v0.4.0 — verified outcomes

Verifier-first reliability and large-tree perception. Every claim in this release was certified by a live four-suite battery against the installed release bundle — 12/12 truth cases with zero silent false-successes, run while the user was actively using the machine (battery report). Tests grew 184 → 337.

Highlights

• Verified action outcomes. Every mutating tool does a read → act → re-read of its target and classifies whether the effect actually happened (success / unsupported / effect_not_verified / verifier_ambiguous), surfaced in _meta with a failure_domain and a plain-language verdict. A button that lies about accepting a click is reported honestly — not as success. Always on (~3% median latency, measured).
• Multi-strategy AX action chains. Clicks that can't land as a plain press walk a verified chain (confirm → open → pick → selection relay → child/ancestor press); the winning rung is reported as chain_rung.
• Background-reliable scrolling. Containers are ranked, and delivery drives the container's own AX mechanisms first — including setting the scroll bar's value, the one mechanism that actually moves an NSScrollView in the background — before falling back to synthetic wheel events.
• Dense-collection viewport windowing + skeleton: true. Virtualized lists/tables are windowed to the on-screen slice instead of a blind first-N prefix; find and skill replay still reach any row (verified live on row 400 of a 500-row table).
• Window-motion verification. Offscreen moves are rejected before any write; resizes settle-poll animated frames and report the honest applied frame when the app clamps.
• Structured errors. [CODE]-prefixed failures with machine-readable code and a one-line recovery hint in _meta.
• Delivery telemetry. delivery_tier, fallback_reasons, and ui_changed on every action.
• Visible-range read_text and web-area rich text rendered to markdown.
• ComputerUseFixture — a truth-suite app (honest/liar/disabled buttons, keystroke echo, 500-row table, web pane) that backs the release battery; launches in the background by default.
• Agent-cursor z-order rules. The overlay cursor shows whenever the target window is visible (split view, second display, unfocused) and clips only when the frontmost app's window genuinely covers the target. COMPUTER_USE_MCP_CURSOR_TOPMOST=1 forces always-on-top.
• Teach-mode durability. Text-entry anchors by role + tree path (labels churn with content); run_skill cold-launches a closed target app in the background.

Fixed

• Continuation leak that could hang daemon-less calls when a wedged replayd never answered a capture handshake.
• Agent cursor invisible over visible-but-unfocused targets on fullscreen / cross-Space setups.
• Stale-identity false negatives on text-entry elements.

Full details in the CHANGELOG.