v0.72.47: Sessions with receipts

v0.72.47: Sessions with receipts

Thirty-day retrospective: August 28 through September 26, 2026 (UTC),
covering the 48 published releases from v0.72.0 through v0.72.47.

An interrupted session needs to leave enough evidence to recover its work, and
a new session needs to prove which tools it can actually use. This month,
Donmai made those two paths more explicit. The daemon gained bounded recovery
for failed carriers and session shims, while execution preflight gained support
for binding capabilities to observed tool artifacts and carrying that evidence
in receipts. Versioned releases
continued throughout the month; this note connects the changes that matter
together.

Recover the affected work

One transient session-shim failure no longer withdraws unrelated sessions
(#507). The daemon can attest a
vanished shim and discharge its recovery obligation
(#561), recover failed carrier
activation (#575), and retain
unpublished interactive workareas before teardown
(#604). Restored workareas are
visible through archive list and show
(#612).

Prove the tools a session received

Capability realizations now bind to observed tool artifacts
(#585); raw preflight receipts
carry applied provenance (#602),
and executed fixture evidence determines eligibility
(#606). Named MCP capability
evidence and protected runtime selection are bound to the exact realization
(#637,
#640).

Make local failures legible

donmai arch assess --require-diff now fails when a PR diff cannot be read
completely, and named Codex failures retain bounded diagnostics
(#665). Pi model routing now
uses the serving host for gateway-backed models
(#667).

Contributors

Thanks to Gabriela Kropf for co-authoring the
worktree-root fix, which keeps
worktree creation anchored to the primary checkout. Thanks to
@MarkKropf for the release train.

Compare the complete range
for the commits included in these releases.