v0.17.0

🛠 Breaking Changes

• [breaking] upgrade Lance 10.0.0 -> 11.0.0 with FTS stemmer self-heal (#214) (0ab11c7)
  Lance 10 -> 11. Its English stemmer changed, so a text index built by an
  older pond misses some word forms; pond now rebuilds it once on the next
  sync or pond optimize (~10 min on a remote store) and pond status
  shows stemmer outdated until then. Upgrade every host sharing a store
  first.

🐛 Bug Fixes

• codex-cli: decode Codex 0.151+ JS-runtime tool calls (#218) (94ab1e3)
  codex-cli now decodes Codex JS-runtime tool calls (seen from 0.147 on):
  tool_name is the wrapped tool instead of exec, is_failure is set when
  the script or any command it ran failed, and params carry the executed
  command and cwd. Native restore uses codex's local-time filename.
• serve: stop cleanly when a supervisor asks (#198) (98df4a1)
  pond serve now stops when a supervisor asks it to. It handles SIGTERM
  as well
  as ctrl-c, and shutdown no longer hangs when an agent is connected: live
  MCP
  sessions are closed and the drain is bounded, so restarts finish instead
  of
  waiting for the process to be killed.
• serve: let /mcp answer on the deployment's own hostname (#196) (1355a3e)
  pond serve reached by a hostname other than localhost now answers MCP
  once
  you name that host with --allowed-host (or POND_ALLOWED_HOSTS);
  without it
  the /mcp route refuses every request with 403 while /v1/* keeps
  working.
  Local use is unchanged.

📚 Documentation

• readme: add the community-adapters row to the roadmap (#211) (e99d352)
• harden the Windows install path from live fresh-eyes verification (#191) (a7d1b5c)
  Windows install docs now name the git prerequisite for scoop bucket add and the core.longpaths and --target steps a source build needs. Installed via cargo binstall? You have pond.exe only - use Scoop or the zip for scheduled sync.

Full Changelog: v0.16.3...v0.17.0