v1.23.2

Fixed

• Accept release asset downloads from the GitHub release CDN host, fixing self-update checksum fetches redirected there.

v1.23.1

Fixed

• Speed up live feed classification by skipping the error-pattern match on lines without error trigrams.

v1.23.0

Added

• Support Enter key to close the live dashboard once a run has finished, and support g and G keys for first and last row navigation in the launcher.
• Support Tab and Shift-Tab pane switching, Ctrl-W word deletion, and Ctrl-U line clearing while typing in the launcher review filter (gauntlet pick), and automatically focus the first matching review on Enter.
• Support Page Up, Page Down, and Space keys in the live dashboard feed view and help overlay.
• Support Page Up and Page Down keys (pgup, pgdown) in the interactive launcher (gauntlet pick) across reviews, agents, options, and filter search.
• Ship template configuration files agents.example.json and .env.example with documented options and placeholder values.

Security

• Require reload handoff state file paths via GAUNTLET_STATE to be absolute, preventing relative path resolution and deletion in the working tree.
• Validate provider and model identifiers in dsh configuration overlays, preventing YAML injection and directory traversal.
• Validate reload handoff state files before reading or removing, refusing non-regular files and symlinks via GAUNTLET_STATE.
• Reject oversized responses in self-update checksum downloads instead of silently truncating.
• Separate git branch names and patterns with -- across merge, rename, and branch deletion operations.
• Isolate --usage-cmd process execution and PATH resolution from the reviewed
  working tree, running the probe in the system temporary directory with
  cwd-relative PATH entries dropped.
• Constrain self-update asset downloads to HTTPS endpoints on authorized GitHub
  release hosts, preventing plaintext transfers or untrusted third-party hosts.
• Validate HTTP redirect target URLs in self-update against authorized release hosts.
• Strip authorization bearer tokens on self-update requests whenever redirected away from GitHub hosts to prevent token leakage.
• Use constant-time comparison for self-update asset checksum verification against timing side-channels.
• Reject unclean and path-traversal state file paths via GAUNTLET_STATE.
• Shell-quote git conflict resolution hint commands with POSIX single-quoting to prevent shell injection via untrusted commit subjects.
• Isolate agent, indexer, and dsh probe execution with absolute-only PATH environments and clean working directories to prevent relative binary resolution.

Fixed

• Reject explicit empty --agents, --bin, and --agent-cmd flags with a usage error rather than silently ignoring them or falling back to auto-detection.

• List scheduled and available reviews across all target directories under --list when multiple directories are configured via --dirs, and search all target trees for --show-prompt.

• Adapt agent lane column widths for narrower terminals (<90 cols) so metrics are not clipped off in the live dashboard.

• Document the Escape reset shortcut (esc:live) in the dashboard footer whenever the feed is paused at the live edge.

• Show :change instead of :open/close for arrow keys in the launcher footer when focused on the options pane.

• Prevent space and arrow keys from modifying inactive options (suggest agent when suggest is off, merge target when commits are off) in the launcher.

• Explain that no agents are installed when viewing the agents pane hint with an empty agent pool.

• Abort git rebase on pull conflicts to avoid leaving repositories in an uncleaned mid-rebase state.

• Fall back to subsequent agents in the pool when command building fails for an agent candidate.

• Preserve error context when resolving binary paths and checking baseline revisions during trailer stripping.

• Strip trailing carriage returns in git status porcelain parsing, worktree cleanup, and UI block padding to prevent path corruption and rendering issues with CRLF line endings.

• Expand tildes and environment variables in custom agent executable paths at launch, and reject unresolvable variables.

• Validate that GAUNTLET_HOME and --prompt-dir name directories and --log names a file at startup.

• Align documented GIT_SSH_COMMAND default in .env.example with the runtime default (ssh).

• Reject mismatched placeholders across custom agent model, effort, stream, and continue configurations.

• Do not count opt-in agents launchable only via bunx (dsh) as usable auto-detectable CLIs in the doctor report, correctly reporting missing agents and exiting 1.

• Separate revision arguments and branch names with -- across git worktree operations, diff statistics, trailer stripping, and commit subject extraction to prevent option injection and file name collision ambiguity.

• Validate JSON key types when decoding custom agent definitions (agents.json), returning an error on non-string keys instead of panicking on type assertion.

• Handle incomplete octal escape sequences without consuming invalid digits or malforming bytes in git filename unquoting (unquoteC).

• Populate line metrics, review status, and subjects when recovering stacked PR layers.

• Serialize stream sink and token usage callbacks during agent execution, retry interrupted lock note updates on EINTR, and synchronize watcher teardown during runner shutdown.

• Normalize custom agent names and definition keys to NFC, rejecting duplicate keys across NFC and NFD spellings and aligning lookup forms.

• Handle non-positive column budgets and 1-column cuts in terminal cell trimming, reserving width for the ellipsis and returning empty strings on non-positive bounds.

• Use canonical review names when expanding review sets and displaying review prompts, preventing unnormalized names from reaching prompt composition.

• Block the launcher (gauntlet pick) from starting an unconstrained run when an active review filter matches no reviews, displaying a clear warning.

• Reject unresolvable environment variable references in GAUNTLET_HOME at startup and degrade gauntlethome.Dir safely instead of resolving unexpanded paths against the working tree.

• Reject empty argument strings in custom agent model, effort, stream, and continue configurations, and reject whitespace-only usage suffixes.

• Normalize available review names to NFC in suggestion parsing, matching decomposed names against agent suggestions.

• Normalize pull request body text to NFC before rune truncation, preserving combining characters on decomposed filenames and descriptions.

• Recognize Unicode whitespace when stripping agent output noise, gutters, and trailing spacing in the line normalizer, and in launcher filter word trimming.

• Distinguish complete Unicode replacement characters from incomplete multi-byte sequences at process output chunk boundaries.

• Surface Escape cancel and live-feed reset keys in the dashboard footer and help overlay, and display active filter queries and clear shortcuts in the narrow launcher fallback.

• Prevent Escape from abruptly terminating an active run when quit is armed in the dashboard; Escape now cancels the quit prompt and resets paused or scrolled feeds to live output.

• Make git worktree removal idempotent on already-removed checkouts, and prune git metadata when the checkout directory has already been deleted.

• Clean orphaned worktree directories and prune stale metadata during worktree preparation, ensuring worktree creation and removal converge across interrupted runs.

• Strip UTF-8 byte-order marks (BOM) when loading custom agent definitions (agents.json), preventing parse errors on Windows-formatted files.

• Pad clipped lines with trailing spaces in dashboard panel formatting when multi-column wide characters are truncated, preventing misaligned panel borders.

• Count Unicode code points instead of bytes when checking for short-flag misses, preventing single non-ASCII flags from triggering typo suggestions.

• Normalize file paths to NFC when correlating file notes to git changes in stacked PR summaries and commit subjects, matching decomposed macOS filenames with NFC text.

• Strip relative build directory paths from release SBOM inventory headers to match asset filenames, and clean scratch files and stray binaries on make clean.

• Prevent auto-update from repeatedly re-applying the already-installed release tag during an active run.

• Unlock git worktrees before removal during merge cleanup, preventing leftover locked worktrees on failure.

• Format branch listings cleanly when deleting matching review branches.

• Derive journal date shards from the run ID timestamp instead of the local clock so midnight UTC crossings place journals in the matching shard, and validate run IDs on open.

• Synchronize stacked PR head and publication state with the runner mutex, guard worktree branch renaming, and force-kill stalled command groups on drain timeout.

• Check write errors on command output streams across subcommands (gauntlet doctor, gauntlet runs, gauntlet show, and gauntlet pick), exiting 1 on failure instead of reporting success.

• Propagate cancellation exit code 130 when the interactive launcher or review planning is interrupted by context cancellation.

• Record loop line changes in parallel worktree mode (--jobs > 1) and preserve line metrics on pull request events in stacked-PR mode (--stacked-prs) across the journal, history, and dashboard.

• Correct documentation in CLI and runs reference for --usage-cmd execution directory, custom agent definition fields and validation rules, and missing --check and --limit option tables.

• Reject empty string arguments for --show-prompt, --merge-into, --pr-base, --suggest-agent, --usage-cmd, and --exclude at startup instead of silently accepting them.

• Enforce placeholder validation on custom agent definitions (model requires {model}, effort requires {effort}, and forbid {prompt} in stream or continue).

• Abort and reset in-progress merges cleanly even when interrupted by a cancelled context, preventing unmerged index state from persisting.

• Pre...

v1.22.1

Fixed

• Pass --add-dir to agy so it knows which directory it is reviewing.
  Without it the model received no workspace context and hallucinated paths
  like /home/user/repo, failing every review that tried to list or edit
  files. Especially visible with --jobs where the review runs in a
  worktree the CLI has never seen before.

• Kill the agent's process group on the normal exit path, not only on
  timeout and cancel. A grandchild that outlived the agent (a background
  task, a language server) no longer survives as an orphaned process.

• Sweep slash-separated lane branches (gauntlet/<tag>/lane-*) on cancel,
  not only dash-separated ones. A cancelled --jobs run no longer leaves
  leftover branches behind.

v1.22.0

Changed

• Stream parsing retains only text-bearing fields for deferred classification,
  reducing allocations for metadata-heavy output without changing text or usage.

Fixed

• Empty SUBJECT: and PATH: fields no longer consume the following output
  line as a commit subject or file note.
• Run-end summaries report the loops the run completed instead of always zero.
• Agent configuration rejects case-variant duplicate fields, including nested
  usage fields, instead of silently letting JSON key order override settings.
• Release concurrency is scoped per tag so unrelated tag pushes cannot cancel
  queued releases. Runs for the same tag remain serialized.
• Launcher help exposes the focused control's full name, state, value, and
  description in scrollable text when terminal panes clip them.
• Stream lines, prompt descriptions, and PR summaries truncate at whole grapheme
  boundaries within their rune budgets, preserving combining accents and flags.
• Changelog validation accepts SemVer prerelease and build-metadata headings,
  so the release checks no longer block release candidates before publication.
  Versions sort by SemVer precedence, and negative version components are refused.
• Narrow launcher panes retain concurrency and selected option values instead
  of hiding them. Panel titles stay within their assigned width so long titles
  cannot push adjacent panels past the terminal edge.
• Deterministic-simulation guidance preserves cryptographic randomness in
  production and confines seeded substitutes to tests or simulation mode.
• Launcher help calls the existing state-summary helper instead of an undefined
  method, restoring compilation.
• Directory lock files keep their inode after release, preventing overlapping
  starts from acquiring separate locks for the same tree. Release clears the
  holder note instead of removing the file.
• Reported subjects and file notes truncate at whole grapheme boundaries within
  their rune limits, preserving combining accents, flags, and variation selectors.
• Release tags with a prerelease suffix are published as GitHub prereleases,
  including when retrying a draft, so stable installs and self-updates do not
  select release candidates. Build metadata alone does not mark a prerelease.
• Run summaries retain interrupted review counts, including summaries rebuilt
  from journal events, instead of dropping that outcome from the status totals.
• Build recipes pin GOAMD64=v1 and GOARM64=v8.0, preventing ambient CPU
  settings from producing binaries that require newer processors.
• Recovered run listings retain the original start time when hot reload or
  multiple directories produce repeated run-start events.
• Persistent review lanes discard staged and unstaged edits when advancing,
  so failed attempts cannot carry tracked changes into the next review.
• Stream parsing no longer treats tool-payload and user-turn text as assistant
  output, so report lines and usage inside a tool result cannot replace the
  run's own subject, file notes, or counters.
• Version output exits with a failure and reports errors on stderr when stdout
  or the --log destination cannot be written.
• Output rate limiting starts its first window at the first line, including
  when an injected clock starts near zero time.
• Failed attempts stop retrying or falling back to another agent once the
  runtime budget is exhausted, including when it expires during backoff.
• Seeded review schedules retain their logical loop number after hot reload,
  so subsequent shuffles and --max-reviews selections match uninterrupted runs.
• Hot reload counts a sequential loop completed during its final review, so
  the successor does not repeat finished work or exceed --max-loops.
• --show-prompt exits with a failure and reports output errors on stderr
  when the prompt cannot be written, including partial output.
• Build and test recipes export GOWORK=off, so a go.work above the
  checkout can no longer add workspace modules or replace directives to the
  build; the dependency set is go.mod's and go.sum's alone.
• Clearing a kept review search in the launcher moves the selection onto the
  first visible review instead of leaving it stranded off the restored list.
• --log tightens a pre-existing log file to owner-only permissions before
  writing, instead of leaving permissions from an earlier looser creation.
• make fmt handles Go formatter paths containing spaces, matching make check.
• Commit steps retain their five-minute timeout when --timeout 0 leaves
  reviews unlimited, rather than allowing a stalled commit to block the run.
• Custom agent files reject duplicate agent names and configuration keys instead
  of silently replacing earlier values.
• Recovered run listings count completed loops across directories and hot reloads,
  without counting an interrupted loop as finished.
• Git status parsing preserves Unicode whitespace in filenames instead of
  stripping it and reporting a different path.
• The completed dashboard freezes elapsed time, budget consumption, and activity
  history while it remains open for inspection.
• Dashboard throughput sums lanes in stable order so replayed usage events
  produce identical rates, counting repeated configured lanes only once.
• Usage probes kill remaining process-group members on every exit, preventing
  background helpers from accumulating between reviews.
• The help overlays on the dashboard and launcher scroll when the terminal is
  too short for them, so every instruction stays reachable by keyboard, and
  wrap long lines instead of clipping them at the pane edge.
• Suggestion parsing rejects malformed names instead of scheduling a review
  whose name matches only a prefix of the response.
• runs exits with a failure and reports output errors on stderr when its
  listing cannot be written, including empty history and partial output.
• Release builds stop when any binary's module inventory cannot be read,
  instead of reporting success with an incomplete sbom.txt.
• Database checks use saved query plans instead of connecting to existing
  databases or executing statements through EXPLAIN ANALYZE.
• URL credential redaction handles apostrophes and embedded @ characters
  without mistaking query or fragment text for credentials.
• Token usage parsing ignores fractional and exponential counts instead of
  recording their leading digits as whole-token counts.
• Custom agent files reject a top-level null instead of silently starting
  with built-in definitions; use {} for an empty configuration.
• The launcher no longer blocks stacked PRs on a dirty checkout because of a
  saved concurrency setting that stack mode ignores. Leaving stack mode restores
  the setting and its clean-tree requirement.
• make vuln scans the selected build tags, including the sqlite driver in
  the default CI scan, instead of silently scanning only the untagged build.
• Custom agent files report validation errors in name order, so identical
  definitions produce the same startup diagnostic across runs.
• Timeout and cancellation kill remaining subprocess-group members even when
  the leader exits before children that ignore SIGTERM.
• show exits with a failure when replay output cannot be written, rather
  than reporting success for a partial or missing replay.
• Prompt discovery excludes --prompt-dir when a symlink gives the same
  directory a different path, including macOS /var and /private/var aliases.
• Recovering the run index no longer appends a reconstructed row for a run
  that already Closed: when runs close out of start order (a long run still
  going when a short later one finishes), the duplicate row could replace the
  completed summary in runs listings, losing args, exit code, and measured
  elapsed.
• In-place retries and agent fallback stop when the starting tree could not
  be snapshotted, preventing repeated writes on top of a failed attempt.
• Releases reject whitespace-only and heading-only changelog sections instead
  of publishing without release notes.
• The launcher preserves all explicitly selected reviews when suggestions are
  enabled, instead of silently running only the suggested subset.
• make check analyzes all three shipped build modes even when TAGS is
  overridden, keeping local checks aligned with CI.
• show preserves exact JSON numbers, including 64-bit RNG seeds, so a
  seed copied from a recorded run replays the original schedule.
• A resumed run whose handoff was written before the wall clock was set
  back no longer resumes in the future with extra runtime.

v1.20.1

Audit cuts: drop firstLine and watchTranscript delegating wrappers, early-return push chain.

v1.20.0

Changed

• Share process-group kill, WaitDelay, and capped stdout/stderr across git,
  gh, usage probes, dsh config dumps, and the indexer.
• Parse agent JSON streams by extracting text and usage during decode instead
  of building an intermediate tree.
• Clip catalog descriptions, suggestion reasons, and review summaries with
  the same rune-bounded ellipsis the rest of the binary uses.

v1.19.0

Changed

• The prompt review now leaves well-constructed prompts alone in auto-fix
  runs instead of asking for report-only praise.
• Releases are now assembled as drafts before becoming visible, and rerunning
  a release refuses to replace an already-published version's assets or notes.
• Pin the govulncheck executable used locally and in CI while continuing to
  scan against the current vulnerability database.
• Dashboard and launcher panels now use square instrument frames instead of
  generic rounded cards.
• The run documentation now includes a quiesced backup and restore drill for
  durable state, including restore verification and explicit RPO/RTO guidance.

Fixed

• Invalid or unrepresentable elapsed values in the run index now fall back to
  the recorded start and end times instead of displaying a wrapped duration.
• Deduplicate --dirs targets that name the same tree through symlinks.
• Preserve launcher run options when stacked PR mode is toggled off again.
• Build and help targets no longer create the test scratch directory; only
  test targets set up and use it.
• Custom agent files are validated completely before any definitions are
  registered, and blank executable names now fail at startup.

Security

• Self-update authentication is now sent only to GitHub over HTTPS, preventing
  release metadata from forwarding a GitHub token to another host.

v1.18.0

Added

• --max-reviews N caps how many reviews one loop runs, however large the
  expanded --reviews/set schedule is. The cut happens after the seeded
  per-loop shuffle, so --seed replays exactly which N ran and different
  loops sample different reviews; a review scheduled twice fills two of the
  N slots when both land inside the cut. With --stacked-prs the single
  ordered pass is truncated to its first N entries. 0 (the default) is
  unlimited, and --dry-run reports the capped count.
• Three reviews for Kubernetes and GitOps repos: k8s-review (manifests,
  cross-resource reference integrity, API deprecations, and kustomize
  structure, components included), gitops-review (the Argo CD / Flux
  delivery layer: source pinning, sync and prune posture, ordering and
  health, secrets delivery, environment promotion), and helm-review
  (chart authoring: template correctness, the values contract, hooks, CRD
  lifecycle). Each gates on evidence in the tree and reviews
  tool-agnostically when the delivery tool leaves no markers. A new
  gitops set schedules them together with container-review,
  infra-review, sec-review, and dr-review.
• --paths LIST scopes every review to the named files, directories, or
  globs, relative to the reviewed directory (comma-separated, repeatable).
  The agent still works from the whole repository for context; the composed
  review prompt tells it to report findings on and modify only the listed
  paths, so the scope is prompt-enforced, not mechanical. Without the flag,
  prompts are byte-identical to before. Suggest, commit, and conflict
  prompts are unchanged, and an explicit empty --paths is refused.
• Stacked-PR bodies open with an overview of what the change is about: the
  PATH: lines a review prints are matched against the layer's own commit,
  deduplicated, and joined into one short paragraph under ## Summary; the
  ## Changes file list stays bare paths. Notes naming files the commit
  never touched are dropped. The overview is flattened, length-bounded, and
  backtick-neutralized like every other untrusted value in the body, and the
  whole body is now capped as well.

Changed

• container-review and infra-review split Kubernetes workload
  ownership more sharply now that k8s-review and helm-review exist:
  manifest structure, probes, security context, and resource limits stay
  with those reviews; infra-review keeps compose, CI/CD, and IaC wiring.
  container-review will use dockle, kubeconform, and conftest when
  they are on PATH. lint-review names the project linters it should run.
• Stack branches are named review/<NN>-<review>-<topic> (e.g.
  review/03-sec-review-input-validation) instead of
  gauntlet/stack/<tip>/<NN>-<review>: the 1-based layer number keeps merge
  order sortable and the topic is a slug cut from the commit subject. Each
  layer starts under a deterministic provisional name
  (review/<NN>-<review>-wip-<base>) and is renamed once its commit exists,
  before the push. A resumed run finds published layers by listing the
  deterministic review/<NN>-<review> prefix and verifying candidates by
  commit graph -- a layer must be a one-commit child of the previous layer's
  tip -- so a same-named branch from an older stack is rejected by ancestry;
  when it occupies the topic name, the new layer appends the stack's short
  base commit. The preflight dry-run probe moved to the same review/
  namespace, and review/ branches are no longer offered as merge targets,
  matching gauntlet/.

Fixed

• Streamed runs (--stream, the default) lost every commit subject and
  per-file note: the report parsers read the output tail, which held the raw
  JSON event lines, and SUBJECT:/PATH: sit inside one escaped string
  there, where the parsers' line anchors match nothing. Commits fell back to
  the generated chore: update <file> subject every time. The tail now keeps
  each stream event's decoded text, so subjects, per-file notes, and the
  branch topics cut from subjects come from what the agent actually printed.

v1.17.0

Added

• make ci runs the Go pull-request checks (make check then make test).
• A missing or empty index.jsonl is rebuilt from the run journals, and a
  stale one has every newer unindexed journal appended, so gauntlet runs
  and the file-signal suggester still see a run whose process died after
  flushing the journal. gauntlet show already read those files.
  Reconstructed rows have no args or exit_code.
• GH_TOKEN is read for release lookups, the same name GitHub CLI uses. It
  wins over GITHUB_TOKEN when both are set, and both now authenticate the
  checksum and asset downloads as well as the release listing, so a private
  --update-repo can actually install.
• gauntlet pick can compose --stacked-prs from the run pane. Turning it
  on clears --commit, --push, and --merge-into and pins concurrency at
  1, so the launcher cannot emit a command the parser would refuse.
• ? on the launcher opens a help overlay, the same key the dashboard uses.
  q / esc close it; they do not leave the picker.
• A project prompt that contains the opening review marker can no longer
  close the fence: both BEGIN REVIEW and END REVIEW in the body are
  rewritten, matching what the end marker already did.
• Conflicted paths named in the resolver prompt are fenced, dropped when they
  carry the resolver's output protocol or formatting characters, and capped;
  a conflict with more files than the prompt will name is left for a human
  instead of launching an agent that cannot finish.
• Commit subjects taken from agent output drop bidi overrides and Unicode
  line separators, not only ASCII controls, so a model cannot spoof git log
  or forge a commit body.
• Suggestion reasons from the triage agent are rune-capped like catalog
  descriptions, so one overlong line cannot flood the suggest listing.

Changed

• --merge-into refuses to merge when git status cannot be read, the same
  way it already refuses a dirty tree, so a merge event cannot report work
  that never moved.
• A missing or stale run index that cannot be reconstructed is an error
  from gauntlet runs, not a listing that silently omits the newest run.
• A stacked-PR reload that cannot verify its pinned base commit fails
  rather than fetching a new tip and splitting the stack.
• Dashboard and launcher wordmark is the path-arrow teal of the mark
  (#0e96a8 on dark terminals, a darker pull of that hue on light), one
  hue, not Catppuccin teal and not a per-letter gradient. Footer keys are
  body-colored chrome like the launcher's. The budget meter rides the heat
  ramp. Reload status uses the info hue. Panel names stay dim with the
  rest of the chrome.
• Dashboard lanes and the feed drop the -review suffix the grid already
  omitted, so a name is spelled the same way on every instrument.
• f in the dashboard footer says widen while the feed is narrowed, the
  same way space says resume while paused.
• home / end jump the dashboard feed the way g / G do, and jump to
  the first or last row of the focused launcher pane.
• The launcher shows the same "warming up" line as the dashboard until the
  terminal reports its size, instead of a blank screen.
• --continue-sessions with --jobs above 1 or --stacked-prs is a usage
  error. Those modes give each review a fresh worktree, so there is no session
  to resume; the flag used to be accepted and silently ignored. Scripts that
  passed both will see exit 2.
• q / esc on the live dashboard arms a hard stop instead of killing the
  run on the first press (1.15.0 still documented immediate quit). A second
  press, or q after the run has finished or is already draining, closes the
  dashboard and cancels the run. The header shows q TO STOP while armed;
  any other key disarms it. q on the help overlay still only closes help.
• gauntlet runs prints STARTED as local YYYY-MM-DD HH:MM:SS. The old
  MM-DD HH:MM:SS column had no year and swapped day and month for readers
  used to ISO dates.
• gauntlet runs DURATION uses the monotonic elapsed Close records, matching
  the run's Total time. An NTP step or a manual clock set between start and
  end can no longer stretch or shrink the listing. Old index rows without
  elapsed_s still use End−Start; a pair that moved backwards prints n/a
  instead of 0s.
• Bundled review prompts: integer-width and abbreviation rules no longer
  rewrite language-idiomatic types and names; post-quantum crypto items are
  note-only; Kubernetes-native checks skip Dockerfile-only trees; docs-vs-code
  disagreements have a single owner.
• Ruff on scripts/ selects the bugbear, pylint, pyupgrade, and bandit
  groups (and every other category those two files already pass), with a
  100-column cap, instead of the default four error codes. scripts/shots.sh
  is gated with shellcheck in the same CI job. Rule selection lives in
  pyproject.toml. make check-scripts runs the same pinned ruff, mypy, and
  shellcheck steps as that job, so a scripts/ change fails locally.
• Docs for --jobs N describe the persistent lane worktrees the runner
  actually uses, not the per-review throwaway checkouts that 1.13.0 replaced.
• Design docs name the git hardening the runner actually applies
  (core.pager=cat, attr.tree, local driver blanks) and the conflict-step
  cap that leaves an oversized conflict for a human. --stream is documented
  as on by default, matching the flag. The landing-page trust model names
  core.pager=cat rather than an empty pager.
• Live usage ticks on the event bus are droppable, the same as agent output:
  a slow subscriber no longer stalls the scheduler on reconstructible
  telemetry. Final token counts still ride on review_end.
• gauntlet show and suggest history look up a generated run id by the date
  it encodes, instead of probing every day directory under the journal.
• gauntlet runs parses the index tail from the end, so a long index costs
  the rows shown rather than a split of the whole slice.
• The file-signal suggester reuses one git handle for the tree listing and
  the churn window. Opening a repo no longer runs rev-parse HEAD until
  line stats need a baseline. A million-file tree is listed only up to the
  scan cap, so the unused tail does not stay in memory.
• Project prompt discovery asks git for *-review.md by name instead of
  walking the tree. Generated and hidden directories are still skipped;
  a directory that is not a repository still walks.
• Worktree line samples run git diff --shortstat and ls-files -o
  together instead of one after the other.

Fixed

• A hot-reload handoff that cannot be read or parsed now aborts the successor
  instead of starting a fresh run. The unparseable case was silent, so the new
  process re-ran every finished review under a new run id.
• Lane worktree removal failures and unreadable HEAD reads during --jobs
  scheduling are logged. Removal errors were discarded, and a failed HEAD
  read was indistinguishable from an unchanged tip, so a lane silently kept
  its stale base.
• gauntlet update network and JSON decode errors name the URL that failed.
• --merge-into no longer treats untracked files as uncommitted work. The
  merge is a scratch checkout of committed work, so a local notes.txt was
  never going to be in it; refusing the merge used to drop a loop's
  committed changes. Tracked dirty files still block, matching --jobs.
• A pump that outlives an agent's process no longer publishes output or
  usage after that review has ended. Those events are keyed by agent, so
  they used to land on whatever the same agent started next.
• A trailing } or ] after agents.json is refused, matching
  encoding/json. json.Decoder.More treats those closers as end-of-value,
  so {}} used to load as an empty definition set.
• Listing runs recovers the whole tail of journals missing from
  index.jsonl, not only the newest, so two runs that died before Close
  both appear. A failed index write is retried on the next Close, and a
  rebuild cannot overwrite a Close that races it.
• gauntlet runs and the file-signal suggester list a crashed run that
  sits behind a later Close, not only an unindexed suffix. The index is
  a cache of summaries; the n newest journals are the listing, so a hole
  in that window is filled from the event stream without rewriting Close
  rows.
• Path flags (--dir, --dirs, --log, --prompt-dir, --bin) refuse an
  environment variable that is unset or empty instead of expanding it to
  nothing. $MISSING used to become the current directory (--dir), the
  bundled prompts (--prompt-dir), or a silently dropped log (--log). An
  explicit empty --prompt-dir or --log is a usage error too, matching
  --dir. A leading ~/ with no usable HOME is refused rather than taken
  relative to the working directory.
• The launcher's a key and a set header's space bar act on the reviews the
  filter is showing, not the ones it hid. A fruitless filter no longer
  selects the whole catalog.
• Typing a review filter on the launcher replaces the key legend with the
  keys that work there (enter keeps it, esc clears it). The legend used
  to keep advertising run and cancel, which those keys do not do until
  the filter is closed.
• A --usage-limit probe that prints more than 4 KiB is ignored, the same
  as any other broken probe, instead of filling memory until the timeout.
• One git or gh command's captured output is capped (32 MiB and 8 MiB)
  so a hostile tree or a runaway listing cannot grow without bound.
• Closing --log reports a write error instead of dropping it.
• The dashboard feed's scroll offset stays inside the retained ring, so a
  long pause cannot claim thousands of lines back after history is trimmed.
• An in-place retry restores the working tree to the snapshot taken before
  the failed attempt, including the user's own uncommitted files, so the
  next ...