变更记录一览。

Features

• a coding run locks its PLANNED set before its editors write

Bug Fixes

• a re-pended run's usage folds on the task's tenancy, and every other owner hook still needs the assignee

Bug Fixes

• a box override naming a missing script is a named refusal, not a red verdict on the diff
• a plan whose every slice landed is recorded done

Bug Fixes

• a cut split replaces its non-converging PR in every plan and retires the PR

Bug Fixes

• pr-body.md names marketing as a sha-reporting /healthz, and a guard holds the list to the handlers

Bug Fixes

• no tsconfig emits beside its sources, and no emitted file sits beside one

Features

• mirrored plan issues stay current as parts merge, the plan revises, and it completes

Bug Fixes

• skip the incumbent review hold for a bot author the reviewer never reviews

Features

• plan list pages by number with status buckets, counts and repo/search filters
• record the keys that failed an ask's judge
• decide and write a plan revision
• agent roster, model picker options and full-row route builder
• learn, store and render the key-outage ops message
• fail the triage judge over to a key the ask has not failed
• one no-model-keys notice per keyless episode
• a failed review names its failure kind, from the code the error already carries
• GET /v1/agents/activity with per-agent running, last run and 7-day outcomes
• Popover, bottom-sheet drawer and a Toast action
• keys wire carries fence, cooldown and model prices; a key label rename carries its pins
• steer autonomous runs with message, and tell a redispatched task what went wrong
• a red default branch is a repo fact: file one fix, hold stale merges, clear on green
• agent change history and an atomic stale-write check on route and mode saves
• GET /v1/key-outage and POST /v1/key-outage/pick
• fleet plans page gets status tabs, numbered pages and plan totals
• triage sees merged work and critical paths, and orders pieces behind live work
• the area lock learns a run's saved diff
• mirror a plan to GitHub issues
• a raw task carries the filer's expected writes, and triage narrows its areas to them
• a merged PR records the paths it changed, and triage's merged read shows them
• an account-wide key-outage banner with the key picker
• the review lane re-verifies its own open threads at each new head
• Agents page under WATCH with read-only agent cards
• re-filing a slug revises the same plan
• a merged task's deploy is a state, and only pending keeps it open
• file plan-mirror epic and part issues
• a failed deploy is a repo fact that files one fix past a grace; the newest verdict per environment wins

Bug Fixes

• a deploy hands in-flight agent.run jobs back without spending an attempt, invalid config exits and absent config is not-ready
• worker sweep A — no duplicate email on a stamp fault, a bounded blog body, a savepointed escalation probe, the dead pool gate deleted, guarded event-sink settles, empty repos skip
• api/mcp sweep — KEK ring loaded once at boot, a partial fan-out retry replays instead of re-minting, throwing mutations audited, box-control reads the owner's truth, exports mark truncation
• ingest verifies signatures over raw bytes, releases a refused delivery's keys, and bounds body and delivery id; webhook retries read a fresh clock; github walks every installation page, evicts expired tokens and drops dead oauth refresh
• a babysit fix round is held only by a writer on its own PR
• no fix round for a check red on the base, and a base fix refreshes the PRs that inherited it
• a resumed task no longer overtakes an older starved writer in the area drain
• dz/wip keeps the best red save, and a moved base merges it instead of dropping it
• runner sweep — the CI log reaches the agent whole, the log sink is bounded, a stuck PR.md refuses the commit, subscriptions alert on a quiet end, and each run owns its /tmp dir; dz-runner 0.0.26
• a conflicted generated file is regenerated, never hand-merged
• one blob download that attaches before click, member CSV neutralises formula cells, and SW registration survives a refusal or an undefined handle
• the code is written on your machines; the merge gate runs on ours
• one sealed user-token store, and a non-JSON blob no longer puts the token in the error
• a box-held babysit round holds other writers only by what it adds to its PR
• a starved writer that cannot claim holds nobody in the area drain
• refuse a merge whose green CI ran over a base that since moved over its files
• the assigner withholds work a box's workspace disk cannot hold, by its own floor and by each repo's per-task need
• a regroup rewrites every edge on the task it supersedes
• a failed bin/setup heals once on a clean compose environment
• babysit stops a PR whose fix rounds stop converging and proposes a split
• a held review names its hold and until when, on its check and in task stalls
• a regroup follows through into every plan linking the superseded task
• disabling a repo cancels its pending tasks
• a declared key capacity moves the learned ceiling with it
• a coding task takes a fair share of a bounded key, not every free unit
• the single-adapter lane heals a failed bin/setup too, orphans included
• a minor finding fixed outside its own file resolves its thread

Bug Fixes

• the re-arm mark is cleared by the claim that consumes it and renewed with the session lease

Bug Fixes

• a box under its disk floor reclaims its biggest safe bytes and names what holds the rest
• hold instead of ending when a transient judge outlives the attempt bound or a corrective re-ask cannot answer
• an over-cap plan group throws a named error, and the goal board walks every epic

Features

• add the per-org plan-file switch, on by default

Bug Fixes

• only the reporter consents to a fleet handoff, the release window pages compare and takes the max semver tag, and gh.issues.close posts a disclosed comment
• a disk-floor refusal excludes the starved box from the re-pend
• a box checkout mirrors the remote's tags, and the commits only they reach

Bug Fixes

• merge gate refuses unsupported globs, 0.x breaking bumps, and stale session policy; review discounts are audited

Bug Fixes

• body caps, rebind-pinned webhook dial, key-name redaction, and four tenant fences
• stamp triage plans from the ask's filer

Features

• an inline plan gets a plan-files group and every work unit waits on it

Bug Fixes

• an SSO session stays inside the organization whose IdP minted it

Bug Fixes

• guard every issue door against plan-mirror marker issues

Bug Fixes

• correct /stacks copy to setup, dev, and check

Features

• plan documents read through PlanDocumentSource (committed or stored)

Bug Fixes

• the BYOK reconcile restores only a key the provider serves

Features

• Custom plans say why a plan stopped

Bug Fixes

• is a regex, and a shebang is a comment

Features

• plan-file validation that lists every problem in one refusal

Features

• one TypeScript source lexer, the union of the three shared ones

Bug Fixes

• refuse a comment line break written as a \n escape
• /proof names the study team as the feature's filer everywhere

Bug Fixes

• plan regroup and plan cancel lock the plan row before its groups

Features

• plan regroup replaces a stuck group with the tasks that replace it

Bug Fixes

• a team gate's exit-75 repair stops the base's stack first, keeps the refusal's table, and saves the diff

Bug Fixes

• a review names binary files as skipped instead of counting them as reviewed

Bug Fixes

• a fleet PR's base is merged in at most once per fix round

Bug Fixes

• read a PR past GitHub's 3,000-file ceiling as a tree diff

Bug Fixes

• read a PR's file list up to GitHub's 3,000-file ceiling

Bug Fixes

• a gate refusal that outlives a green setup repair is the tree's fault, not the box's