c4fa04d0 docs(changelog): move the [#10562] entry under [Unreleased]
• 5e6526fd5f Merge remote-tracking branch 'origin/dev' into takeover/11084
• 3e00fef166 batch6: merge dev 7415dc0074
• 7415dc0074 Merge pull request [#11023] from code-yeongyu/feat/frontend-skill-redesign-11021
• c6fbbd680d chore(bundle): regenerate generated artifacts for batch [#6] at f9c3d39442 (re-cut without [#11085])
• 39fd171694 Merge branch 'dev' into fix/10562-installer-glibc-musl-detect
• f9c3d39442 fix(batch6): car x dev semantic interactions found by the full receipt
• 9e156955b8 fix(copy): exempt the OXC em-dash rule's own EM_DASH constant (batch [#6] integration)
• 005e9534bc batch6: merge dev d127625784
• c5a69f5482 Merge remote-tracking branch 'origin/dev' into feat/frontend-skill-redesign-11021
• 8324e0b1e0 Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
• d127625784 Merge pull request [#10537] from code-yeongyu/fix/10534-stop-path-deaf
• 131dc25bda fix(visual-qa,frontend): restore [#10685]'s scroll-owner probe and host-unreachable form
• 10c9bef105 test(skill-loader): assert resolved skills equal their templates, not frontend prose
• 90be6615db Merge remote-tracking branch 'origin/dev' into takeover/11084
• 292cc3b7dc Merge remote-tracking branch 'origin/dev' into fix/10534-stop-path-deaf
• 8208a551d2 fix(browser skill): a grant without an endpoint is invalid_grant; concurrent refreshes share one acquire (#10601)
• c3957a747e Merge origin/dev into feat/frontend-skill-redesign-11021
• c8291c156b Merge pull request [#11022] from code-yeongyu/feat/frontend-slop-lint-11021
• 994c0b9c60 Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
• 304f6831ed docs(changelog): note task_status windows fix (#11094)
• 4664dbba63 fix(browser): honor refusals and refresh grant endpoint
• 779fd13caa fix(memory): a parked/ read error fails enqueue instead of moving the anchor
• e9a7c58867 batch6: merge [#11083] @df67b8b2c8
• 3f87932573 refactor(ulw-research): one ledger grammar for validator and writers, with property tests (review fold 5, Part of [#11009])
• 90899ad426 Merge remote-tracking branch 'origin/dev' into takeover/11084
• e62aa0e5a4 fix(memory): the facts enqueue anchor also reads parked entries
• a3b7de6548 batch6: merge [#10553] @aa8c571772
• 33859d058f docs(changelog): move [#10999] out of the released [5.1.44] into [Unreleased] (batch [#6] integration)
• cb428c82ea docs(changelog): link [#11051] in its paragraph (batch [#6] integration)
• 6c1c17f776 batch6: merge [#10659] @22ea00b40d
• 47ee158f06 batch6: merge [#10994] @af359db6d7
• 2ddec23b07 chore(lint): ratchet baseline drops dev's removed non-null assertions (new-project.ts)
• dae02801ae batch6: merge [#10999] @2e7be0f373
• 78d7f327e7 batch6: merge [#11051] @1de267b2a0
• f4b14aa60f Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
• c86e8b6f87 fix(lint): fold [#11032] review: no-string-case-mismatch reads source text like Biome; web no-console allows warn/error; array-callback-return covers useIterableCallbackReturn
• af1e61ae21 batch6: merge [#10458] @e4b544c017
• f949c20bcb batch6: merge [#9551] @590077f426
• 43d9f80f6c fix(omo-native): resolve symlinked Bun bin directories
• 640d2240c7 Merge remote-tracking branch 'origin/dev' into fix/11073-launch-context-error
• 985989bcb0 docs(changelog): link launch context draft PR
• cb44a04e77 fix(computer): report actual child launch refusal
• 2af6ae297e Merge pull request [#11074] from code-yeongyu/batch/memsync-coord-5
• d8ca67f141 test(computer): verify chunk ordering and command recovery
• 3234ce39ff fix(ulw-research): verified claims need a list marker; supersede needs a replacement (review fold 4, Part of [#11009])
• 004275ccc6 test(doctor): preserve native launch refusal reasons
• 52f7dd780b Merge remote-tracking branch 'origin/dev' into fix/10534-stop-path-deaf
• f61fde1b0e docs(changelog): note the traced bundle-inputs map (#11084)
• 87a4771ccc test(computer): require the native refusal exit code
• 48d6cd2aba docs(frontend): say the styled sibling stands in for DESIGN.md under the small-change rule
• 198b7261e3 test(computer): cover actual child launch refusal
• a32a585c73 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
• eee5cd1f1f docs(changelog): note task_status publish for finished host tasks (#11083)
• 7839784958 Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
• 013d6d5b66 chore(bundle): regenerate generated artifacts for batch [#5] at 28fff56aab
• 3daf04154a fix(ulw-research): keep Korean quoted speech in one sentence (review fold, Part of [#11009])
• 39791a016b refactor(ulw-research): split fact ledger validation into fact-ledger-schema (review fold 3, Part of [#11009])
• 1eb17098e5 fix(codex): exclude tests from marketplace sync
• a4ae7267ff fix(ulw-research): tolerate trailing whitespace and reject duplicate blocks in the fidelity brief parser (review fold, Part of [#11009])
• c6361e6d0f chore(bundle): regenerate generated artifacts for batch [#5] at 42eb820c71
• a6879556d8 fix(frontend): read TSX const generics and nested attributes as code
• aa8c571772 chore(bundles): regenerate after merging dev
• 42eb820c71 docs(changelog): fold the two [#10935] paragraphs into one (batch [#5])
• 54d672c977 batch5: merge [#11049] @88c7a760d1
• 515a0cdca3 batch5: merge [#11048] @25ee090afb
• 85da286290 batch5: merge [#10961] @0bef58aa1f
• 56d8a986b1 Merge origin/dev into fix/usage-panel-reads-engine-limits
• 2389bab47f batch5: merge [#10971] @eb620ae21d
• 85a65c2bbd batch5: merge [#11030] @225f62eb99
• 6d6d94fb1a batch5: merge [#10685] @0b68bd8661
• 72bf8216ec Merge pull request [#10953] from code-yeongyu/batch/memsync-coord-4
• 18fd8aa590 fix(ulw-research): bound the verified-claims section and validate ledger events (review fold 2, Part of [#11009])
• 7c1106c40e Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
• f3c142b6f2 fix(frontend): read attribute names, not values, in the draft guard
• 9eea54f8d9 Merge pull request [#11066] from code-yeongyu/fix/4227-browser-guard-routes
• a8ada69b94 fix(ulw-research): parse year-shaped values, signs and ranges in parseNumeral (review fold, Part of [#11009])
• 7de29eeecd Merge pull request [#11042] from code-yeongyu/feat/11009-t6
• 8d2c90e77d Merge pull request [#10908] from code-yeongyu/ci/10904-derive-python-warmup
• 1a63c2d6d0 fix(desktop): read macOS secure input at every status, not once per heartbeat (#10537 review)
• 81de60704d Merge pull request [#11013] from code-yeongyu/ci/platform-publish-fails-on-npm-error
• 28ee9e1c3a fix(ulw-research): verified-claims allowlist, header matching and ledger reference checks (review fold, Part of [#11009])
• 2847d81661 fix(frontend): judge stat numbers by form, keep TSX code out of the draft guard
• ece9dfde1d fix(browser): drop the last in-app refusal from the skill; record the orphaned browser bridge (#11066 review)
• c08c23d993 fix(frontend,visual-qa): resolve route and gate contradictions from review
• 2e7be0f373 fix(memory): the description preflight never blocks the completion gate
• 30d81b6b06 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
• 390d89f993 Merge remote-tracking branch 'origin/dev' into feat/11009-t17
• ee5713be14 chore(bundle): regenerate generated artifacts for batch [#4] at e3c65bbfdf
• 7d361dc038 fix(ulw-research): read round numbers >= 10 trillion by their 10^4 group (review fold, Part of [#11009])
• 25f794c16a Merge remote-tracking branch 'origin/dev' into feat/11009-t4
• 67cb93030b Merge remote-tracking branch 'origin/dev' into feat/11009-t1
• d61eae98d0 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
• a976dea22f Merge remote-tracking branch 'origin/dev' into feat/11009-t5
• 36dc6c5f02 Merge remote-tracking branch 'origin/dev' into feat/11009-t6
• 5bac6cf690 Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
• 0328b3e64f fix(browser): inside OmO Desktop the skill is the terminal one, plus the app built-in browser
• aca3fc31e8 test(browser): inside OmO Desktop the library is the terminal one plus the built-in browser (RED)
• 62149455e2 Merge remote-tracking branch 'origin/dev' into ci/10904-derive-python-warmup
• 53104356c8 Merge remote-tracking branch 'origin/dev' into ci/platform-publish-fails-on-npm-error
• 3eaf04dad6 Merge pull request [#10979] from code-yeongyu/fix/10945-hooks-fixture-no-auto-maintenance
• 07770d951a chore(bundle): regenerate telemetry schema artifacts for batch [#4] at cdd5eb5248
• 7ea959e3bb docs(changes): drop stray rebase marker lines
• bbe5df7558 docs(browser skill): Built-in has no fallback browser; work the thread tab in few calls (#10601)
• 060fe3efe0 docs(browser skill): Built-in drives the thread's one tab (listTargets + attachPage)
• fe1b7e0273 test(desktop-session): drop the now-unused Response import
• a1ebe28a42 fix(desktop-session): admission before the gate keeps reporting only stop and cancel (#10534)
• 33d5d4eeee fix(desktop): refuse computer input while the stop chord cannot be heard (#10534)
• 6be6c769f4 test(desktop): RED: a deaf stop chord must refuse input (#10534)
• cdd5eb5248 Merge remote-tracking branch 'origin/dev' into b4
• 19287dbbf5 Merge pull request [#10980] from code-yeongyu/feat/telemetry-artifact-decoupled
• af359db6d7 fix(copy): avoid retired agent name
• fd1818e61f ci(publish-platform): the helper comment names the TLOG 409 as the only retried failure
• ed5ed68a16 Merge remote-tracking branch 'origin/dev' into ci/platform-publish-fails-on-npm-error
• cd9aa7ad27 fix(copy): align shared source strings
• 732ec37d70 chore(lint): ratchet baseline takes dev's new counts (project-memory-recall.test.ts)
• 373e908842 Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
• 302ac1e556 ci(publish-platform): retry the TLOG 409 with a fresh provenance signature first; stream npm output; drop the dead provenance env
• 225f62eb99 fix(programming): make scaffold tests offline by default
• 88c7a760d1 merge: stack account storage fix on device_revoked branch
• 590077f426 Merge remote-tracking branch 'origin/dev' into feat/thread-session-callable-extension-ops
• 1f4c516b8f fix(copy): polish punctuation replacements
• 440ba9a6de Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
• eb620ae21d fix(memory): no sync cycle after stop(); fold review LOWs for the [#10637] series
• 38d7548c4f fix(lint): the parity tool reads oxlint's JSON output, so Windows paths parse
• deaf67495f Merge remote-tracking branch 'origin/dev' into test/10925-dump-host-commands-on-relist
• 3ba2d52505 build: regenerate generated artifacts after dev merge (node:24-bookworm linux/amd64, bun 1.4.3)
• b65e20fb5b Merge remote-tracking branch 'origin/dev' into feat/telemetry-artifact-decoupled
• 0e035cba0c fix(telemetry): keep the vendored collector registry byte-exact on Windows checkouts (#10980)
• 0b68bd8661 Merge remote-tracking branch 'origin/dev' into omo-10685-prestage3
• 880a87fd8f Merge dev into fix/11019-bun-bin-ownership
• df05c13d0f Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
• d1245c5e74 chore(bundle): regenerate generated artifacts for batch [#4] at bbfe40423d
• 05aacecf60 test(telemetry-core): identify shutdown deadlines by arm position, not length; name every wait only the clock sees
• c6aa849c11 test(sdk): a replay of a turn past the seven-day window stops as expired (#10458 review H2)
• 8f12ee0cc2 feat(ulw-research): add fidelity defect vocabulary and gate (Part of [#11009])
• 25ee090afb docs(changelog): link revoked-device fix PR
• 658ebcbe8f docs(changelog): link account storage fix to PR 11049
• 6ddd186f75 fix(omo-native): preserve account storage failures without rereads
• 43a4785327 fix(account): end sessions for revoked devices
• 2155fafff1 feat(ulw-research): add numeral, rational and unit primitives (Part of [#11009])
• bbfe40423d batch4: merge [#10715] @959bc277cc
• 1011c952e5 feat(ulw-research): add fact ledger, fidelity state and claim index modules (Part of [#11009])
• ab060a8c52 feat(ulw-research): add text normalization and sentence index primitives (Part of [#11009])
• 5ee365994a feat(ulw-research): add bilingual fidelity lexicon and Korean particle rules (Part of [#11009])
• 46263ad528 feat(ulw-research): add the fidelity brief parser (Part of [#11009])
• 84d1aa1e21 batch4: merge [#10987] @eec39f6284
• 51592e2bb2 batch4: merge [#10985] @df61b660d1
• 5edaf06c65 batch4: merge [#10730] @939740b9df
• 6e02762d59 batch4: merge [#10727] @3b46cd14a1
• 7dcdb4fd80 batch4: merge [#10951] @3d05463ad6
• a656084090 batch4: merge [#10358] @5f8488059f
• c65022b9c7 batch4: merge [#10355] @933dea8c6b
• 523d3b3c6e batch4: merge [#10948] @99590477a4
• 065d71fac0 refactor(ulw-research): export static-gate context for the fidelity gate (Part of [#11009])
• dfbeeec9bc Merge pull request [#10938] from code-yeongyu/batch/memsync-coord-3
• 76aa6d6b09 batch3: merge dev 912c96f5dd (test-only: [#10969]; no conflicts)
• 912c96f5dd Merge pull request [#10969] from code-yeongyu/test/packaged-reload-assert-tmpdir-pin
• b580fae73a test(rpc): pin released-host occupancy and non-fatal prewarm on unsafe keys
• b1833595fc Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
• 944f4de133 test(telemetry-core): check shutdown waits by timer identity, Bun.sleep and timers/promises spies; clock only for synchronous stalls
• 7c88a63245 test(omo-native): refresh command audit inventory
• a986d10edd Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
• 99dea80fb0 style(web): Prettier-format packages/web/.oxlintrc.json (web's format:check)
• 236929df9c docs(changelog): link [#11038]
• 0ca0a49b14 fix(memory): dead-letter parked facts entries
• 67a89c5dce Merge remote-tracking branch 'origin/dev' into fix/10945-hooks-fixture-no-auto-maintenance
• 9a344fedb9 Merge origin/dev into docs/programming-skill-oxc
• aad0603d8a Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
• 80854d7207 test(telemetry-core): the never-settling shutdown test fails on every regression the wall-clock check caught
• 576a8a7337 Merge remote-tracking branch 'origin/dev' into feat/telemetry-artifact-decoupled
• 86ab0e468b batch3: merge dev ef16402e43 (changelog-only conflicts: CHANGELOG.md, changes.md)
• 333d3a180e docs(changelog): link programming skill PR
• dd7c2797c6 Merge remote-tracking branch 'origin/feat/frontend-slop-lint-11021' into feat/frontend-skill-redesign-11021
• c9247fece4 docs(changelog): side panel reads engine subscription limits (#10553)
• ef16402e43 Merge pull request [#11016] from code-yeongyu/fix/compiled-ca-trust-teardown-waits
• beca740919 Merge remote-tracking branch 'origin/dev' into feat/telemetry-artifact-decoupled
• 155225f344 Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
• 54c35db503 Merge pull request [#10741] from code-yeongyu/fix/10738-session-paging
• 40f9740690 fix(build): copy the telemetry schema artifacts into the plugin payload (#10980)
• dd5dff7f18 Merge remote-tracking branch 'origin/dev' into fix/10738-session-paging
• ab7010a84b docs(programming): default TS/JS to OXC
• e8c0ead4cd build(omo-codex): regenerate install-local.mjs (node:24-bookworm linux/amd64, bun 1.4.3)
• e6a428dae7 chore(bundle): regenerate generated artifacts for batch [#3] without [#10712]
• eec39f6284 Merge origin/dev into fix/10866-dropped-count-atomic
• df61b660d1 Merge origin/dev into fix/10892-relaunch-durable-id
• 251be05a9e docs(changelog): record Bun bin ownership fix
• cb0cf023ef test(thread): give the byte-split decode test the win32 transport secret
• 5f3e3ea121 fix(telemetry): type the os.userInfo test spy; changelog paragraph for the Windows temp-home fix (#10935)
• 9bfe57a4db fix(telemetry): judge temp homes without reading the account home from HOME; an unresolvable HOME fails safe (#10935 review)
• 0c8b93a21b fix(telemetry): detect Windows temp homes through the shared path-containment helper (#10935)
• 6682b6f5e2 test(telemetry): assert the install-id 0600 mode only where POSIX modes exist; log the Windows temp-dir inputs (#10935)
• 9320efbd54 fix(memory): deny a dangling link instead of treating it as a missing note
• 94db1557d1 fix(memory): deny swapped grant roots, keep missing notes readable, state the resolve-then-realpath contract
• 54543e2214 docs(changelog): link Windows memory grant fix
• f6df2d7310 fix(memory): canonicalize project read grants
• b6f765a5cc test(thread): decode one-byte reads on a simulated win32 transport
• 720b02082d Merge remote-tracking branch 'origin/dev' into fix/10945-hooks-fixture-no-auto-maintenance
• 7cc16d6f9b fix(omo-native): preserve Bun global bin ownership
• 9b1a607b75 Merge pull request [#11011] from code-yeongyu/test/11010-spool-lock-order
• 7cf28d2e22 docs(changelog): frontend skill redesign (#11023)
• 9d731da51c feat(frontend,visual-qa): restructure around brief, build, subtract, verify with before/after mode and a bounded QA loop
• 3d0bea27b1 fix(frontend): share one file walker between both lint CLIs and skip dangling symlinks
• 20fbc429ad Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
• ade45fbfb7 docs(changelog): draft guard lint (#11022)
• 634b4ed9c2 feat(frontend): draft guard lint for promo copy, emoji icons, hype badges and vanity stats
• 939740b9df docs(changelog): add the Unreleased entry for [#10730]
• 3b46cd14a1 docs(changelog): add the Unreleased entry for [#10727]
• a64b344fc5 Merge remote-tracking branch 'origin/dev' into fix/10738-session-paging
• 3222ebf0e3 test(memory-core): match the traced hook by its normalized path tail (Windows)
• 32658d4684 test(telemetry-core): accept claims at shutdown cap
• 0b09bcb796 Merge branch 'dev' into lint/no-em-dash-copy
• 24eaa157ba batch3: drop the stale [#10965] paragraph from [Unreleased]
• 3307a2d639 batch3-no10712: drop [#10712]'s changelog paragraph; take batch [#3] (73478224ba) generated files pending regen
• 585343ce4f batch3: fix integration of [#10924] (expected facts lines carry the receipt)
• 911020ae02 batch3: fix integration of [#10421] (restore its launcher rename/dispatch hunks)
• e7b1f01387 batch3: fix integration of [#10924] (pass the required exchanges in the two new facts-record-tool tests)
• e292c58ff8 batch3-no10712: merge [#10972] @f7cd68d46b
• afe869c6a7 batch3-no10712: merge [#10941] @2a08d00ad6
• a38d172e33 batch3-no10712: merge [#10935] @965f342fff
• 727d2175f1 batch3-no10712: merge [#10903] @bb9230d0dc
• f67b4ab614 batch3-no10712: merge [#10914] @2788dc2731
• 11d3faa12e batch3-no10712: merge [#10924] @3e5cb38861
• f1bccfbf4d batch3-no10712: merge [#10853] @83b305345b
• 9d3aed8915 batch3-no10712: merge [#10852] @9736b52334
• a31aa7bfd2 batch3-no10712: merge [#10921] @7f2cbb2511
• c07b9860ff batch3-no10712: merge [#10822] @e726ffeb7d
• 432068b7d7 batch3-no10712: merge [#10421] @a1312869ad
• bb8fc243d3 batch3-no10712: merge [#10493] @8f5cf6b941
• 9ea473e649 batch3-no10712: merge [#10483] @d8b0e2f420
• af101cf821 batch3-no10712: merge [#10906] @c1a4079601
• 2780551b66 batch3-no10712: merge [#10902] @46c682b282
• b19bb26f98 test(omo-native): expect the adopted session path as the host reports it
• 8dd3aefa10 test(memory-core): every test git fixture turns off git auto-maintenance
• 644a068a7d test(omo-native): prove the compiled-binary probes exited before removing their folder (#11015)
• 91c6a7132a ci(publish-platform): a failed npm publish fails the job; retry the Sigstore TLOG 409 once without provenance (#11012)
• 16667ed926 test(telemetry-core): ignore locks after shutdown cap
• af59f4f5e9 Merge remote-tracking branch 'origin/dev' into secmed-10693-b
• 5bb22c3fa3 Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
• 04676f50f1 fix(lint): the ratchet skips generated sources by path (*_pb.ts, *.generated.ts)
• e12b20a484 Merge pull request [#10673] from code-yeongyu/fix/10210-catalog-import-windows
• 70b12503b7 fix(qa): guard Windows helper tree kills against recycled parent PIDs
• 8d716a2aa8 Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
• 8c2369db86 Merge pull request [#10666] from code-yeongyu/docs/10665-capabilities-hand-entries
• cb1b273e41 Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
• 0d2f1d6294 Merge pull request [#10943] from code-yeongyu/fix/packaged-reload-tmpdir-root
• 8f32696098 feat(lint): require reasons for lint and type suppressions
• a1339af7f7 Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
• 79d84caa7c Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
• 8620dc6119 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
• 38f77b1501 docs(changelog): link [#10999]
• e889b13b7a wip(lint): ported Biome rules are diffed against Biome's own verdicts; type-aware rules off
• 4ff6cdf7e5 fix(memory): trim reflection descriptions before validation
• 86f6434e28 test(lint): avoid command hit in path fixture
• 3fbad8e8c8 Merge remote-tracking branch 'origin/dev' into docs/10665-capabilities-hand-entries
• 4520ea135a fix(lint): cover product launchers and runtime helpers
• cbc85c96cb docs(thread): describe the observing protocol probe and the attach fence
• cb06002718 docs(changelog): note product copy lint adoption
• 69df6b722b Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
• 8b400b25eb feat(lint): reject em dashes in product copy
• 9a13dfd2ca Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
• a34331b4c5 Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
• e6f9df36a5 fix(task): contain shutdown teardown failures
• 8fb7c05713 fix(thread): answer attach refusals as typed release and UI refusals; budget the handshake
• 0cdb3d145f Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
• a52d1cdf08 Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
• e0512c3c34 test(rpc): pin adopt exit codes and typed release refusals over attach
• 4f50e7c2f3 Merge remote-tracking branch 'origin/dev' into secmed-10693-b
• ce0536c7d1 docs(changelog): move the [#10988] line under [Unreleased] (the gate reads CHANGELOG.md)
• 9b662b73c6 docs(changelog): fragment for [#10988]
• 999be9ab09 docs(changelog): undelivered-message count matches what was dropped (#10987)
• 329dd8c4d5 docs(changelog): relaunched task records its own session id (#10985)
• 036b2807a5 fix(task): report refused starts before teardown
• 894055ae5d Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
• 624b72edc4 test(thread): serve rpc_host fakes on the win32 transport, as real hosts do
• 358623a47f Merge remote-tracking branch 'origin/fix/10637-sync-rpc-field' into fix/10637-sync-cycle-waiters
• b31545a606 Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
• 85e73d1b9a Merge remote-tracking branch 'origin/fix/10637-sync-tui-surface' into fix/10637-sync-rpc-field
• 764cc751d1 docs(changelog): the engine publishes its OTel schema artifact (#10980)
• 1416f92727 feat(telemetry): publish the engine OTel schema artifact, decoupled from the PostHog schema
• 1d0279f393 test(memory-core): fixture repos start no detached git maintenance that outlives teardown
• cf50b3908a Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
• 688c1152e8 Merge remote-tracking branch 'origin/fix/10637-sync-status-change' into fix/10637-sync-tui-surface
• 42ab0b44d2 fix(memory-core): only a successful sync cycle clears a shown failure; a moved lock path is a change (#10637 review H1, M1, L1, L2)
• 2cec92b812 test(telemetry-core): the never-settling shutdown test proves a deadline ended it within the cap again
• a73afece4a fix(skills): preserve grant notices across reconnects (#10693)
• d9e7c2968b Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
• b97b06ab6d fix(skills): identify both vendored store sources (#10693)
• cf09d743bb fix(skills): bound pending MCP grant handles (#10693)
• 5d67091a49 fix(skills): retain global config user authority (#10693)
• 5d2fb8118f fix(memory-core): a failed sync cycle settles nextCycle() and still runs a queued request (#10637, [#10968])
• 614dd6c476 fix(skills): report real file I/O failures (#10693)
• 8103883031 fix(skills): use worktree boundary for task links (#10693)
• aa90ff499e Merge remote-tracking branch 'origin/fix/tests-never-replace-process-env' into test/packaged-reload-assert-tmpdir-pin
• c6f5536943 fix(skills): preserve project discovery rules (#10693)
• cd7c5c630f fix(memory-core): neutral stranded-lock reason, and say why failing outranks paused (#10637 review LOW 1, 2)
• 1502c6244d test(omo-native): setup e2e children are awaited on their exit event under a named bound
• ed65fc5119 Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
• 3c137d7a77 Merge remote-tracking branch 'origin/dev' into secmed-10693-b
• 0bef58aa1f fix(memory-core): a resumed sync cycle re-syncs the index for its committed paths (#10637)
• 3ed1682f53 fix(memory-core): the sync commit reclaims or reports a stranded git lock like a memory write (#10637)
• 66089b87a8 docs(changelog): link [#10958] in the sync failure entry (#10637)
• 9333e42a90 feat(memory-core): sync tells its owner when the shown failure appears, changes or clears (#10637)
• 8839d0a36f feat(memory-core): an unreachable sync service reports offline once it persists (#10637)
• 0f4e470363 feat(memory-core): an expired or refused sign-in reports auth_expired with the sign-in action (#10637)
• 3d05463ad6 docs(changelog): note [#10951]
• 840c9cd821 docs(changes): note [#10951]
• 65ad1b216c fix(telemetry-core): a spool lock whose unlock gave up is reclaimed after the claim lease
• 9b48f9bfb9 feat(memory-core): a failed sync cycle reports a failing status with kind, reason and action (#10637)
• 5f8488059f Merge remote-tracking branch 'origin/dev' into feat/telemetry-turn-span
• 933dea8c6b Merge remote-tracking branch 'origin/dev' into feat/telemetry-spool-lifecycle
• 0de44ac3db Merge remote-tracking branch 'origin/dev' into docs/10665-capabilities-hand-entries
• 99590477a4 test(telemetry): pin handoff_hint malformed-payload drops; untangle QA conditional-event comment
• dc42fd0469 fix(thread): read negotiation frames in the endpoint fixture; log via utils/logger
• 2a08d00ad6 test(telemetry): isolate tests from opt-out env (#10940)
• 965f342fff fix(telemetry): the automation check can never throw on the consent path (fails to telemetry off); strip agent-dir overrides from the shared name list (#10935 review)
• ba392aa210 fix(telemetry): adopt the legacy install id with agent-dir overrides ignored (#10935 review)
• 71e92828ac fix(telemetry): a misconfigured temp dir never marks a real home ephemeral; changelog links the PR (#10935 review)
• a3f37f860e fix(telemetry): one anonymous install id per user, independent of the agent home; no telemetry from automated runs (#10934)
• 653d325950 docs(changelog): move the plan-gate replay entry under [Unreleased]
• 2788dc2731 fix(memory-core): keep the timeout diagnostics inside the windowsHide and fs-boundary audits (#10914 review)
• 62a50909c0 docs(changelog): note the task-store check for a session's own task id (#10903)
• 29a211611d Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
• 3e5cb38861 fix(memory): a two-letter name such as Na is a real person, not a placeholder (#10918)
• 7f2cbb2511 test(memory-core): fail when git-mode project lookups fall back to sync fs (#10044)
• 83b305345b test(thread): exercise every git failure class on every OS through injected git IO
• dd736670a6 docs(changes): add [#10918] unreleased fragment
• 13c62c8c2a fix(memory): a placeholder person on a project fact no longer loops the facts child or stalls the memory queue (#10918)
• 3b5c93efb8 fix(memory): skip project notes the transcript already read by file path (#10044)
• 0a75d3a438 fix(thread): a git failure never fails a send; provenance degrades to unclassified with a logged diagnostic
• fef73f2ac4 fix(memory): keep project scope off the tool-result hot path (#10044)
• 40d3d56711 test(thread): assert the single header line (workspace and project first), then sentence, then body
• 84e2a14971 docs(changelog): link the [#10044] entry to [#10921]
• 409f950e11 fix(thread): ride the new dev: idempotent provenance trigger, one header line, settled() in tests, no config loader in the thread SDK
• 530c9628e6 fix(thread): a dangling worktree .git and the sender's git ceiling resolve as unclassified; link the Bun rejects deadlock
• d8cd57a4b7 fix(thread): decide no-repository structurally, list the delivery fixture's receiver, settle the v4 refusal explicitly
• cfa36c913f docs(changelog): note sender provenance on gateway deliveries (#10853)
• 213858f0cc feat(thread): show the sender's workspace and project first on gateway deliveries
• 9736b52334 chore(schema): regenerate omo.schema.json for the provenance label pattern
• c2d425029a fix(config): give provenance labels a non-blank pattern and add the [#10852] fragment
• 71d30b6690 docs(changelog): note the provenance.workspaces setting (#10852)
• 9416396efa Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
• 74662ab662 feat(config): add provenance.workspaces settings for sender classification
• f872188385 docs(memory): document project scope and config schema (#10044)
• f491d4bd28 feat(memory): persist recall terms for touched projects (#10044)
• 3c54db5545 feat(memory): surface notes on project touches (#10044)
• f1a9957659 feat(memory): grant revocable project note reads (#10044)
• aa1195b2c4 feat(memory-core): resolve touched project memory scope (#10044)
• 1e2039b96e fix(memory-core): record thread states of the timed-out git and its children; keep collecting when a trace is locked (#10821 review)
• f496287512 docs(changelog): link [#10914]
• 918fe00a66 ci(memory-core): record the process table and git trace2 when a git times out on Windows CI (#10821)
• caed354468 fix(rpc): share the key-root rule, bound askHost by one deadline, tidy auth refusals
• 89b159f5e3 test(rpc): pin delta-review fixes: key-root rule, total deadline, auth refusals
• 892091838f ci(publish): derive the Windows eval-smoke warm-up from the kernel prelude (#10904)
• 146d1ffea9 Merge remote-tracking branch 'origin/dev' into fix/rpc-socket-token-client
• b24f3a6e86 fix(rpc): address [#10712] review: session-less wake, key root, remedy, logging
• abb51111f3 test(rpc): resolve askHost's default key root in a child with its own HOME
• 426f833aa4 test(rpc): pin review fixes for v1.1 refusals, key root and logging
• 3d2369b2b7 fix(thread): type v1.1 attach refusals and never fail a mutation on release
• e320d31ab1 chore(bundles): regenerate generated bundles for bundle-train batch [#2] (bun 1.4.3)
• 345f4d1663 batch2: merge [#10668] @ca59274e46
• afc7f27bed batch2: merge [#10607] @1d9b7eb475
• 23c1a80da0 batch2: merge [#10604] @c116516181
• 3b7ce65f7b batch2: merge [#10889] @6142224b5b
• cb1577488a batch2: merge [#10731] @ea6b1e521e
• 68dad7cd4d batch2: merge [#10728] @10ac5b7bba
• 65a7b9ef87 batch2: merge [#10885] @ed8def4f8a
• 65590982a1 batch2: merge [#10658] @185872cd6c
• 44a3d1421e batch2: merge [#10634] @bb1ab9b7ec
• ee3ef17dd3 batch2: merge [#10824] @01f537e85c
• 45d6752938 batch2: merge [#10807] @b69c102842
• a2c0dbae08 batch2: merge [#10498] @cb2c46f5a9
• ef086f1bc6 batch2: merge [#10868] @9403ee93f7
• f84a3fc7b6 batch2: merge [#10853] @905f68f030
• a9e0ccce08 batch2: merge [#10843] @798e5fbff9
• aaaeabb2f2 batch2: merge [#10273] @3dd3e430fd
• 0507f07adb batch2: merge [#10855] @a8d5b313a6
• b30668c193 batch2: merge [#10854] @93b9ecfa35
• d75e3565da batch2: merge [#10674] @7931ca2684
• ac5195d433 batch2: merge [#10372] @026d195f40
• d8b0e2f420 fix(model-core): audit scans files directly under src/; model-core GLM rung reads the table (#10141 review)
• 905f68f030 fix(thread): decide no-repository structurally, list the delivery fixture's receiver, settle the v4 refusal explicitly
• a4f7eb4c6f changelog: keep the [#10493] entry in CHANGELOG.md Unreleased (the gate reads CHANGELOG.md, not fragments)
• 1ecb1debd9 changelog: keep the [#10483] entry in CHANGELOG.md Unreleased (the gate reads CHANGELOG.md, not fragments)
• 889a6a4bad Merge origin/dev into fix/profile-custom-providers; move the changelog entry to changes/unreleased/10493.md
• f5f73e18bc Merge origin/dev into fix/10141-family-latest-models; move the changelog entry to changes/unreleased/10483.md
• 24359213bd docs(changelog): note sender provenance on gateway deliveries (#10853)
• bbdda65161 feat(thread): show the sender's workspace and project first on gateway deliveries
• f5db154567 chore(schema): regenerate omo.schema.json for the provenance label pattern
• 48f7825ab8 fix(config): give provenance labels a non-blank pattern and add the [#10852] fragment
• 77126c12cc Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
• 516e66d6ec docs(changelog): note the provenance.workspaces setting (#10852)
• 7ecd9fbead test(thread): pin v1.1 attach refusals and post-mutation release outcomes
• 8bdae19f2b feat(config): add provenance.workspaces settings for sender classification
• 4fa6eb824f wip(lint): the ratchet counts disable comments, fails on parse errors, and --update only lowers
• 020ed6587d docs(changelog): note [#10822] under Unreleased
• 2589d2df06 docs(changes): add [#10822] fragment
• 6b3e609d8f Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
• bc3e9b9b41 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
• 9eae658d23 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
• c5929f9c8d wip(lint): port Biome noImplicitAnyLet and noStringCaseMismatch; enable no-inner-declarations and no-redeclare
• 12cdec25f3 wip(lint): enable consistent-type-exports and no-invalid-void-type (Biome useExportType / noConfusingVoidType)
• 541cb26bcf wip(lint): port Biome noEnum as omo/no-enum (local prep)
• 9968c146c3 wip(lint): sub-packages lint with oxlint from the root; Biome keeps formatting (local prep)
• c4ad26db1d wip(lint): clear the 14 oxlint errors in the Biome sub-packages (local prep)
• af7ac720cd wip(lint): oxlint configs mapped from the sub-package Biome rule sets (local prep)
• 1ae8c645bf chore(lint): ratchet the three strictness rules per file with oxlint 1.89.0
• 99531052dc feat(telemetry-core): turn tracing on the gated OTLP sender; inspector loads lazily from ./otlp
• d5739470b2 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
• f1f57cda00 test(telemetry-core): write spool fixtures through the providers, not the transport
• a8fbb8f550 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
• 7467183e58 Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
• 0cc47b6278 Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
• fe92a7130b Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
• 38ed1d4a9a Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
• ebfedf3825 fix(session-manager): let a cancelled session_list stop counting (#10738)
• 917b332654 fix(skill): an unreadable native skill keeps its host content and never drops the rows after it (#10693)
• 52a90e8eb3 fix(session-manager): abort session_info walks and never truncate on a missing cursor (#10738)
• 5db2f90b25 fix(security): re-scope only the MCP server whose grant changed, and blame only the requested skill's link (#10693)
• 148b913631 docs(changelog): note the session paging fix (#10738)
• 190bbe03a3 fix(session-manager): page session reads and stop a timed-out search (#10738)
• ad301b63b7 docs(changelog): move the {WaitFor:} entry back under Unreleased
• 90af6ffcc1 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
• 6c3e169a3b fix(get-worker): pick the glibc build on glibc hosts with the musl loader installed (#10562)
• be3e2692e2 fix(security): never let the skill security notice replace a containment result (#10693)
• 518fa58e28 fix(security): pin the authorized skill file before opening it so a swap is refused on Windows too (#10693)
• a9a5a91bf3 fix(security): make the CI shard green under containment (#10693)
• 76695f9db7 Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
• 5a7e3af616 fix(security): register non-project MCP connections synchronously again (#10693)
• b29ee02412 fix(security): retry the grants file replace on Windows and compare canonical paths in the swap test (#10693)
• 68a9d6721c fix(security): keep the config skill entry root check in front of link containment (#10693)
• 34c7a6c78e Merge remote-tracking branch 'origin/dev' into secmed-10693-b
• f482c6d2d8 fix(security): keep skill discovery and MCP env contracts green under containment (#10693)
• c7e85f7ba6 test(security): type the fake setInterval through the test-value helper (#10693)
• b248ac1421 test(security): stop blocking on the pending materialization before the revoke (#10693)
• 4192ac4601 fix(skills): skip disabled native skills before the containment check (#10693)
• bb8fd1172b test(security): type the mocked setInterval callback (#10693)
• 4ed2d6cc8d Merge remote-tracking branch 'origin/dev' into secmed-10693-local
• 959bc277cc docs(changelog): link [#10715] from the git-master co-author entry
• efed301b44 fix(thread): preserve Windows RPC secret transport
• 484c6d77d6 test(rpc): scope challenge contract to POSIX
• 47fe05a6d0 test(rpc): use platform temp dir for contract host
• c8b8c3e79a docs(changelog): record skill containment and project MCP env policy (#10693)
• a87dbe549c test(security): pin shared grant-name acceptance (#10693)
• 781914100b fix(git-master): stop claiming a squash keeps one trailer; instruct one amend rewrite after a squash (#10713)
• bb897128c7 fix(security): reuse native atomic MCP grants store (#10693)
• cf71940b39 docs(git-master): document the default-on co-author trailer and regenerate config schemas (#10713)
• c881f47972 feat(git-master): restore the sisyphus-dev-ai co-author trailer as a default-on setting (#10713)
• 572ab5230a test(security): prove cross-process grant revocation (#10693)
• 0074f01aa7 test(security): pin shared store identity and writer parity (#10693)
• 099952d02a fix(security): key provenance and cancel targeted materializations (#10693)
• 7ab0550d3e test(security): exercise targeted manager invalidation (#10693)
• 58e5171d8a test(security): isolate user client provenance records (#10693)
• 3895daabab fix(security): reconcile grant notices and exact user walks (#10693)
• 1225b79e69 fix(skills): A12 allows intended nested scrollers; one hit-target unit; Layout line without DESIGN.md
• 5f1fe37de3 test(security): exercise native host policy and user walk (#10693)
• f0dd7ef213 test(security): cover grant identity and notice reuse (#10693)
• 3af729b6f5 fix(thread): authenticate RPC hosts and fence session mutations
• c487cf246e fix(security): contain skills and scope legacy MCP env (#10693)
• b78145d62b test(security): cover volume casing and pending revoke (#10693)
• e233904ca4 test(security): cover shared grants and legacy command flow (#10693)
• dfdba25c39 test(rpc): cover authenticated fenced client mutations
• 6204a6954b test(security): RED for skill link containment and MCP env policy (#10693)
• 96d27a2b3a chore(bundles): regenerate after merging the [#10273] head f7be11c7 (Linux, bun 1.4.3)
• f41be5122b Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• 9fe42e6545 Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
• c3d2bb4004 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• d8c8607830 Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
• a95bee166a test(omo-native): turn off the child's Bun transpiler cache so the [#10210] leak test sees only installs
• 7e41d9b2d9 docs(changelog): frontend StyleGallery layout contract and HIG build rules (#10685)
• 472accf2c2 feat(skills): StyleGallery layout contract on every layout change, checked by visual-qa; HIG as frontend build rules
• 8cb41d4e1c Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
• 26130f1bb7 test(omo-native): run setup e2e children offline so the catalog import stops installing the engine (#10210)
• c674813c69 docs(model-capabilities): state the refresh overwrites today and what the guardrail suite really asserts (review)
• e526e45747 docs(model-capabilities): hand-scoped snapshot entries must survive the scheduled refresh (#10665)
• 1c57575d79 docs(changelog): note the LSP engine leaving omo.js (#10659)
• 10ec20eab2 chore(omo-codex): regenerate the Codex installer bundle after merging dev (Linux, bun 1.4.3)
• 56d7ce62ec Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
• 9bb69092cb Merge remote-tracking branch 'origin/dev' into tchain-10225
• 505665682a test(telemetry): the immediate-send import lives in the PostHog sidecar; pair the load spy's module mock with cleanup
• bee343d10d Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• e587ceca45 chore(bundles): regenerate after merging dev onto the lazy PostHog sidecar (Linux, bun 1.4.3)
• 34cf3d0eb9 Merge origin/dev (48c3f53a06, lazy PostHog [#10640]) into feat/telemetry-summary-crashsafe
• b22705a06e chore(bundles): regenerate after the opt-out and spool-bound fixes and the dev merge (Linux, bun 1.4.3)
• 18afb7fd4e Merge remote-tracking branch 'origin/dev' into tchain-10225
• 54d9920ed6 fix(telemetry): telemetry turned off loads no telemetry code, and the summary spool is bounded
• 639ff84c79 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
• 0765d28280 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
• 84f33e7db0 chore(bundles): regenerate after the dev merge and the lazy summary recorder (Linux, bun 1.4.3)
• 431005bb8c fix(telemetry-core): daily active shuts its client down when the flush fails
• ee1757dcd0 Merge remote-tracking branch 'origin/dev' into tchain-10225
• 7ea21a15d7 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• 645eebc3f7 chore(bundles): regenerate after merging dev (Linux, bun 1.4.3)
• 4863ceb5fa Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• 25ddd47a7e chore(bundles): regenerate after merging the [#10273] refresh (Linux, bun 1.4.3)
• aa0297bbea Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
• a781f71aeb Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
• e354831bc2 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• 97a60c30b6 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• 312713e7b7 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• 115ce9c982 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• f8e44fc3be Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
• 39e554326c docs(changelog): the side panel's regular-mode notice (#10560, [#10565])
• 38c65c1351 fix(side-panel): a rotation to an unread account draws nothing; omo.json reference describes engine-read usage
• 1a1a8f1a65 fix(side-panel): read subscription limits from the engine and drop the panel's own poller
• 0ced82c497 Merge remote-tracking branch 'origin/dev' into fix/10536-pin-check-registry-pairing
• 4579d0117f chore(bundles): regenerate omo.js after merging dev 5d1d35e6f5 (#10485)
• ed55219f74 chore(bundles): regenerate bundles after merging dev 5d1d35e6f5 (#10141)
• 1415f9af76 docs(changelog): builtin profiles resolve to a declared custom provider (#10485)
• 8c33e8cefd Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
• 728761ecd9 Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
• 71e4b0a39d Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
• 2e7d8c8bc1 chore(bundles): regenerate after merging the refreshed base
• ad3ce87b3f Merge branch 'feat/telemetry-otel-host' into t10273m-10358
• c91a7ffa56 Merge branch 'feat/telemetry-otel-host' into t10273m-10355
• 77f9d957d4 fix(gateway): commit layer-2 replay receipts with the op; off means the tools do not exist
• 3d41798798 chore(bundles): regenerate after merging the refreshed base
• 4ed009bd86 Merge branch 'feat/telemetry-otel-host' into t10273m-10355
• 0d51447f6d Merge branch 'feat/telemetry-otel-host' into t10273m-10358
• eba53d2805 Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
• 4717ac2884 Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
• 2bf81f933f docs: changelog entry for the session-callable store extension ops
• 1e57be3788 Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
• 6f105762cb Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
• fb41e4867e Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
• 5c05dd7e8b Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
• f5fe6ea4c3 Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
• 32f3a47144 refactor(model-core): name each family's latest model once (#10141)
• 75c238e3d8 Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
• 7fa6d95744 perf(gateway): check session op arguments in the store worker without typebox
• 4a4f4c0444 perf(gateway): import typebox/value lazily in the store worker
• 2857a31042 test(gateway): budget loaded-runner time on worker-heavy tests
• 6a665cacf4 Merge remote-tracking branch 'origin/dev' into wt/9551-devmerge
• 2e78084d8c test(gateway): pin the v7 whatsapp fixture to schema v6
• e38cf2ffde Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
• 4a32a3e11c feat(gateway): internal session ops reachable only from the session's own component
• f64ffc7446 test(thread): fix two type errors in the extension-tools tests
• f6b1405113 test(thread): restore the await-finality cases next to the throw cases
• 083f9666e7 test(thread): prove the wake touch follows the commit; split the session-call test file
• d0771959c0 fix(thread): a throwing status or expire never ends a session await early
• 735eee84e3 docs(thread): document the ext_ tool namespace, exact caller match and await finality
• e219fb4847 test(thread): a registration refused for a taken tool name leaves the schema untouched
• ef989e1eee fix(thread): session-call LOWs from review r1 (L1, L4, L6, L7)
• e284fdc48f test(thread): make the hollow session-tool tests able to fail
• c7a0f376a0 fix(thread): a restarted store worker never downgrades a newer persisted registration
• deac642f86 refactor(thread): drop extensionSessionCall, leaving one session seam
• 94ff80841d fix(thread): refuse two sessionCallable entries that declare the same op
• 739a9f7c34 fix(thread): resolve an extension tool's caller by exact durable id only
• 9e6ac626b5 test(thread): the await wake test completes from a second store after the waiter armed
• a7372ec90c fix(thread): a session await ends only on a final status, else expires and says so
• 0ef50e60c1 fix(thread): put extension session tools in their own ext_<extension>_<toolname> namespace
• d161ca5ceb fix(thread): expire a session await at once when no connector has started
• 31c0f0e294 docs(thread): document the session-callable extension seam and log the change (omo-gateway todo 14)
• 09a300b40f feat(thread): one session tool per declared extension op; thread_create records its creator
• 182ebead44 feat(thread): session-callable store extension ops with a store-stamped caller (omo-gateway todo 14)
• eb64194009 test(thread): work-item status op follows the gateway's lead-path contract
• 48b3082475 test(thread): RED tool-surface tests for session-callable extension ops (omo-gateway todo 14)
• 5109348eb0 test(thread): RED contract for session-callable store extension ops (omo-gateway todo 14)
• 9799041671 test(telemetry): review the opt-out purge's link-back of a kept claim in the consent-gate audit (#10234)
• 9f63ef64a8 docs(changelog): link the opt-out purge entry to its PR (#10267)
• ddbc703886 fix(telemetry): the opt-out purge loads with the recovery sidecar, so an opted-out start keeps owner liveness out of the entry bundle (#10234)
• 21f9797461 test(telemetry): read the scopeless-window outcome after the recovering process shuts down, now that the recovery sweep loads on demand (#10234)
• 6acb7bbc95 test(telemetry): an opted-out start purges a killed owner whose pid an unrelated process now holds (#10234)
• a80dbada87 fix(telemetry): the opt-out purge claims a record before deleting it, so a live writer racing the purge keeps its window (#10234)
• 4cb0cccd9f fix(telemetry): an opted-out start purges dead owners' summaries, consent is read fresh per write, empty scope fails closed, cwd-less events keep the last cwd (#10234)
• f3fe90fdff test(telemetry): RED for opted-out startup purge, consent flip, fail-closed empty scope and cwd-less events (#10234)
• b26abaaab9 Merge remote-tracking branch 'origin/dev' into tc10225m2
• 4bf5c35bf6 Merge remote-tracking branch 'origin/dev' into tc10225m
• 999d2c4386 chore(bundles): regenerate after merging the base and the consent fold
• 677b811f98 fix(telemetry): read consent fresh on every turn span ending, not only at shutdown
• 3a2ec0a5fb Merge branch 'feat/telemetry-otel-host' into feat/telemetry-turn-span
• 7ca1063308 chore(bundles): regenerate after the win32 liveness fix
• b799545a2a Merge remote-tracking branch 'origin/dev' into merge-dev-9666
• 32ac85125a chore(bundles): regenerate after merging dev
• 54b5c2d1b0 Merge branch 'dev' into feat/telemetry-summary-crashsafe
• 778e86c13f docs(changelog): note the web-terminal {WaitFor:} input token
• 2a71b73409 fix(telemetry): end an open turn span at shutdown only under consent, clear its traceparent with the turn
• 068a055303 docs(changelog): note the omo.turn span and turn trace context
• 215ef0e0ca feat(telemetry): omo.turn root span with trace context on every turn event
• e6c2189e3e test(telemetry-core): drain case uses the collector's exact drain reply; docs(changelog): spool lifecycle
• 7629e98e7f Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• 6a1c8c72f1 feat(telemetry-core): bounded disk spool with ack-gated replay
• eaeb8059d6 test(telemetry): RED omo.turn span, trace context on turn events, task-bridge traceparent
• 5c55440bc3 test(telemetry-core): spool lifecycle acceptance cases (RED: cap on sweep, scheduler seam, claim re-check, replay-time opt-out)
• 3c2e29cb6a Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• 931dd862f6 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• 0176b2af6f Merge branch 'dev' into fix/9583-web-terminal-waitfor-token
• f95042e746 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• c5469f5fa2 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• 090f9ed8f0 docs(changelog): note the per-run summary_epoch in the crash-safe session summary entry
• 72e725496e fix(telemetry-core): declare TelemetryDeliveryError and PostHogTransportOptions in the types entry
• 48fe42ae93 fix(telemetry-core): resolve captureImmediate only on a 2xx answer
• 4a0b1b9cbf Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• 4a56d5935a fix(telemetry): acknowledge session_summary only after an immediate send
• c5499d5922 fix(telemetry): re-send session_summary with its original timestamp
• 499bca80d1 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
• 35e7c37972 feat(telemetry): crash-safe session_summary with ownership, stable ids and ack-gated pending files
• 43ac2e9867 fix(telemetry): mask provider and model independently
• 79e55f0dd5 feat(telemetry): session_role on session/turn/summary events
• d74cafa806 Merge branch 'dev' into fix/9583-web-terminal-waitfor-token

• 35ee8d9a0a feat(qa): add a {WaitFor:<text>} input token to the web-terminal driver

  :::bash bun add -g omo-ai