v0.4.0

Added

• rauf loop run --pause-on-needs-human — opt-in run mode that halts the loop
  (state paused_human, with a distinct non-zero exit code) on the first
  RAUF_NEEDS_HUMAN instead of setting the item aside and continuing, so a
  supervising session can detect the pause. Emits a loop_paused NDJSON event.
• rauf resume --answer <id> "<text>" (repeatable) — inject a human's answer
  into a paused needs-human item and re-queue it; the answer is threaded into the
  item's next prompt and cleared once it completes.
• Machine-observation surfaces (loop run --ndjson event vocabulary and
  status --json DerivedStatus) are now documented as a versioned contract
  in docs/SPEC-BACKLOG-TOOL-CONTRACT.md, with the machine-vs-human surface
  distinction made explicit.
• Web dashboard: a specific empty/error state when the configured root directory
  does not exist (with a Settings link) plus pre-save root validation; and a
  favicon (served in dev and from the compiled binary).

Changed

• Backlog-authoring guidance uses model tier aliases (opus/sonnet) instead
  of pinned IDs, and documents opus[1m] for items that need the 1M context
  window (opt-in via the [1m] suffix; no cost premium on Opus).
• The web server's startup recovery resolves its root via the standard precedence
  (RAUF_ROOT env → config → cwd), honoring an explicit RAUF_ROOT/--root
  override.
• --create-branch, --pause-on-needs-human, and resume --answer are now listed
  in the CLI --help flag tables.
• Purged user-facing ralph leftovers from the web UI (theme localStorage key,
  migrated transparently; command examples).

Fixed

• Loop wedge: item completion is now authoritative — if an item's on-disk
  status is perturbed (e.g. reverted to pending) mid-iteration, the runner
  re-asserts in_progress before marking done and surfaces failures, instead of
  silently failing the invalid pending -> done transition and re-running the
  item indefinitely.
• Server startup recovery (recoverStaleLoops) no longer resets in_progress
  items in projects whose lock is held by a live loop (e.g. a direct-mode
  rauf loop run); only genuinely stale loops are recovered.
• LOG_PATTERNS.needsHuman now matches the runner's actual
  Item <id> needs human input (set aside): <reason> line.
• RAUF_* terminal tokens in the diagnostic "Signal text" log dump are redacted so
  agent prose can no longer plant false signals in a grepped rauf.log.
• rauf resume --answer 001 "..." no longer misreads the answer text as the
  project path in the documented no-path form.
• README: broken images and the loop diagram restored/renamed; the version badge is
  now a dynamic GitHub-release badge; docs builds no longer dirty the working tree.

Full Changelog: v0.3.0...v0.4.0