v0.3.0 — settings, and a phone that tells you

paddock could show you a blocked agent, but only while you were looking at it. This release closes that: your phone now tells you.

Telegram notifications

A message when an agent becomes blocked or done, carrying its name, its state, and a link straight to that agent.

Telegram rather than Web Push, decided deliberately. Web Push needs a service worker, a VAPID keypair, a permission prompt and — on iOS — a Home Screen install before a single notification can arrive. Telegram needs a bot token and one HTTPS POST, works on any device already running it, and is unaffected by an expired Cloudflare Access session.

The cost is recorded rather than glossed: bot messages are not end-to-end encrypted. So the message carries a name, a state and a link, and never terminal output or the agent's task line — the task line is live agent-authored text that can carry pasted secrets. That last point was a real defect caught in final review, after surviving every per-task review because the implementation plan itself contradicted the design.

Notification policy is deliberate about the failures that make an alert channel worth ignoring:

• keyed on the transition, not the state, so an agent that stays blocked does not repeat
• first sight after boot is silent, or restarting paddock would ping once per already-blocked agent
• quiet hours drop rather than queue — a pile delivered at 08:00 describes agents unblocked five hours earlier
• a failed send does not consume the transition, so the next update retries; the per-agent cooldown is what bounds that, and it is floored at 1s so it cannot be disarmed

Settings, at #/settings

Reachable from a ⚙ button in the header, and split into two clearly-labelled scopes, because conflating them misleads:

This device	Theme, refresh rate (Live / Balanced / Frugal), terminal font size, line wrap
All devices	Telegram token and chat, notifications on/off, triggers, quiet hours, cooldown, public URL

Sending happens on the server, so a switch tapped on your phone also silences your laptop. The view says so in words rather than leaving you to find out.

The bot token is write-only. paddock has no authentication of its own — Cloudflare Access is the only gate — so anything an endpoint returns is readable by whatever passes that gate. The token goes in and never comes back: the API reports only configured and a four-character hint, and it is stored at ~/.config/paddock/settings.json, written atomically at mode 0600 with an fsync before the rename.

Also

• The header now shows the mark and paddock instead of local, the default host id. A real host id still shows, dimmed.
• Terminal font size defaults to Automatic, restoring the responsive clamp a fixed default had been silently overriding — worth roughly 14 columns on a 390px phone.
• Theme changes apply immediately instead of on the next page load.

Notes

Behind an authenticating tunnel this needs no extra configuration — see docs/deploy-cloudflare.md, which also now records the ordering that matters: create the Access application before publishing the hostname.

418 tests. One known gap is recorded in docs/roadmap.md: no test guards the composition root's fan-out call site, so an edit bypassing it would pass the suite while silently disabling notifications.