v0.1.19

Added

• Anticipatory appraisal for confirmed-goal planning and inline outbox messages:
  owner-bound commitments, verification and cost evidence derive guilt,
  embarrassment, regret, disappointment, anxiety and curiosity assessments.
  run --appraisal-evidence supplies invocation evidence; outbox anticipate
  records exact-argument predictions with optional release guidance, and
  outbox outcome links owner feedback to confirmed delivery. Supported
  exposed-error and impact records produce retrospective embarrassment and guilt.
  Revised predictions and superseded outcomes retain their history; affected
  replay/probe paths explicitly report unsupported evidence reproduction.

• Ground mismatch learning in verified criterion/check failures; owner-bound task diagnostics can carry relevant count constraints without exposing expected answers. Forecast overruns remain observations and no longer justify behavioral rules by themselves.

• run --mismatch-case and registered experiment fixtures enable independent JSON-artifact validation of clean planning mismatches in isolated file-only tasks. Validation and rule proposals retain ungraded outcomes for missing evidence or policy refusals; each executed arm records an audit receipt. --no-goal-guidance now works before or after a subcommand.

• mecha run --goal KIND:ID explicitly confirms a goal, including on resume; experiments can register per-task confirmed goals. Completed todo steps now retain and execute a previously declared check when the completing update omits it.

• A paired appraisal pilot with twelve independently graded artifact tasks,
  synthetic charter and sensor fixtures, and reporting that preserves missing
  measurements. Explicit experiment planning levers now enable disabled settings.

• Goal-aware planning feedback: confirmed goals persist across turns and resume;
  declared checks execute through the normal guards; failed criteria/checks and
  frozen-check changes can produce bounded mismatch reflections. Forecast
  overruns remain observations. Trace replay explicitly refuses recordings with
  harness checks until their observations can be reconstructed.

• goal_context retrieves applicable goal-linked rules and recent, clean examples
  with passing checks. Optional agent.goal_guidance gives fixed planning advice
  from task progress, confirmed goals and charter sensor discrepancies.

• Event-time goal attribution preserves task and charter relationships. Owner task
  closure remains a separate verdict; global queue movement earns no causal credit.

• Explicit per-task fixture clocks and recorded rubric judges for assistant
  experiments; answer checks receive actual tool evidence and fail on grading errors.

• Durable workflows link task conversations, questions, drafts and dependencies;
  owner-specified completion checks inspect artifacts and confirmed delivery.

• A Today view groups urgent items, decisions, verified work and waiting, with
  commitments, quiet hours, coalesced reminders and snoozing. Refreshes share
  source reads across workflows; finished work can be explicitly reopened.
  Failed chat recording preserves prior workflow completion evidence. Blocked
  question resumes leave the question open and create no running marker.

• Batch outbox rejection continues past uncertain deliveries, preserving their
  records and reporting partial failures with a nonzero exit status.

• Explicit structured-output provider capabilities for quarantined extraction,
  plus stable research, assistant and coding tool profiles.

• Repeated assistant lifetime fixtures check actual sent messages and calendar
  events after review, detect duplicates, and record owner-action counts.

• Outbox delivery reconciliation in the CLI and web, with durable attempts that
  prevent automatic retry after an uncertain outcome.

• A learned rule can be scoped to a surface. The front-end that owns
  a run tells prepare its kind (GlobalOpts::surface, never a flag),
  the learned-rules block is matched against it, and the run record keeps
  what was matched (RunConfig::rules_surface) for the miner to stamp —
  never SessionMeta::kind, which the board's task door on serve
  records as a task while the block was matched as web. A rule learned
  from reflections all on one surface loads only there, widens by
  restatement from another, and narrows by conviction, as the workspace
  does; the reflect pass reconciles rows stamped with a kind before the
  field existed. A question continuation restores the asking run's
  surface off its record rather than asserting one, and the miner stamps
  the keys of the run record covering each intervention. A stored scope
  naming a surface this build cannot read is kept verbatim, matches
  nothing rather than everything, and is reported at startup, and the
  front door and mail now append the run record that keeps the surface
  they declare. Rules from before the key carry no surface and load on
  every surface as they did.

• The TUI's task edit form carries the project. tasks set --project
  existed in the terminal and not in the modal; the edit form now
  prefills the project and re-files only when the field changed (clearing
  it clears), so the two surfaces offer the same correction.

• mecha rules says when a scope loads nowhere. A rule scoped to a
  workspace or surface no run record ever presented is dark with nothing
  warning — the corpus-shaped half of the never-loads check, which named
  tools only; the roster prints LOADS NOWHERE beside it and the JSON
  carries loads_nowhere, read off every run record in the session store
  and only when a scope names such a key.

• The fixture board can be asked to truncate (MECHA_FIXTURE_BOARD_CAP=N),
  and the cross-process fixture test measures the flag every board reader
  keys off against the fixture rather than a literal.

• A learned rule can be scoped to a workspace. The workspace a run
  is jailed to joins the tool set as a scope key (Situation::scope,
  Situation::matches, Situation::key): a rule learned from
  reflections that all came from one workspace loads only in runs jailed
  there, a verbatim restatement from a second workspace's batch widens it
  by dropping the key, and a conviction in one workspace narrows it to
  the one it held in — the same harness arithmetic tools already had
  (GOAL-SYSTEM-DESIGN.md §17.4). The run record keeps the workspace
  the block was matched against (RunConfig::rules_workspace), and the
  miner stamps a reflection with that rather than the session's jail —
  on serve and Slack the two differ, and a lesson scoped to a jail no
  match presents would be dark forever. Every mecha reflect pass now
  reconciles each recorded workspace against the run record before
  anything is mined — to the matched one, or to none where the record
  carries none; never adding a key, and leaving a row whose session
  cannot be read — since reflections stamped with a jail before the
  field existed were inert until the workspace became a key, and the
  nightly's learn follows that pass. Rules from before the key carry no
  workspace and load everywhere as they did. The surface stays recorded
  and unmatched, since prepare is not told the session kind.

• A project closes when the owner closes its last task, and its
  appraisal is the fold over every session that worked one. The board
  row now carries project_id beside the project's name (mecha-graph
  PR #10, unreleased when written), the closure appraisal in mecha tasks set records
  project:<id> on the appraisal's goals after the task, and closing the
  last open task under a project prints the project's reading on stderr —
  labels counted, valence summed, tasks never delegated or unreadable
  counted rather than dropped. No follow-up is staged for a project and no
  record is written; a board that names a project without identifying it
  is said once rather than read as no project
  (docs/GOAL-SYSTEM-DESIGN.md §17.7 item 5, finished). mecha tasks set --project re-files a task by name or node id, or clears it with "" —
  the correction path a cited pointer needs, through the graph's own
  resolver.

• The goal pointer crosses to the graph whole; the sentence stays
  home. A distilled episode's meta carries goal and
  serves_charter as kind:id pointers and the pointer on each goal
  error, where the kind word alone used to cross — resolved first: a
  charter id against the charter, a task or project id against the board
  (one kg_task_list per distill run), and what does not resolve falls
  back to the kind word on goal and on each error's goal alike, so a
  run that named a setpoint is not read as one that named nothing
  (serves_charter is the join key alone, absent when no line resolves).
  The goal hypothesis, the owner's answer and the charter line's text
  never ride (§17.7 item 8).

Changed

• Refreshed the documentation for current CLI commands and configuration, Today
  and workflows, automatic learning, outbox delivery recovery, and replay limits.
  Goals and appraisal now covers confirmation and drift, project closure, step
  metrics, current labels, and the features consuming appraisal evidence.

• The knowledge graph is named as the graph everywhere in the tree.
  Comments, tests and one mecha distill warning still called it by the
  retired server's name; nothing calls that server, and the words now say
  so. Three places changed what somebody does (found on review): the
  published evaluation page named a fixture file that does not exist, the
  landing page's [[mcp]] snippet named a binary that is not shipped (and,
  once it named a shipped one, lacked the [mcp.capabilities] untrusted_input = true that arms the interlock over the graph — the
  override TRIFECTA.md calls load-bearing; found on review), and
  prompts/agent.md told the model to call pkg__kg_* tools that are not
  on the surface — it now names the bare kg_* the documented wiring
  (prefix_tools = false) exposes.

Fixed

• Stopping the web service preserves active turns. SIGTERM and Ctrl-C
  close pending questions, cancel chat and mounted voice work cooperatively,
  and wait for partial transcripts and outcomes before exiting. A second
  Ctrl-C or SIGTERM forces termination if needed. Idle event streams and voice
  clients no longer prevent shutdown. Updated serve/voice service units signal
  the daemon first, and MCP cleanup finishes before it exits.

• Chat input appears on every connected device. Typed messages and steering
  are broadcast with request IDs, avoiding duplicate echoes on the sender and
  preserving separate messages with identical text. Steering distinguishes
  queued, delivered, and too-late input instead of claiming everything was sent.

• Chat transcript and event-stream reads no longer create sessions. The app
  explicitly opens chats and repeats that step when reconnecting; scripted
  clients must first POST /api/chat/{key} with X-Mecha-Request: 1.
  Mode changes now reject invalid keys before creating a workspace.
  Permanent opening refusals stop retries; transient failures back off.

• Docker-confined MCP clients now own and remove their containers when the
  last client drops, including failed or cancelled startup and servers that
  ignore stdin EOF. Cleanup also works after the async runtime shuts down;
  mecha run releases clients before refusal and empty-output exit codes,
  as does mecha batch before a failed-batch exit.
  Daemon failures are retried and reported with bounded Docker diagnostics.

• Browser mutations now require a same-origin request header, including
  bodyless actions, uploads, and voice offers. Reload the web app after
  upgrading; scripted API clients must send X-Mecha-Request: 1 on writes.

• Chat uploads reserve filenames atomically and refuse symlinked inboxes;
  resumed conversations use their recorded workspace for attachments.
  Downloads stream from confined file handles instead of buffering whole files.

• MCP clients terminate their spawned child process and abort reader tasks
  when the last client is dropped, including after an unsuccessful handshake.

• fs_read applies line selection and its byte ceiling while reading, so a
  small selection does not allocate or decode an entire large file.

• Graph route updates and charter drag state now use Svelte's reactive state
  correctly, removing the corresponding build warnings.