v0.163.0

Release Notes

Reliability & Data Integrity

• Parallel in-place edits are now serialised per file to prevent silent data loss; edit_file calls to the same file no longer clobber each other, while distinct files still edit concurrently. Previously both calls read the original text, the second write won, and both reported success — so an agent could report an edit it had not made.
• Artifact mutations are serialised across every writing path — the tools plus the panel's edit, revert and delete routes — so concurrent updates no longer overwrite each other or lose a version. Two updates reporting the same new version was the symptom.
• Scheduler failure backoff is now computed from the persisted post-claim next_fire rather than the stale pre-claim value, so consecutive failures defer by the correct number of slots.

Delegate Output

• An ACP delegate's reply reads as prose again rather than one unbroken wall: narration that resumes after a tool call starts a new paragraph, instead of being fused to the previous sentence. Chunks within a single run still join seamlessly.
• A message chunk delivered twice in a row is now dropped, with a warning so occurrences stay countable. The known emit-side doubling turned out to repeat only the first chunk, which the existing whole-message collapse could not catch — so it was reaching transcripts, room bubbles and PR bodies. The guard resets at tool boundaries, so an agent deliberately restating where it got to is preserved.

Onboarding

• onboard_project no longer clones into the server's working directory when onboarding.root is unset. Path("") resolves to Path("."), so an unset root silently became the process's current directory and the containment check passed trivially — the clone landed wherever the server happened to be running, and that relative path was registered into the managed-projects registry the filesystem fence projects from. An unset root is now refused by name.
• Project onboarding is enabled by default, so the tools and configuration are discoverable. A stock install still gains zero new capability: the allow-list is empty (nothing can be cloned) and no root is set (nothing can be registered). The switch was only ever a surface, not the consent — and being off was also what hid the settings you needed to find. Refusals now name what to configure.

Multi-Agent Rooms

• room.max_rounds now defaults to 3, so addressed participants answer each other rather than each replying only to the operator. Set room.max_rounds: 1 to restore the previous single-pass behaviour. A single addressee is still capped at one round.