v5.59.0

Added

• Sensitive Operator Bridge actions (launch consent, nickname mutation, merge, release, deploy,
  session lifecycle) now have a library-level single-use confirmation card
  (lib/bridge-confirmation.js) binding the exact operator, guild, channel, action, target and
  digest, replayable never and expiring on a short TTL -- closing the residual same-user
  local-process gap accepted at v5.31.0 (#2106). Not yet wired to a live route (Slice 2, #2842).
• A three-tier Remote Operator Authority policy (classifyBridgeActionTier in
  lib/bridge-confirmation.js): ordinary work (investigate, plan, implement, test, file issues/
  PRs, status, route, dispatch) authorizes directly from verified Discord input; merge/release/
  deploy/session-lifecycle/launch-consent/nickname-mutation require the new single-use
  confirmation card; data-deletion/credential/permission/rule-change require a dashboard step-up
  token unless the Operator has explicitly opted that one category into Discord-only risk (#2116).
  Not yet wired to a live route (Slice 2, #2842).
• Operator bridge reach now defaults new activations to a narrow project group instead of every project (lib/bridge-reach.js#defaultActivationScope), offers a non-destructive one-time prompt to narrow an existing all-projects install when groups exist (needsGroupNarrowingPrompt), and supports taking a whole batch of projects out of (or back within) reach in one atomic call (setProjectsOutOfReachBatch) instead of one request per row (#2117).
• A session can now ask whether the operator bridge is configured, enabled, and whether its own project is in reach, before trying to use it (lib/bridge-awareness.js#resolveSessionBridgeAwareness). Bridge notifications now support a fleet-wide global default per event kind, layered with a per-project override that wins when it exists (resolveNotificationPolicy, setGlobalNotificationPolicy, setProjectNotificationOverride) -- every existing notification stays on by default until the operator turns one off (#2119).
• The operator bridge can now register multiple watched Discord channels and forum threads (lib/bridge-channels.js), each with its own mode (watch-only or two-way) and a separate sendAllowed flag; a broad "every thread" forum scope requires the operator's explicit approval. Watched messages -- including ones the Operator themself typed into a watched channel -- are stored as bounded, explicitly untrusted data (authority: 'watched-untrusted') with a retention bound, never promoted into a bridge route, answer, candidate or approval. Posting to a channel is held unless backed by a scoped publication grant bound to the exact destination, text, route and idempotency key, with safe idempotent retry/readback when the outcome of a post is unknown (#2394).
• A third pinned Discord ingress surface, advisory-channel (#2817): one channel where several allowlisted peer authors (plus the operator) may be heard, carrying no routing, launch or nickname authority at all -- enforced by a database CHECK and two triggers, every server-side write that could grant authority (route-to-project, ask-launch, launch, decline, pin, ask, and any --answered-by naming an advisory route), the gateway's suggestion (always Master, never reserved), a dedicated rate-limit bucket, a consecutive-turn anti-loop cap, an optional mention/reply gate, and [advisory-only] CLI badging with a mandatory guardrail banner on tc bridge read.
• The bridge helper's own half of the advisory-only surface (#2818): configure --advisory-channel/--advisory-authors/--advisory-enabled|--advisory-disabled, a startup/preflight check that the pinned channel belongs to the operator's own guild and differs from the operator channel (disabling only the advisory surface on failure), inbound admission of allowlisted peer authors including specific bots, and outbound replies resolved to the verified advisory channel. A refusal reply is never posted back to a bot sender, closing the automated reply-loop an error message to another bot would otherwise start.
• A second, persistent global role beside Project Master: the Advisor (Morpheus 🕶️), always
  zero-privilege. Toggle it from the dashboard header or any session banner (/api/advisor/status,
  /settings, /launch, /kill); it launches tool-stripped (no Bash/Edit/Write/MultiEdit/
  NotebookEdit/WebFetch/WebSearch) into its own sandbox (~/.tangleclaw/advisor-sandbox/, never a
  project or the database), seeded with curated public TangleClaw knowledge, and is mechanically
  refused every route outside its own API — session launch/kill/wrap, project/group mutations,
  Medusa send, and everything else (#2819).