v0.59.0

[0.59.0] - 2026-10-19

Line-count correction. bin/masc_tui_render.ml went from 14,374 lines in v0.58.0 (c9adfa1a) to 734 lines in this release (9d2fa390), −94.9%. The per-PR line counts in the entries below (14,399, 3,966, 729 and the intermediate values) were measured at each PR's merge and do not reproduce from any single ref.

Upgrade notes

• Pending formats 12 and earlier are refused; an operator-selected matched queue, append-log and rules reset loses pending approvals, unconsumed grants and standing rules. Follow docs/guides/APPROVAL-RULE-STORE-UPGRADE.md before deployment (#43410).
• Answered-Ask admission fingerprints now use "ask-answer-v1:" plus the SHA-256 of the canonical (ask_id, answered_at, answers) JSON instead of the rendered text hash. If an answered Ask turn was admitted into a checkpoint before upgrade but had not finished when the server restarted on the new build, re-delivery of that ask_id against the same checkpoint will be rejected with "approval admission evidence conflicts with persisted input"; re-ask the question or clear that checkpoint's admission marker to proceed (#43566)
• Legacy Ask log entries that recorded only an unattributed integer turn_id (without a trace reference) decode with source_turn_ref = None; malformed turn_id or source_turn_ref values are rejected (#43576)
• /api/v1/keepers/:name/provider-input now returns the parts list instead of inline system_prompt, messages, and tool_schemas bodies. Upgrade the server and masc_tui together from the same build; an older TUI binary cannot decode the Ctrl-X context inspector response from a newer server (and vice versa) (#43583).

Fresh state required

• The IDE feed now requires producer-attributed canonical rows in <base-path>/.masc/tool_calls/; preserve these journal files, including older unattributed rows. Leave existing .masc-ide/by-url/*/tool_events.jsonl copies untouched: they are no longer read or migrated, and no deletion or rewrite is required (#43473).
• Lane Add-on bindings now record lifecycle and engine, and old records are not read. Stop the server, delete .masc/lane-addons/bindings, then start the new build. Worker containers from the previous build carry no scope label, so the startup sweep leaves them alone and they are removed once by hand (#43548).

Added

• Run canonical Write nodes and exact inline Skill children in task recipes. Read output can feed Write and a verification Read in one invocation, retaining the original file authorization, publication recovery and physical receipts. (#43445)
• Ask answer follow-up can now show committed SDK Tool result records from the
  turn input containing the exact canonical first answer, including physical
  execution, trace and Keeper turn identities in observation logs. The TUI retains
  prior positive facts when fresh action evidence is unavailable. Source lookup
  uses a derived index over the original Tool ledger; queue admission, input
  membership, successful effects and Task completion remain distinct observations.
  See Keeper Ask answer recovery. (#43462)
• Record original-turn Skill preparation construction, reuse and lock-acquisition boundaries in runtime manifests and Runtime Lens, preserving missing, failed and cancelled observations without changing execution admission. (#43500)
• Expose active context, Tool and executable Skill preparation in live turn previews, retaining original scope outcomes and preventing late completion from replacing newer provider or Tool activity. (#43503)
• Show recently observed preparation for the exact chat or batch execution and autonomous turn, bind previews to the actual running Owner slot, and preserve later provider or Tool activity over delayed preparation reads. (#43504)
• Observe Task and prompt preparation with the original running Keeper Owner and turn identity, including autonomous preparation before its journal exists. (#43505)
• Observe the actual shared-input preparation as a world phase under the original running Owner and turn reference. (#43506)
• Observe initial common prompt preparation through the original running turn's preview writer. (#43508)
• Retain each running turn's preparation scope, outcome and elapsed time, with proven parentage for nested and parallel observations. Show this history in the exact execution's TUI details while preserving current provider activity. (#43518)
• Observe Lane, shared-memory and Wiki submission waits under the original world preparation, retaining source outcomes and distinguishing lookup failures in TUI details. (#43524)
• A request can carry x-masc-expected-base-path and x-masc-expected-masc-root; the server compares them with the workspace it serves before routing and answers 400 invalid_workspace_precondition, 409 workspace_precondition_failed or 503 server_booting, so a client no longer needs to read /health before each workspace-scoped request (#43586).
• Look up canonical Keeper turn records by complete Turn_ref beyond the recent page, preserving readable absence, unavailable history and partial-history observations through an exact HTTP mode and a request-bound TUI decoder. Direct Ask inspector navigation and runtime performance remain unverified (#43611)
• Open a question's immutable source turn with O, retaining the answer draft and independently publishing record, original-input and response observations. Keep pinned sources separate from recent navigation and preserve completed observations when partial results arrive late (#43613)
• Record per-component monotonic start/observation receipts, including failed and unfinished reads, and document source-level Before/After boundaries and the remaining historical-response page limit (#43613)
• Read all retained context-inspector response parts in a separate scrollable response tab; preserve the opened input/proof and its reading position when returning with Esc (#43617)
• Wire codex_subscription/<model> (codex-app-server) into benchmarks/terminal_bench (render_configs.py, driver/deps.sh, driver/collect_result.sh, run_matrix.sh, probe_keeper_tools.sh) (#43624)
• TUI /score [N] opens full official alphaTex notation and local synthesized playback in the terminal, with zoom, system paging, track selection and preserved source diagnostics. Install the pinned alphaTab/alphaSkia companion with scripts/install-alphatex.sh (Node.js 22+ and Kitty graphics required). (#43636)
• Add an exact-answer follow-up SSE endpoint and typed receiver that deliver wake/turn, Tool and original Task observations as each settles, sharing one canonical answer capture. Reject duplicate, changed-identity and incomplete streams. The Questions pane still uses aggregate reads until its next integration layer; visible latency remains unmeasured (#43660)
• Choose installed native VST3 instruments and saved presets for TUI score MIDI playback, remember the selected sound, and repeat or stop the same phrase. (#43684)
• Observe native MIDI phrase instrument selection, render hashes and local player state through a snapshot-backed Lane Add-on. (#43685)
• Add macOS simultaneous audio and MIDI capture with Float32 WAV, full UMP packets, shared device timestamps and durable take finalization. (#43687)
• Record simultaneous audio and MIDI takes from the score viewer, inspect channel waveforms and MIDI tracks, reopen WAV sessions and export MIDI 2.0 Clips. (#43688)
• Retain typed component receipts and a separate partial-reader count for full-refresh Runtime, Board and Keeper roster/Candle observations; expose received and failed components in the existing progress badge and diagnostic JSON without changing data admission or adding requests. (#43710)
• Observe Board posts and hearth readers independently, retaining completed child results across parent interruption and distinguishing caught cancellation from unfinished reads; publish refresh progress through an owned atomic inbox without waiting for the bounded dataset mailbox. (#43720)
• Open complete, scrollable repository and model detail readings with v while preserving workspace ownership. #43722
• Read full Board resolution notes and follow explicit successor posts with S, returning to the original post with Esc. #43728
• Add an offline Pele 1.6.0 companion that renders Mermaid source to themed, width-aware PNG previews, with a separate content-addressed installer and terminal-safe diagnostics (#43729).
• Open closed Mermaid fences and structured Mermaid outputs with Pele through the TUI's asynchronous Ctrl-O image preview; preserve source, terminal palette and width, and newer staged attachments (#43730).
• Select an exact Usage account with f across Plan and Trend, retaining the choice across refreshes and time windows; a restores all accounts. #43732
• List all seven main TUI surfaces and their reading entrypoints in /features, including complete repository/model details, Board successors and Usage account selection. #43747
• Keep code-fence names literal in the feature sheet instead of consuming their rows as diagram or tablature blocks. #43747
• Add mandatory continuity snapshot schema 2 with exact unread message coordinates, original-message hashes and typed refusal causes. Preserve valid records in later summaries and summarized requests, refuse destructive purge when an unread source no longer fits, and keep hole-bearing snapshots from certifying wholly read Memory ranges. This foundation does not enable message skipping; the remaining lifecycle work is tracked in #37850. #43749
• Record volatile per-message inference using the existing structured continuity status so TUI can decode its actual outcome. #43749
• Preserve exact unread message records in mandatory schema 2 atom and official-turn Memory receipt identities, including Prepared recovery and unchanged-fact commits. Expose accounted coverage separately from wholly read range e...

v0.58.0

[0.58.0] - 2026-10-16

Upgrade notes

• skill-activation-events.jsonl written after this version records
  async_result_delivered rows; earlier binaries reject the unknown kind and
  cannot decode the ledger for that trace, so do not roll back once such a row
  is written (#43179).
• skill-activation-events.jsonl written after this version records
  async_action_observed rows; earlier binaries reject the unknown kind and
  cannot decode the ledger for that trace, so do not roll back once such a row
  is written (#43188).
• Stored keeper_msg requests move from schema 4 to 5 and prepared execution journals from schema 1 to 2, without conversion. Old requests are refused as unsupported keeper_msg request schema_version; old journals cannot resume. Before replacing an existing runtime, finish or explicitly resolve its pending requests, result waits and completion delivery using that runtime. Keep the old base path and its artifacts for diagnosis; start this candidate against a fresh base path. The affected partitions are <base-path>/.masc/keeper_msg_requests/{active,terminal,execution_journals}. Do not clear the shared keeper_msg_requests root: it also retains owned-job and producer authority. No automatic deletion or in-place migration is performed. (#43201)
• Execution journals move from schema 2 to 3 without conversion. Finish or explicitly resolve pending Composition runs and completion delivery on the original runtime before replacing it. Preserve the original base path and its artifacts for diagnosis, and use a fresh base path for this candidate. Existing requests retain schema 5; old named requests without a journal do not gain logical successor authority. Affected authority remains in <base-path>/.masc/keeper_msg_requests/{active,terminal,execution_journals,named_composition_runs,prepared_continuations}. Do not purge the shared request root. (#43202)
• Named async calls through the internal descriptor-only compatibility adapter require a frozen turn surface. Production Keeper bundles already supply it; this does not add a runtime setting or scheduling budget. (#43202)
• Producer intents are private durable records in <base-path>/.masc/keeper_msg_requests/named_submissions. Preserve them with the existing request and journal partitions; missing original intent does not authorize replacement submission. This adds no migration or runtime setting. (#43205)
• Persisted nested Skill result evidence now requires activation and activation_frame_sha256 fields; older nested result records without those fields are rejected as Malformed_draft (#43208).
• Keeper async request records now use schema_version = 6 (persistence_failed carries a structured attempted_status object); schema_version = 5 records are rejected without migration (#43210).
• Execution journals from earlier development candidates without the strict original Keeper-turn and replay-mode fields are rejected; missing identity is never inferred or rewritten into a fresh launch (#43216).
• Existing workspaces require an operator-selected reset before this format cut can serve approvals: archive <base-path>/.masc/gate/pending.json together with pending.log.jsonl, plus always-allowed.json; this removes pending approvals, retained one-shot grants and all remembered rules from active use. Preserve a full gate backup, reissue requests and explicitly approve remembered rules again. See upgrade and rollback notes; this PR does not reset runtime state. (#43361)

Added

• Async composition completion prompts include canonical selected results and their original task, turn and run references. Larger projections retain exact result lookup coordinates; missing, inconsistent or unowned records remain explicit errors, and Keeper instructions use usable completion results directly (#42841).
• Prepared compositions can freeze a reusable Skill proposal and use the same draft digest to validate and publish its exact source bytes. Owner, package and frozen tool contracts are rechecked before publication. The generated plan codec preserves JSON values without manual TOML rewriting. (#42869)
• Added an exact frozen inline Skill compiler API with fixed parameter binding,
  collision-free node namespaces, named export mapping, and whole-child failure
  dependencies. Public draft authoring and dispatch activation integration follow
  separately; async children still require durable suspension. (#42889)
• Added durable nested composition invocation provenance and exact parent-result delivery correlation, preserving distinct child identities across readback. Skill evidence and dashboard decoders support the new typed invocation. Actual draft/executor activation wiring follows separately (#42895).
• Public inline composition drafts freeze exact child Skill recipes and mappings, revalidate them before dispatch, record attempted children through the canonical turn journal, and retain child dispositions and useful exports with the parent result. Blocked children do not activate. (#42902)
• Keeper event queues preserve the actual admission clock across duplicate intake, retention, deferral, reprioritization and fresh reads. Health and Dashboard distinguish observed residence, an empty queue and explicit missing or invalid clock evidence without deriving lifecycle decisions from duration. (#42936)
• Continue a prepared async composition with its original resume_run_id and
  draft digest after canonical prior-request settlement; reuse completed node
  results and occurrences under the original run, invocation and task. #42973
• Add Keeper isolated Docker job start, status and cancellation tools with
  durable create/start intentions, exact saved container identity and original
  source task/turn context across subsequent calls. #42989
• Capture available terminal logs without process-preview truncation and retain
  their artifacts in owned journals while keeping
  writable program/CLI data outside blob-maintenance authority sources. #42989
• Bind Keeper isolated jobs to their original invocation before preparation,
  so a lost start reply can recover and reconcile the same durable job. #42995
• Reject changed source or command bindings before backend calls and preserve
  unknown launch intentions without creating or starting a replacement. #42995
• Added the read-only, concurrent keeper_job_result tool. Prepared async Compositions can retain a producer-owned wait and explicitly resume the same run to consume that original job's complete outputs. Rechecking preserves the original occurrence IDs and reuses completed siblings; generic deferrals and unknown command effects remain non-replayable. Direct pending result reads let the Keeper continue other work. Job-completion reconciliation and automatic wakes remain separate work. (#43000)
• Match the owned-job composable output schema to supported structural types and select stdout through its canonical _blob wrapper. (#43000)
• Preserve frozen tool contracts as canonical literal JSON so schema properties named _blob cannot be mistaken for artifact references during prepared-run loading. Actual execution/input references retain strict manifest validation. (#43000)
• Recover pending isolated job results on startup and the existing maintenance pulse, then deliver durable notifications with the original job, task, output references and conversation. Independent job fibers let maintenance and new jobs continue while a backend is blocked; committed results need no backend call to recover delivery. (#43009)
• Prepared Composition waits capture the exact previous worker, canonical waiting record and saved node occurrences for continuation admission. Same-job waits retain separate node identities. (#43037)
• Resume canonically ready original prepared job-result waits from server startup, the existing maintenance pulse and durable job completion hints using current TOML/meta, published Skills and exact owner/node admission, without requiring a provider turn or relaunching the job (#43109).
• Prepare and run an isolated owned-job launch inside a task composition, passing its original job ID and complete artifacts to dependent nodes while retaining the completed launch during continuation (#43129).
• Run exact inline Skill children inside prepared async parents with durable original trace, runtime, snapshot and Task provenance, actual child admission and full result scopes (#43131).
• Correlate prepared async status results with the original admitted request,
  journal and recorder. Seal the actual SDK occurrence in the durable result
  manifest, preserve staged handoffs across ID reuse, and clear stale bindings
  on lookup or SDK validation failure. Provider responses and official-client
  handoffs retain separate inline/reference evidence. Correlation reaches the
  Keeper log; durable async Skill-delivery/action attribution remains pending.
  (#43157)
• masc prerequisite-actions searxng offers the one step that fits the
  masc-searxng Docker container: searxng_docker_run when none exists
  (writes <base>/.masc/searxng/settings.yml unless a file is there, pulls an
  image fixed by tag and digest, starts it with --restart unless-stopped,
  published on 127.0.0.1:8888 only) and searxng_docker_start_existing when
  one is stopped (docker start, nothing written). A running, paused,
  restarting or unusable container has no step. The receipt waits up to 30
  looks for a JSON search to be answered and says to read docker logs masc-searxng when it is not. dependency_readiness
  (masc.searxng_readiness.v1) names Docker, the container and the endpoint
  separately, at http://127.0.0.1:8888, not localhost (#43168).
• Record prepared async child result handoffs in the original session's Skill
  event ledger. Preserve the original admission frame and Task attribution,
  validate it during append and replay, and retain physical ...

v0.57.0

[0.57.0] - 2026-10-16

Upgrade notes

• /health: the scheduler lag percentiles and threshold counts moved under .scheduler.lag (#43176). Scripts that read them at the .scheduler top level must read .scheduler.lag. The repository comparison script was updated in #43199. The old key is gone and a reader gets null without an error, so a monitoring script that compares a lag threshold silently reads "no lag". See Breaking.
• Wiki search (masc_wiki_search, keeper_wiki_search) orders results by BM25 and searches only the title, summary, tags and body of pages whose header reads. The matching rule is unchanged, but a query no longer matches the author or source line (#43178). No configuration change.
• Local developer switches: run scripts/opam-pin-external-deps.sh --install once to pin eio_posix (#43255).
• Board MIDI playback needs midi_soundfont under [tui] in runtime.toml (#43166).

Breaking

• /health scheduler lag moved from .scheduler.<field> to .scheduler.lag.<field> (#43176). A reader of the old path receives null, not an error. The fragments carry no Breaking marker; this entry is the release lead's disclosure, and the operator can reclassify it.

Experimental

The user-facing features under Added below have no recorded execution evidence in their fragments, so they are Experimental until a dated run log naming the head promotes them. Guide status: /features, attachment opening and the MIDI soundfont setting have a guide in docs/TUI-GUIDE.md. Guide: none found in docs/TUI-GUIDE.md (read by the product owner at the cut) for /listen, the MIDI metadata reader, Candle pricing, exact-lane admission and the shared workspace memory log.

Added

• The alphaTex tab renderer keeps \title, \tempo and \ts and draws a header line ahead of the tab (♩=96 · 4/4 · "Riff", only what exists) plus a physical measure-number row above each system (#43163).
• New pure SMF reader Masc_tui_midi: format, tracks, names, PPQ, merged tempo map, time signatures (denominator decoded as a power of two), duration through the tempo map; SMPTE division and format 3 fail as explicit variants. User-visible from #43166 (#43164).
• Board read pane: attachments are numbered [N] and digit keys 1-9 open them — audio plays locally, MIDI plays via fluidsynth (new [tui] midi_soundfont setting, read at boot) or opens externally with the reason, Guitar Pro and other files save to the local cache and open in the default app. A status line at the pane bottom reports what happened, including a parsed MIDI summary (tracks, BPM, time signature, length) (#43166).
• Candle 지갑별 누적 반감기 차감액(decayed_milli), 마지막 이벤트 시각(last_event_at), 유통 통화량·활동 키퍼 수 요약(supply_summary) 및 [shop.pricing] 통화량 연동 동적 가격(Fixed | Supply_scaled)과 구매 시점 가격 상한 검증(expected_price_milli / Price_changed)을 더한다 (#43172).
• Add typed exact-lane admission (Runtime.lane_requirement, Runtime.runtime_capability, Runtime.refusal, Runtime.admits) and CLI slot partitioning (Keeper_lane_cli_oneshot.partition_cli_slots) with per-slot refusal reasons surfaced in workspace curator execution metadata and TUI lane inventory details (#43174).
• Workspace_memory_log and Workspace_memory_reader add the append-only shared workspace memory JSONL log (Prepared -> Change* -> Committed | Aborted) with file-locked monotonic sequence validation, mid-append truncated-tail crash recovery, and per-keeper reader cursors with context-overflow bisection and single-entry reference fallback (#43175).
• Keeper chat: /listen plays the newest playable attachment in the conversation — audio through the local player chain, MIDI through fluidsynth with [tui] midi_soundfont (same machinery as the board numbered keys). Bytes resolve from the block, the workspace media store, or a local file (#43189).
• The alphaTex score reader reads rhythm effects: a dot ({d}), a double
  dot ({dd}), a tuplet ({tu 3}) and a grace note ({gr}) change the
  latest beat's length, counted in ticks so every form lands on an integer
  (#43194).
• Lane Add-on binding inventory issues now name their failure kind: details carry a bracketed tag ([identity-changed], [absent-unconfirmed], [parse], [non-regular directory], [unreadable]) so publication contention reads apart from real damage without opening the store (#43212).
• /features opens a one-screen feature sheet — five sections, 31 rows, one sentence per feature beside the wire name that opens it (? keeps the key-level reference, /help keeps the command catalog) (#43217).
• Sheet rows draw plain text on purpose: the chat notice path renders control bytes as text, so a styled row shipped as a visible [2m; hierarchy lives in the diamond and the column instead of colour (#43217).
• docs/TUI-GUIDE.md "What can I do here" now names /features as the discovery one-liner (#43217).

Changed

• /health .scheduler now nests its single-pass wake-up lag percentiles and 50ms/200ms threshold counts under .scheduler.lag directly from Scheduler_lag (#43176).
• masc_wiki_search and keeper_wiki_search list the closest page first
  inside each tier, by BM25 over the wiki's pages. Hangul is cut into
  two-character pieces, so a two-character Korean word is a term of its own.
  The matching rule is unchanged. For a page whose header reads, only the title,
  summary, tags and body are searched, so a query no longer matches the
  author or source line. A page whose header does not read is still
  searched whole (#43178).
• The Keepers detail "Current failure" section now leads a fenced empty
  assistant turn that observed no effect with a human sentence and the next
  action (message the keeper again to retry; this runtime never switches to
  another runtime automatically) instead of the
  provider_attempt_effect_fenced wire. A fenced turn where a tool may have
  run keeps the wire, since a retry could repeat that tool. The
  wire follows dimmed underneath as runtime_blocker_signature, so log
  searches keep their key, and the dashboard summary follows the same
  reading (#43195).

Known issues

• Full regression run 38850227393 (head 9b6212a, TARGET_SUITES empty) failed. The release lead attributed it, from a quoted log reading, to an environment candidate: Unix.ENOMEM from io_uring_queue_init in test_tui_chat_search_projection under the parallel full run. It is a candidate, not a confirmed cause.
• Full run 38855354535 (9b6212a) and full run 38859872654 (ff7738c, the cut base) completed successfully.
• Shared workspace memory log (#43175): whether the JSONL log rotates or compacts, whether it is wired into a live path, and whether the per-Keeper reader cursor resumes after a downgrade to 0.56.0 and an upgrade back are unconfirmed. Treat it as Experimental.
• Commits merged to main after ff7738c belong to v0.58 unless they fix a release-blocking defect.

Also in this release

• Fixed: 3 entries
• Documentation: 2 entries
• Internal: 6 entries

Every entry is in CHANGELOG.md under ## [0.57.0] - 2026-10-16.

Full changelog: v0.56.0...v0.57.0

Verified candidate: https://github.com/jeong-sik/masc/actions/runs/38866127177

v0.56.0

[0.56.0] - 2026-10-14

Upgrade notes

• MASC_CLUSTER_NAME is no longer read. All state lives under <base>/.masc;
  nothing creates or reads <base>/.masc/clusters. A workspace that used a
  named cluster keeps that folder untouched and unread, but tool blob cleanup
  no longer counts references from it, so blobs only that folder referenced
  are removed by the next cleanups. Move or archive the folder before
  upgrading to keep them (#43017).
• The cluster field is removed from /api/v1/status and from the dashboard,
  operator snapshot, operator digest and briefing JSON. masc_status prints a
  Project: line instead of Cluster: (#43017).
• .masc/root-state.json is no longer written or read; .masc/state.json
  alone says a workspace is initialized. An existing root-state.json is
  left in place and can be deleted (#43074).
• connectors/browser/install-host.sh is removed. Scripts or docs that call it
  should run masc browser-lane-setup --mode extension instead (#42867).
• resources/read on masc://wiki/log returns only the last 64 KiB of the log,
  starting at a line boundary. A client that read the whole log through this
  resource must read log.md directly (#43124).
• After upgrading, every Keeper request carries a "Workspace wiki" paragraph: one line per wiki page, built at the start of the turn. Its size grows with the number of pages. Set enabled = false under [wiki_contents] in runtime.toml (or MASC_KEEPER_WIKI_CONTENTS_ENABLED=false) and restart to turn it off. Add the table to a live runtime.toml only after this version is running; earlier versions do not know it (#42961).

Added

Items marked Experimental have no recorded run on a user's path yet. Each is
promoted in a later release once a live run on that path is recorded.

• Experimental: masc web-search-setup prints each web search provider's state and the
  search order a call would use, and writes the [web_search] section of
  runtime.toml when given options. It never writes an API key, and it refuses a
  SearXNG address that is not an http or https URL (#42821).
• Experimental: masc prerequisite-actions geckodriver and masc prerequisite-actions firefox
  show whether the program the browser lanes start answers --version, and at
  which absolute path, and offer an install action: a Homebrew step on macOS, the
  project's own page on Linux. Neither action edits runtime.toml (#42843).
• Experimental: masc browser-lane-setup --mode extension installs the browser lane for a
  workspace: the lane token, the native messaging host and its launcher, the
  Firefox native messaging manifest, and the MASC extension, which the binary
  now carries. It starts no browser. Without --mode it prints the lane's state
  and changes nothing (#42866).
• Experimental: masc browser-lane-setup --mode bidi installs the browser lane host and its
  launcher and writes the [browser.live.bidi] table of runtime.toml, so the
  MASC server starts a Firefox of its own and attaches the host to it. It writes
  no extension and no native messaging manifest. A table that is already there
  keeps its values; --firefox, --profile and --port change only the key
  they name. --mode can be given twice to connect both routes, and an option
  the chosen modes do not use is refused (#42941).
• Experimental: each Keeper turn carries the wiki table of contents: one line per wiki file (title, file, one-line summary), built from the pages at the start of the turn rather than read from index.md, followed by the request's route to keeper_wiki_read (direct, through keeper_tool_search, or unavailable). A wiki listing failure shows a fixed line without the IO error. Autonomous turns record the paragraph as the wiki layer of the dynamic-context receipt. [wiki_contents] enabled in runtime.toml (default true) turns it off (#42961).
• Experimental: masc browser-lane-setup --mode host installs the browser lane host and its
  launcher and nothing else: no extension, no native messaging manifest, no
  runtime.toml. It is for a browser the operator attaches by hand and for
  bringing an installed lane's host up to the running build (#42976).
• Experimental: masc browser-lane-setup --mode automation writes the geckodriver path of the
  automation lane into the runtime.toml the server reads. It names the
  geckodriver that PATH finds first when that file answers --version
  (--geckodriver names another); --browser writes binary, only when named.
  Keys already in the file keep their values and are edited where they are, in
  [browser.automation] or directly in [browser]. It installs no host,
  extension or manifest (#43093).
• Experimental: adding the word rhythm to an ```alphatex fence draws a rhythm row under the lowest string: one w/h/q/e/s letter in the first cell of each beat. A fence without it draws the same tab as before, cell for cell (#43118).
• Experimental: The install journey asks "5 · Give imp tools (optional)" after the sandbox
  step, as one checklist whose rows start marked. The browser row finds
  geckodriver and Firefox, offers the install menu for what is missing, and runs
  masc browser-lane-setup --mode automation before masc setup starts the
  server. The GitHub row offers the login gh holds on this computer (account,
  scopes and token source are shown first) and, once masc setup has created
  imp, passes the token to masc keeper-github set-token --keeper imp on
  standard input; without a login it runs the one-time code login. Nothing is
  installed or written until the list is confirmed, unmarking every row skips
  the step, and quick setup only prints the rows with their commands (#43119).
• Experimental: Keeper compositions can declare typed output exports and preserve complete node inputs/results in a durable execution artifact. TOML and structured JSON plans expose the existing independent-branch failure policy and retain both contracts when parameters are bound (#43137).
• Experimental: Keepers can prepare and inspect a task-specific read-only composition without publishing a shared Skill, then run the exact Keeper-bound draft inline or asynchronously. Drafts bind inputs, mode and frozen tool contracts, and record the source invocation before dispatch (#43137).
• Experimental: Independent named inline Skill compositions can overlap when every leaf permits concurrent reads. Each invocation keeps its own causal history, run identity, observations and activation evidence while the owning turn continues to collect all completions (#43137).
• Experimental: The install journey's "5 · Give imp tools" checklist gains two rows that
  connect a Firefox: BiDi (MASC starts a Firefox of its own on a local debugging
  port, with a notice that the port has no authentication) and the MASC add-on
  (through your everyday Firefox, with a notice that Firefox removes the add-on
  when it restarts). Both start unmarked and are shown only when Firefox was
  found. The chosen routes go to one masc browser-lane-setup call, which plans
  all of them before writing any, and run before masc setup starts the server.
  Quick setup marks each row [x] or [ ] in its list and runs nothing (#43138).
• Experimental: Add scripts/migrate-lane-addon-bindings.py, which classifies lane add-on binding records written by v0.48.0 or earlier using the container's own rules, and can move the records that are safe to move out of the read path (#43139).
  • Usage: python3 scripts/migrate-lane-addon-bindings.py --base-path <masc base path> [--write-out <archive dir>]. The default run is classify-only and changes nothing; it prints one line per record and the before/after counts. --write-out DIR (run with the server stopped) additionally archives every detached legacy record byte-identically to DIR/<name>.json.legacy (hash-verified) and renames the store file to <name>.json.migrated, which the store skips because read_bindings reads only files ending in .json. Records that are not detached are never moved or rewritten: repairing one means adding top-level visibility and source_access, which is an authority decision, and the tool reports those instead.
• Experimental: The install journey's "5 · Give imp tools" checklist gains a web search
  check, marked from the start. Confirmed, it runs masc web-search-setup with
  only the workspace, which writes nothing: it shows which providers have a key
  and which variable to export for one that has none. It runs in the
  environment the server masc setup starts gets, without MASC_BASE_PATH and
  MASC_CONFIG_DIR. A refused or unstartable command says how to look again
  and does not end the journey. Quick setup lists the row and runs nothing
  (#43145).
• Experimental: masc_web_search gains a zai provider over z.ai's Web Search MCP server
  (GLM Coding Plan). It reads ZAI_API_KEY, the variable the glm-coding
  model provider already uses, and joins the chain only when named in
  provider, provider_order or fallbacks: a key that is present on every
  GLM install is not asking for the plan's search allowance to be spent. A
  search is three requests, each under MASC_WEB_SEARCH_TIMEOUT_SEC
  (#43162).

Changed

• The "no web search provider is configured" failure names every credential
  variable and points to masc web-search-setup. Provider selection and the six
  provider fetchers read their credentials through one table,
  Web_search_provider (#42821).
• The TUI no longer shows "persistence failure history unavailable; provider completeness and liveness unknown" as a CHILD HEALTH line on every Child content read. The value never changed, so it read as an alarm and hid real diagnostics. A short caveat that failure history only lives as long as the collector is attached only when a real failure is shown (#42857).
• The lane token rule (at least 16 visible ASCII characters, whitespace around
  it trimmed) ...

v0.55.0

[0.55.0] - 2026-10-14

Upgrade notes

• Check runtime.toml before upgrading (since 0.54.0). A provider row whose catalog entry needs an API key must have a [providers.<id>.credentials] block. The server starts without it, but the first call routed to that row is refused, and every Keeper that uses the row stops with a configuration error. The deployment preflight does not catch a missing block; find such rows in the dashboard or TUI runtime.toml editor and add the block before upgrading (#42927, #42933).
• Keeper files never re-saved since 0.41.0 are now rejected. Keeper metadata that still carries trace_history or last_handoff_ts is no longer current. 0.41.0 dropped both keys on read for one release (#39025); that tolerance is gone, so such a file is treated like any file with a key outside the schema: the runtime logs it as unreadable and reads it as absent, the boot path moves the file aside as <name>.json.rejected-<time>-… and re-materialises the Keeper from its declaration with fresh counters (the parked copy keeps the old ones for recovery), and the deployment gate rejects it. A Keeper saved at least once on 0.41.0 or later has neither key. To clean a file that was never re-saved, stop the server, confirm it has exited, and run for f in <base-path>/.masc/keepers/*.json; do cp -p "$f" "$f.bak" && cp -p "$f" "$f.new" && jq 'del(.trace_history, .last_handoff_ts)' "$f.bak" > "$f.new" && mv "$f.new" "$f"; done, which keeps a .bak copy of each file (#43010).
• Lane add-on bindings written by v0.48.0 or earlier are no longer read. Retained lane add-on binding files written by v0.48.0 or earlier have no visibility and source_access, and this version does not read them. List them with rg --files-without-match '"visibility"' <base-path>/.masc/lane-addons/bindings, and again with '"source_access"'. A detached record leaves the declaration that names it applied, stays listed under the configuration issues, and keeps slice at complete: false until the operator moves the file away. A record that is not detached stops the declaration that names it, and the tool cannot detach it, because the container of such a record is cleaned up only through a readable record; the operator writes visibility and source_access into the file by hand. The accepted values are in docs/guides/lane-package-activity.md (#42868).
• Tool arguments that used to be read leniently are now refused. Check any script or saved call that sends them.
  • masc_keeper_up network_mode: a non-string value was ignored and the keeper TOML's mode was used. It is now refused with network_mode must be a string (#42931).
  • masc_keeper_up instructions: a non-string value was read as absent and the keeper TOML's instructions were kept. It is now refused with instructions must be a string. An empty string still reads as absent (#42938).
  • masc_browser_read mode: a non-string value was read as text. It is now refused, and an unknown spelling is refused with mode must be one of … (#42934).
  • masc_tasks and keeper_tasks_list status: a value that is not one of the six task statuses, including the empty string, answered "No tasks." or an empty page. It is now refused with the accepted values (#42980).
• Thinking replay and downgrades. This version reads provider response events written before the thinking-prefix digest (#42943). Whether an older version reads the events this version writes was checked at the decoder level only, not by running one (#42729, #42875).

Known issues

• A row that points a catalog provider id at a proxy endpoint needing no key is refused at its first call since 0.54.0. A row cannot yet declare "no key" (task-2314). Rename the row to an id the catalog does not know and declare its endpoint and model capabilities yourself, and it runs as before. A row renamed this way has no model discovery (#42927, #42933).
• When the server refuses to start on a store left in an unrecoverable publication state, the message recommends --accept-store-quarantine. That option is refused in this state too; only the second route in the message (repair, then validate-stores) works, and the repair procedure is not documented yet (task-2288).
• The wiki and the stores that moved under .masc/ in 0.54.0 look empty when files are still at the old place, and no screen says so. Move them as the 0.54.0 Upgrade notes table shows (task-2300).

Added

• Experimental: masc_wiki_lint reads the wiki and reports broken links, links it does not follow, orphan pages, pages without sources or with only hearsay, and pages whose header does not read. It writes nothing. Usage: call masc_wiki_lint with {}, or narrow with kind, page, limit and cursor; see docs/guides/wiki-lint.md (#42969).

Changed

• masc_keeper_up reads network_mode once and hands the typed mode on: an unknown spelling is refused at parse with the same message, a non-string value is refused with network_mode must be a string instead of falling back to the keeper TOML, egress_allow is checked against the parsed mode (so "Policy" is the policy lane there too), and the keeper TOML records the canonical spelling (#42931).
• masc_browser_read reads mode once into a closed variant: an unknown spelling is refused with mode must be one of … right after the argument-name and framePath checks, before the destination, scope, frame and maxChars checks; a non-string mode is refused instead of being read as text; and the schema enum is checked against the decoder in test_enum_mirror_sync (#42934).
• masc_keeper_up refuses a non-string instructions with instructions must be a string instead of reading it as absent and keeping the keeper TOML's instructions; the empty string still reads as absent, and a whitespace-only string is still read as instructions (#42938).
• The JSONL prune pass reads directories and removes day files on a system
  thread instead of the fiber that runs it, for dated stores
  (Dated_jsonl.prune) and the flat stores the server prunes by mtime. The
  two flat-store prunes are now one prune_flat_files_older_than ~matches
  (#42947).
• The dashboard tool surfaces no longer draw raw wire names in their last six spots: the executor list row, the executor detail title, the executor result rows, and the tool inventory card title pass the name through the shared display rule, so keeper_task_done renders as KeeperTaskDone while kebab-case skill slugs and already-PascalCase names stay untouched (#42979).

Removed

• masc_runtime_verify no longer returns slot_error, props_error and models_error in each runtimes row; they were always null. Nothing in this repository reads them; readers outside it were not checked (#43023).

Also in this release

• Fixed: 20 entries
• Documentation: 2 entries
• Internal: 44 entries

Every entry is in CHANGELOG.md under ## [0.55.0] - 2026-10-14.

Full changelog: v0.54.0...v0.55.0

Verified candidate: https://github.com/jeong-sik/masc/actions/runs/38516035987

v0.54.0

[0.54.0] - 2026-10-13

Upgrade notes

• Check runtime.toml before upgrading. From this version a provider row
  whose catalog entry needs an API key must have a
  [providers.<id>.credentials] block. The server starts without it, but the
  first call routed to that row is refused, and every Keeper that uses the row
  stops with a configuration error. Find the rows that lack the block and add
  it before upgrading. A row that points a keyed catalog id at a proxy that
  needs no key cannot take a block; follow the Known issues entry. Add the
  block in the dashboard or TUI runtime.toml editor, whose save reloads the
  loaded runtime table, or restart the server after editing the file by hand:
  a file edited on disk is not re-read by a running server. After that, the
  next turn that reaches the row is no longer refused for this reason
  (#42927, #42933).

• Stop the server and move these folders before the first start. From this version the folders below are read only under <base_path>/.masc/. Anything left at the old place is not read and is not deleted.

  Old place	New place
  <base_path>/docs/wiki (docs/library up to 0.52)	<base_path>/.masc/wiki
  <base_path>/data/tool-events	<base_path>/.masc/tool-events
  <base_path>/data/keeper-wake-payload	<base_path>/.masc/keeper-wake-payload
  <base_path>/data/verdicts	<base_path>/.masc/verdicts
  <base_path>/event-queue-bulk-backups	<base_path>/.masc/event-queue-bulk-backups

  If this version has already run once, the new folders exist and a plain mv nests the old one inside; follow the #42789 entry below (#42757, #42789).

• (Since 0.53.0, listed there only under Removed) scripts/deploy.sh does not read config/keeper.env or .env. Deploys take every variable from the invoking shell (#42513).

• The wiki moved from <base_path>/docs/wiki to <base_path>/.masc/wiki. The
  old directory is not read. A workspace that has pages moves it while the
  server is stopped: mv <base_path>/docs/wiki <base_path>/.masc/wiki
  (#42757).

• Eight scripts no longer fall back to a folder under the home directory when
  no base path is named: measure-keeper-denial-streaks.py,
  measure-tool-roundtrips.py, capture-tui-screenshots.py,
  capture-tui-lane-runs.py, probe-structured-output-enforcement.py,
  memory_os_judge_eval.py, bench-web-tools.py and searxng-local.sh start.
  Pass the script's flag or export MASC_BASE_PATH (#42762).

• Tool events, keeper wake payloads, verdicts and event-queue bulk backups
  are kept under <base_path>/.masc. Before this version starts for the
  first time, with the server stopped, move <base_path>/data/tool-events,
  <base_path>/data/keeper-wake-payload and <base_path>/data/verdicts to
  <base_path>/.masc/ under the same names, and
  <base_path>/event-queue-bulk-backups to
  <base_path>/.masc/event-queue-bulk-backups if it exists. Rows left at the
  old places are not read. Once this version has run, the new folders exist
  and a plain mv would nest the old one inside (.masc/verdicts/verdicts),
  where it is not read either: move the YYYY-MM month folders instead, and
  append a day file that exists on both sides (#42789).

• install.sh --uninstall --purge-data removes these four stores with the
  rest of <base_path>/.masc; it left <base_path>/data behind. The
  dashboard's workspace file view no longer lists them (#42789).

• The container images no longer declare the /app/data volume, and
  docker-compose.yml drops masc-data and masc-oneclick-data. The old
  volume stays on the host but nothing references it, so docker volume prune would delete it: move its three folders first. With the service
  stopped, attach both volumes to a throwaway container, for example
  docker run --rm -v <data volume>:/from -v <state volume>:/to busybox sh -c 'for d in tool-events keeper-wake-payload verdicts; do [ -d /from/$d ] && mv /from/$d /to/$d; done', where the two names are what docker volume ls
  shows for masc-data and masc-state (or their oneclick pair)
  (#42789).

• skill-usage-stats.py, analyze-keeper-execute-failures.sh and
  msx-fetch-homebrew-carts.sh no longer read the current directory when no
  base path is named; pass the flag or export MASC_BASE_PATH.
  audit-keeper-fleet-readiness.py and keeper-production-readiness-gate.py
  exit 2 instead of 1 when none is named (#42800).

• MASC_TELEMETRY_RETENTION_DAYS, MASC_TOOL_CALL_LOG_RETENTION_DAYS,
  MASC_AGENT_CORE_EVENTS_RETENTION_DAYS and
  MASC_TOOL_USAGE_LOG_RETENTION_DAYS are removed. Telemetry, tool calls,
  agent core events and tool usage keep day files for the workspace window
  (MASC_JSONL_RETENTION_DAYS, then runtime.toml
[maintenance].jsonl_retention_days, default 30). A machine that set one
  of them shorter than the window now keeps that store for the window
  (#42878).

• Provider usage history (16 days) and wire capture
  (MASC_KEEPER_WIRE_CAPTURE_RETENTION_DAYS) are pruned by the server's
  startup and 24h prune instead of on append. A process other than the server
  that writes a dated store no longer removes old day files itself (#42878).

• Provider credentials are declared only in runtime.toml under
  [providers.<id>.credentials]; the catalog no longer knows environment
  variable names (#42543, #42933).

• Provider rows that use the same key must each declare the same credential to
  share a quota window. Before, they shared one without a declaration (#42543,
  #42933).

Known issues

• A row that points a catalog provider id at a proxy endpoint needing no key is
  refused at its first call in this version. A row cannot yet declare "no key"
  (task-2314). Rename the row to an id the catalog does not know and declare
  its endpoint and model capabilities yourself, and it runs as before. A
  row renamed this way has no model discovery (#42927, #42933).
• When the server refuses to start on a store left in an unrecoverable publication state, the message recommends --accept-store-quarantine. That option is refused in this state too; only the second route in the message (repair, then validate-stores) works, and the repair procedure is not documented yet (task-2288).
• The wiki and the stores that moved under .masc/ look empty when files are still at the old place, and no screen says so. Move them as the Upgrade notes table shows (task-2300).
• The TUI Resources screen does not follow the resource list's next page, so a list longer than one page (512 entries by default) is cut off at its end, where the wiki rows sort (task-2309).

Added

• Experimental: Read the JSONL day-file retention window from runtime.toml [maintenance].jsonl_retention_days when MASC_JSONL_RETENTION_DAYS is unset, so operators can set retention per workspace; the startup prune log names the window source (#42625).
• Experimental: Allow Lane Addons to use an Apple container microVM with verified image identity, isolated networking, read-only root and owned persistent state; keep Docker as the default for existing Lane Addons. (#42764)
• Experimental: Retain the runtime for recovery and refuse runtime changes that would silently replace an installation's persistent state. (#42764)
• Experimental: Board post attachments accept the kinds file, audio, score and midi and an optional name; the dashboard reads them and offers a stored one as a download No guide yet (none found in docs/guides, TUI-GUIDE.md or KEEPER-USER-MANUAL.md) (#42766).
• Experimental: POST /api/v1/artifacts stores an uploaded file of up to 32 MiB in the artifact store and returns its sha256 and size No guide yet (none found in docs/guides, TUI-GUIDE.md or KEEPER-USER-MANUAL.md) (#42767).
• Experimental: The TUI board read pane lists a post's attachments by kind, name and size No guide yet (none found in docs/guides, TUI-GUIDE.md or KEEPER-USER-MANUAL.md) (#42769).
• Experimental: TUI board compose attaches local files with Ctrl-A and uploads them when the post is sent; a path that is not a regular file, or a file over the artifact store's 32 MiB limit, is refused before it is read No guide yet (none found in docs/guides, TUI-GUIDE.md or KEEPER-USER-MANUAL.md) (#42775).
• Experimental: The TUI highlights alphatex code blocks No guide yet (none found in docs/guides, TUI-GUIDE.md or KEEPER-USER-MANUAL.md) (#42777).
• Experimental: The TUI draws an alphatex code block as guitar tablature, breaking at bar lines to fit the pane; a score it cannot draw shows its source with the reason No guide yet (none found in docs/guides, TUI-GUIDE.md or KEEPER-USER-MANUAL.md) (#42779).
• Experimental: /queue clear in the Keeper chat cancels, in one command, the waiting messages this TUI is tracking for the Keeper on screen: it drops unsent ones, takes back one handed over for sending but not yet posted, and asks the server to cancel each one it holds in its queue. See docs/guides/tui-chat-queue.md (#42780).
• Experimental: resources/list carries one masc://wiki/<topic> entry per wiki page, titled and described by the page's own title and summary, and masc://wiki/log once the wiki has a log, so a client that only lists resources, the TUI Resources screen among them, can open a page (#42851).
• Experimental: The page listing carries only files whose name is a valid page topic: a file like notes.json.md, whose URI would read back as a different page or as nothing, stays in the masc://wiki index with its reason instead of becoming a dead listing row (#42851).
• Experimental: Usage: in the TUI, open the System / Resources screen and select a masc://wiki/<topic> row to read that page, or masc://wiki/log for the append-only log of page creations and updates. (#42851).
• Experimental: AGENT_CORE_ANTHROPIC_DROP_BLOCK=false stops adaptive Sonnet 5.5 and Haiku 5.5 completions from sending `thinking.block_binding.prefix_mismatch_behavior = "d...

v0.53.0

[0.53.0] - 2026-10-13

Upgrade notes

• The Library is now the Wiki. Pages are read from <base_path>/docs/wiki; files left in <base_path>/docs/library are no longer read, so move the ones you keep. Tools masc_library_* and keeper_library_* are now masc_wiki_* and keeper_wiki_*, and the resources moved from masc://library to masc://wiki. The old names are not accepted (#42703).
• masc_wiki_add is gone. Use masc_wiki_create to make a page under a name you choose (page, title, summary, source, body) and masc_wiki_update to replace the body of an existing page against the base_revision you read. A wiki page needs summary and revision in its header to read; a page written by hand without them is listed by file name with the reason (#42704).

Added

• GET /api/v1/keepers/<name>/chat/history/page takes a limit query parameter that scales the window (default and maximum 400 rows), and the TUI asks for 100 older rows at a time so one page no longer holds the UI loop for about 18 ms; a server without the parameter ignores it (#42202).
• exact-lane run completions now record provider usage on the run row: mark_completed takes optional usage, the wire schema gains an optional usage field, and existing v6 logs replay as None without a version bump (#42272). The curator, librarian, board attention, HITL, and candle runners pass usage from Exact_output successes.
• Run one archive-first workspace GC pass from the 24h maintenance loop, at the same cadence as the schedule retention prune: terminal tasks older than the new task.archive_retention_days runtime setting (default 30) move to tasks-archive.json without waiting for an operator to run the manual masc_gc tool. Non-terminal tasks are never archived, and the archive takes each task before the backlog commit drops it (#42282).
• merge-guard reads the leader-selected-ci commit status on member heads and refuses to merge while a leader-selected run is pending or failed (#42294).
• leader-ci answers a pending leader-selected-ci status when dispatch pins selected member heads and settles it to success/failure with if: always() (#42294).
• Retain scoped Child observation histories in the TUI reader and require full prefix validation to recover from known history rewrites. (#42306)
• Connect retained Child observations to TUI workspace read epochs and preserve running full-Audit intent through temporary identity loss. (#42307)
• Report the linked MSX core's own Git commit in machine metadata when the core build can establish it; unknown identity remains null (#42330).
• Preserve the local continuity synthesis stop branch in memory-health observations, with strict dashboard and TUI decoding and cleared reasons when execution resumes; this diagnostic evidence does not itself retire history (#42566).
• Add a glossary entry for Keeper Call Association, the TUI chat transcript-to-call-log join verdict (Masc_tui_keeper_call_evidence.keeper_call_association): its closed eight-value contract and the missing (proven absence) vs coverage_gap (unproven absence) boundary (#42569).
• Record the selected continuity snapshot fingerprint and successful bounded history projection alongside prepared-request capture identity. Summary bodies and raw unknown-origin errors are excluded; this evidence does not certify delivery or history retirement (#42602).
• Add glossary entries for Accept Rejection and Rotate-now Evidence Asymmetry: the Accept_rejected closed vocabularies (accept_rejection_kind pair, seven accept_response_shape values, three accept_no_progress_retry_kind values) with their mapping to the No_progress_* Failure Route rotations and receipt degraded_retry_reason strings, and the intentional evidence asymmetry among the 17 Rotate_now branches where only Server_error_not_transient leaves cross-turn candidate evidence (#42617).
• Add a glossary entry for Native Tool Completion, the provider-fact vocabulary for a native tool end (Runtime_native_tools.completion_outcome, seven constructors), distinct from Recorded Call Outcome (ledger record) and Tool Call Outcome (wire projection), and naming the End_observed vs Completion_unrecorded boundary with its TUI live-event consumption (Native_tool_ended, Undecodable) (#42631).
• Provider retry observations now travel from the Claude runtime through the journal, AG-UI projection, SSE schema, and TUI/decoder layers, with dashboard retry progress and response-state admission reconciled against the ownership machine (#42634).
• The web dashboard labels tool names with the shared display rule from lib/tool_display.ml: journey waterfall bars, session trace rows and Gate approval cards read keeper_task_done as KeeperTaskDone, while skill slugs like browser-lanes keep their readable name; identity_call keeps its provider · remote form (#42649).
  • Usage: always on, nothing to enable — open any run's journey, session trace or pending approvals in the dashboard and every tool name renders the label form; nothing changes if the label pipeline fails silently, entries fall back to the raw wire name.
• Wiki pages have a fixed name and a revision. masc_wiki_create refuses a name that exists, and masc_wiki_update refuses a stale base_revision and returns the current revision and body so the writer can merge and send again (#42704).
• The wiki keeps two files of its own beside the pages: index.md (one line per page with its title, file and summary, rebuilt after every write) and log.md (one line per create or update, appended). masc_wiki_list returns the index, and masc_wiki_update requires a one-line note that becomes the change's log line (#42705).
• Show image evidence inline on Kitty-style terminals and its links in the TUI verification detail, and stop the pane failing on binary evidence items (#42743).

Changed

• Native stacks land whole, once, through merge-async on their top PR; a lower PR is never selected to merge the layers below it first, and a stack that conflicts with main is restacked whole with gh stack rebase and pushed once. The constitution, contributor guides, Native GitHub Stacks guide, CI review doc, glossary, Keeper prompt, PR patrol skill and review README now say this (#42183).
• Runtime configuration data and pure diagnostic projection moved into a private canonical owner, preserving public contracts and keeping configuration effects in Runtime (#42308).
• Exact durable tool-call evidence is separated from chat rendering, and Results-mode status decoration is derived from typed receipt/transcript decisions instead of literal tool-name text (#42320).
• Teach the DOS Sangokushi III skill the observed gate breach, deferred-battle reinforcement, and confirmed city-capture flow (#42329).
• Document verified Sangokushi II monthly battle continuation, reinforcement arrival and short-frame manual combat observation in the MSX add-on guide (#42345).
• Document observed Sangokushi II ruler succession, marriage-event progression, and inspection of a surviving officer after defeat (#42402).
• Document the observed Sangokushi II recruitment food anomaly, checkpoint comparison, and merchant rice resupply (#42404).
• Show human-facing tool display labels (PascalCase) on the approval card, chat activity rows and approval rows via one pure Masc.Tool_display.label hub; wire names, keys and schemas are unchanged (#42624).
• Test-only repair for the chat handoff row: the assertion now expects the shared display label (ReadHandoffEvidence case-correct as drawn) instead of the raw wire name read_handoff_evidence, and pins that the wire name stays off the screen (#42647).
• The TUI tools list (effective surface and registered catalog) shows the shared Tool_display labels instead of raw wire tool names; skill slugs pass through unchanged. (#42648)
• Order the TUI Plan usage view by what can be used now and draw one line per window, with the unusable windows first (#42691).
• TUI chat skill rows draw the tools a skill used through the shared display rule: a Fusion lens row now reads ↳ **MascFusion** · observed action instead of the raw wire name, and slug names like browser-lanes keep their readable form. Stored records keep the wire names (#42697).
  • Usage: always on — open a keeper chat's activity pane and read the observed action rows under a skill; nothing to enable. If a name still reads raw, it is a name the server sent that is not a wire tool name, shown as-is.
• keeper_wiki_search describes what it returns: one line per matching page with its title and file name. The old description promised relevance scores and snippets that the tool never returned (#42703).

Removed

• Deploy-time env-file sourcing: scripts/deploy.sh no longer reads config/keeper.env or .env, and the readonly freeze, the preserve/restore_env_override helpers, the env-file preflight cases and the seed-list row for the file are gone. Deploys take every variable from the invoking shell (#42513).
• The retired config/keeper.env credential file is rejected from fresh config-root seeding, so a gitignored copy left in an upgraded checkout cannot ride the embedded config tree into new workspaces (#42513).
• Drop two declared-but-unread tool parameters: think_policy on masc_runtime_ollama_probe and session_name on keeper_voice_session_start. No handler or test reads either key (#42608; #42527, #42528).

Performance

• The TUI loop applies queued async results for at most about one frame per pass and returns to the keyboard, instead of applying a whole burst in one pass; passes over 20ms in a 20 second PageUp run fell from 38 to 15 (#42284).
• perf(chat): keeper-chat page rows omit stream_contract (about a quarter of page bytes; the page route serves only the TUI) (#42719, #42200).

Also in this release

• Fixed: 81 entries
• Documentation: 28 entries
• Internal: 5 entries

Every entry is in [CHANGELOG.md](https...

v0.52.0

[0.52.0] - 2026-10-12

Added

• The TUI home now shows when MASC starts the Keeper Firefox, on the BiDi
  host rows, instead of a bare browser line (#42250, with #42235's start
  record and #42227's refusal-reason note underneath it). When the host
  selector cannot tell whether the clock passed, the row says that rather
  than inventing a start time (#42227). 가이드 없음(대상 문서:
  docs/design/browser-bidi-live-host.md).

• HITL late-approvals gained an authenticated HTTP restore endpoint with
  health fields, so a deflected approval can be restored after the fact
  (#42266).

Changed

• render_chat now gets its exact durable-call association and verdicts
  from a new internal owner module and builds its rows from typed
  receipt/transcript state instead of re-parsing the Results prefix
  strings; the public renderer interface is unchanged (#42320).

• test.yml runs the full behavioural suite on a nightly schedule again
  (17:43 UTC), files each red night as a nightly-test-lane issue with a
  masc-triage declaration, so regressions outside the pull-request
  gate surface on main within a day (#42290, #42319).

• leader-ci (approved-selection recheck) surfaces refusal reasons in
  the job log and its gh api failures are visible in the run log
  (#42294, #42313, #42317, #42318).

Also in this release

• Fixed: 256 entries
• Documentation: 17 entries
• Internal: 45 entries

Every entry is in complete changelog under ## [0.52.0] - 2026-10-12.

Full changelog: v0.51.0...v0.52.0

Verified candidate: https://github.com/jeong-sik/masc/actions/runs/38188319172

v0.51.0

[0.51.0] - 2026-10-10

Upgrade notes

1. Keeper chat transcripts need fresh state (#41899). Transcripts written by v0.50.0 hold a terminal_assistant slot that this version no longer reads, so Keeper replies are not saved (transcript_persist_failed: ... unsupported transcript slot kind "terminal_assistant") and the server starts without a warning when installed with scripts/install-local-build.sh. Restarting the server does not clear it. Stop the server, back up and remove <base-path>/.masc/keeper_chat/*.jsonl (the path does not depend on MASC_CLUSTER_NAME; <name>.jsonl.lock files may stay and are recreated on the next write), then start the new server. All Keeper conversation history is removed. If keeper_chat_events/ is kept, chat-journal-audit ... Missing_terminal_row errors may be logged for up to a few hours after the reset; they do not block saving. scripts/deploy.sh refuses to continue on old transcripts; scripts/install-local-build.sh does not check, so remove them before installing. Going back to an older binary has not been verified; back up and reset before going back as well.
2. DOS checkpoints from earlier builds cannot be restored (#42145, #42147). The DOS snapshot format version rises; restore refuses older checkpoints, typed and untouched. Keep the old worker beside checkpoints you still need, or use the game's own saves with the new worker.
3. claude-opus-5 is removed from the model catalog (#41880). A runtime.toml that still binds claude-opus-5 has that runtime disabled at boot. Switch the binding to claude-opus-5-5 or delete it. Opus 5 through OpenRouter (anthropic/claude-opus-5) is unchanged.
4. Authoritative recall pins are retired (#41837). An offline preparation and rollback procedure for existing pins ships with the change; follow docs/guides/RECALL-PIN-PUBLICATION-UPGRADE.md before deploying.
5. [browser.live.bidi] (#42125). Write the table only after deploying a server that reads it.
6. BiDi host shutdown (#42043). A SIGTERM that arrives after another handled signal now ends a BiDi host immediately; the Firefox session may be left behind and need a restart before it can be attached again.

Added

• The MSX Lane Add-on can export the mounted guest-written floppy to a new catalog .dsk, preserving the original media and returning a byte-count/SHA-256 receipt, for game saves loaded after a fresh boot (#42026). Exercised with one Sangokushi II save, export and fresh-boot reload.
• DOS press and type can run an explicit instruction allowance after one input, preserving the unsent suffix and reporting delivered activity accurately (#42097). Exercised with one input followed by an explicit allowance on a Sangokushi III checkpoint.

Experimental

Not yet exercised end to end on a user path; the condition for promotion is on each line.

• Keeper Firefox. The server starts the dedicated-profile Firefox and its BiDi host when runtime.toml has [browser.live.bidi], records it in .masc/browser-lane/keeper-firefox.json, and starts it on demand for a Keeper's hover or drag (#42125, #42151, #42170, #42178, RFC #42108). A host it starts also ends any session with a Firefox on another profile (#42151). When the last host on the port ended leaving its BiDi session in Firefox (or Firefox refuses a new one), and .masc/browser-lane/keeper-firefox.json shows MASC started that Firefox, the server restarts it before starting a host; the profile is kept so logins stay, but open tabs are closed. Any other Firefox on the port is left running and the server log says why (#42186). Fixes in the same bundle: #42119, #42150. Promotion needs a real-Firefox run from server start through hover/drag, and a refusal of a Firefox on another profile.
• MSX/DOS Lane. Attachable MSX/DOS Lane packages with play and observation skills, and a local JSON command driver (#42002, #42018, #41993). Verified so far: a fake worker and fixtures. Not verified: server attach, a real Docker install, continuous play of a real game. Promotion needs attach, skill exposure and detach recorded, and one real worker session.
• Librarian admission for memory writes. Ordinary observed memory writes enter durable Librarian admission before current recall; with the Librarian switch off they take the direct path (#41996). Admission requests can be exported in isolation and collected with hash verification for retention experiments, without provider calls or Memory consumption (#42005). The admission queue file format is expected to change in the next release. Promotion needs a log of an observation write passing admission into current Memory on a real server.
• Host selector (#41909). Carried over from v0.50.0: not yet run through a real Keeper path.

Changed

• Keeper chat opens with compact speaker marks, aligned prose and opt-in metadata; background Keeper activity no longer occupies the composer (#41685). Shared TUI footers keep current actions and warnings while System owns server identity (#41703). Keeper names lead the roster; Info fields wrap and keep stale readings visible (#41712). Dashboard places decisions before passive summaries (#41723).
• Server-owned Keeper request failures are distinct transcript rows; the redundant row kind is removed (#41899).
• TUI chat history retains image, SVG, file and voice output, including media-only autonomous turns (#41955).
• Board attention ledgers no longer grow with consumed work (#41506).
• Lane tools are discovered through attached workers in MCP and Keeper; colliding export names are quarantined with typed diagnostics (#41999). HTTP machine input and screens route through attached workers (#42001).
• Codex input-too-large refusals use the context-shrink retry (#42039).
• World constitution render ceiling raised from 8192 to 12288 bytes (#42194).

Removed

• Claude Opus 5 (claude-opus-5) from the model catalog, Claude Code seed bindings and release evidence list (#41880).
• The 181 Python PTY scenarios that drove masc_tui by waiting for screen text, with their harness, dune rules and CI capture steps (#42155).
• 48 OCaml TUI test files and 1,452 of 4,143 cases that checked only drawn text, layout, width, row order, scroll offset or colour (#42165).
• The compare_tui mode of bench-tests.yml and the tui-pty-scenario agent skill (#42182).

Known issues

• A Board verdict completion may reach a Keeper one heartbeat cycle late. The completion record is not lost and is applied on the next cycle, so a Keeper that does not react right after a verdict is not an error. (task-2232)
• A Task Skill pin whose Skill was edited or deleted makes every turn of the Keeper that holds the Task fail at setup. The fix (#42208) is not in this release. (S-1)

Complete change record

• All 129 folded fragments, including Internal and Documentation entries, are preserved in v0.51.0 full changelog.

Also in this release

• Fixed: 63 entries
• Documentation: 13 entries
• Internal: 22 entries

Every entry is in complete changelog under ## [0.51.0] - 2026-10-10.

Full changelog: v0.50.0...v0.51.0

Verified candidate: https://github.com/jeong-sik/masc/actions/runs/38082111307

v0.50.0

[0.50.0] - 2026-10-09

Upgrade notes

• Each Muse account's managed configuration is replaced once on first use after the upgrade, carrying its sign-in, so no new sign-in is needed; Muse Keepers start one fresh host session because the account revision changes, and a Gate a Muse Keeper left open across the upgrade is not resumed, as with any release that changes the tool surface (#41349).

Added

• Candle accounting, payout evidence, balances and portrait accessory ownership are available through configured server, TUI and dashboard surfaces. Payments remain dependent on the configured Candle policy; see the complete change record for each stage (#39978, #39979, #39981, #40004, #40010, #40024, #40029).
• Keeper detail includes portrait accessory browsing and previews. Chat and About screens display Keeper portraits with layouts adapted to terminal space (#39883, #40013, #40020).
• Provider accounts can share model lists through model sets while retaining their own identity and binding overrides (#40096).
• Fusion results support retained source captures, named projections and Lane composer previews (#40184, #40189).

Changed

• Home retains visited conversations and presents decisions by request identity with detail and return context (#40137, #40152).
• Work and decision indexes use aligned titles and focus-aware navigation. Keeper roster navigation preserves draft cursor editing and voice input (#41558, #41583).

Removed

• /play qr is removed; invite QR codes now appear only on the card opened by /play invite or /play link (#39877).
• The hourly Issue Taxonomy reconciliation workflow is removed; issue-creation labels and on-demand drift repair remain (#41275).
• Remove the unused Lane add-on sampling recovery iterator (#41293).
• Remove 22 retired ollama_cloud model catalog rows; the corresponding local Ollama rows remain (#41474).
• The unused English Keeper prompt draft and its dashboard toggle are removed; managed asset synchronization retires the runtime copy (#41493).

Complete change record

• The complete categorized change record, including all detailed fixes, performance changes, documentation and internal changes, is preserved in v0.50.0 full changelog.

Refreshed candidate repairs

Added

• Open the shared model editor directly from Runtime All and select 272k, 500k, 750k, 1M or custom context variants while retaining account settings. (#41119)

Upgrade notes

• After installing this server, restart every open TUI: a TUI built before this change sends no workspace with a Goal transition, so the server refuses its confirm, reopen and drop with expected_workspace precondition is required until it runs the new binary (#41501).

Changed

• The GitHub release page lists the summary’s actionable sections and counts Fixed, Documentation and Internal from the retained complete change record when present, linking directly to that tagged record; releases without a separate complete record use CHANGELOG.md (#41591).

Included native execution stages

The native execution entries below describe successive changes included together: #41652 supplies the Keeper Owner restart recovery left for follow-up by #41641, and #41655 supplies the native dispatch wiring left for follow-up by #41652. Those two staged follow-ups are included in this candidate.

Added

• Native runtime calls accept caller-owned durable execution stores across regular, streaming, cooperative, and checkpoint-continuation entry points. Keeper Owner restart recovery remains follow-up work. (#41641)

Added

• Keeper Owner retains typed native execution witnesses, requeues witnessed active calls after restart, and preserves unacknowledged terminal or unknown-effect receipts. Native dispatch wiring remains a separate follow-up. (#41652)

Added

• Direct Keeper native calls retain per-call execution authority and restore exact input/checkpoints after restart, with canonical terminal readback and explicit fencing for unknown or unretained effects. (#41655)

Final candidate repairs

Changes merged from main on 2026-10-09

The candidate was brought up to current main before tagging. The sections below list what a reader acts on; the fixes, documentation and internal changes are in the complete change record.

Upgrade notes

• The lease key change means a v1 (older) server and a v2 server cannot see each other's lease. Stop the old server before starting the new one across an upgrade; starting both at once on the same BasePath is refused only while both use the same lease format. (#42032)

Added

• espeak_ng voice endpoint kind for local speech-out on Linux and macOS without say, supporting -v/-w synthesis, --voices catalogue lookup, and voice variant suffixes (+<variant>) (#41412).
• /api/v1/runtime/resolved carries each runtime's failed_attempt (time, failure kind and the Keeper that recorded it), and the TUI runtime detail draws it as "Last failure". The lane walk already put such a runtime behind the candidates that answered; the projection dropped the fact, so the reason a lane skipped its head was not visible (#41479).
• Store complete and resumable World Curator briefings so Keepers can reuse shared semantic context across source changes and interrupted synthesis (#41592).
• Browser hover_at moves a trusted pointer without clicking on an attached live Firefox BiDi tab or the automation lane, guarded by the observed URL and viewport. Extension-only live connections explain the required BiDi attachment before sending input (#41620).
• Live-client discovery identifies the host transport so callers can select the BiDi connection when the same Firefox also has an extension connection (#41620).
• H3 librarian continuity working-state meaning-preservation harness (#41725): five separate-process phases over one shared MASC root judging obligation records per-ID, per-status and whole-clause verbatim across cuts, a real process restart whose S2 phases require and store-assert a switched fixture identity via H3_FIXTURE_MODEL (checkpoint model field, default h3-fixture-a, S2 requires h3-fixture-b), and an explicit lossy-projection injection whose acceptance currently overwrites the lossless original (finding recorded).
• approve-guard.sh --print-footer --repo <owner>/<repo> --pr <number> --head <40hex> prints the exact approve-guard: footer line a reviewer should append, computed from the PR's live base/head diff (reviewed base + diff sha256). Read-only: it posts nothing, approves nothing, and refuses when combined with any approval or mutation flag (#41761).
• masc_msx_meta reports which ocaml-msx core this server linked — the core's own source digest, the digest at the CI pin, and whether they match — the way the DOS lane's core identity already does. masc_msx_checkpoint_info reads a checkpoint slot's metadata (format version, saved-at time, the core digest that wrote it, media names, saved input edge count) without restoring it, so asking what a slot holds no longer replaces the machine every spectator watches (#41773).
• Prompt presets record default prompt body hashes and show changes since saving in preset detail and restore output. Defaults remain current when restoring; drift is informational. (#41783)
• Expose the linked ocaml-dos core identity through the read-only masc_dos_meta Tool, before a game is loaded. (#41812)
• Add the read-only masc_dos_inventory Tool so operators can inspect the files and byte lengths a DOS game directory will mount before boot (#41819).
• Keep inventory and load selection aligned across directory aliases, classify non-regular entries as unavailable without opening them, and redact host paths from inventory errors (#41819).
• Capture Agent retry TUI frames with verified source and executable provenance using the targeted runner's resolved suite selection (#41891).

Changed

• Antigravity and Muse Code send a new session's carried range as composed; the start-prompt byte ceilings derived from max-context are removed, and a Muse model is no longer refused at load for a window below the host's overhead (#41369).
• Goal creation requires a non-blank title and refuses a due date already past
  its 23:59:59 UTC deadline; existing Goal dates remain editable (#41399).
• Glossary Korean wording: replaced 15 translationese terms with plain Korean across docs/spec/00-glossary.md (audit H section 5, T1-T15), e.g. Candidate Fault, Attempt Dispatch, Reasoning Effort, Seed, Librarian Gap entries; ledger is now glossed once at first ledger occurrence (#41446).
• Glossary size RFC: docs/rfc/RFC-glossary-one-line-index-and-domain-files.md proposes restructuring docs/spec/00-glossary.md (298KB, 236 entries) into a one-line index plus per-domain files, with growth evidence and open questions; no code changes (#41449).
• Deliver a reusable World Curator synthesis to Keeper turns, replacing fixed-byte claim prefixes while preserving completed shared context during refresh failures and exposing source freshness (#41596).
• When merge-guard.sh / approve-guard.sh --merge-check refuses because no approval is bound to the head and complete diff, the refusal now lists for each non-author approval which test failed (author association, first-line verdict, footer prefix, reviewed base / diff sha256 tail, a stale diff hash, or the review-scope stamp) and prints the exact footer line to copy. The same script now makes the admission decision, so the decision and the reasons come from one place (#41614).
• Print rejected-review details before a structured-verdict refusal, and diagnose scope stamps independently of malformed footers only when admission fails. Successful admission reuses each fetched review and does not fetch rejected reviews again for diagnostics (#41614).
• Open Keeper chat without timestamps, turn...