Papertiger 0.17.0

Upgrading migrates planner schema v10 or v11 to v12.
Read commands refuse the older schema and name the init command to run; take a backup first.

Changed

• Every planner table refuses writes from ordinary SQLite connections; use the executable or enter through the public mutation API.
  Stored events are append-only, and normal opens refuse missing or altered guards.
  This protects against raw-SQL misuse, not a filesystem owner deliberately defeating the guards.
  Public API connections are trusted after mutation entry.

Added

• history inspect <event-id> and history quarantine <event-id> --expect-sha256 <digest> --why <reason> recover structurally invalid legacy history after explicit review.
  Original rows remain unchanged; an audited recovery event preserves every raw field through export/import.
  Unknown timestamps and associations remain unknown, and task state is not inferred.

Fixed

• audit identifies every malformed stable event reference and reports oversized titles on terminal tasks, which can also block recovery imports.
• Task reads identify priorities stored as text and name the recovery command.
  After preserving a backup, edit <task> --priority <integer> --why <reason> can repair that value as an isolated edit, preserving the original text in a repair_priority event.
  Reads never infer a numeric default, and other unreadable task fields roll back the repair.
• Project skill guidance no longer points to an absent personal command binding.
  First-use diagnostics preserve the selected authority instead of instructing project users to guess a database path.

Prebuilt archives are attached for Windows x64, Linux x64, Intel macOS, and Apple Silicon macOS.
Merge .agents, .claude, and tools into the project root. Skills are ready to discover; executables, documentation, licenses and the source manifest live under tools/papertiger.
Verify the adjacent SHA-256 asset before extraction.