v0.45.0

Minor Changes

• 3a5521a: Add preview-pinned, audited recovery for unknown workflow liveness and abandoned resume locks. Confirmed recovery requires an actor and reason, writes durable intent before effects, and preserves unknown outcomes after interruption. Keep active owners, workspace authority, retained peer reservations, and existing lease checks protected.

• 6c978aa: Tunnel readiness now requires the original registration receipt and saved process generations. Commands retain unknown state instead of reusing or replacing it, and file links use only verified ready tunnels.

  The toolkit replaces isTunnelStateLive with tunnelReadiness and a mandatory verifier. Embedding hosts can use createTunnelReadinessVerifier from harnery/core/servers. Cloudflare state uses only cloudflared_pid and cloudflared_start_token; obsolete provider fields remain unknown and cannot authorize actions.

• 3832b99: Add explicit per-turn content capture and reviewed exact-path rollback in owned
  local Git workspaces. Preserve separate staged, unstaged and untracked content,
  refuse stale or overlapping authority, and retain unknown outcomes after an
  interrupted capture or restore.

Patch Changes

• 223e20c: Give local server registrations immutable receipts and serialize registration, activity, stop and cleanup by ID. Export the existing no-clobber lease primitive for host launch custody. Preserve exact receipt custody through asynchronous host effects. Refuse live duplicate registrations, stale cleanup and older records without custody. Tunnel lifecycle commands preserve launch witnesses, use retained process handles and keep uncertain state instead of terminating processes by PID, command line or port.

  Serialize tunnel lifecycle and actual Tailscale routes across provider effects. Atomically retain pending provider intent before effects, publish ready state only after success, and preserve route custody when cleanup fails.

• cae43d9: Honor configured project-state permissions for rollback indexes and newly created state directories.

• 18f4d4b: Bind service and server signals to retained Linux pidfds or Windows process handles. Refuse direct signals when native handle support is unavailable, preserve durable service stop requests, and keep Windows process creation tokens consistent across native and standalone readers. Remove the unreachable legacy resource service launcher.

v0.44.0

Minor Changes

• 4bd8654: Report unreadable repository observations as unknown in checkpoint recovery and workflow proof. Failed reads no longer claim a checkpoint match or cleared dirty paths.

  Guard governor, supervisor, and server stop signals with a process-generation recheck. Missing or different start tokens send no signal. Service status reports generation, running and installed builds, and whether a restart is needed. Server records with unknown identity remain visible; arbitrary stop commands and automatic adoption from old tunnel state are removed. Registry stop controls a tunnel's recorded gate; saved provider-helper PIDs lack generation evidence and are left alone.

  Preview run reclaim without --yes. Both salvage and discard now prove run inactivity and workspace ownership, and hold the resume, binding, and repository leases before changing files. Refusals leave workspace files untouched. The raw reclaim preparation helper is no longer a public export; callers use the guarded provider operation. See ADR 0207.

• bf87b5a: Add an explicit removal entry limit up to 100,000 for one verified
  caller-owned managed artifact. Keep the 10,000-entry default and all existing
  path, ownership and hold protections.

• 3e5c1f0: Add a portable ZIP toolkit for embedding hosts, with bounded decoding, checksum validation, collision checks, and extraction that rejects existing symbolic links. Existing outputs require an explicit overwrite option, and atomic replacement preserves other hard links to an existing file.

Patch Changes

• e1bc022: Keep governor runs moving after a planner returns an invalid dependency graph. Record the failed plan and charge the existing replan budget, then let the governor retry within its frozen limits. Workflow, storage, and persisted review-input failures keep their existing error behavior.
• 4f21b48: Add guarded removal of clean repository copies inside an owned artifact. The command refuses unpublished HEAD, branch and tag commits, uncommitted work, and registered worktrees while preserving the surrounding artifact and evidence.
• 1631d37: List pending and recently surfaced task messages in context recovery briefings. Recovery leaves inbox receipts and checkpoint history unchanged.
• 232b5c4: Bind context recovery acceptance to the exact prepared checkpoint and task instance. Refuse stale or mismatched acceptance without changing newer state, and keep repeated completion idempotent.
• 5ec2fac: harn doctor now reports the node executable on PATH. Under Bun it previously showed the Node version Bun emulates, which could hide an old or missing Node install. A missing Node under Bun is a warning, and Node older than 20 still fails.
• 79dd3e2: Make session-name Stop remediation open a fresh verification boundary before requesting the exact display, so a previously rejected reply cannot keep recovery pending.
• 2c09514: Stale workspace lease recovery no longer strands the winner. The winning claimant now moves its recovery directory to a private name before emptying it, so a contender's claim can no longer replace the emptied directory and fail the winner's cleanup after it already holds the lease.
• 229f842: Keep literal inline-code contents when checking Markdown heading anchors. Angle-bracket text and underscores inside matching code spans now survive markup removal, while actual HTML tags outside code still disappear. Matching backtick runs and duplicate headings retain their heading-anchor behavior.
• d67c8a6: browse --login under WSL now keeps browser-session cookies and reports where the sign-in ended. Before the Windows sign-in window opens, the dedicated profile is set to continue where it left off, so closing the window no longer deletes cookies that have no expiry date, and the headless read restores the last session so those cookies are copied into the store. The read also lists the pages left open on the sign-in site and prints the last one as [--login] Last page: <url>, plus a JSON login summary on stdout with lastPage, for sites whose landing address carries a per-session token. Closing the profile now fails loudly when a Chrome process survives, and both the sign-in and the read refuse to start while Chrome is still open on the profile instead of handing off to the open window.
• f213979: Record mailbox drains as injection-unconfirmed instead of claiming delivery before hook output succeeds. Approval decisions remain separate from unread message notifications.
• 340224a: Allow explicitly named copied Harnery state inside an authenticated caller's owned managed artifact while preserving live workspace, artifact record, peer claim, Git and path protections.
• b9a3beb: Bind peer pings to known task instances, including stale and done recipients. Route CLI and web messages through the private instance inbox, surface them after native output succeeds, and provide a supported inbox watcher without changing presence or file claims.
• df42f60: Keep private home-path owners distinct in diagnostic exports and preserve captured finding episodes and their evidence links during replay. Freeze the producer's output before redaction so replay checks the original result independently.
• b754332: harn section now picks the header that exactly matches the query when other headers only contain it, so "Media" selects ## Media beside ## Media recipes.
• 40865b3: Keep stale-sweep observations bound to the captured generation. Coordinate cache publication with exact-file cleanup, preserve refreshed and replacement state, and recover retained files after process death without overwriting newer publications.
• 623b80e: Preserve partial output from failed spawns and carry explicit effect and refusal
  uncertainty into retry decisions, workflow proof and work charging. Require
  positive no-effect evidence and observed absent output before granting an
  automatic retry or an uncharged attempt; keep genuinely unstarted processes
  uncharged and stopped.
• 623b80e: Keep workflow terminal writes and cache cleanup bound to the generation captured at dispatch. Fail the run when terminal confirmation fails, reject stale authority mutations and pending replay, and recover held cache cleanup after process death without consuming a replacement generation.
• 987976f: Protect retained peer workspace authority before reclaim changes files. Claim
  publication and cleanup now share recoverable path reservations, while
  unrelated allocations can continue during reclaim preparation.
• 43c6212: The ZIP toolkit now accepts an archive, base, or destination whose parent directories pass through a symbolic link, such as /tmp and /var on macOS. It still refuses a link at the named path itself or anywhere below it.

v0.41.0

Minor Changes

• 1040f84: Add storage.sharing to .harnery/config.jsonc. The default, private, keeps
  project state owner-only as before. group writes state directories 2770 (setgid) and
  files 0660, so several Unix users who share the project directory's group can
  coordinate in one project, and integrity checks accept group access while still
  rejecting any access by other users. The setting is read from the project file
  only; HARNERY_STORAGE_SHARING overrides it per process.
• fa18ba6: Headed browse sessions (--login, --headed) now launch the operator's installed Google Chrome when one exists, drop Playwright's --enable-automation default, and disable Blink's AutomationControlled feature, so pages no longer see "Chrome for Testing" or navigator.webdriver. Sign-in flows that screened for automation and refused clicks in the headed window (X was the reported case) now behave as in a normal browser. New --browser-channel <chrome|chrome-beta|msedge|chromium> and HARNERY_BROWSER_CHANNEL choose the browser explicitly; headless runs keep the bundled Chromium. The BrowserClient gains channel and hideAutomation options. Headed sessions also run with the Chromium sandbox on (no --no-sandbox banner) and no longer add --disable-gpu under WSL, because software WebGL (SwiftShader) is itself a bot signal; HARNERY_BROWSER_WSL_DISABLE_GPU=1 restores the flag for machines whose headed window paints blank without it. HARNERY_BROWSER_NO_WSL_DEFAULTS is removed. browse --login --plain spawns the installed Chrome with nothing attached, for sign-in verification steps that detect the DevTools protocol itself; the cookies land in the shared profile that later automated runs reuse. Every browse, browse-session, plain login, and fetch load now presents a normal Windows (macOS on a Mac) Chrome user agent at the launched Chrome's major version, never desktop Linux and never HeadlessChrome, because WAF rules deny those outright; the value is stored at ~/.cache/harnery/user-agent.json and reused, --user-agent <ua|auto|native> manages it, and HARNERY_BROWSER_UA overrides per environment.
• 200b420: Read pages at human pace by default. browse, browse-ai, fetch, and the headed browse-session verbs now wait a random 3 to 9 seconds between consecutive loads of the same registrable site, tracked in a shared machine-local ledger (~/.cache/harnery/pace.json) so separate processes queue behind each other instead of firing together. Different sites never wait on each other, and loopback, private-network, single-label, and reserved-suffix hosts (.localhost, .local, .test, .internal) are exempt so local development and page QA keep machine speed. Each command takes --no-pace for one run; HARNERY_PACE=off disables the gate machine-wide, and HARNERY_PACE_MIN_MS, HARNERY_PACE_MAX_MS, and HARNERY_PACE_EXEMPT tune it. The gate ships as the harnery/lib/pace toolkit export for hosts that load pages through their own clients.
• 13b0d3c: harn init wires a set of adapters instead of exactly one. --adapter is
  repeatable, accepts comma-separated ids, and accepts all. With no flag, init
  wires every adapter whose CLI is installed on the machine, plus every adapter
  the project already has wired; a machine with neither falls back to
  claude-code. --instructions-only keeps its single-adapter scope.
• af7ff21: Add first-class OpenCode (V2) support. OpenCode joins the workflow adapter
  registry (opencode run --format json spawner, offline bench fixture, effort
  validation) and the Event Ledger V3 adapter census with its own capability
  profile. Because OpenCode V2 intercepts lifecycle events through an in-process
  plugin rather than a settings-file hook map, the adapter spec carries an
  install mode: harn init --adapter opencode installs the Harnery OpenCode
  plugin (opencode-plugin/, copied to .opencode/plugins/harnery/ under an
  ownership header, auto-discovered so opencode.json is never edited) instead of
  writing a hooks map, and skips the CLAUDE.md shim and skills mirror because
  OpenCode reads AGENTS.md and .agents/skills natively. The plugin bridges
  prompt, tool, permission, compaction, and session-bus events to agent-hook --adapter opencode, injects returned context through OpenCode's own channels,
  rejects a denied tool call, and stamps OPENCODE_SESSION_ID into tool shells.
  init --check, deinit, doctor, and the wiring summary understand the plugin
  install mode, and every --adapter option accepts opencode. Stop verdicts
  are observe-only for OpenCode, like Codex. This change adds an adapter
  capability digest, so harn init archives the prior Event Ledger V3 epoch and
  mints a new one; the three published digests stay byte-identical. Enforced Stop
  re-prompting and SQLite-backed context telemetry are follow-ups.
• 1752248: Add webview, a lightweight headless page probe through Bun.WebView (experimental, Bun 1.4+), as a Harnery command. It starts a fresh browser per call with ephemeral storage unless --profile is given, never attaches to a running user browser, scrolls before clicking, waits for same-URL replacement documents after actions, and takes the human-pace gate with --no-pace. On Node it fails with a clear webview_unavailable message, like tunnel. Embedding hosts that carried their own copy can delete it and take the command from createHarneryProgram. ADR 0185.
• 8301d24: Show recorded lines added and removed in the agent status box for the turn being reported. Preserve counts after commits and label incomplete measurements. Run init after upgrading to refresh the event schema.

Patch Changes

• 11cda98: Move per-adapter hook behavior out of the hook CLI and the V3 producer into
  one module per adapter under src/core/hooks/adapter/behaviors/. Session-start
  labels, sound and journal effects, prompt-context nudges, transcript discovery,
  the Codex WSL bridge, and runtime-context retries are now looked up by adapter
  id instead of decided by scattered equality checks. Event payloads, the ledger
  schema, and capability digests are unchanged.
• a59e90d: Accumulate command output counts and fingerprints in bounded memory, then record
  one summary per stream at completion or process exit. Streaming output no longer
  pays a durable ledger write for every emission. Forced termination can lose
  unflushed output summaries; command start and completion retain their existing
  durability.
• 202eda9: Align driven Chromium client hints and navigator platform with the selected
  desktop user agent, including initial popup documents. Headed browsing uses
  the real window viewport unless a viewport is explicitly requested. Chrome
  WebView probes now reuse the shared user-agent resolver.
• f217dca: Detect a stored cursor-agent login for billing checks. The probe reads the
  CLI's auth.json at the same location the CLI resolves (CURSOR_CONFIG_DIR,
  then the platform config directory), so harn doctor and workflow billing no
  longer report the Cursor login as unverifiable, and a CURSOR_API_KEY that
  would override a subscription login is refused like the other adapters.
• 87937e2: Recover Cursor Stop followup replies onto a derived remediation turn so afterAgentResponse can record the status box after the original turn has already closed. Pin Cursor Stop loop_limit to 2 on harn init so a missed box cannot retry five times.
• a33f46a: Stamp Cursor's verified contract from a live cursor-agent 2026.09.18-9a7762b
  attestation. Invocation, final result, and session id stayed supported; cost
  stayed unsupported. The previous verified version was 2026.08.11-e8db854.
• 6a4d306: Load the selected lazy command when a root option carries its value inline,
  such as --format=json. The scanner now leaves the following command token in
  place instead of mistaking it for a separate option value.
• 3537939: Name agents lifecycle active in every refusal a continuing session hits after its generation ended: whoami, status, set-task, identity assume, and heal now point at the one command that opens a fresh generation instead of leaving the caller to guess.
• 1a66671: Pace top-level document requests triggered by links, forms, scripts, popups and
  session actions. Redirects share the original reservation; assets are not paced.
  Block service workers while pacing is enabled so they cannot bypass the gate.
• 12149f5: The OpenCode plugin prepends the project's bin/ directory and an existing
  Bun install directory to each tool shell's PATH, so bare project launchers
  resolve in sessions whose server started from a minimal environment.
• 289e298: Count the non-empty lines inside one command.output_observed chunk instead of
  reporting one line per event, so a host can record a whole output body as a
  single event without losing the line total.
• 0fef7f6: Keep delayed Codex context observations on their original hook producer sequence
  during approved session shutdown. This prevents finalization from introducing a
  producer sequence gap that makes the shared event ledger unavailable.
• 238d0a3: Re-attach the session-name display instruction as PostToolUse context on up to two ordinary tool results while the requested title stays pending. The fail-open gate from ADR 0182 stays; the reminder gives a model that skipped the block a second chance without a denial the transcript cannot support.
• f8c1869: Fix session-name display checks for Claude Code transcripts that stream thinking before visible text. Keep tool access available with an explicit diagnostic when transcript evidence is missing or malformed, and preserve that unavailable state through Stop enforcement and V3 observations.
• 26de7ea: Replace the seven copied platform-to-adapter normalizers with one shared
  implementation next to the Adapter union. Three of the copies did not know
  opencode and silently ...

v0.40.0

Minor Changes

• d29d1c6: Keep name resolution out of the config and process-launching graph.

  readLiveNames and assignName now require an explicit freshnessSecs
  instead of falling back to coordFreshnessSeconds(). That fallback made
  every consumer of the name pool import core/config.ts, which resolves the
  coordination root through a git rev-parse spawn. The dashboard's read-only
  Codec director reaches name resolution, so its dependency-boundary guard
  failed on the transitive node:child_process import.

  Callers that assign names already hold the coordination root and now pass the
  configured freshness themselves. Resolution behavior is unchanged.

Patch Changes

• d29d1c6: Gate the registered-screenshot thumbnail test on an installed browser, matching
  the renderer suite. The dashboard workflow installs no Chromium, so the test's
  post-edit re-render assertion failed there instead of skipping.

v0.39.0

Minor Changes

• 4874b4c: Add cached resource status for agents, disk capacity and Linux pressure measurements, and native macOS and Windows machine collectors. Keep WSL and Windows host measurements separate, report stale or unavailable data explicitly, and reuse supervisor diagnostics for resource advice.

• 63858bb: Add zero-configuration delivery cards for managed artifact workspaces.

  The new artifacts delivery-card command automatically lists safe, visible
  root-level files and folders, capped at five entries. Optional saved web and
  local destinations form an allowlist for remote results, friendly labels, and
  nested files. The linked list uses concise labels, while the plain-text block
  keeps the full copyable destinations. Artifact links automatically use a live
  dashboard tunnel and fall back to the local dashboard when no matching tunnel
  is running.

• e744895: Clear resource pressure on the recovery dwell alone, raise the I/O entry bar, say when only the dwell holds a state, carry stall readings in supervisor history so the trend is real, and log every pressure state transition with its reasons.

• b4ce66a: Derive resource pressure from contention evidence instead of finding severity,
  and stop control-state reads from scaling with ledger history.

  The assessment now comes from one pure policy module. State is set only by
  signals that show a shared resource is actually contended: pressure-stall
  averages, a new out-of-memory kill, swap-out rate, direct reclaim, exhausted
  memory with exhausted swap, and exhausted storage. Findings that name who holds
  a resource are carried as contributors and can no longer raise the state, so a
  single large process no longer tells every agent to stop working while the
  kernel reports no stalls. Entry and exit use different thresholds with a dwell,
  a counter reset or observer restart starts a new baseline, and a dimension the
  platform does not expose is reported as unavailable rather than healthy. New
  /proc/vmstat rates (swap in and out, direct reclaim, major faults) back the
  memory signals on Linux. resources status, the prompt notice, the dashboard,
  diagnostics explain, bundle replay, and shadow admission all read the same
  published assessment, and every threshold now lives in one policy object that
  is included in the bundle threshold digest.

  The authenticated storage witness now covers a validated candidate epoch, so a
  hook no longer parses the whole active segment when the control state is
  candidate. Candidate creation and activation became one locked step,
  initialization can resume a stranded candidate, the route resolver repairs one
  at its next boundary, size-based rotation applies to a candidate epoch, and a
  non-active control state opens a diagnostic finding instead of showing up only
  in an initialization check.

  Breaking: diagnostic advice moves to schema version 2 and carries the
  assessment plus the prior hysteresis state; there is no version 1 reader. The
  resource snapshot moves to schema version 2 and supervisor findings to version
  3, which adds a required finding class.

• aba6664: Add artifacts discard to retire reviewed temporary evidence with a one-hour
  grace period, a recorded reason, and existing ownership and hold protections.
  Expose minute durations on artifact creation and renewal, surface discard advice
  after QA, and check for expired artifacts hourly during active work.

• 7646037: Add a project-owned prompt-context extension to the normalized hook path.

  Embedding hosts can opt into one versioned provider contract while Harnery
  keeps adapter routing, bounded execution, and redacted audit behavior in one
  place. Claude Code, Codex, and Cursor receive context directly through their
  prompt hooks.

• 1b04d2d: Derive backup snapshots from the storage catalog, enforce a configurable size limit, add per-host freshness throttling, and allow SessionStart to launch scheduled snapshots without delaying the agent. The detached runner owns no hook stdio, records its exit status for the next session's start-up context, and a local per-host freshness cache bounds remote restic round trips to about one per window.

• 16c1df9: Keep native tiles as the evidence for page review and snapshot reuse. Version 2 packs store a half-size overview, bind reviewer decisions to exact native pixels and finding text, and require recapture of older packs. QA runs allocate one tile budget across all contexts, report gaps explicitly, and retain capture evidence when a deterministic gate fails. Reviewed decisions survive pack expiry and can affect later signoffs only when explicitly enabled.

• 0ae9c3f: Add an OpenClaw Event Ledger V3 adapter and a self-contained OpenClaw plugin with trusted-location redaction, memory-only raw intake, a bounded recorder worker, portable state roots, fingerprints for both runtime bundles, native-fixture intake, and Node 24 record-mode coverage.

Patch Changes

• 8247625: Capture public cross-origin stylesheets and media without credentials so wildcard CORS responses can be inlined. Keep cookies for authenticated same-origin assets.

• d67827d: Assign workflow children canonical roster names while keeping workflow labels as task descriptions.

• 1e70296: Register the dashboard storage snapshot as a repairable cache so inventory and
  maintenance account for its files.

• 4963fcb: Preserve setup arguments when a QA job context exactly matches required planner coverage, so deterministic gates and visual captures use the same setup. Reject conflicting context IDs or rendering identities instead of silently dropping their arguments or check targets.

• 20867a7: Automatically associate full-page standalone browser captures with their saved screenshots inside artifact workspaces, so file thumbnails can reuse verified captures. Selector fragments, unresolved assets, and changed outputs are excluded.

• ec5a98a: Read the event ledger tail through the validated snapshot cache in readLedgerV3Since
  instead of rediscovering and revalidating every frame per call. A poller now pays for the
  bytes appended since its last read; on a 24 MB active segment a no-change read drops from
  about half a second to nothing.

  Back the semantic service's fallback wake timer off while sweeps find nothing (doubling up
  to 30 seconds) and snap it back on the first new event or pass. The ledger watcher still
  wakes it immediately on an append, and a stop request wakes a backed-off wait at once.

• dbfd7e6: Report Linux full memory and I/O stalls separately from partial stalls, show their
  direction, and detect recent kernel out-of-memory kills without treating old
  counter totals as new incidents.

• 7ac231e: Retry page-review gates and allocation when a lazy image changes document geometry during an incomplete native capture. Stable out-of-bounds captures still fail, and every tile must retain native coverage.

• 5ae3d25: Name dropped evidence distinctly in the OpenClaw adapter's redacted failure log.

  When the memory-only recorder reports busy and a signal is dropped, the
  record_failure debug row now carries error_name: "RecorderBusyError"
  instead of the generic "Error" shared with every other crash. The injected
  recorderFault switch reports "RecorderFaultInjectedError". Only the fixed
  class name is logged, so error text still never reaches the debug log.

• 2c507ab: Preserve rolling artifact expiry across manifest migrations, release, and hold
  updates. Payload edits, renames, and deletions still extend retention. Add a
  preview-first activity repair for unchanged older migrations with verified
  preimages, preserving explicit retention windows and recording correction receipts.

• 8f4ae0a: Stop the observer publishing a negative sample age, which made the resource
  status reader reject its own assessment as malformed on about half of all
  cycles. The observer read its clock before sampling, so the snapshot's time sat
  a few milliseconds ahead of it. A sample time inside the tolerance now reads as
  zero, one beyond it reports an unreadable age with a stale reason instead of a
  negative number, and the observer assesses against a clock read after sampling.

• af9b75b: Retain private source identity inputs beside explicit review capture outputs so a source mismatch can be reproduced from disk. Keep the digest and acceptance checks unchanged, preserve failed retry evidence, and reference the saved bytes without printing raw page source.

• 8934bb5: Recover dead local artifact-lock owners, limit automatic cleanup slices, and
  distinguish interrupted attempts from completed sweeps. Remind agents to retain
  or discard reviewed evidence when releasing artifacts.

  Require boot-scoped process tokens for PID-reuse recovery; wall-clock process
  start times never justify removing a live PID's lock.

  Release an initializing lock when writing its owner record fails, including a
  partially written record.

• 058854f: Include one-minute load average in supervisor history so the resource dashboard
  can chart load alongside CPU, memory, and process count.

• e4d8fb2: Run authoritative QA gates and native capture on the same page visit within a globally reserved tile budget. Retain preliminary and retry evidence, reject source changes, and allow one complete gate and allocation retry without increasing browser concurrency.

• 476e38e: Include fixed and sticky controls inside open shadow roots when capturing native page tiles. This prevents repeated controls in stitched screenshots while preserving ordinary shadow content and restoring control styles afterward.

• d0fb443: Skip hard-expired live-display generation files on read and sweep them from the supervisor every five minutes. A directory of stale generation files no longer costs the dashboard a full parse on every request.

v0.38.0

Minor Changes

• 0580685: Add artifact schema v2 with durable, owner-scoped holds. Held work survives expiry,
  byte-budget cleanup, release, and nested review-pack cleanup. Clients can create
  an artifact with its initial holds already recorded and check hold capabilities
  before starting work. Manifest changes and deletion share a filesystem lock.

  Existing v1 manifests require the explicit, dry-run-first artifacts migrate
  command, which preserves each original manifest before adding an empty holds
  array. Unsupported manifests remain protected. The public manifest type is now
  ArtifactManifestV2; clients must update their imports.

• 032b457: Run any heavy command as a durable detached job. admission run --detach hands
  the command to a supervisor that queues for its slot, runs it with output on
  disk, and records the terminal exit code, so losing the client no longer loses
  the job. admission wait <job-dir> reconnects and returns the command's own
  exit code, admission jobs lists recent jobs with their state, and
  admission status reports detached jobs in flight beside queue holders. A
  supervisor that dies is classified dead rather than left ambiguous, which is
  what lets a caller retry safely instead of guessing.

• a50ae60: Export the admission toolkit so host CLIs can join the same machine-wide
  queues as qa-run and admission run. harnery/lib/admission now ships
  acquireAdmission, admissionStatus, and admissionBaseDir (the shared
  $TMPDIR/harnery-admission / HARNERY_ADMISSION_DIR helper). Command
  modules keep using that helper; they no longer own the path formula.

• e3fd7fc: Add a synchronous extraCookies host hook so embedding CLIs can mint
  session cookies into the shared jar before fetch and browse attach
  it. --no-cookies skips the hook. extraHeaders cannot merge a Cookie
  header once the jar has already set one.

• 1b316b5: qa-run and qa-record now create isolated managed workspaces under
  .harnery/artifacts/ when --out-dir is omitted. The output participates in
  artifact retention and byte budgets instead of leaking into the project source
  tree. Explicit output directories are unchanged, and qa-status without a path
  now finds the newest run across managed QA workspaces.

• 021c67f: Page review pack follow-ups. review-pack expand <dir> --tile T012 [--context <id>] [--dpr 2]
  re-captures one tile region of an existing pack at a higher device scale factor into
  contexts/<id>/tiles/<tile>@<dpr>x.png and records it as an optional expanded entry on
  the context record, leaving every existing tile untouched; browse gains
  --review-pack-expand <tile-id> and --device-scale-factor <n> to do the render.
  Every context with tiles now carries contacts.png, a box-filtered row-major grid of its
  tiles with ids stamped, recorded as contact_sheet on the context record and linked from
  review.md; finalizePageReviewPack builds a missing sheet from disk.
  Gate records in a pack can carry hits (rectangle-bearing findings lifted from the gate's
  browse envelope: runts, truncation, contrast, placeholder, image, clip, overlap, crowd, align,
  gap, overflow, target size); the inspection plan maps each hit to the tiles covering it under
  gate_hits, adds those tiles to primary_tiles, and review.md links them per gate line.
  The pack schema stays harnery-page-review/v1: every new field is optional and additive.

• 5940108: Page review pack hardening. Every pack now carries retention and expires 90
  minutes after its judge finishes (after capture when no judge runs); the whole
  pack directory is deleted by review-pack clean (preview by default, --yes
  to delete) or, when review_pack.auto_clean is on, before the next qa-run or
  review-pack create, leaving only pack-expired.json. --retain <minutes>
  on qa-run, review-pack create, and review-pack judge overrides the
  default; policy.review_pack_retention_minutes does the same in a job.
  Capture fidelity is checked while the capture browser is open: two probe bands
  are re-shot by scrolling and compared with the full-page screenshot, and a
  context whose full-page capture is wrong is tiled from scrolled band captures
  instead (capture_fidelity on the context record). The judge still opens no
  browser; each tile's rubric now carries its band position and capture source.
  Gate hits below the tile cap get their own hit band tiles
  (browse --review-pack-hit-rect, wired from qa-run). Reviewer findings and
  dispositions have a command surface: review-pack findings add,
  review-pack disposition, and review-pack verdict (writes
  evidence/verdict.json and a reviewed outcome beside the machine outcome).
  review-pack list and review-pack show inspect packs on disk. The gate
  stage skips its duplicate full-page PNG when a capture stage runs, and the
  pack's DOM is stored gzip-compressed. The pack schema stays
  harnery-page-review/v1; every new field is optional.

• 551ea59: Split page QA into capture and judge through a page review pack. qa-run
  now renders each context once into run-<id>/pack/ (full-page screenshot,
  tiles as PNG files, DOM, signature) and closes its browser, then judges every
  tile of every context through one bounded in-process pool of vision calls
  (policy.critique_pool / --pool), and persists signoff snapshots from the
  pack's files. New review-pack create|judge command and browse --review-pack
  capture flags. Result schema version 4: stage capture, wall_time_ms.capture,
  critique_pool, review_pack; per-row latency_ms moved to critique_pool.

• 607ded2: qa-run now takes turns and survives disconnects. Every run queues on the
  machine-wide "browser-qa" admission resource by default (capacity 2, tunable
  via HARNERY_QA_ADMISSION_CAPACITY or --queue-capacity, opt out with
  --no-queue); the wait is recorded as wall_time_ms.queue and never counted in
  total, and an admission timeout (--queue-timeout, default 20 minutes)
  finalizes a normal incomplete result with an "admission" blocker so the
  evidence trail survives a full queue. Runs are durable: every run directory
  now carries job.json (the effective validated job, usable with qa-verify
  --job) and run-status.json (live state, current stage, and a 15-second
  heartbeat), and --detach launches the matrix as a detached background process
  with output in runner.log, printing the run directory and returning
  immediately. Two new commands complete the loop: qa-status reports a run's
  live state (launching/queued/running/completed, plus derived dead), reconnects
  to detached runs with --wait using the runner's own exit codes, and shows the
  admission queue with --queue; admission is the generic wrapper (admission run
  --resource -- <command...>, admission status) that makes any heavy job
  take turns on one machine via crash-safe FIFO file tickets with dead-PID and
  TTL pruning under $TMPDIR/harnery-admission or HARNERY_ADMISSION_DIR.

• 411be3d: Report critique tile coverage and refuse a capped signoff. Full-page
  critique keeps at most --check-critique-max-tiles bands per context
  (default 24) and drops the rest, so on a tall page the bottom was never
  reviewed and nothing said so. tilesFromFullPage now returns
  { tiles, coverage }, browse records coverage (page height, reviewed
  height, bands total and reviewed, capped) on the critique envelope, and
  qa-run lifts it onto each critique row. A capped context in signoff mode
  is a critique blocker and the run finalizes incomplete; review mode
  keeps the outcome and carries the flag. New policy.critique_max_tiles
  (1 to 200) reaches the planner and every critique child so the predicted
  ceiling and the real coverage agree.

• 42661cf: Record vision-call latency on each qa-run critique row. The critique
  provider already reports per-backend call counts with p50/p95 latency in
  the browse envelope's provider_meta; the runner read it only for the
  provider label and dropped the timings. QaRunCritiqueOutcome.latency_ms
  now carries them keyed by backend, so a straggling tile is visible in
  page-qa-result.json rather than only to someone watching ps. When a
  context runs several scope commands, counts sum and the percentiles keep
  the slowest scope. Absent when no backend reported a call.

• a1dd855: agents status now shows the session's latest page-QA verdict on the runner's
  own clock, so runner time is never read off session age. A new qa line
  renders as passed 4m ago · 90s runner (2m queued), reporting the verdict, how
  long ago the run completed, and how long the runner took, with admission-queue
  wait shown separately because it is never part of runner total. Hand-recorded
  evidence renders manual 12m ago · not a pass rather than a verdict and a
  clock, and a result older than 24 hours collapses to stale (2d). The line is
  absent when the session has recorded no run. Backing this is a per-session
  pointer at .harnery/qa/<instance-id>.json, written atomically by the command
  layer (the matrix runner is toolkit tier and cannot reach the coordination
  core). Every read is best-effort: a missing, unreadable, or partial pointer
  renders no line and can never fail the status command.

• 28a99f7: qa-run results are now verifiable evidence, and qa-verify checks them. Result
  schema v2 gives every invocation a run identity block (run_id, start/finish
  timestamps, tested revision with source and dirty-worktree flag, a SHA-256
  digest of the effective job, and the recorded output directory), host-pressure
  samples, and last_completed_stage. Output is isolated per run: --out-dir names
  a parent and each invocation writes into run-<run_id>/ beneath it, maintaining
  an atomically-renamed latest.json pointer, so a reused workspace can never
  present a stale result as current. The new qa-ver...

v0.37.0

Minor Changes

• 56751e7: Add a live structured-log flow dashboard with bounded per-family reads, severity filters, pause controls, and record inspection.

• d299154: Improve local diagnostic findings with incident recurrence, validated process ownership, bounded agent activity context, and explicit service-staleness reasons.

• 78074e3: Add --color-scheme <light|dark> to browse: emulates prefers-color-scheme for the whole session (threaded to Playwright's context colorScheme), so theme-aware pages render in either scheme without page-specific toggles. Absent flag keeps today's behavior.

• 94ae820: Add harn diagnostics explain --json for deterministic local pressure and fan-out advice. Live advice requires a current supervisor heartbeat, so an old findings file cannot masquerade as current pressure. Advice is included in frozen diagnostic bundles and replay digests, while repetitive related timeline events are compacted into counted first-to-last clusters. The supervisor remains observer-only and never starts, stops, or throttles work.

• b65c3ae: Record bounded terminal hook-health receipts, project them through the local
  supervisor, surface deterministic findings, and show completed hook health on
  the resource dashboard.

• f5ae171: Add an optional local resource observer with process-tree attribution, bounded snapshots, and service lifecycle commands.

• 576a2ff: Add deterministic comparison for two frozen diagnostic bundles, including
  finding regressions and recoveries, advice and capability changes, completed
  hook health, and bounded shadow-admission evidence.

• 5aab533: Replace the resource-only daemon with an optional local supervisor that collects bounded resource history, service and hook health, anomalies, and incremental structured-log feeds for the dashboard.

• c8c2db7: Make agents ping deliver to an agent name rather than to a running instance. A message to a name with no live session is now held in a durable mailbox and delivered when a session of that name next starts, instead of being refused. A message to a live agent is surfaced in their next prompt, which previously never happened: the entry landed in their journal and nothing showed it to them.

  The refusal that remains is a name no agent has ever held, and that error lists the closest known names. Senders therefore need one command and no lookup of who is currently running, which is what the previous behavior forced. Per-message and per-mailbox ceilings bound the queue, and delivered messages are archived for audit.

  Also fixes the prompt-context route resolving the agent name: the hook does not pass --name, so every name-addressed section, pending council invites included, was silently skipped. The name is now read from the heartbeat when the caller omits it.

• 7528cc3: Add qa-run, a one-command page-QA matrix runner: it executes the QA planner, deterministic gates per viewport/theme/state through a bounded process pool, interaction assertions, manifest-required critique, and the QA snapshot in a single invocation, writing one fail-closed machine-readable result. Jobs are validated (secret-bearing fields refused) and may widen but never narrow the planner's coverage.

• 6da5243: Add sanitized diagnostic bundle capture, strict frozen-bundle validation, and offline finding replay through harn diagnostics.

• d2894e3: Add opt-in shadow admission telemetry to workflow and governor runs. --observe-pressure demand-starts the optional supervisor only before a real child dispatch, waits for a fresh cycle, records bounded diagnostic advice in the transcript, proof, and run report, and always leaves dispatch unchanged.

• 9dd6e3e: Bound repository-local coordination storage with artifact byte budgets, explicit
  large-workspace acknowledgement, loose-file adoption, closed Event Ledger V3
  epoch retention, and verified compression for sealed legacy V1 shards.

Patch Changes

• 182c71f: Correct the agents health finding text for heartbeat cache issues. It said the listed rows were files "the sweep isn't reaping", which was true only while the sweep was absent from the reconcile pass. Now that it runs there, a surviving row means the sweep deliberately kept it (malformed but mtime-fresh, or neither audit write could persist) or it aged past the freshness cutoff since the last pass. The old wording reported working behavior as a fault.

• d1d891c: Do not drain an agent's mailbox on a prompt an adapter cannot deliver. Cursor's prompt hook can allow or block a turn but cannot inject model context, so rendering messages there removed them from the queue and then discarded the output. Those sessions now keep their messages until SessionStart, which Cursor does deliver. The capability is exported as canReceiveContext so any future consumer of state-spending context has one place to check.

• 8c7513b: Make qa-run execute every deterministic check in the planner manifest, fail on recorded browser diagnostics when console is required, and stop incomplete when a future planner check has no executable mapping.

• 4546bfb: Run hook coordination effects in-process so one adapter event no longer
  launches several nested agent-coord runtimes.

• 0074b5c: Verify that local file URLs target a dashboard serving the same repository root.

• 2de364d: Rename the agents health JSON field zombies to heartbeat_cache_issues so it matches the rendered cache issues row and the condition it actually measures. Stale or malformed heartbeat cache files are not zombie processes.

• 15edcde: Restore stale coordination-cache reaping in the reconcile pass. Both agents reconcile and the session-start pass now call one shared composition that runs the stale sweep before V3 session finalization and reports swept_heartbeats, swept_pidmaps, and swept_peer_hashes. Previously each called only the finalizer, so the sweep ran nowhere but its own uninvoked subcommand and stale rows accumulated indefinitely.

  Also fix the finalizer predicate for lifecycle.sweep_observed, which matched stale_sweep (the finalization-request name) instead of stale_heartbeat (the observation the sweep emits). From a cold start that branch was unreachable, so a swept session never produced its finalization request.

  The sweep's safety contract is unchanged: configured coordination freshness for valid rows, an extra stale-mtime gate for malformed or missing timestamps, a durable audit record before any deletion, and keeping the row when neither audit write can be persisted.

• a40880d: Keep a blocked committer's staged paths in its durable claim set. When two sessions have unfinished changes in one file, the original claim holder's later commit is now blocked too instead of silently sweeping the other session's working-tree edits. Canonical Codex session rows also bypass the PID-based transient-identity heuristic because Windows-hosted sessions cross a process boundary and have no usable WSL PID anchor.

• 9def66f: Require Cursor replies to show the Harnery status box. The response hook now records only privacy-safe visibility booleans for Stop, and Cursor projects receive a generated Always Apply rule with the paste instruction.

v0.36.0

Minor Changes

• 66275fd: Add segmented durable histories, crash-safe private coordination inboxes, and bounded conversation archive, query, context, and dry-run lifecycle surfaces.

• 92d4be4: Add harn init --instructions-only to refresh managed AGENTS.md regions and
  Harnery-owned skills without changing adapter hooks, managed Git hooks,
  configuration defaults, or Event Ledger V3 state.

• 441870d: Add deterministic Event Ledger V3 support packs, logical authority readers, exact-transaction shadow migration controls, and sealed legacy V1 inventory and gzip canaries with replacement disabled.

• 2088e25: Add user-controlled soft storage budgets, pressure reporting, and exact manual retention for manifest-backed operational and debug logs.

• 7ead96a: Add bounded operational logging, rotating shared segments, query and export commands, storm controls, metrics, and guarded agent diagnostic producer cutovers.

• f247e48: Add a source-owned storage catalog, validated host registrations, inactive lifecycle policies, and read-only inventory and health commands.

• 97a9469: Add budgeted storage-maintenance planning, exact-target execution, immutable receipts, automatic claim-first slices, and receipt consolidation with dry-run defaults and fail-closed destructive-action controls.

• d1934a6: Expired artifact workspaces are now swept automatically. The first session start of each day runs the same guarded deletion as artifacts clean --yes (only managed-expired entries, each re-classified immediately before removal; unmanaged and legacy directories are never touched), throttled by a stamp file at .harnery/artifacts-auto-clean.json that also records the last run's result. Retention previously depended on someone remembering a manual command, so expired workspaces accumulated indefinitely on busy hosts. Disable with artifacts.auto_clean: false in .harnery/config.jsonc or HARNERY_ARTIFACT_AUTO_CLEAN=0.

• 6ecc4df: Bound V3 event-ledger epochs with automatic size rotation and an epoch fence on writes.

  Every canonical read validates the complete epoch, and hook producers are one-shot processes, so an unbounded active segment made each hook's cold read scale with all recorded history (memory and latency grew without limit). The route boundary now rotates a valid active epoch into .harnery/ledgers/v3-archives/ once active.ndjson reaches a threshold (default 32 MiB; events.rotate_active_bytes in .harnery/config.jsonc or HARNERY_EVENT_V3_ROTATE_ACTIVE_BYTES override it, 0 disables). The replaced epoch archives whole and unmodified; live sessions re-onboard into the successor on their next signal.

  Because producer boot sequences must start at 1 and causal links must resolve inside their own epoch, writers gained an epoch fence: producers stamp events and producer state with the genesis id they were built against, the writer refuses (epoch_replaced) or quarantines (.epoch-replaced beside the spool) anything produced for a replaced epoch, and stale producer state is never adopted across an epoch boundary. LiveEventLedgerRouteV3 now carries genesis_id, and publishAuthorityTransactionV3 / reconcileAuthorityTransactionV3 accept an optional epoch fence.

• 2c3a3df: Add bounded dashboard request and event-loop diagnostics plus harn web performance summaries.

• 4bd9294: Record exact Codex context tokens, inferred Claude model-window measurements, and Cursor's first-party percentage in canonical V3 context observations without fabricating token counts.

• 14f9c11: init now excludes the .harnery/ coord root from editor indexing: it appends a managed entry to .cursorindexingignore and merges "files.watcherExclude": {"**/.harnery/**": true} into .vscode/settings.json (creating either file when absent, and leaving a settings file it cannot merge safely untouched with a manual-step notice). deinit reverses exactly the managed pieces. Git-aware tools already skipped runtime state via .harnery/.gitignore, but Cursor's codebase indexer and the VS Code/Cursor file watcher do not read gitignore, so a busy coord root (tens of thousands of ledger events plus working artifacts) turned editor startup into an indexing storm on session-heavy hosts.

• 4e09fbe: Load only the selected CLI command implementation during async dispatch while
  keeping root help, aliases, command order, completion, and whole-tree discovery
  available through lightweight metadata and explicit materialization helpers.

• 9d8db8e: Add bounded semantic-reader soak reports for recent outcomes, controlled phase
  and expression frequency, cue stability, rapid reversals, and token usage.

• a48beef: Add harn files url <path> to mint port-aware local links for HTML pages and other repo files, and teach generated agent instructions to use it.

• 46324e1: Add a bounded local review queue for labeling accepted semantic meaning, phase,
  expression, portrait usefulness, and state transitions from Codec.

• a018cd5: Add a project-owned instructions.promptReminder that Harnery injects on every
  supported prompt without duplicating native adapter reminders or persisting the
  host text in coordination state.

• 887bc00: Let agents repair their current V3-backed coordination cache with harn agents heal and no identity flags.

• dcb0778: Add provenance-labelled token receipts and bounded usage aggregates to the
  Semantic Expression V2 readers, CLI status, and Codec. Native harness counts
  remain separate from visible-payload estimates, while missing legacy or failed
  call usage stays explicitly unreported.

• 97c29c1: Authenticate active V3 control state without replaying the complete epoch in every hook process.

  Active epochs now carry a root-key-authenticated witness bound to the immutable control pair, the reader's complete storage fingerprint, and a repairable semantic validator checkpoint. Matching witnesses answer the active control question without loading event history. The canonical writer validates each appended suffix against the checkpoint before advancing the witness. Any invalid append, rewrite, segment change, inode replacement, forged witness, or crash gap falls back to canonical full validation, and valid crash gaps repair the witness automatically.

  Ordinary hooks also reuse the recorder-proven generation for payload owner resolution, epoch-restoration checks, and the generation-bound session-name cache. A 30 MiB fresh-process pre-tool-use benchmark fell from a 1.16-second median and 354,700 KiB maximum RSS to 0.195 seconds and 84,322 KiB.

• 1ec02fe: Add cached repository views to documentation lint and metadata validation so
  pre-commit checks validate the exact Git index without reading unrelated
  working-tree edits.

Patch Changes

• 9625e0a: Record fresh Claude and Cursor context evidence in Event Ledger V3 during
  active turns, including exact Cursor pre-compaction token counts.

• 84c1694: Hold ready Event V3 rows until their causal parents and attestation declarations are committed. This prevents concurrent re-onboarding from appending a dependent event before the event that mints its attestation.

• a9852da: Report every missing end-of-turn signal in one Stop verdict instead of one per continuation.

  The Stop rule returned on its first failing check, so a turn that was missing the status observation, the pasted status box, and the task declaration cost three separate continuations to repair. Each continuation forks a fresh hook process, so on a busy multi-agent host the ritual's own enforcement added to the hook load it polices. The verdict now collects every failing signal, keeps the first failure's rule id so blocked_rule telemetry and the adapter's rule= stderr contract are unchanged, and enumerates the rest in the reason so a single continuation repairs all of them.

• c531f97: Bound duplicate V3 producer-diagnostic file creation. While a key is below 32
  loose exemplars for a UTC day, the writer adds a key digest suffix to each
  loose filename and the gate counts those names from the directory. No summary
  or lease state is created below the bound. At or above the bound, a short
  per-key lease protects one summary for that key and day. The summary preserves
  the logical count, first and last times, represented bytes, hourly buckets for
  that UTC day, bounded exemplar digests, and approved metadata. Concurrent
  writers may admit a few extra exemplars because the flood stop is approximate,
  not an exact quota.

  Coalesced writes return the summary path. Mitigation failures fail open to a
  loose write and append a best-effort health record to the size-capped,
  append-only mitigation-health.ndjson log. Existing loose diagnostics are
  never moved, rewritten, deleted, or reclassified. agents health and doctor
  report logical occurrences from loose files plus summaries, with physical
  counts shown separately. HARNERY_V3_DIAGNOSTIC_SUMMARIES=0 disables the gate.

  Storage-catalog and support-pack registration will be added when ADR 0129 and
  ADR 0131 are implemented. This patch does not claim those registrations.

• 454805f: Retry the bounded Codex terminal-row lookup for up to 250 ms at Stop so a just-flushed context row is not missed.

• cb4e370: Stop Cursor session-name loops by recording exact title blocks from
  afterAgentResponse and by treating later preToolUse narration as unavailable
  rather than proof that the earlier title response was missing.

• 1dcbe90: Reuse immutable coordination projections so dashboard readers do not repeatedly reduce the complete event history during one render.

• acd6608: Fix Claude Code Stop remediation so recovered tool turns share ritual evidence without changing whether the original turn used tools. Reuse the strict assistant-text status-box scanner at Stop time, repair the whole ritual in one retry message, and retain cap-exhaustion diagnostics.

• 98cc676: Keep Event V3 rotation configuration inside the vendorable le...

v0.35.0

Minor Changes

• dcaf4c8: Rearrange the agent name pool so gender alternates letter by letter within each 26-name pass, with five passes starting female at A and five starting male. Every pass is now 13 female and 13 male, every letter carries five names of each gender, and the pool is 130/130, so one fixed set of 13 female and 13 male portraits can dress a whole pass. Eleven names were substituted to make the split reachable, two of which removed near-duplicates (Kaleb duplicated Caleb, Ulrich duplicated Ulrik). Counter positions now map to different names than before; already-assigned names are unaffected because name history stores the resolved name.
• 7a31784: Add an extended tier of ten optional Codec expressions (observing, wrapping-up, compacting, conducting, weighing, planning, verifying, strained, blocked, dormant) on top of the eleven required ones. Packs may ship extended art; a pack that lacks it renders the expression's required fallback parent, so art lands incrementally without invalidating any pack. Deterministic ladder rules derive eight of them from evidence already on the panel (lifecycle, typed waits, compaction boundaries, subagent counts, image artifacts, context band); planning and verifying arrive through the semantic phase mapping, which now gives them and wrapping-up their own faces. Weighing is typed and fallback-mapped but has no deterministic rule yet.
• 56b76d1: Read attributable Codex context usage from bounded local telemetry. Latency
  reports now include per-kind wait completeness and response timing while
  unsupported inference and missing context stay unknown. Codex transcript
  flush races reconcile from owner-only state on a later hook without delaying
  turn completion or exposing native paths and identifiers in the ledger.
• e3f31b1: harn browse trio mode now writes a standalone <prefix>.html: stylesheets are inlined, fonts and images are embedded as data: URIs, and every remaining reference is rewritten to an absolute URL on the captured origin. Root-relative asset paths previously resolved against whatever host served the saved file, so a snapshot opened anywhere but its own origin rendered as unstyled text with broken images. Scripts and preload hints are dropped, and the trio .json reports what was inlined under htmlSnapshot. Print mode and --selector captures still emit the raw serialization.
• 2d8f75d: Reset managed artifact expiration whenever files in the workspace change.
• d191265: Attest effective per-session telemetry support separately from static adapter capability profiles, and join Claude Code usage to native prompt ancestry without claiming a context limit the runtime does not report.
• 5d1afac: Carry effective runtime telemetry capabilities into V3 latency reports and add a stable evidence key that prevents comparisons across unlike telemetry support.
• f7f24be: Observe model effort and speed from native runtime signals. readRuntimeTuning reads the newest Codex turn_context row (effective per-turn reasoning effort, including overrides) and the newest Claude Code assistant transcript row (model, effort, and usage speed from the same row). scanTranscriptRuntime replaces scanTranscriptModel, returning the paired model + tuning values. The V3 runtime attestation gains a tuning observation populated at session start, refreshed via session.attestation_changed when the observed value moves, and rendered on the codec card.
• 3941b33: Add Semantic Expression V2. Semantic readers may propose an optional,
  evidence-cited expression cue for an otherwise neutral Codec portrait. The cue
  uses a controlled vocabulary, model-synthesis basis, and medium or low
  confidence. Event-backed expressions retain precedence, and the derived
  read-model storage moves to .harnery/semantic/v2/ without reading V1 caches.
  Each structured reply is bound to the request's exact generation ID and
  evidence digest before it can be persisted.
• 99b04ee: Add the product-tier harnery/core/semantic contract, deterministic Event Ledger V3 evidence projection, exact harness-routed readers, typed receipts, bounded scheduling, atomic derived storage, the explicit-start harn semantic reader service and inspection CLI, and local-only semantic meaning with reader health in Codec.
• 998834b: Ship harn-team, a fourth generic skill covering the run/work/governor tier choice, the governor artifacts, and the drive loop; the injected block points at it (with a governor --help fallback when excluded) and its intent paragraph now names the event-ledger path and links the tool-intent guide.

Patch Changes

• 8d02beb: Adopt a mid-generation re-attestation into the joined V3 coordination and
  command producer states instead of refusing forever. The producer state path
  is derived from the generation alone, so after a session.attestation_changed
  the stored attestation id could never be superseded and every later authority
  transition (for example agents set-task) was refused for the rest of the
  generation. The producer now adopts the hook's live attestation id in place,
  preserving its sequence, clock, and observation dedupe, the same continuation
  the hook producer itself performs.
• cff2f31: Start the bounded semantic reader automatically with the Harnery dashboard for
  an active V3 coordination root, recover after a V3 genesis rollover, and
  preserve manual pause and deterministic fallback.
• 454805f: Record exact Codex context usage when Stop hooks omit transcript paths by caching a verified rollout source in owner-only V3 producer state.
• 45d6331: Normalize approved out-of-root claim paths so releases match across absolute
  and dot-dot forms without exposing the external path in Event Ledger events.
• 0c6d95b: Verify the pending session-name display on Codex: the PreToolUse latch and the Stop-time naming ritual now discover the Codex rollout transcript by session id when the hook payload omits transcript_path, so an exact display can be stamped as seen on that adapter instead of remaining pending for the session's whole life.
• 1fe67f3: Export discoverCodexSessionTranscript from the runtime-telemetry adapter: locate a Codex rollout transcript by session id across the native and WSL-mounted sessions roots when a hook payload carries no transcript_path. Codex omits the path on every hook event except Stop, which left evidence-dependent verdicts such as the pending session-name display permanently unverifiable on that adapter.
• c7b5643: Decision and presence observations now join the active V3 hook generation with the adapter's native session ID instead of its privacy-safe session fingerprint.
• 03d05ea: Export the Event Ledger V3 active watch path used by the semantic service from the public V3 barrel.
• bb41057: Rotate urgent semantic readings across every pending generation instead of alternating only the two oldest entries.
• f5cf15a: Preserve the semantic rolling call window when ledger, model, or contract changes invalidate derived state.
• 15caade: Owner resolution no longer lets an inherited foreign-adapter session-id
  environment variable hijack a nested agent's identity: on a cross-adapter
  conflict, the nearest token-verified pid-map anchor (claude-code/codex) now
  outranks the session-env join, while same-adapter conflicts, Cursor's shared
  shells, bridge-marked children, and unverified rows keep the existing env-first
  order. harn agents health also surfaces stop-hook remediation-cap
  exhaustions (count, latest, session samples) as an anomaly, so a session whose
  end-of-turn evidence never lands is visible without grepping the debug ledger.
• 5ec35aa: Bound Codex session-name recovery when assistant transcript evidence is unavailable. Routine agents set-task calls stay title-silent, pending prompt reminders emit once per minted name, and agents suggest-name --json creates the explicit retry boundary with the exact stored name.
• b1e7378: Remove stale heartbeat cache rows for terminal V3 generations after preserving the failed lifecycle observation in the producer diagnostics spool.
• 5b66829: Record privacy-safe per-harness semantic call latency and byte metrics in the bounded service log.
• afdef32: Carry session-naming evidence (suggested_session_name, session_name_seen_for, session_name_seen_at) across a coordination generation reopen of the same native session. A resume or mid-flight onboarding names the same adapter tab, so rebuilding the cache without that evidence re-minted a fresh title and demanded its display again; a multi-day Codex session accumulated five pending names this way. The carry is dropped when the durable identity observably changed.
• c902bee: Preserve bounded semantic call metrics by omitting deferred-only pass logs and throttling repeated sweep errors.
• 0f122e5: Instruction template now names the live V3 ledger location (.harnery/ledgers/v3/) instead of the retired .harnery/events.ndjson path in the intent-declaration guidance.
• 5fe991e: Keep an already-seen session title silent when the first task update materializes a restarted Event Ledger V3 generation.
• 413e382: Stop-hook remediation backstops: the finish sound no longer replays on stop
  continuations (stop_hook_active), so a blocked-stop loop cannot become a
  repeating alarm; consecutive blocked stops in one cycle are capped (default 5),
  after which the stop is allowed so a session whose ritual evidence can never
  land terminates instead of bouncing until its budget dies; and remediation
  messages now carry --session-id so evidence from processes that don't
  descend from a pid-map-registered anchor lands under the correct owner.
• eb7791d: Make a semantic service stop finish only the in-flight model call before exiting.
• 0f1de1d: Reject path, URL, command, environment, and secret-shaped text in accepted semantic readings before local persistence.
• 534e7fc: Wake the explicit-start semantic service when a...

v0.34.1

Patch Changes

• 4e5e850: Let a latched session recover by repeating agents set-task. While the current session name is still pending, the command now returns the unchanged name with session_name_retry: true, and PostToolUse creates a fresh ordered display boundary for the next exact block.