v0.4.0

A passing patch can wait for a person.

• apply: review on POST /v1/runs (or --review on delegate run/replay) holds a passing patch instead of applying it: the run still ends passed, and its new delivery field reads pending.
• GET /v1/runs/{id}/patch serves the passing attempt's diff; delegate patch <run> prints it.
• POST /v1/runs/{id}/apply lands a held patch unstaged after git apply --check, refusing with git's own reason (409) and touching nothing when the tree moved under it; POST /v1/runs/{id}/discard sets it aside. delegate apply|discard <run> do the same from the CLI.
• Both are recorded on the run as an applied/discarded event after its end and as its delivery (applied, pending, discarded); an existing database gains the column on open.
• Counts read "1 file" / "2 files", and a run that never passed no longer claims a tier of -.
• /v1/capabilities lists the review feature.

v0.3.0

A tiered task dispatcher: a packet goes to the cheapest tier that fits, runs in an isolated worktree, is judged by its verifier, escalates with the verifier's own words, and lands unstaged when it passes.

• Packets, verified worktree runs, the escalation ladder, a SQLite run log and an HTTP daemon.
• Claude Code headless as a tier worker, beside the other runners.
• Fail-over inside a tier when a provider never starts or produces nothing, with error lines picked as the reason; infrastructure errors stay out of the stats; a clean exit with no changes counts as a failure.
• serve.env entries are exported to workers so the daemon can reach cloud tiers.
• The capabilities say what each class decides (tier, ceiling, verify, attempts) and what conserve and rush do to the ladder.
• The daemon trusts the tailnet the way the bridges do: a peer on the tailnet or loopback needs no password, everyone else still does, and the capabilities say which mode is on.