0.5.4

Android runtime performance

• New Android Rooms default to the fast 37.5% software-rendering profile, matching the normal 540x1140 Room preview.
• Balanced Rooms now use 50% instead of 75%, reducing SwiftShader pixel work for existing Rooms on their next emulator recreation.
• Fixes retained docker-android emulator restart after its one-shot KVM permission bootstrap removed the root passwd entry.
• Same-Room measurement: guest screencap improved from about 919 ms at 1080x2280 to about 298 ms at 540x1140; repeated Settings launches also improved.

Validation: full test suite passed, typecheck passed, lint completed with zero errors, and the installer SHA-512 matches latest.yml.

0.5.3

DevHotel 0.5.3

• Adds acquire_room and enforced compatible Room reuse to prevent agents from creating unnecessary duplicate Rooms.
• Adds automatic Room lifecycle management: idle sleep, expiry grace, safe fail-closed deletion, pin protection, and wake-on-use.
• Adds privacy-safe PurplePulse startup telemetry for packaged builds: persistent random install ID, once-daily ping, normalized OS, Electron platform, short timeout, silent failure, and no user/device identifiers.
• PurplePulse verification was performed only with environment: test; no pre-release production telemetry ping was sent.

0.5.2

Retained Android locale recovery

• Recovers interrupted app-locale matrices after a DevHotel restart by
  reattaching only to the exact retained emulator and tracked install.
• Launches the tracked application before proving locale, process, and
  foreground state, then restores and re-proves the original app locale.
• Preserves the recovery fence and reports structured operator guidance when
  the target, install, user, lease, API level, or locale ownership changed.

Room-owned volume safety

• Makes volume reconciliation Room-aware and fail-closed for ambiguous or
  cross-Room ownership.
• Binds legacy adoption and garbage collection to immutable volume identity.

This release contains the Android recovery fix from PR #62 (e929bc1). The
operator-host recovery and resource-release evidence remains tracked in issue
#61 and is complete only after the installed host successfully replays its
retained recovery records.

0.5.1

Android runs survive lost responses and control restarts

• android_run now acknowledges a durable caller-assigned operation ID immediately. Poll with check_operation; replaying the same ID returns the original in-flight or terminal result, while mismatched requests fail closed.
• Distinct Android requests keep distinct identities. Existing Room mutation locking, emulator ownership checks, device leases, and artifact fences remain authoritative, with no Android timeout increase.
• Caller-assigned operation IDs remain durable beyond the rolling display history. Interrupted workspace pauses are reconciled on startup and Room shutdown.
• Control API relaunches retain a non-secret preferred port, avoid Fetch-blocked ports, rotate bearer credentials, and MCP clients rediscover current control credentials after connection or authorization errors.

This release contains the reconciled work from #55, #56, and #57.

0.5.0

Windows 11 x64 — download DevHotel-Setup-0.5.0.exe below.

This is the release the Android work has been building toward. 0.4.3 could build
an APK and put it on a screen; it could not be asked what the screen then did,
could not lend you a real phone without two projects fighting over it, and had
no third Room kind. All three are here.

Windows Rooms, on VMware Workstation

A Room-owned Windows VM as a linked clone of a template snapshot, with guided
setup, fail-closed VMX authoring, and a sleep that asks the guest before it
pulls the plug. Opening the VMware console is a named, user-only, journaled
capability, because it is the one path in the product that takes the real Host
cursor and keyboard. Guest exec and file ingress stay deliberately later.

Android Rooms drive themselves, and can prove what happened

android_run, android_screenshot, android_dump_ui, android_tap_text,
android_wait_for_text, android_launch_app, android_force_stop,
android_logcat. Actions are witnessed against the device's own log, so
"it worked" and "adb accepted it" stop being the same sentence. Every adb
command runs through a fenced helper joined to the emulator's network
namespace — all capabilities dropped, read-only root, owner-checked private
socket, topology proved before and after. Screenshots are published as durable
Room artifacts, so an image can no longer be lost to a message limit.

Locale matrices and acceptance receipts

android_locale_screenshot_matrix captures an app in each locale it claims,
using Android's app-scoped LocaleManager — no adb root, no framework
restart, no data wipe — and re-proves the restore before it returns.

android_create_acceptance_report leaves an immutable receipt assembled from
evidence DevHotel can reverify: no raw commands, no adb serials, no Host paths.
final-physical requires a real device lease with purpose acceptance and has
no emulator fallback, so a report cannot quietly downgrade its own evidence.

One USB phone, many projects

A physical phone is a Hotel Service lent to one Room at a time under an
exclusive lease, with a visible queue and automatic reclaim when a worker dies.
The broker never uninstalls, clears, or wipes — the verified build stays on the
phone. Wireless pairing keeps its codes out of every diagnostic surface and
requires explicit consent.

Fixes worth naming

• android_run could not launch anything. The focus probe read a dumpsys
  section that no longer carries the focus line.
• Clean reset never worked on a real VMware install.
• Docker 29 joined network namespaces could leave a Room unstartable.
• A Room that said ready was not always ready — status is now revalidated
  against the live runtime.
• ls turned a Room amber. Running a command is no longer treated as proof
  that the workspace diverged.
• Private repositories can be cloned, with the token split out before
  anything is stored and passed to git over stdin — never argv, environment, or
  disk.

Full detail in CHANGELOG.md.

Installing

Run the installer; DevHotel starts in the tray and keeps itself updated from
Releases. Still a developer preview: it needs Docker on the Host, Android Rooms
need KVM through it, and Windows Rooms need VMware Workstation Pro.

0.4.3

Reset Room — housekeeping without checking out

A Room can now be handed back clean while staying the same Room. Reset clears what the Room can rebuild by itself; it keeps what only you could have made.

• Kept: room number, nickname, project, domain, HTTPS, runtime and package manager, start command, source code and its Host link, environment variables, change history, safety backups and build artifacts.
• Reset, each an option: dependencies (reinstalled into a fresh generation — the live layer is never wiped), download caches (SDK/Gradle caches on Android Rooms), Room App data (Keep data / Fresh data / Remove apps), and the Room browser profile. The stale thumbnail always goes, so the Lobby card cannot show a picture of the Room before the reset.
• Safety: every Room App is dumped to a backup before its data is destroyed, and the change refuses to roll back destructively until that dump exists — the same interlock the service-version change uses. Resetting app data therefore needs an awake Room.
• Honest about undo: a reset is not undoable (cleared caches and browser data have no inverse), so it never offers one. Room App data is recoverable from the safety backup through Restore in Room Apps.
• Legacy Host-bound Rooms are refused — their workspace is a bind mount to your real folder. The same rule now guards room_pull_file / room_push_file, which could otherwise have read and written a legacy Room's real Host folder.
• Caches are emptied in place rather than by deleting their volume: the Room's containers mount those volumes for the Room's whole life, so a delete would be refused mid-reset. Android Rooms have no dependency layer, so reinstalling dependencies there is refused instead of writing into the source tree.
• Surfaces: the Room's ☰ menu (Reset Room…, confirmation by typing the nickname), and the reset_room MCP tool. Source code is deliberately out of scope, per goal.md §13.3; restoring code stays Sync from Host / Git.

Unservable providers fail loudly instead of impersonating a Web Room

A feasibility review of adding a Windows provider found the placeholder was riskier than the missing feature.

• A stored provider value was cast through unvalidated, and every runtime branch reads "android, else web" — so a Room row naming a provider this build cannot serve would have booted as a Node/Debian Web Room, with Web checks and Web change kinds. Hydration now rejects an unknown provider, and webSpecFor — the one path every Room container is built through — refuses a known-but-unavailable provider with the registry's own reason.
• The New Room wizard renders roadmap providers from the registry, so the disabled "Windows Room" tile states its real availability and disappears by itself once the provider reports available. windowsProvider.ts claimed to be "visible on the roadmap, never faked in the UI" while nothing rendered it at all.
• Windows Rooms themselves remain unbuilt, and the creation contracts (zProviderKind) stay web | android.

Host sync no longer dead-ends after a build

Reported by an agent whose Android Room could never sync again: the room went modified at its first android-run and refused every later sync, with no way back from any surface.

• The workspace fingerprint is content identity, not a filesystem snapshot. Generated trees (build, dist, node_modules, .next, coverage, .gradle, .git/objects) are now pruned including their own directory entry — previously the excluded directory's entry still counted, so a first build permanently looked like Room-side drift — and mtime no longer participates, so touching a file without changing it is not an edit. Deleting build output now genuinely restores the fingerprint.
• Reset baseline: accept the Room's current files as the comparison point when they have legitimately changed. Nothing is copied and no Host file is read; the change is journaled with its actor. Available in the room's Working state card, as POST /v1/rooms/:id/sync-baseline, and as the reset_sync_baseline MCP tool. The sync it unblocks still needs its own explicit user action (and, for agents, the approval dialog).
• The refusal message now names the way out instead of only stating the problem.

Existing rooms carry fingerprints computed the old way, so their first sync after updating still reports drift once — Reset baseline (or any successful sync) re-anchors them.

Phone-first Android rooms

• noVNC's own chrome — the pull-out control bar, its handle and status toasts — is hidden in the Room preview. The Room shows a phone screen; DevHotel's strip drives it.
• Rotate joins Back / Home / Recents in the phone strip, stepping the device through its four orientations over adb. The emulator screen keeps the size the Room was created with, so a rotated device is letterboxed inside it — Quick change › Orientation resizes the screen itself for a full-size landscape Room.
• Landscape Rooms are actually landscape. Setting Orientation rotated the X screen but left the guest portrait: hw.initialOrientation alone does not turn the device, because Android reads its orientation from the panel and qemu keeps the panel's aspect ratio. The AVD panel axes are now swapped for landscape Rooms (at every resolution preset, native included), so the device boots landscape and fills the screen instead of standing narrow in a wide frame with the emulator toolbar and the docker-android wallpaper showing beside it.
• The letterbox around the phone is black in every case: openbox runs the image's wallpaper autostart alongside ours, so the fit daemon now paints the root window itself rather than assuming our autostart replaced it.
• The Android room bar shows the device (profile · Android version · AOSP) instead of a meaningless vnc URL; browser back/forward hide, reload stays.
• Screen orientation (portrait/landscape) joins device/OS/resolution in Quick change, undoable and settable over MCP.
• One emulator no longer appears as two adb serials: DevHotel targets the auto-detected emulator-5554 and never adb connects, so Gradle instrumentation runs once.
• android_screenshot gained mode 'screen': an X-display grab that also captures FLAG_SECURE apps; 'auto' prefers the sharper guest-side screencap. Both are served by GET /v1/rooms/:id/screenshot.

The MCP setup command actually works

• The one-line Claude Code command in Settings was rejected by the CLI: --env is variadic, so --env ELECTRON_RUN_AS_NODE=1 devhotel made it read the server name as another environment variable and abort. The command is now claude mcp add devhotel -s user -e ELECTRON_RUN_AS_NODE=1 -- "<exe>" "<script>" — name first, user scope so every project sees the Hotel, still absolute paths.

MCP survives app restarts

• The bundled MCP server cached its first control-API connection forever, so restarting the DevHotel app (which rotates the loopback port and token) made every tool fail until the whole MCP session was restarted. The client now detects the stale connection, re-reads control.json, and retries once — long-lived agent sessions keep working across app restarts and updates.

Documented control API

• docs/control-api.md publishes the loopback REST contract (discovery via control.json, bearer auth, all /v1 endpoints with agent semantics) so external agents can collaborate without an MCP session. Runtime kinds beyond node/jdk (Go/Rust/Python) and a Room-owned Container Service (Docker-in-Room for Compose e2e) join the backlog from the seventh field report.

Agent field-report fixes (docs/feedback/2026-08-12-agent-field-reports.md)

• hotel_status MCP tool + GET /v1/status: one call for app version, backend health, gateway ports/routes, and every room with provider/status/domain/URL and live emulator state.
• android_screenshot: the phone screen returned directly as an MCP image — captured with in-room adb screencap, so no host SDK, no noVNC letterboxing, no upload round-trips.
• android_run: one-shot build → install all built module APKs → launch a chosen applicationId → screenshot of the running app. The android-run quick change itself now installs every module (multi-APK apps like app+crash-lab no longer need manual adb) and accepts applicationId.
• room_pull_file / room_push_file: official file egress/ingress for room workspaces (base64, 16MB cap, /workspace-only paths, docker-cp transport — no more temp-HTTP/wget workarounds). Pushing marks the working state modified.
• Device selector honesty: hints now state profiles mimic screen size/shape only — the runtime is an AOSP emulator, not Samsung One UI or a physical device.
• The full five-agent feedback triage (exclusive lease, snapshot reset, streamed exec output, failure bundles, artifact receipts, android clone, Gradle queue, newer images…) is recorded as the working backlog.

Host sync is a standing Room grant, not a popup

The modal that interrupted every agent sync is gone. Its job is done by a persisted, revocable grant instead — closer to goal.md §5.11, which describes grants with scope, actor and revocation rather than per-call prompts.

• No dialog. sync_from_host runs under the Room's inbound-sync grant. The human already chose that folder when creating the Room, sync re-reads only room.sourceRef (agents can neither supply a path nor create linked-folder Rooms), and it never writes to the Host.
• Revocable per Room: "Agents may sync from Host" in the Working state card. Revoked ⇒ 403 for agents, while the user's own sync button keeps working. The toggle is journaled.
• Honest audit: agent syncs are recorded as actor agent. They were previously journaled as user because the dialog had approved them — the trail said a person acted when an agent did.
• Recoverable: a successful sync used to delete the workspace generation it replaced, taking Room-side edit...

0.4.2

Android emulator preview restored

• Android Rooms are served Rooms again: a Room-owned KVM-backed emulator sidecar joins the anchor netns and its noVNC screen is routed as the Room's site, pinned to the phone's 540×1140 aspect in the preview.
• Build & run builds the debug APK in the Room, waits for the emulator to boot, installs over the shared-netns adb, and launches the app on the visible screen; Build APK keeps the immutable provenance snapshot build.
• Emulator device/OS selection is back in Stack with action-level Undo; checks probe the relayed emulator screen, gateway route, and HTTP response.
• No Host SDK or Host adb is used; shared physical devices remain a later Hotel Device Service.
• Emulator screen-resolution presets in Stack: Balanced (75%, new default), Fast (50%), and Native. The guest LCD is scaled at AVD creation, which is the biggest speed lever since the room emulator renders in software (no GPU passthrough); boot animation is skipped too. Device and Android OS version (11–14) stay selectable alongside, all undoable.
• The phone screen is genuinely edge to edge now: window rules, a black backdrop, and a tiny libX11 fit daemon are staged into the created emulator container before its first start. The daemon keeps the qemu window at the full 540×1140 X screen (qemu ignores WM geometry rules at map time and its -scale flag is obsolete), openbox strips decorations at map, the toolbar stays hidden behind the full-screen phone, and stray qemu chrome (the floating collapsed-toolbar button) is swept off-screen.

Everything drivable over MCP

• The control API and devhotel-mcp now cover the full room surface: delete_room, restart_web, clone_room, rename_room, list_changes, room_components, and room_logs (web/orchestrator tails) join the existing create/start/sleep/inspect/exec/check/change/undo/diagnostic tools.
• Agents can create Android Rooms (create_room with provider: 'android') and drive android-build, android-run, and emulator-config as quick changes.
• Hotel Services reach agents read-safely: hotel_github_status and hotel_github_install provision the pinned gh; connecting a credential stays a human action in the app.

Fixes

• The MCP setup card (Claude Code one-liner and mcpServers config with copy buttons) is back in Settings — the 0.4.1 renderer rewrite dropped it while the main-process API remained.

Manual, draggable Web preview split

• The desktop/mobile split is now a manual toolbar toggle instead of always-on; each Room remembers whether it is split.
• The divider between the two panes is draggable; the ratio is clamped to 15–85 % and persisted per Room.
• The preview backdrop (letterboxing and gutter) is black on both the renderer and the native panes.

0.2.2

• Installed programs in Stack: every room lists its programs with live in-room versions; switch Node/npm↔pnpm/PostgreSQL/Redis versions in place, undo per component. Service version switches back up the data, recreate the service, and restore it.
• Database lifecycle (add · version · backup · restart · remove · restore) lives in Stack; Overview is a clean summary.
• Android rooms: the phone screen now fills its frame edge to edge (phone-aspect preview, frameless main window only, tool windows minimized).

0.2.1

Android rooms run your app on screen

• KVM-backed emulator joins the room's network; the Site page shows the phone screen (frameless, phone-sized, auto-connected) — a browser for your Android app.
• Build & run: one click builds the APK, waits for boot, installs over in-room adb, and launches the app.
• Device (Galaxy/Nexus) and Android version (11–14) selectable per room, undoable; latest-build card with an open-APK-folder jump.

Services

• Backups are listed in Overview with time/size and a one-click Restore (safety-backed-up and undoable).

Stack & Health

• Package manager (npm ↔ pnpm) is now a quick change with Undo; Health shows the live in-room npm/pnpm version.

0.2.0

Android build rooms (provider v1)

• Create a room from any Gradle/Android project: containerized JDK 17 + Android SDK (digest-pinned image, licenses pre-accepted), per-room Gradle caches and a persistent SDK volume — nothing installed on the host.
• One-click Build APK as a verified change; in-room terminal; adapted health checks. Emulator + preview is the designed v2.

Per-room services with real backups

• Add PostgreSQL 17 / Redis 8 into a room's private network (localhost:5432/6379 in-room, no host clashes).
• Backup / restart / remove from Overview; destructive operations capture an automatic safety backup, and undoing a removal restores the service and its data. db-restore guards itself with a pre-restore backup too.

Full-page room view

• The site and the room pages (Overview · Stack · System · Activity · Health · Console) each cover the whole window, browser-style; sleeping rooms home on Overview and navigate to the site on wake; browser-style ⋯ menu.

Room System page

• Per-room control panel: environment variables, CPU/memory limits (docker-enforced), timezone — one undoable change.

Browser-grade preview tools

• Docked Chrome DevTools (F12 or the </> button) beside the site; viewport presets (desktop/laptop/tablet/phone) via device emulation.

Host cleanliness

• Settings → Host footprint: exactly what's on the host, open-folder buttons, autostart toggle, and Uninstall & remove everything (deletes all rooms/volumes, CA trust, autostart, app data, then launches the uninstaller).