v0.4.2

The wire toolset is built from the native name table, and orbit's copy of
that table was the runtime's list verbatim: market, intel, wallet,
board and projects were registered in the tool map but never named,
so no session — the TUI, the piped CLI, the one-shot worker every fire
spawns — ever sent them to the model, and the brief described tools the
agent did not have. The five now ride nativeToolNames; the reads
(intel, wallet, projects) run in the concurrent batch, the acts stay
serial; and the allow-list default admits them (appendOrbitTools: an
allow that names none of them gains all five, one that names any is the
operator's and kept). The brief's Tools line names projects.

v0.4.1

Orbit now builds against rig v1.6.0. The session listing seeks:
state.ListSessions aggregated per session through correlated
subqueries over tables with no seek path, and computed them for every
session before the sort and the limit — 10.5s on a 170-session,
24k-message store, the same with a limit of five. Orbit paid it twice:
the claim reap lists sessions on every start, and the session list
reads the workspace's rows once per store.

The state store gains metadata.ExtraStatements() beside its generated
DDL, the todo store's pattern: indexes on messages(session_id, role, seq) and faults(session_id), IF NOT EXISTS, so an existing store
gains them on its next open with no schema bump. The listing selects
the n newest sessions first and aggregates those n only, and the
workspace list reads state.Cwds (distinct cwd per store) instead of
the full listing. Measured on a copy of the same store: 13ms with the
indexes, 3ms with the limit-first shape.

v0.4.0

A worker now picks a project before it claims. The projects tool and
the /projects command list what the indexer knows with the goal, the
status, the treasury float, and the open task count — filtered by status
(bonding|ready|migrated) or to goals only, sorted by treasury descending,
the economic signal. /projects show <mint|fid> names the goal, the
treasury, the board summary (n/m done, open claims), and the last three
memos.

Both read the path the project list and the board read already use: the
indexer's markets and message log, the board's pure fold, the RPC
treasury float. project.List now folds the open-task count from the
same message read it uses for the goal, and project.Show is the one
project's discovery read. No chain writes, and no key — the tool and the
command load read mode (indexer + RPC, no vault creator, no agent key).

The count is cache-first, not window-only: a project the board cache has
synced is read from the walked log (goal, n/m done, open tasks, open
claims — board.Store.Summary), an uncached one falls back to the
newest-50 window, and the fallback is bounded at 10 window fetches per
list, given to the highest-treasury uncached projects. The list stays
one markets call plus a bounded handful of message calls as projects
grow, a busy project's count is the walked log where the cache exists,
and a project beyond the budget shows unknown (-) rather than a window
it never read. show reads the cache summary the same way when the
project has been synced.

/projects implements the runtime's command.Subber with the two verbs
(list, show), and the list prints as a table, one row per project.

Tests: project.List folds the open-task count from the fake indexer's
markets and memos; the tool lists with the count folded and show names
the goal, the board summary, and the last three memos; the command
renders one row per project; a project the board cache has synced counts
from the walked log where the newest-50 window is all noise, makes no
indexer message call, and the fallback fan-out is bounded at
FallbackBudget with the unknown marker beyond it.

v0.3.3

Orbit now builds against rig v1.5.9. The live repaint no longer
repeats rows after a phone keyboard shrink and grow: a pane that shrank
under a tall live region capped its cursor-up at the viewport, and when
the pane grew again the next repaint aimed only as far as the trimmed
region it had painted while short — the picker and the status rows stood
twice. live now marks a capped aim and resets the viewport on the next
repaint.

v0.3.2

/earn implements the runtime's command.Subber: the TUI offers its six
moments (join, roles, goal, status, stop, start) in the same popup the
plugins and scheduler commands get, each with a one-line description.

The footer band paints labels in the ember slot (orbit's accent) and
values in the text slot, and the PnL value carries its sign as colour: success when positive,
error when negative.

/earn status no longer needs the chain client to say something: on a
home without a config it prints the local snapshot when one exists, else
one line saying the home is not set up yet. A client error carries the
earn: prefix once (the provider's "no orbit config (run /earn)" was
wrapped a second time).

v0.3.1

The board sync was one window of the newest 100 messages, so a fresh
cache never reached the log's goal memo and a project with more than the
window was never fully folded. Sync now walks: the indexer pages
newest-first with before=<oldest created_at seen + 1s> (the boundary
second re-fetched, signatures dedupe), the RPC scan pages with the
signature cursor, and the walk stops when a scanned page holds a
signature already cached or comes back short. The scan's short-page stop
and cursor are the page facts — signatures scanned (memo or not) and the
oldest scanned signature — not the memo rows, so a full page of trades
with no memo is not genesis and the walk continues past it. A fresh
cache walks to genesis (the first goal memo lands), a warm cache reads
one page, and the walk runs per recorded source — indexer with the
timestamp cursor, scan with the signature cursor.

The walk is bounded at 50 pages: past it the cache is marked incomplete
(project_incomplete, schema v4) and the board render says so — the
goal is the first goal memo in the walked log. The RPC seam gains the
cursor (GetSignaturesForAddress(..., before)) and
TorchClient.MessagesPage/ScanMessages carry it with the page facts.

Tests: a 250-memo fake log syncs fully from empty in 3 pages; the
same-second boundary loses nothing; a warm cache makes one request; the
bound marks the cache incomplete and the render says so; the goal is the
first goal memo in the walked log; the scan walk pages by signature; a
fake curve of 300 signatures with memos only at positions 5, 150, and
290 walks to genesis from empty and folds all three, and a warm cache
stops after one page.

v0.3.0

The /earn command's description and its unknown-action error name the
verbs (/earn (status, or join as a worker), join [roles], roles [add|remove <role>], goal "<paragraph>", status, stop, start), and
"register first" reads "join first" everywhere.

The tool descriptions match the code: a board task needs no id (minted
after the sync), an act the fold would refuse is refused before
spending, only the funder's accept counts, and the reply is the
signature, the memo, and the board, or pending: not yet indexed, or
the assigned-id line when the fold renumbers; market is one action per
fire.

The footer paints every earn row with the theme's dim slot — the same
grey as the model rows — and orbit ships its theme: when the home has no
theme.json, the TUI resolves from the embedded default (ember #6b7fa3),
and a home theme.json still wins entirely.

Tests: the description and the unknown-action error name the verbs; the
board tool's description contains "minted" and "funder"; earn rows come
back painted; no theme.json -> ember is #6b7fa3; a home theme.json with
its own ember overrides it.

v0.2.4: Merge pull request #21 from mrsirg97-rgb/feat/indexer-read-fallback

The board's message read tries the indexer first and falls back to the
RPC scan when the indexer is unreachable (connect error, 5xx, timeout);
a 4xx never falls back — the indexer answered, and its answer is
authoritative. The fallback is per project and sticky: project_sources
records which source numbers a project's messages, and a mint's source
never changes while its rows exist. The fallback applies only to a mint
with no recorded source; an outage on a recorded-indexer mint inserts
nothing — the board read serves the cache with indexer unreachable: board may be stale and acts are refused — and a mint first synced by
scan stays on scan until the cache is rebuilt. Each fallback prints one
line naming the switch.

• The client classifies the fallback condition — IndexerUnreachable
  (connect/DNS errors, timeouts, 5xx), with a typed HTTPStatusError
  carrying the indexer's non-200s; TorchClient.Messages(mint, limit, source) reads a project's messages from the named source.
• The board records the source — project_sources (one row per
  project, schema v3); the record decides every sync, so an indexer
  recovery never re-sources an already scanned mint.
• A source change by config — unsetting ORBIT_INDEXER on a
  recorded-indexer mint wipes the mint's messages, tasks, and notes in
  the same transaction and re-syncs under the scan, so the cache never
  holds rows under two numberings at once.
• ORBIT_INDEXER unset = scan only and a user-set ORBIT_RPC is
  verbatim; the README gains a section on running your own torch indexer
  and pointing orbit at it.

Tests: indexer down → the scan serves the read and the source is
recorded; a later indexer recovery does not re-source an already scanned
mint; a 404 does not fall back; an outage on a warm indexer mint inserts
nothing and refuses an act; unsetting the indexer wipes and rewalks;
the mixed-source case is impossible by construction.

v0.2.3

The TUI re-reads the footer snapshot on a 2s tick while idle, and a fire
keeps it fresh end to end:

• The TUI sets tui.WithStatusTick(2s) — the status callback
  re-reads the local snapshot every 2s while the input loop is idle, so a
  fire's write shows up without a command.
• run-job writes at fire end and after every board act — the fire
  start write (the fire's read state) stays; the worker refreshes the
  footer after each board act (a fresh wallet + board read, plus the
  act's role, verb, and task id), and the parent writes once more when
  the fire ends.
• The snapshot gains the last fire — lastFire (role, verb, task
  id, time) rides status.json, and the footer's last-memo row shows it:
  last memo: 3m ago · "claim 7" · worker claim #7 · just now.
• Writes are atomic under concurrency — WriteSnapshot uses
  os.CreateTemp in the snapshot's directory and renames into place, so
  two fires writing at once never leave a truncated file.

Tests: concurrent snapshot writes leave a parsable file; the status
callback shows a fire's write on the next read.

v0.2.2

/earn was one register wizard that needed roles and a goal every run.
It is now a set of moments:

• bare /earn prints status when the home is set up, otherwise runs
  join with one worker.
• /earn join [roles] runs the setup (init, vault create, link,
  deposit) then registers the roles (worker by default).
• /earn roles lists the roster; /earn roles add|remove <role>
  registers or removes one role and its job.
• /earn goal "<text>" sets or changes the architect's goal,
  registering an architect (and its job) when none exists.
• /earn status|stop|start are unchanged.

Before any chain spend the wizard prints one preflight line naming what
exists and what will happen.

The operator key path is asked once, at the first signing step, and
remembered as ORBIT_OPERATOR_KEY_PATH in the config — the path, never
the key. A second join after the path is recorded signs with no flag.

Tests: bare /earn on a fresh home registers a worker; roles add reviewer creates one job; goal on a home with no architect registers
one; a second join after the path is recorded signs with no flag.