v0.5.65

conclave notify is now opt-in. If you use it, this release turns it off until the project says otherwise — see the first section.

notify is opt-in and says it is experimental (#374)

The docs presented it as a ready channel to a human. The README called it "the only channel to them"; the operator skill gave it a section explaining how to reach the person whose project it is.

Every prerequisite for it actually working was a defect fixed in the last few releases: naming a transport at all, somewhere to write that down, a bind the device can reach, and a vendor version the code had been read against. There is one transport that reaches a person, over a protocol owned by a third-party app that changes without notice, and it carries machine-global state — a broker, its socket, token and lifecycle — for something no project currently depends on.

To enable it:

{ "notify": { "experimental": true, "transport": "even-realities" } }

Without that, tell and ask refuse by name — "notify is EXPERIMENTAL and is not enabled in this project" — rather than with the older "no transport configured". Those are different facts and a test pins that they print differently: a gate whose refusal is indistinguishable from the old one is the same defect wearing a new label.

broker, log and vetoes are ungated. The broker is the diagnostic surface, and an operator working out why notify will not work needs broker status to answer rather than refuse — stop especially, for a broker started before the project opted out. log and vetoes read what already happened, and a project that opts out still has that history to account for; gating them would hide a veto nobody has collected. The gate is on sending.

A launch says when the shared install moved under it (#356)

scripts/release.sh repoints ~/.local/bin/conclave, which is per-user and shared by every project on the machine. A release cut in one project moved the tool for every other project's next launch, silently — and the affected party had no signal distinguishing "my change broke this" from "the tool changed underneath me". One operator drifted three versions in a working day having installed nothing; an earlier regression broke a seat for a session that had released nothing and lost time bisecting a failure it had not introduced.

A launch now compares itself against the last installed launch on this machine and says when they differ, naming both builds and that the install is shared. Per machine rather than per project: a project with no previous run would otherwise get silence, and a first run is the one already doing hook registration and trust prompts, with unfamiliar output there to absorb the blame.

A first launch says which build it is rather than nothing. A development checkout neither notices nor writes. An unreadable record reads as no record — a notice that can break a run is worse than the silence it replaces.

mutations restore verifies what it wrote (#363)

restore copied the stored original back and reported success without looking at what it wrote. A corrupted or truncated backup reported restored, exit 0, deleted the marker and the backup, and left the damaged file in place with no record of the original — in the one command whose whole purpose is recovery.

It now verifies its copy against the sha256 begin recorded, in the same words end uses. On a mismatch it keeps the marker and the backup, loudly and non-zero: the backup is what is suspect, and deleting both would destroy the only evidence of what the file used to be.

The help now describes all three verbs. restore clears the marker, which is why end afterwards has nothing to check — documented nowhere, which made an honest message read as a failure.

Design-note rot (#367, #369, #370)

Three sections of docs/design/concurrent-implementers.md cited line numbers that had moved, in bare :NNNN shorthand that reads as a reference to whichever file was named several lines above — enough to send a reader to the wrong file, which is how it was found. They now carry full paths and sit under ## LIVE: headings, so citations.test.ts checks them.

One section's conclusion was wrong, not just its line numbers: it argued rotateImplementer() "cannot survive" and described replacing it. Both entry points exist today, deliberately — the arbitrary pick did not survive; the entry point did, refusing at N>1 rather than choosing. Corrected rather than deleted, because a design note that quietly drops a prediction it got wrong is worth less than one that says so.

In relay.ts, two stacked docblocks describing #implementers() sat above a different member, so every doc consumer attributed sixteen lines about seat filtering to a one-line accessor. They were also two generations of the same doc, and the older contradicted the newer about how the filter works.