aterm v0.147.0

aterm v0.147.0

2026-10-30 · 320 changes since v0.146.0

Fixes

• gui: no hwkey key answers a confirmation, whatever window it names
• keeper: harden socket/log symlink and ownership checks and fence companion refusals per request
• accounts: exclude renewal bookkeeping from login enrollment
• accounts: fence explicit renewal against vanished login files
• search, sixel, bootstrap-verify: guard empty column spans, sixel param slots, and nsswitch/group checks
• secrets, uds: a vault holder ends its registrations before the Mac sleeps
• secrets: rounds while the Mac sleeps never take alab-secrets unprobed at the wake
• secrets: a server that cannot hear this Mac's sleep says so
• secrets: a sleep thread that failed is not logged as a timeout
• wayland: guard OwnedFd fds, serial wraparound, v1 output done, late offers, and bind versions
• grapheme, pty, update-core: harden line_break marks, child env upsert, and private-dir/lock bounds
• toolchain, control, session: harden deadlines, pipe bounds, RFC 8259 strings, and reply landing hooks
• gui: a confirmation fences the key queue as it opens, so no queued hwkey key answers it
• gui: the key fence holds the Windowed proof before it asks AppKit for the app
• db: move a directory at the claims ring state aside, so claims go on (F19)
• db: a rebuilt claims ring state keeps its floor and finds every old table (F19)
• db: a clock back from running ahead reads its peers again at once (F19)
• db: the catalog's tables leave the claims ring its storage slots (F19)
• db: a clock behind its claims floor records no claim (F19 review)
• secrets: a Mac left in to carry on and then removed never strands the Undo
• secrets: Macs let in through the remover's entrants never acknowledge its acts
• secrets: removing the remover contests its acts instead of acknowledging them
• secrets: a bare m<N> that is also a host name names every Mac it matches
• secrets: an Undo names the incarnation of the remover that has removals to undo
• secrets: revoke sends a Mac the log does not seat to the admin's revoke
• secrets: a Mac the log lets back in loses the deny rows its removal wrote
• agent: survey_facts names deny rows' labels without aterm-secrets off unix

Tests

• accounts: reject checkpoint-only login enrollment and recovery
• accounts: give the completed-init fixture a provider profile
• agent: this crate's tests read no host names
• two live turns wait the hang detector for their submit, not the verb's 2 s window
• fabric: three bus reads wait the harness's IO bound, not the product's 3 s
• worker_spawn: wait for the roster's placement columns before judging them
• secrets: a POST after a torn tail, and one that makes a full store drop a record, write the file whole
• secrets: a will-sleep through the server's own listener wiring ends its registration until the wake
• census: the denied node_key census test names this Mac m1 from a scratch aterm.toml
• date initial account input before wrong-account holds
• prepare lab worlds under short scratch roots
• handoff: v0.146.0's producer fixtures, written by its own cut
• census: main's node-key deny test names this Mac m1 from a scratch aterm.toml, not the host's name
• lift must-answer waits off product budgets in link, atpkg, http, release, update
• lift must-answer waits off product budgets in aterm-db and aterm-secrets
• lift must-answer waits off product budgets in aterm-gui and aterm-pty
• format the hang-detector lifts in aterm-db, aterm-secrets, aterm-gui and aterm-pty
• close the hang-detector gaps a hostile review of the lifts found
• aterm-secrets' own envelope reads wait the hang detector

Docs

• secrets: say when a refused member resends its store, and every case a records file is written whole
• vitals: clarify macOS free memory excludes speculative pages
• db: say only what the claims-ring fixes back (F19 review)

Other

• Add preserved two-host Commons startup fixtures
• Record physical ordinary-startup Commons convergence
• secrets: bound publish_local_node_key locks and enforce log recipient exclusions in observe_commons
• db: use read-only Journal::read_existing in runtime pending poll and observe_contacts
• fleet: a test of the binary sets a join's wait for its issuer through a dev seam
• ctl: a test sets a discovery probe's wait through a dev seam
• ctl: redial tests lift the probe cap for a server that serves
• fleet: init tests whose listener serves wait the hang detector for its proof
• net: fleet test listeners give an in-process dialer the hang detector
• style: format …'s after_host_gone and …'s serves_new_key look
• ctl: a test sets a connect's accept patience, on its thread or through a dev seam
• upgrade: the roster-aside tests read their fakes under the hang detector
• fleet: a leave whose every peer serves in process reads them under the hang detector
• ctl: with_accept_within is a unix tests' setter
• net: the descriptor-scan test's drain control reuses one pair until it drains
• ctl: the dev-seams feature's comment names both seams it turns on
• Format with trustfmt
• secrets: read settled control journal lock-free in writer_here
• ctl: the last two redial tests lift the probe cap for a server that serves
• secrets: a server's store with no genesis takes records only with the genesis that roots them
• secrets: a join flood takes the newest fresh row, never one that asked again
• secrets: a publish lets the state lock go before its PUTs
• secrets: a records POST copies no record's bytes and appends what it adds
• style: trustfmt server.rs
• secrets: a full desk takes a row of the most crowded sources, never a newcomer's first
• Preserve ordinary host run output and identify instance followers
• agent: detect_machine_id reads no host name and no real home in its crate's tests
• agent,docs: a test reaches the pool's host-name fallback again; census and R8 text say what is true
• Remove redundant inner unsafe block around safe offer destroy wrappers
• secrets: preserve log audience exclusions across overlay/publish and accept followed signers in prepare_account_decision
• style(secrets): the wiring test names its handler type for tippy's type_complexity
• secrets: overlay log Commons membership on unstamped envelopes and filter Commons hosts
• secrets: include unproved founders and [everyone] exclusions in roster labels and revoke repair
• secrets: filter denied 64-hex node_keys and merge branch node_keys in reconcile_merged_metadata
• db: enforce log audience exclusions in check_log_witness and verify_peer_against_local_log
• lab: make the prepared-world tests' parent under /tmp, not $TMPDIR
• Add expiry boundary regressions for account wall advice
• Use supported ordering in the planning model
• Resume retained quota walls after their recorded expiry
• harness: the quiet upgrade tells an agent whose own work holds its move
• harness: the window's old break door forwards to the guarded one
• harness: the quiet tell promises only a move aterm can make
• harness: the shared move plan names its result and goes by value
• supervise: a break tells its host a task landed under Land, tested
• harness: the quiet tell's plan gate goes before the build probe
• supervise: a tape from before the guarded break door replays the old one
• harness: two of main's relaunch tests name the upgrade's tell
• secrets,agent: enforce deny-lists in swarm label, pool identity, mail relay, and census
• agent: tests pin the machine choices and the Muse goal store that this crate's test arms skip
• Correct remote-hold recovery advice for merged fleet membership
• accounts: harden the automation on main's design (round 2 of the review)
• Ignore future mailbox timestamps before selecting renewal input changes
• Keep account admission controls within their clock and platform
• agent: bind node_keys in roster_identities and census, enforce deny-lists in names_this_machine
• agent: resolve age1 recipients in census server_heard and enforce deny-lists in survey_facts
• Keep mapped Unix build outputs while their processes still use them
• Exercise complete-but-cut and oversized mapping observations
• Name the mapping witness as an explicit pointer read
• Keep every possible owner of an ambiguous Linux mapping
• Keep mappings visible beside the removers own lock descriptors
• secrets: enforce roster deny-lists and log exclusions across steward lease, standby server, and admin checks
• Finish merged-book diagnostics and measure sweep progress
• Compose sink Landing arg and Watch::enter onto merged origin/main
• Use usize::clamp in Sink::drain_loop
• Update trust floor ratchets
• Gate Unix-only aterm_secrets call in survey_facts::resolve_machine_label
• secrets,agent,cli: expire denied lease holders and filter stale denied account claims
• agent,primer,cli,docs: Cruise and Land answer a park on a go-ahead for the agent's own work (go-ahead@v1)
• prism-glass 1 fix: trail-diff fails a light arm on a dark ground
• prism-glass 1 fix: the yield's state goes with the light
• prism-glass 1 fix: every route that lays the glass again yields it
• prism-glass 1 fix: a composed frame's yield reads its own pane
• prism-glass 1 fix: the yield keeps the spec's bar, measured on the shipped glass
• prism-glass 1 fix: the Settings preview keeps the page law
• prism-glass 1 fix: the dark pin's glass reads are wired through the app
• prism-glass 1 fix: the dump honours page wallpaper and pane themes
• prism-glass 1 fix: the light corpus compares the live level with main's paper arm
• aterm-release: the proved (calculus) counter reads Trust's VF5 calculus authority
• aterm-release: the proved (calculus) counter refuses every line Trust would not write
• aterm-release: trust_credit formatted (verify fmt --fix)
• secrets,db,net,gui,agent: enforce deny-lists across toolset peers, Commons enrollment, lease expiry, and copy_again
• secrets,agent: enforce roster deny-lists and node_key exclusions across log entries, admit, drive grants, and standby stewards
• Fix agent lint failures found by the wide networking check
• Specify account identity credit for alternate login completion
• Distinguish alternate account publication from requested renewal
• Collapse the denied-member admission condition
• Trail review9 fixes (work in progress): Comet air rows, mono ring latch, cat's wide steps, bolt girth, bar latch, Sparkle pin, combining marks
• Trail review9 fixes (work in progress): the companion keeps off a lettered row above, trail-companion reads
• settings_preview: the head-law test builds
• settings_preview: the companion's row bound reads the head law, and the shipped specimen is held to it
• kitty_pet: a bound under a lettered row keeps its head under it, and the sink reads a bound's whole way
• cursor_glow: a pinned colour is Sparkle's paper star too
• aterm-effects: a chosen colour lands as itself on paper
• aterm-effects, aterm-gui, aterm-render: fit the companion to its row between lettered rows; a chosen colour charges in its own hue
• aterm-effects: the console judges the box the head law draws
• aterm-gui: the preview reads the head law's fit without a test seam it cannot reach
• aterm-effects: the typing-momentum glow wears a chosen colour in its own hue and chroma
• aterm-effects: the momentum chosen-colour test judges the glow's own quads, beside Classic too
• aterm-effects: Classic's paper wake wears a chosen colour in its own hue and chroma
• aterm-effects: a stance's stretch never carries the pet onto the caret's cell
• aterm-effects: a departing ghost keeps the edge its body's stretch kept
• aterm-effects: the stretch-off-caret test names its row type
• aterm-effects: a run off a held landing sets out from the pose on glass
• aterm-effects: the head law reads the last row, holds across gaps and looks ahead; a strike's narrow control reverts its girth alone
• Themes keeping: a reused list keeps its frame, a press's reveal parts from main no more
• Themes keeping: a press that moved the keyboard away holds no place for a status
• Themes keeping: R2's chosen-anew rule has a control and a line among the rules
• Themes keeping: a list is reused for another room only where its stops lay out alike
• Themes: fold the press-reveal and row-likeness comments to one line
• Themes keeping tests: hold each known walk to every rule it breaks
• Themes: tell the least bar's keyboard span on the least room's own rows
• Themes: read a footer control's reach only where a least's span asks it
• Themes: ask the render's Between before rows_apart where a least's span is told
• Themes keeping tests: fold five test comments to one line
• Bound disposable package caches through guarded whole-generation retirement
• Preserve package host entry and settled cache status across compiler changes
• Preserve registrar fixture process groups under the bounded wait
• secrets,db,agent: enforce lock-safe roster reads, node standing, and host deny-lists
• secrets: cascade node-denied members in revoke repair and enforce roster/node checks in handover and log overlay
• agent: two lints main's tippy -D warnings flags (a Copy recipient cloned, a collapsible if)
• release: pin which wrong .cer the certificate wait names
• cli: pin how help permissions reads its consent probes
• release: build the arrival test's paths instead of cloning them
• release: the arrival test pins that a .cer which left the folder leaves the wait's report
• Keep Cargo queries out of build-cache ownership
• secrets: enforce node standing in recipient_is_removed and roster deny-lists in entry/fleet reads
• secrets,db: fix lock self-deadlocks in enrollment/log/roster/fleet reads and check log roster in peer verify
• membership_log: the Undo's cutoff and progress, and the coverage rule alone (F16)
• secrets: any member removes, and the vault pass covers concurrent removals (F16)
• members: a removed Mac that asks again shows as removed; Allow again restores it (F16)
• members: remove, undo and Allow again from the CLI and the band; the admin revoke is the no-log fallback (F16)
• lab: the F8 lane's removals plane runs F16's quorum Undo after the heal
• style: trustfmt the F16 files
• lint: the F16 code passes tippy -D warnings
• secrets(F16 review R1-4): host lists the remover cannot open are named and rotated by their members
• secrets(F16 review R1-2): revoke takes the admin path for an envelope admin; a log removal says its key stays
• members(F16 review R2-6): aterm members undo lists the Undo rows and signs nothing
• style: trustfmt the F16 review fixes
• style(secrets): two tippy findings in the merged tests
• Bump all harness versions for the 0.147 release window
• secrets,agent,cli: enforce local recipient/roster denials in materialization, commons, and LocalLog
• Add direct session mail over authenticated fleet drives
• Read reserved entries without recursively asking for unused admin status
• Complete the two lint corrections missed by the abbreviated report
• agent,primer,cli,docs: the go-ahead answers only an agent's own reversible park (go-ahead@v1 review)
• agent,primer,cli,docs: the go-ahead answers only an agent's own reversible park (go-ahead@v1 review 2)
• secrets: say the denied standby check's error with is_err
• agent: trim a go-ahead word's edges with a char array
• Advance automatic disk cleanup through bounded target pages
• secrets,agent: track applied.vault stamps in LocalLog/Commons and enforce canonical roster denials
• Fix harness-bump baseline before the release version changes
• gui: pin what a notice route posts and the balloon's title-only text
• gui: pin that a refused secure-input change is not recorded
• gui: pin the jobs pass's root-only pid version and coalition match
• gui: pin the exact thermal state's precedence and the why seam's scenes
• gui: pin Tab Control's host naming, machines.toml and Bonjour readers
• gui: pin that an unconfigured roster reads without the harness state
• gui: pin that a disk search cut short makes a cut survey
• gui: read kern.boottime's sec past the space after its =
• gui: name every None case in configured_hosts_in's and roster_at's docs
• gui: the host-name test pins a [names] match by the name; the thermal test has no 10 s budget
• Collapse the denied-local-log guard without changing its predicate
• Admit LAN requests automatically to the pinned open ALab vault
• Collapse the steward recipient denial check for tippy
• Request the current notary credential and bind its wire entry
• secrets: lift node, label, and recipient denials across new-incarnation log restores
• Release Commons test journals before checking revocation
• Advance managed ALab vault jobs to the installed release
• secrets: lift log-restored deny rows in entry, steward, and admin roster checks
• Refresh managed ALab subscribers from headless converge passes
• Keep admission and refresh regression tests precise
• db: keep recovered schema-successor credential requests in standing
• release: invoke ensure_notary on mutable notary_acquire when credential raises need
• Initialize pending subscriber fixture state before mend checks
• Create pending refresh fixture through the real join path
• Prepare and prove shared release signing automatically
• Group membership node record masks for lint
• Remove obsolete helpers after shared keychain extraction
• Show shared Commons account proposals in account lists
• Compose the node mask argument grouping with account lists
• Keep fleet mail usable across concurrent reads and departed senders
• Keep the mailbox lock error on Unix targets
• Accept direct-mail metadata in fabric proof waits
• secrets: deny node_key and expire steward lease on member removal
• Report safe local stages for refused network observations
• Reproduce contact expiry between a live publication and its reader
• Age expired peer contacts without discarding a fresh observer snapshot
• Pair membership eligibility masks and record corrected observer evidence
• Keep the shared Git credential helper active across token rotation
• Harden file safety, signal state, and deadlines in aterm-agent
• Fix main tippy warnings in node_service and go_ahead
• Fix module paths for read_bounded and write_atomic in upgrade_drive submodules
• Keep SecretRule::Under scoped inside repository root unless rel traverses outside
• secrets: let unproved founders wrapped in Commons open control from log
• secrets: preserve Everyone members in reconcile_commons_log and filter removed seats in member_list
• Publish direct fleet mail arrivals through normal discovery
• Retry direct mailbox observations until refresh succeeds
• Exercise retryable mailbox refresh under contention and damage
• Refuse owner forwarding when a fleet-driven session moves
• Retry pre-dispatch fleet busy replies within the original deadline
• Check late handoff writes wake a real mail subscriber
• Mark the response formatter context as intentionally unused
• Read the last cached direct arrival without reverse iteration
• Preserve direct identifiers in the timeline view
• Use the fabric module binding for the mailbox worker
• Describe approval-free ALab LAN joins in setup help
• Compile durable mailbox notifications only on supported Unix hosts
• Read mail frames after the subscription roster handshake
• Reproduce retained retry activity after alternate login publication
• Retire attributed retry holds after verified login publication
• Fence publication cleanup by captured claim identity
• Test expired retry attribution with a deterministic clock
• secrets: reserve admin validation for reads that need it
• style(secrets): format the log-backed read regression
• secrets: exercise denied admins and avoid unused policy privilege checks
• secrets: preserve roster denials across node key replacement
• Show shared imported account candidates without inventing login details
• capacity: lift verify's memory book into aterm_capacity::book
• capacity: a covering claim covers the builds its holder's tree starts
• atpkg: build_admit, a plain build's memory claim around its targo
• lab: claim each heavy nested build's memory before it starts
• atpkg: a rerouted cargo build claims its memory before it runs
• models: the build claim's lock order, bound to build_admit
• atpkg: a debug build's front claims in the ledger its test names
• capacity,verify,release,atpkg: say what runs the front now the hop is out
• atpkg: a rerouted cargo execs again, so its tab still names cargo
• atpkg: verify's own test compile and lint read verify's records
• capacity: a plain build claims the most of every record of its work
• capacity,atpkg: a fresh rerun never pushes a build's heavy peak out
• atpkg: a failed build keeps a peak that raises its key's claim
• atpkg: one signal forwarding at a time in a process
• atpkg: a front dies of the signal its build died of
• atpkg: a front passes on every signal a direct build would have taken
• capacity,atpkg: a claim outlasts what its signalled build left running
• atpkg,lab,models: bind the claim-before-spawn order where calls take it
• lab: a heavy build's test names the failed-build rule it checks
• atpkg: a debug front on a scratch ledger admits at once
• capacity,atpkg: test the live lineage and a front's reaped-child floor
• capacity: test that the cover marker reads its holder's claims alone
• capacity,verify,release,atpkg,lab: a cover marker names one claim
• atpkg: format build_cache.rs
• capacity,atpkg: read the build's tree with no lock of the same name held
• atpkg: name the verify stage rule's function type
• agent: clear main's four tippy errors
• verify: a stage new to its checkout claims what another checkout kept
• secrets: name why the node index takes eight arguments (main's tippy error)
• Complete bounded disk observation cycles before worker handoff
• secrets,db: harden log witness wraps, roster projection, and deny checks
• Validate actual service destinations before automatic migration
• Preserve stopped service choices during automatic restart
• Validate only new server candidates while restarting retained programs
• Keep standby test seam platform and lint attributes on its function
• Harden file staging, non-blocking reads, pid-zero guard, and Mach-O bounds (Batch 107)
• Allow pipe replay in agh and fix main tippy warnings in aterm-agent
• Keep aterm-agent tippy fixes in fix/batch-106
• Fix identity-op lint in macho_order test and update fleet allow --all assertion
• Align fleet_live_headless hold refusal check with merged-book advice
• db,secrets: harden ring adoption bounds, custodian writer checks, and log enrollment
• Preserve newer node services across fallback app selection
• Scope the node admin lock name to Unix
• Verify fresh node destinations before starting the service
• Observe node lock contention at its actual wait hook
• Scope the node lock test observer to Unix
• Inspect retained credential requests without advancing their state
• Use explicit JSON types and actor references in request inspection
• Report retained request operations separately from interpreted records
• Keep the ring storage bound as a direct comparison
• secrets: harden lock files, handover audience checks, and multi-seat log denials
• Expose RecordsAuthorLock file types to lock-order census
• Avoid redundant rewind recording work per parsed slice
• Share immutable rewind queue routing per message

---

Source release. SHA256SUMS is a per-file manifest of the released tree, with a detached Ed25519 signature (SHA256SUMS.sig) by a machine key named in the attached master-signed roster (aterm-machines.toml + .sig). Verification chain and key inventory: SIGNING.md in the publication engine; the roster pin is committed in aterm crates/aterm-update-core/src/pins.rs.