CHANGELOG.md

# Changelog

All notable changes to FlyBot (earlier: DS Bot) are listed here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the versions follow [Semantic Versioning](https://semver.org/). Before 1.0, a minor version can contain breaking changes. Entries from the historical `0.1.0-dsbot` preview and earlier describe the pre-FlyBot DS Bot lineage.

New entries are written as one fragment file per change in [changelog.d/](changelog.d/README.md) and folded into a release section at release time; `[Unreleased]` below holds entries written before that.

## [Unreleased]

## [0.2.33] - 2026-11-15

### Changed

- `scripts/i18n-usage.mjs` sees copy a helper hands back: a `return` of a sentence — or of a `?:` / `||` expression built from sentences — is reported by `--missing` instead of staying invisible to both i18n checks, as long as the helper is drawn (called at a copy position, or rendered as an `h(Component, …)`). A helper whose value is data — a status id the file compares, a React key, a class name, a URL or a `location.href` template — is not reported. Product measured five such sites in `plugins/social/client.js`; the missing-entry baseline grows by 34 pins of English a reader can still see untranslated, and the bare-draw and template-draw counts are unchanged.
- `scripts/i18n-usage.mjs` now closes the `]` it opens: an indexed read like `list[0]` no longer leaves the scan inside a bracket it can never close, so a literal beside it (`return list[0] || 'None yet'`) is reported by `--missing` instead of being swallowed along with the rest of the file. The same walk also records the names a `${}` hole interpolates, so a sentence a helper builds from a local counts as read rather than as a dead local. The missing-entry baseline grows by one pin — `Your own Bots stay shared. {} can share it again.`, the other branch of a sentence already pinned — and the bare-draw and template-draw counts are unchanged. See [#3077](https://github.com/ThinkFlowLab/FlyBot/issues/3077).
- The approval dock no longer reads the server while its tab is hidden; coming back to the tab reads both of its lists at once instead of waiting for the next five-second poll (#3080).

### Fixed

- In the Bot Social dock, the **Retry** on a failed send listed from another chat no longer looks clickable while a different hold is being decided: the whole list's Retry goes disabled with the decision that is in flight, because the click there was already being dropped ([#3050](https://github.com/ThinkFlowLab/FlyBot/issues/3050)).
- Sharing a Bot with a friend is one share at a time: while a row is sending, no other row is clickable, so a second click no longer takes the sending row's "Sharing…" over and posts a second grant at the same moment ([#3062](https://github.com/ThinkFlowLab/FlyBot/issues/3062)).
- A release section is dated by the Asia/Shanghai calendar day of the release moment instead of the UTC day, so a release after 16:00Z no longer lands under the previous date (`changelog.mjs release` defaults to it; `--date` still overrides) (#3064).
- "Approve all" no longer loses the reason when a batch is mixed: a hold that fails keeps its own sentence and the card it belongs to ("Eve: the hold is stale") while the holds that did send leave as before, and the receipt still names only the people reached (#3071).
- `plugins/social/client.js`: a Bot Social hold whose send failed now keeps a **Not sent** card, with the reason and **Retry**, until it leaves the queue — the dock remembers the failure itself instead of only the one error line the next click clears, so the 5 s poll that still lists the hold as pending can no longer draw it back as waiting. Its **Retry** sends the same approval again (`approve`), once per card that actually went out, and a second click on a card that already went out sends nothing. A local failed hold keeps the host's own retry, which can be tried again while the host keeps answering with a failure.

## [0.2.32] - 2026-11-14

### Fixed

- Bot Social's Sharing and friend cards now speak the window's language: the five headings and lines from [#2973](https://github.com/ThinkFlowLab/FlyBot/issues/2973) plus the accept-invite submit, the Retry on a send that failed, the open-room chip and the invite link button now draw the Chinese `core/src/client/i18n.js` already carried, instead of English. Text a user or a Bot stored — a friend's name, a send error — is still shown exactly as stored, never translated. See [#2973](https://github.com/ThinkFlowLab/FlyBot/issues/2973) and [#2994](https://github.com/ThinkFlowLab/FlyBot/issues/2994).
- Settings → Bot Social now names the whole server in a Check refusal, not only its host: the address keeps its path (and its scheme when it is not `https`), so two servers on one host — `https://social.example/team-b` and `https://social.example/team-c` — no longer produce byte-identical "Could not reach …", redirect, HTTP-status and "did not answer like a Bot Social server" sentences. See [#2975](https://github.com/ThinkFlowLab/FlyBot/issues/2975).
- The GitHub issue title the diagnostics build and the element names the page reader returns now cut on whole characters and end in `…` when something was dropped. An emoji at the 80-character bound stays one character, so the created issue title no longer shows a replacement square and the tool result carries no lone surrogate. See [#2978](https://github.com/ThinkFlowLab/FlyBot/issues/2978).
- A 60-second repeat now reads `Every minute` instead of `Every 1 minutes` on the task card and in the form, and the form's unit reads singular beside a count of 1 (`1 minute`) with the four unit words translated. See [#2979](https://github.com/ThinkFlowLab/FlyBot/issues/2979).
- The Project board's Decisions and Meetings sections drew their empty state in English in a zh window: the line was English prose handed to `t()` as a key, and the folder case was joined at runtime, so no dictionary entry could ever match it. Both sections now carry the empty case as a key with the folder as a parameter, so a zh window reads 决策/会议 empty states in Chinese while an English window reads exactly the sentence it read before; a read that failed still appears as the host's own sentence. ([#2984](https://github.com/ThinkFlowLab/FlyBot/issues/2984))
- The Project board's metrics note ended in the host's machine reason, so a zh window read 「指标不可用: no-credentials」 — a half-translated line with a token that means nothing to the reader. The client now names the reason shapes it knows (no token, no fetch, no source, an unreadable source, and a failed read with its short detail) as one dictionary sentence, so a zh window reads 「指标不可用：这台机器还没有配置 GitHub token」; an English window reads exactly the line it read before, and a reason the client cannot name keeps the host's own words instead of a guess. ([#2985](https://github.com/ThinkFlowLab/FlyBot/issues/2985))
- A Bot's name now folds a run of whitespace to a single space when it is created or renamed, the way a group's name already did. `Dev  Ops` (two spaces) is stored as `Dev Ops`, so creating or renaming to it while `Dev Ops` exists is refused with the existing sentence instead of leaving two rows that draw the same name and answer `@` only once. A line break is still refused as a line break, not folded. See [#2986](https://github.com/ThinkFlowLab/FlyBot/issues/2986).
- Accepting a result in the Inbox now finishes the card at 100% like a board move to Done: the card used to keep the number it last stored (60% on a card returned at 60%), so the same finished card read 100% from the board and 60% from the Inbox, and an accepted card could not be corrected afterwards. A cancelled or failed card still keeps its last number. See [#2988](https://github.com/ThinkFlowLab/FlyBot/issues/2988).
- A team saved before a Bot name folded its runs of spaces is repaired once when it loads: a stored `Dev  Ops` is read as `Dev Ops`, so `@Dev Ops` now reaches that Bot instead of a twin created afterwards. Creating or renaming to the single-space spelling is refused while the old name is there, and when two saved names fold onto one, the Bot that already held the folded spelling keeps it and a log line names the one that did not. See [#2992](https://github.com/ThinkFlowLab/FlyBot/issues/2992).
- The face-to-face room's invite-link card still drew four lines and its countdown in English in a zh window, although the dictionary already carried each one: the expired and withdrawn notices, **Copy link**, **Withdraw link**, and the `{time} left to join` line, whose countdown now carries the number alone so the sentence around it can be translated. A zh window now reads all five in Chinese, and an English window reads exactly the bytes it read before. ([#2999](https://github.com/ThinkFlowLab/FlyBot/issues/2999))
- The two approval cards and the friend panel still read English in a zh window for sixteen lines whose Chinese the dictionary already carried: **Waiting for approval** (label and aria-label on both the chat card and the held-reply card), **Show less** / **Show more**, **Approve**, **Reject**, **Friend requests**, **Accept**, **Done**, **Keep** and **Remove** on the two inline confirmations, and the share list's **Try again**. A zh window now reads them as 等待批准 / 收起 / 展开 / 批准 / 拒绝 / 好友请求 / 接受 / 完成 / 保留 / 删除 / 重试, and an English window reads exactly the bytes it read before. No dictionary entry was added and the client bundle is unchanged. ([#3004](https://github.com/ThinkFlowLab/FlyBot/issues/3004))
- `read_group_chat`'s `newest N of M` no longer shrinks when a co-seat mention's booking sits below the reader's join floor: the count now discounts only the bookings at or above that floor, so a Bot that joined after a busy room's bookings are told the lines it can see (`newest 30 of 211` instead of `newest 30 of 201`) rather than a total short by one per mention. ([#3037](https://github.com/ThinkFlowLab/FlyBot/issues/3037))
- The Runs tab (运行记录) named the other attempt of a row in English in a zh window — `superseded by <id>` on a retried run and `retry of <id>` on its retry — the only words on that row that never went through `tr`, so they sat beside translated time and status chips. Both lines are now drawn through `tr` as `已被 {id} 取代` / `{id} 的重试` in a zh window, an English window reads exactly the bytes it read before, and the raw id stays in the line's tooltip. No dictionary entry was added and the client bundle is unchanged. ([#3040](https://github.com/ThinkFlowLab/FlyBot/issues/3040))
- A `recall` of a topic name that cannot be a topic file — `../x`, `a/b`, a name with a backslash — no longer answers with the whole `MEMORY.md`: it is refused with the same sentence `remember` gives, naming the allowed form, while a name that is merely unknown still says so and lists the topics this Bot knows ([#3042](https://github.com/ThinkFlowLab/FlyBot/issues/3042)).
- While one Bot Social approval is being decided, every card in the dock now locks its Approve / Reject / Auto-send controls, not only the card whose send is in flight, and a second click can no longer start a second decision beside it: the dock keeps one decision at a time, so two replies never overwrite each other's progress or error line. See [#3044](https://github.com/ThinkFlowLab/FlyBot/issues/3044).
- `read_group_chat`'s `newest N of M` no longer trusts a booking list shorter than the room's own count: a room that kept only its booking count and recorded one number afterwards reported fewer lines than its window holds (`newest 30 of 206` where 196 are there), because the unrecorded bookings were counted as if every one sat inside the window. Such a room's placements are unknown, so it keeps the room-wide discount. ([#3046](https://github.com/ThinkFlowLab/FlyBot/issues/3046))
- A file refused because a folder on its path starts with a dot now says which part it hit and how to attach it anyway — copy the file to a folder that is not hidden and attach that copy — instead of only "hidden files and folders are private", and `message_friend_bot`'s `files` description carries the same route. A credential, a private FlyBot file and an unsupported extension keep their own refusal words ([#3048](https://github.com/ThinkFlowLab/FlyBot/issues/3048)).
- `scripts/i18n-usage.mjs` has a third scan ([#3049](https://github.com/ThinkFlowLab/FlyBot/issues/3049)): a copy drawn through a template literal with a `${}` hole (`superseded by ${id}`) is now reported by `--template-draws` instead of being invisible to both i18n checks, with one `{}` per hole, so the fix is one `tr()` key. The draw is counted where copy is read — an `h()` copy attribute or child, a `text:` prop, a copy table value — including a template the reader reaches through a name. The bare-draw and missing-entry counts are unchanged, and each of those reports now ends with one line counting the template draws it cannot judge.

## [0.2.31] - 2026-11-13

### Added

- A start with one or more feature plugins switched off now writes one line — `flybot: feature plugins off at start: <ids>` — naming every plugin this process left off, so a missing Project surface in a pasted log can be told apart from a switch. A start with every switch on stays silent ([#2939](https://github.com/ThinkFlowLab/FlyBot/issues/2939)).

### Changed

- The Feedback page's error list now says how much of it is drawn: the newest eight rows sit under a count like `Showing 8 of 50`, and the existing `Show more` control opens the rest, with the line reading `Showing all 50` while it is open. A reader with more errors than fit can now tell the list is cut rather than complete before quoting it in a bug report; eight or fewer errors keep the list exactly as it was, with no count and no control. See [#2884](https://github.com/ThinkFlowLab/FlyBot/issues/2884).
- A read across a multi-part own chat now has a test for the part index it carries: every part named with its window, the current one ending `now`, and the `read_own_chat with part N` hint that leads back to a closed part's handoff note.
- The subsystem page that documents a read-only window now says what its **Reload** button answers, not just where the control is drawn: pressing it re-reads the team without a page reload, and one line then says whether the window is still read-only or can write again, while a failed read reaches the usual error surface and a window that was never locked hears nothing. The page says this once, and points at the test that covers it. See [#2902](https://github.com/ThinkFlowLab/FlyBot/issues/2902).
- Contributor docs now state how a repository path written in inline code is checked: the core suite fails a page under `docs/` that names a `core/`, `plugins/` or `patches/` file that does not exist, and the fix is to point it at the file's current home rather than to delete the backticks ([#2906](https://github.com/ThinkFlowLab/FlyBot/issues/2906), [#2913](https://github.com/ThinkFlowLab/FlyBot/issues/2913)).
- The `plugin-runtime` page now says what the three facts on a Settings → Plugins row are: `enabled` is the owner's switch, `installed` is whether this profile carries the package, and `loaded` is whether this start really attached it — so a switch can be on over a package that is absent, and a carried package can be installed without being attached when its switch is off or its start failed. It also records that with no profile to read, or an unreadable one, `installed` is unknown rather than `false`, and that Settings → Plugins turns only an explicit `installed: false` into the "Not installed in this profile." row. See [#2914](https://github.com/ThinkFlowLab/FlyBot/issues/2914).
- A read-only window still copies the conversation from the details drawer: the lock refuses writes, not the transcript export ([#2919](https://github.com/ThinkFlowLab/FlyBot/issues/2919)).
- A scheduled task's card now says when the connectors its run would carry have moved since the task was set: the host stores the reach at create and edit beside the reach it has now, and the row reads `· changed since it was set`. The run itself still uses the current reach, because DSH has no hook before a delivery to pin it. See [#2930](https://github.com/ThinkFlowLab/FlyBot/issues/2930).
- A server address saved in Settings that this build cannot use is now named on the Bot Social settings page, with the reason, instead of silently reading as `Profile default` — the address still does not take effect and the profile default keeps running, but the page no longer hides that a saved choice was discarded. See [#2946](https://github.com/ThinkFlowLab/FlyBot/issues/2946).

### Fixed

- A Bot name made only of characters that draw nothing is now refused with **A Bot needs a name**, from the new-Bot form, on creation and on rename alike: the braille pattern blank, the Hangul fillers, the combining grapheme joiner and the other default-ignorable code points survive both `\p{Cf}` and `trim()`, so such a name rendered as an empty name. A name that draws something is unaffected, and a name keeps the characters it was written with. See [#2879](https://github.com/ThinkFlowLab/FlyBot/issues/2879).
- A read-only window's Reload now answers: the press writes one receipt naming what happened — the window is still read-only, or it can write again ([#2883](https://github.com/ThinkFlowLab/FlyBot/issues/2883)).
- A Reset of the whole workflow whose Bot release fails now arms the step deadline of the run it froze, so the lane slot comes back when that deadline fires instead of waiting for the owner to save the graph again. See [#2923](https://github.com/ThinkFlowLab/FlyBot/issues/2923).
- The Plugins row for a package this profile does not have prints an install command `dsh` accepts: it now names the profile (`dsh plugin --profile web add @flybot/<id>`) instead of leaving it out, which `dsh` refused with `error: required option '--profile <name>' not specified` ([#2926](https://github.com/ThinkFlowLab/FlyBot/issues/2926)).
- The Plugins row for a package this profile does not have prints the profile this runtime is in, not a hard-coded `web`: `plugins/list` and `plugins/set` answer the runtime's own `profile` name, and the row falls back to the literal `--profile <profile>` placeholder when a host answers none (a command naming `web` was wrong on Desktop). `plugins/set` also answers the full rows again, so `loaded` and `installed` survive a flip instead of coming back as `undefined` (P-721) ([#2931](https://github.com/ThinkFlowLab/FlyBot/issues/2931)).
- The Feedback page's error count now divides by the whole log, not by the rows on screen: a log of sixty errors reads `Showing 8 of 60` folded and `Showing 50 of 60` open, instead of `Showing 8 of 50` and `Showing all 50` under a `Recent errors · 60` title. The count line and the title now report the same number, so ten errors are no longer missing from a page that claims to hold all of them. See [#2932](https://github.com/ThinkFlowLab/FlyBot/issues/2932).
- A Bot name whose **drawn** form is already taken is refused. `#2879` refused only a name that draws nothing at all; a name that draws something and also carries a character the screen does not draw still passed, so `Dev` plus a combining grapheme joiner (or a braille blank, or a Hangul filler) sat beside the existing `Dev`: both rows read `Dev` while the identity key stayed distinct, and `@Dev` could only ever reach one of them. `createBot` and `updateBot` now compare `drawnKey()` — `nameKey()` with the code points that have no glyph of their own removed — beside `nameKey()`, from either side. A combining mark is not one of them: the letter under it draws it, so two names that differ there stay two names. A drawn form nobody holds is still a name, and nothing is stripped from the stored name ([#2935](https://github.com/ThinkFlowLab/FlyBot/issues/2935)).
- The bug report's `Read-only` row no longer stops in the middle of a word: the sentence is now abbreviated to `~` first and bounded after, so a long home folder cannot leave a row that ends mid-word with no mark, and a row that really was cut ends with one `…`. A browser log line and its code carry the same mark where they were cut. See [#2936](https://github.com/ThinkFlowLab/FlyBot/issues/2936).
- The report behind Settings → About now says which feature plugin is switched off, so a bundle about "Projects is gone" answers "did you turn it off?" by itself: a `Plugins` row after `Read-only` names every switched-off plugin in list order (`project off`, `timeline, project off`) and ends ` (restart pending)` while a switch still differs from what this start loaded. A host with every switch on, or a state with no `flybot.plugins` at all, draws no row and keeps the report exactly as it was. See [#2940](https://github.com/ThinkFlowLab/FlyBot/issues/2940).
- A saved Bot Social server choice that exists but cannot be read or parsed no longer makes the whole plugin look uninstalled: the refusal itself stands, but Settings → Bot Social now shows it with the file's path and reason, and Settings → Feedback keeps one line saying the same thing. See [#2945](https://github.com/ThinkFlowLab/FlyBot/issues/2945).
- The Bot Social Settings page now shows the reason a saved server address was refused as a whole sentence instead of cutting it at the name length limit (a plain `http://` address ended at "… for localho"), and a genuinely long reason is shortened at a word boundary with `…` ([#2950](https://github.com/ThinkFlowLab/FlyBot/issues/2950)).
- A task copied to another Bot now records the reach that Bot had when it was copied, so its card can say `changed since it was set` once the roster moves. The copy path lost the new task's id on its way out of the write, so the reach-at-set was never stored and the copy looked as if it had always had today's reach. See [#2951](https://github.com/ThinkFlowLab/FlyBot/issues/2951).
- The report behind Settings → About no longer prints one string for two different files: in the normal layout, where the DSH home sits under the OS home, a file inside that home read `~/state.json` exactly like a file at the OS-home root. The outer folder now shortens to `~` first and a home under it keeps the part that tells it apart (`~/.dsh/bot/state.json`), on the `Read-only` row and on the error lines alike. See [#2956](https://github.com/ThinkFlowLab/FlyBot/issues/2956).
- The saved-server line under Settings → Bot Social names the whole saved address again: the page cut it at 80 characters with no mark, so two addresses that differed only past that point drew the same sentence, and an address the host could not read drew `The server saved here () cannot be used: …`. The address is now drawn whole up to the host's 200-character bound and shortened with a visible `…` only past that, and an empty address leaves the brackets out. See [#2958](https://github.com/ThinkFlowLab/FlyBot/issues/2958).
- The `Used before` buttons and the `Checked` summary on Settings → Bot Social now name a server by its whole address, not just its host: two servers on one host with different paths (`https://social.example/team-b` and `…/team-c`) used to draw the same label, so the page offered two identical buttons for two different servers. The label keeps the path, and keeps the scheme only when it is not `https://`, so a root address still reads `social.example`. See [#2963](https://github.com/ThinkFlowLab/FlyBot/issues/2963).
- A diagnostics report from a computer whose DSH home is nested deeply no longer cuts the end off the `Read-only` row: the row used to stop at `… close the other one and` because the long home filled its 200 characters. A home too deep for that bound now gives up its middle instead (`~/.local/share/deepseek-harness/teams/flybot-dev` reads `~/.local/…/flybot-dev`), keeping the last level the sentence names and the advice after it whole. See [#2964](https://github.com/ThinkFlowLab/FlyBot/issues/2964).
- The saved-server line under Settings → Bot Social now shortens an over-long saved address in the middle instead of cutting it at 200 characters with no mark: a head prefix stays, then a visible `…`, then the last path segment, so two saved servers that differ only in that segment (`…/one` versus `…/two`) no longer read as one sentence. An address within the bound is drawn byte for byte, unchanged. See [#2968](https://github.com/ThinkFlowLab/FlyBot/issues/2968).
- The chat's `Scheduled task:` and `Update` lines now cut on whole characters and end in `…` when something was dropped. An emoji at the 80-character bound stays one character instead of showing a replacement square, and a cut prompt no longer reads as the whole one. See [#2972](https://github.com/ThinkFlowLab/FlyBot/issues/2972).
- The report behind Settings → About now shortens the whole home it prints, not half of it: a DSH home outside the OS home used to stand in full in the `Read-only` row (a lock held by another dsh, or a team file that could not be read) while the file rows beside it said `~/state.json`. Both folders now become `~` before the sentence's 200 bound is applied, so a long home no longer cuts the reload advice off the end of that row. See [#2944](https://github.com/ThinkFlowLab/FlyBot/issues/2944).

## [0.2.30] - 2026-11-12

### Added

- The room read's `newest N of M` total now has a test for the boundary where a co-seat mention's reserved number sits above the reader's join floor and the log has been trimmed ([#2886](https://github.com/ThinkFlowLab/FlyBot/issues/2886)).
- The Project domain now ships as its own peer plugin, `@flybot/project` (`plugins/project`), instead of living inside the core: Project State, the Project board, the Project's own Chief, the team dossier, the Project metrics and the Project Assistant moved out of `core/src/host/project-*.js`, and the `project_state` / `project_digest` tools are registered by that plugin. Settings → Plugins gains a **Project** switch that turns the whole domain off at the next start; with it off (or with the plugin not installed) the core keeps its documented fallbacks — a Project is created without a Chief or an assistant and the board and the dossier answer empty. Nothing a Project does changes: same reads, same refusals, same strings, and every existing test moved with the code. See [#2830](https://github.com/ThinkFlowLab/FlyBot/issues/2830).

### Changed

- Settings → Plugins now draws a plugin this profile never installed as a plain "Not installed in this profile." row with the command that installs it, instead of an ON switch for a domain the running process does not have; a Project whose Chief failed now shows the host's error under its row instead of looking empty. See [#2869](https://github.com/ThinkFlowLab/FlyBot/issues/2869).
- `docs/subsystems/workflow.md` now says how a run frozen by a whole-workflow Reset that could not release every Bot gets its deadline back — the next graph save arms it, and the deadline releases the remaining Bots again ([#2888](https://github.com/ThinkFlowLab/FlyBot/issues/2888)).
- A read of a Bot's own chat now has a test for its capped window: the heading says `newest 12 of 20` and the 12 lines end on the newest message.
- The four subsystem docs that describe the Project domain no longer send a reader to files #2830 moved: ten backticked references in `core-client.md`, `core-host.md`, `team.md` and `workflow.md` now name `plugins/project/src/project-{board,assistant}.js` and `plugins/project/test/project-{board,team,roles}.test.js`, where the board, the assistant and their tests live today, instead of `core/` paths that no longer exist. See [#2895](https://github.com/ThinkFlowLab/FlyBot/issues/2895).
- A read of a Bot's own chat now has a test for the count across parts: 4 messages in the part that ended and 10 in the current one read as `newest 12 of 14`.
- The read-only Bot overview's model value is now pinned in the three states it can read — the catalog has not loaded yet, the catalog serves the model, and the catalog cannot serve it — so a change that calls every model `not available` before the list arrives, or hides one the catalog cannot serve behind a plain provider name, fails the suite instead of shipping. See [#2901](https://github.com/ThinkFlowLab/FlyBot/issues/2901).
- `plugins/list` now has a test holding its `installed` answer to the profile on every call: a plugin package installed or removed while the host runs is reported as installed or not, instead of freezing what the start read.
- The repo-path guard now reads the docs tree: a backticked `core/`, `plugins/` or `patches/` path with a code or document extension that does not exist on disk fails the suite, so a subsystem doc that keeps pointing at a moved file is caught instead of read.

### Fixed

- A room that was already stored as one chat per member no longer shows the same room several times with each member's lines in their own copy: the older rows' sessions are kept as earlier parts of the one chat, so no line is copied, every message reads back word for word and an assistant reply stays an assistant reply; the chat's session is rebound to the handle of the row that survives, so the next line is sent, an open question card moves with the chat, and a room with more than one open card is left for a later round instead of dropping one. See [#2804](https://github.com/ThinkFlowLab/FlyBot/issues/2804).
- A standing approval or a board claim is now refused when the store wrote nothing, instead of reporting success: in a read-only window (another dsh holds the store) or a stopped host, an **Always allow** answers with the store's read-only sentence and keeps no grant the file does not hold, `standing-approval-remove` keeps a grant whose removal was not written, and a claimed card rolls back to its queued state without posting the claim line, while Allow once and Reject still answer in a read-only window because they write nothing. See [#2805](https://github.com/ThinkFlowLab/FlyBot/issues/2805).
- A channel that keeps refusing a send no longer costs memory for the life of the process: the notifier remembered every permanently refused idempotency key and never dropped one, while the sent keys beside it were capped at 1 000. The refused keys now keep the same bound and drop the oldest first, so a deleted channel or a revoked bot stays a remembered failure without the table growing with every send. See [#2808](https://github.com/ThinkFlowLab/FlyBot/issues/2808).
- The tree plugin's `jobTimeoutMs` is capped at 2147483647 ms (about 24.8 days): a larger value — 30 days is the natural way to ask for "effectively no deadline" — was handed to Node's `setTimeout`, which silently replaced it with 1 ms, so every queued reorganization job was reported abandoned on a healthy host while the host call it was waiting for kept running and writing. The value is now clamped to the ceiling with one warning that names the deadline actually used, so a job whose host call answers inside it resolves normally. See [#2811](https://github.com/ThinkFlowLab/FlyBot/issues/2811).
- The memory journal's fold line now reports the number of changes it really replaced: each fold counted its own `truncated` line as a dropped change, so the tally grew by one more than the journal had folded away on every fold after the first. See [#2816](https://github.com/ThinkFlowLab/FlyBot/issues/2816).
- A scheduled task that hits an approval no longer hangs its turn: when a reminder turn asks for a tool nobody can approve, the request is rejected in place instead of waiting on a card with no one to answer it, the turn ends normally so `state.scheduleRuns` leaves `running` and the next delivery can run, and the Session the run owns gets one visible line naming the tool and saying it was skipped and can be run from the chat or covered by a standing approval. The direction is only hang → denied, never an allow. See [#2818](https://github.com/ThinkFlowLab/FlyBot/issues/2818).
- The timeline plugin's `exportMs` is capped at 2147483647 ms (about 24.8 days): a larger value was handed to `setInterval`, which silently replaced the delay with 1 ms, so an export interval meant as "effectively never" ran the exporter on every tick and each run filtered the whole trace on the host's event loop. The interval is now clamped to the ceiling with one warning naming the interval in force, so a long interval exports on the deadline it asks for.
- The Feedback page now says when the error log could not be read instead of claiming nothing was recorded: when the host reports the log unreadable, the empty state names the reason (for example `EACCES`) and says the errors it holds are not shown, while any errors the report does carry are drawn unchanged. See [#2833](https://github.com/ThinkFlowLab/FlyBot/issues/2833).
- A timeline export that keeps failing now warns once when the streak opens and once when it recovers, instead of once per tick, and `timeline/health` reports the exporter state (`failures`, `lastOkAt`, `lastError`) so a broken collector is visible without reading the log.
- `read_group_chat` now counts the lines the room said, not only the lines its log still holds: a room that said 500 lines and keeps the newest 60 reads `Latest in "Ops" (newest 30 of 500, oldest first):` instead of `newest 30 of 60`, and a reader at floor line 300 reads `newest 30 of 201`. A room that never trimmed reads byte-identically, and the caps (`ROOM_READ_MAX` 30, `ROOM_LOG_MAX` 60, the membership store's 200) are unchanged. See [#2838](https://github.com/ThinkFlowLab/FlyBot/issues/2838).
- `check-pack.mjs` now packs `@flybot/project`, so the Docker image and the release tarballs carry the plugin the tree already runs; a test compares the pack list with `plugins/*` so a new plugin cannot silently drop out of both again.
- The source comments, plugin README and subsystem pages that describe the Project domain as its own plugin now cite [#2830](https://github.com/ThinkFlowLab/FlyBot/issues/2830) instead of an unrelated workflow-store fix; no behavior changed. See [#2843](https://github.com/ThinkFlowLab/FlyBot/issues/2843).
- `read_group_chat` no longer counts a share-seq reservation as a line the room said: a mention that reserves a remote line number writes nothing to the room log, so reserving one after a five-line log used to read `Latest in "Ops" (newest 5 of 6, oldest first):` and grew one phantom line per mention; the header stays `Latest in "Ops" (oldest first):`, the number is still issued from the room's own counter so the next line written takes the one after it, and a second mention is never a redelivery of an earlier line. A room whose log really was trimmed still reports the lines the cap dropped. See [#2855](https://github.com/ThinkFlowLab/FlyBot/issues/2855).
- Saving a key no longer lands through a temp name someone else planted: the secrets file is staged at `secrets.json.<pid>.<uuid>.tmp` with an exclusive create, so a link, a hard link or a directory at that name refuses the save before its first byte — nothing is written outside the home and nothing is renamed into place ([#2864](https://github.com/ThinkFlowLab/FlyBot/issues/2864)).
- A meeting's decision file no longer lands through a link planted at its temporary name: the temp file is created exclusively, so a link, a folder or a device already at that name refuses the write before a byte lands and the decision moves on to a name of its own, instead of writing outside the folder and putting the link where the decision file belongs ([#2865](https://github.com/ThinkFlowLab/FlyBot/issues/2865)).
- Settings → Plugins no longer shows a plugin as simply on when its package is missing from this profile: each row now carries `installed` as well as the owner's switch, read from the profile's `dsh.profile.bundles`, so a plugin whose package was never installed reads as not installed instead of drawing an ON switch for a domain the running process does not have. See [#2868](https://github.com/ThinkFlowLab/FlyBot/issues/2868).
- A failed workflow card in the Inbox now opens the graph that failed, not just the Workflows list: the card's Open carries the graph id through Settings, so the reader lands on that flowchart, and a graph that no longer exists still leaves the list up ([#2874](https://github.com/ThinkFlowLab/FlyBot/issues/2874)).
- With the Project plugin switched off — or with `@flybot/project` not installed — the browser now shows no Project surface at all: no **Projects** row in the sidebar, no **Projects** page in Settings (a link that asks for it lands on General instead), no `#project=<id>` board, and no project-agent entry in a Bot's header. `plugins/list` now also answers whether each feature plugin really attached on this start (`loaded`), so "on but absent" is no longer indistinguishable from "installed and on"; the switch itself keeps its meaning and Settings → Plugins is unchanged. When the plugin is present every surface is exactly what it was. See [#2877](https://github.com/ThinkFlowLab/FlyBot/issues/2877).
- A Project board with no Project yet no longer says "create one" in a read-only window: it names the empty state and says why the window cannot create, and only a writable window keeps the create sentence ([#2882](https://github.com/ThinkFlowLab/FlyBot/issues/2882)).
- Turning a plugin switch off and then back on still asked the owner to restart: `plugins/list` answered `pendingRestart: true` for a change the next start would not notice, and nothing cleared it. The banner now compares each switch with the value this start loaded, so it clears as soon as every switch answers that again ([#2893](https://github.com/ThinkFlowLab/FlyBot/issues/2893)).
- A graph save that changes `stepTimeoutMinutes` now arms a run frozen by a failed Reset with the value the save names, so a 5-minute setting fires at 5 minutes instead of leaving the 45-minute default in place for another 40.
- A chat bubble no longer deletes a line that merely starts with an arrow: a leading `X → Y` is dropped only when every hop is one of the conversation's Bot names, so a reply opening `Settings → Models 页面` keeps that line and only a real delegation trace goes ([#2841](https://github.com/ThinkFlowLab/FlyBot/issues/2841)).

## [0.2.29] - 2026-11-11

### Fixed

- A Bot turn now carries its own outcome to the sender instead of leaving it in the wording: an answer says `failure: false`, a turn stopped before it answered says `failure: true` with the stop notice as its reason, and a failed one keeps its failure notice — so a workflow step classifies the step by that marker, a stop notice can no longer advance a run, and an answer that happens to quote a failure sentence can no longer fail one ([#2742](https://github.com/ThinkFlowLab/FlyBot/issues/2742)).
- A Workflow run whose host call never answered no longer stays running for ever: a step whose deadline passes is ended as failed even while a dispatch, a release or a Bot start is still waiting, with its Bots released. A start whose Bots the host does not create within 60 seconds is refused, and a queued card a drain had already taken out of the queue goes back to it instead of disappearing. A lane also keeps its concurrency limit while a start is still waiting on the host: two steps ending in the same turn no longer start one card too many. ([#2748](https://github.com/ThinkFlowLab/FlyBot/issues/2748))
- A Workflow run whose Stop cannot release a Bot no longer retries for ever: after two deadline retries it ends `failed` as `release-failed`, with the ids the host would not remove and the attempt count on the run, so its lane slot comes back and the cards queued behind it start (#2750).
- A tree reorganization no longer waits for ever on a host call that never answers: after 10 minutes the job is abandoned with its id in the log (`flybot-tree: reorganization job <id> was abandoned after …`), later placements, repairs and the daily tidy still run, and `settled()` still resolves. An abandoned `exclusive()` job reports `abandoned: true` with its job id instead of hanging. See [#2751](https://github.com/ThinkFlowLab/FlyBot/issues/2751).
- A card queued behind a run that ended **failed** now starts on its own: the load-time reap that ends a run a dead host left `running` drains the lane's queue the way any other terminal transition does, instead of leaving the card parked with a free slot until the next assign. See [#2752](https://github.com/ThinkFlowLab/FlyBot/issues/2752).
- A room whose stored join floor sits above its own `room.seq` no longer shows an empty history: the read path clamps that floor to `room.seq`, so the guest sees the line it joined at and every line after it, warns once per room, and leaves the stored state untouched ([#2754](https://github.com/ThinkFlowLab/FlyBot/issues/2754)).
- A `state.json` whose saved room or Bot record is `null` no longer hides the whole team: the file as it was is kept as a `state.json.broken-<stamp>` copy, one warning names `state.json`, the room is folded to an empty member list (an unusable Bot record is dropped), and the repaired team loads and saves. A version-1 file still keeps its `.v1` backup, and a read-only window records the evidence but never writes `state.json`. See [#2755](https://github.com/ThinkFlowLab/FlyBot/issues/2755).
- A `track_tasks` batch whose store write was refused no longer leaves the cards it committed in memory: the board is restored before the error, so a ghost card cannot ride the next save onto disk (#2761).
- `workflows/<id>.json` — the file a saved workflow definition lives in — was written with `writeFileSync`, which opens the target at zero bytes and then writes, so a second window reading inside that window parsed half a definition (or nothing), `list()` skipped it as unparsable and `open()` answered `workflow/not-found` for a definition that was not lost. Saving now stages a private temp name in the same folder and renames it over the target, for both `save()` and the `project.json` pointer `setDefault()` writes, so every read sees the previous complete definition or the new one, and a crash inside the write leaves the old bytes whole. A temp name a crashed write left behind is swept by the next write, a failed write removes its own temp name, and a link planted at the temp name is refused before the first byte. See [#2762](https://github.com/ThinkFlowLab/FlyBot/issues/2762).
- A refused state save no longer leaves an unaccepted **Always allow** live in memory: the grant is rolled back and the refusal is reported, so the next matching card still asks instead of being answered on the owner's behalf; a refused **Remove** likewise keeps the grant it could not delete ([#2764](https://github.com/ThinkFlowLab/FlyBot/issues/2764)).
- Reading a long room that was saved before rooms carried a `seq` counter no longer walks its log once per line: the read works out the join floor once and filters with that number, so a 20,000-line history reads in linear instead of quadratic time, with the same visible lines and the same one-time warning ([#2766](https://github.com/ThinkFlowLab/FlyBot/issues/2766)).
- `bot_schedules` no longer prints `next <a time that has already passed>` for a task whose status is not `active`: such a row reads `no next run` (the same sentence paused rows already used) and keeps its status word, while an `active` row is unchanged. The settings page already said `Finished` for the same row, so the tool and the page now agree. See [#2767](https://github.com/ThinkFlowLab/FlyBot/issues/2767).
- `ask_user` now enforces the two-to-four answers its own card promises: a question with one option, or with more than four, is refused with `Give two to four answers.` and no card is stored, instead of accepting a single "choice" or silently dropping a seventh option (labels dropped as empty are not counted, so five given with two blanks is a three-button card and passes). Two to four options produce the same card and the same answer string as before. See [#2771](https://github.com/ThinkFlowLab/FlyBot/issues/2771).
- `read_own_chat({ part: N })` no longer calls the current part "in your context" after a checkpoint condensed it. When the part carries a `[Checkpoint N]`, the answer names the checkpoint, shows the newest messages that are still in context, and points at the words search for the rest; without a checkpoint, and for an ended or missing part, the answer is unchanged. See [#2774](https://github.com/ThinkFlowLab/FlyBot/issues/2774).
- `update_bot` now refuses a colour the host does not know, instead of answering `Updated <name>.` while the Bot keeps the colour it had; the refusal names the accepted colours ([#2775](https://github.com/ThinkFlowLab/FlyBot/issues/2775)).
- `core/dev/token-report.mjs` with no `--db` now reads the ledger where the host writes it, `$DSH_HOME/bot/usage.sqlite`, instead of one directory above it, so the command runs on an ordinary install instead of exiting with "no ledger at" ([#2778](https://github.com/ThinkFlowLab/FlyBot/issues/2778)).
- `read_group_chat` now says how many room lines its 30-line cap left out — `Latest in "<room>" (newest 30 of 45, oldest first):` — instead of printing a cut log as the whole log; an uncut read is byte-identical ([#2780](https://github.com/ThinkFlowLab/FlyBot/issues/2780)).
- Two "Always allow" answers on the same Bot could lose one of the grants. A refused save put the whole list back the way it was found, and the second answer had already added its own grant to that list in memory, so the rollback dropped it — and a save queued behind the refused one could write a grant whose own save had been refused. Answers on one record now run one after another, so each rollback touches only its own grant.
- `boundedSpawn` released the Bots a late spawn created only when the host’s late answer succeeded: a late **failure** carried the ids it had already made on `error.spawned` and the deadline branch only warned, so those hidden run Bots lived until the process exited. The deadline now releases that list too, while a refusal and a release that itself fails still warn ([#2785](https://github.com/ThinkFlowLab/FlyBot/issues/2785)).
- A card queued behind a run ended by the reap a window runs when it **takes the store over** now starts on its own: the takeover reap drains the lane's queue like the load-time reap, instead of leaving the card parked with a free slot until some unrelated assign or ingest. See [#2787](https://github.com/ThinkFlowLab/FlyBot/issues/2787).
- `read_group_chat` resolved its floor from the Bot's own participant record and filtered the room log on the raw `joinedSeq`, so it never ran the #2754 clamp: a stored floor above the room's own `room.seq` — the shape a host counter left on a participant record before #2612/#2613 stopped the write — hid every line from that reader and answered `"<room>" has no messages yet` in a room the pane and every other reader still showed. The read now asks the membership window for its seat floor (`rt.seatFloor`), which applies the same clamp, memo and one-time warning as the human reads, and it keeps answering from `room.seq` when the room was saved before `seq` existed ([#2790](https://github.com/ThinkFlowLab/FlyBot/issues/2790)).
- A room a friend publishes once per member is one chat again: the friends' list keys a remote chat by the room — the same published name at the same home — instead of by the member handle it arrived on, so one group no longer fills the sidebar with a row per member and keeps its history when that handle changes ([#2797](https://github.com/ThinkFlowLab/FlyBot/issues/2797)).
- Feishu's app mode drew the App Secret as a bare `.bt-secret-input` — the masked field the Secrets page only ever places inside a bordered `.bt-q-field` wrapper — so it showed as a grey `Paste or type the key` line under the App ID box with no box and no label, and the form read as if only the App ID could be filled in. The connector form now gives every masked credential that same wrapper, so app mode shows an App Secret box beside the App ID box and the webhook field gets the border it was missing too ([#2799](https://github.com/ThinkFlowLab/FlyBot/issues/2799)).
- The tree plugin's `jobTimeoutMs` config key now bounds a queued reorganization job: the value was read by the organizer but never passed to it from the plugin config, so every job waited on the ten-minute default however the key was set. A value that is not a finite number above 0 still keeps that default. See [#2758](https://github.com/ThinkFlowLab/FlyBot/issues/2758).
- The board's metrics cache no longer holds every five-minute window it has ever answered: a window that is over is dropped on the next write, and the table is capped, so a host that runs for weeks keeps a handful of entries instead of one per window per repository and zone. A hit inside the same window, the five-minute lifetime and every number on the board are unchanged. See [#2806](https://github.com/ThinkFlowLab/FlyBot/issues/2806).
- The memory journal (`<home>/memory/journal.jsonl`) no longer grows without bound: it keeps the newest 500 changes, and at most 1 MiB, folding anything older into a single `truncated` record that says how many changes it replaced. Remembering and forgetting a fact used to leave one journal line behind forever; the memory itself was already at a steady state, so only this log kept growing ([#2807](https://github.com/ThinkFlowLab/FlyBot/issues/2807)).

## [0.2.28] - 2026-11-10

### Fixed

- A window that takes over a workflow store after the other window closes no longer writes the copy it loaded while the other one was still running: the first read or write after it becomes the writer re-reads `workflows.json`, and it reaps the run the closed window left behind instead of leaving the lane blocked. A card that was only queued is kept and starts normally. See [#2704](https://github.com/ThinkFlowLab/FlyBot/issues/2704).
- `inflight.json` — the record that lets an interrupted turn resume — is now staged in a temp file and renamed over the old one, so a crash in the middle of the write leaves the previous complete notes instead of an empty or half-written file. Every turn and queued message the crash cut off is still picked up at the next start, where an empty file used to drop them all silently. A file that still cannot be parsed (a hand-edit, a disk error) is now reported once with its path and the reason instead of passing for "nothing was in flight", and a temp name a crashed write left behind is swept by the next host that writes. See [#2705](https://github.com/ThinkFlowLab/FlyBot/issues/2705).
- A timeline window that opens while another window is writing the trace no longer loses every span for the rest of its life: it asks for the writer lock again when it has something to write, begins persisting as soon as the other window closes, and keeps the segments already on disk. Until the lock is free a flush that wrote nothing answers `false` and names the reason once, instead of reporting success for a dropped span. See [#2706](https://github.com/ThinkFlowLab/FlyBot/issues/2706).
- Every message `read_own_chat` shows now names its part in the anchor, `part N #<seq>`, from the first message of a chat onward, so an anchor a Bot saved before the conversation moved to a second part still opens that same message afterwards. A bare `#<seq>` in an anchor written earlier keeps working and reads the part that is current now, but the answer says the part was guessed instead of reporting an exact hit — previously it silently returned a different message from another part and said `exact: true`. Anchors written the old way remain valid; nothing needs re-reading. See [#2710](https://github.com/ThinkFlowLab/FlyBot/issues/2710).
- `read_own_chat` no longer shows every message twice when a second window or a plugin activation indexes the same chat: the part's mark is read inside the transaction that writes the rows (so the second writer sees the first one's commit), and the index's `lines` table now refuses a second row for the same event. An index an older build already duplicated is rebuilt once from the Session logs on the next start, and the log says how many duplicated lines it found. A window another dsh keeps read-only now reads the existing `chat-index.sqlite` without creating, repairing or writing it, instead of writing the index behind the other window's back. See [#2711](https://github.com/ThinkFlowLab/FlyBot/issues/2711).
- A saved team whose group-chat record carries no `members` list (a hand edit, a restore from another machine, or a version-1 home from before the field) no longer makes FlyBot fail to start: the record's list is repaired to empty when the team is loaded, the room itself is kept, and the repaired team is saved, instead of every later load rejecting with no warning and no way to repair it from the UI. See [#2714](https://github.com/ThinkFlowLab/FlyBot/issues/2714).
- A saved team file whose fields that hold tables arrive as `null` — or as something else that is not a list or a record — no longer loads as a writable team that then fails every write. `exchanges` is repaired to an empty list and `exchangeTurns`, `questions`, `rooms`, `bots`, `prefs` and `agents` to an empty record when the team is loaded, and the repaired team is saved, so creating a Bot, renaming a room, posting in a group, a memory write and a delivery all work again instead of each throwing a stack trace that never named the team file as the problem. See [#2715](https://github.com/ThinkFlowLab/FlyBot/issues/2715).
- A team file that is empty or half written is now described as what it is instead of telling the person to update FlyBot. `state.json` holding `{}`, `null`, `[]` or an empty string parses but carries no `version`, and the read-only sentence used to read `saved by a newer FlyBot; update FlyBot` — a repair that cannot help an install already on the current version. It now reads `the team file has no version — it is incomplete (an empty or half-written file)`, so the first thing a broken install shows points at the file to move aside. The newer-version sentence is kept for a file whose `version` is above this build's, the file is still never changed, and a zero-byte or truncated file keeps its existing backup-and-load-fresh path. See [#2716](https://github.com/ThinkFlowLab/FlyBot/issues/2716).
- A Bot Social settings or identity file that exists but cannot be read or parsed is no longer treated as "nothing was ever saved". A torn `flybot-social-bots.<tag>.json` used to make a server switch silently restart the Bot as a stranger — no member identity, no grants — and the next switch rewrote the only copy; the switch now refuses before anything moves, names the file and leaves its bytes alone. A torn `flybot-social-server.json` refuses at start instead of quietly connecting to the default server as if no server had been chosen, and a damaged credentials file of another server is warned about and left out of the known-server list. A file that is absent still means a first run. See [#2717](https://github.com/ThinkFlowLab/FlyBot/issues/2717).
- The decision log no longer shares one temp file between writers: the trim stages the retained log at `decisions.jsonl.<pid>.<uuid>.tmp` and renames it over the log, so two hosts of one team folder cannot take each other's temp away and report a write that never landed — the `a decision was not written: … ENOENT …` warning, and the trim that was lost with it, are gone ([#2724](https://github.com/ThinkFlowLab/FlyBot/issues/2724)). A read-only window, the second host of one team folder, now writes nothing at all: `record_decision` there appends no line, trims nothing, fires no `decision` event, and answers `Not recorded: this window is read-only, …` instead of claiming a record that is not on disk.
- Pausing or resuming a workflow run while one of its steps was still dispatching no longer loses the control: both now land on the run record the lane holds, so a run paused during a dispatch stays paused when that dispatch returns and a run resumed during one stays resumed — the stage no longer reads `已暂停` while the run is `running` with its step deadline re-armed and no Resume pressed ([#2734](https://github.com/ThinkFlowLab/FlyBot/issues/2734)).
- A card parked behind the concurrency limit is no longer dropped when the host refuses to start a Bot for it once: the parked row goes back to the head of the queue and starts on the next drain, instead of leaving the queue while the stored claim still answered `already: true` — which left the card in nobody's hands, with no run naming it, until a human used `rematch` ([#2735](https://github.com/ThinkFlowLab/FlyBot/issues/2735)).
- A workflow store that parses but holds an entry that is not a workflow now answers `store-unreadable` instead of throwing out of every read of `workflow/state`: the panel gets the repair hint, and the damaged bytes are kept as `workflows.json.broken-<stamp>` before the next write, instead of a raw `TypeError` escaping each render ([#2736](https://github.com/ThinkFlowLab/FlyBot/issues/2736)).
- A memory review answer that named a topic memory cannot use no longer throws the whole answer away: only that change is left out, the valid `add`, `edit` or `remove` beside it lands and the cursor moves past the lines that were read, and one warning per answer — not one per process — says how many this answer lost and why the first one was, so a later answer in the same Session still warns again while a secret keeps its silence and is not counted ([#2739](https://github.com/ThinkFlowLab/FlyBot/issues/2739)).
- The `/api/health` route, the one answer given without a session, now uses the connection's fence verdict as it comes instead of comparing it to `403`: a refusal with any other status (a newer code, or the `400` a connection answers for a request it cannot read) is written with that code and no health body leaves, and an answer that is not a status reaches the web server's `400` arm instead of being read as "not refused" ([#2740](https://github.com/ThinkFlowLab/FlyBot/issues/2740)).
- A Workflow step whose Bot turn the host stopped before it answered is now reported as failed, with the stop notice as its reason, instead of finishing as done and handing that notice downstream as its output. A step's ordinary answer that merely mentions "model call failed" is no longer read as a failure. ([#2741](https://github.com/ThinkFlowLab/FlyBot/issues/2741))

## [0.2.27] - 2026-11-09

### Fixed

- A trace rotation whose flush is refused no longer prunes the oldest segment, so the last durable trace file stays on disk instead of being deleted while the newer records exist only in memory ([#2624](https://github.com/ThinkFlowLab/FlyBot/issues/2624)).
- A timeline trace whose open is refused — a directory that cannot be listed, one removed underneath, or an I/O error — now gives its writer lock back instead of keeping it for the life of the process, so the next open in the same process and every later process succeeds once the problem is gone, and one transient read failure no longer leaves the on-disk trace switched off until a restart ([#2629](https://github.com/ThinkFlowLab/FlyBot/issues/2629)).
- A Bot Social credentials, backup or settings file that exists but no longer parses is now refused with a message naming it instead of being read as "not configured", so a torn file no longer makes a restart register a new home identity and overwrite the old one. Writes land through a temp file and a rename, so a failed write leaves the previous file whole ([#2631](https://github.com/ThinkFlowLab/FlyBot/issues/2631)).
- A grant or profile change that falls back to Bot Social's REST routes now gives up at the client's deadline instead of waiting forever, so a Bot Social server that accepts the connection and never answers shows a timeout error rather than a hung action ([#2633](https://github.com/ThinkFlowLab/FlyBot/issues/2633)).
- An external participant whose room turn times out is now stopped instead of being left running, so a late answer to the timed-out turn can no longer become the next turn's answer — a slow process no longer replies one turn behind ([#2634](https://github.com/ThinkFlowLab/FlyBot/issues/2634)).
- The group board (`track_tasks`) now matches a Bot name and a group name the way every other door does — trimmed, case-insensitive, a leading `@` dropped from a Bot name and surrounding quotes from a group name — so `assignee: "dev"` and `group: "delivery group"` resolve the Bot and the room they name instead of being refused while the same state resolves them everywhere else. A name that matches no member or more than one still gets the same refusal ([#2637](https://github.com/ThinkFlowLab/FlyBot/issues/2637)).
- A Project name, repository, default branch, owner id, working folder or status that ends in an emoji at its length bound is now cut on a character boundary, so `state.json` stores a whole character instead of half a surrogate pair that every UTF-8 write showed as a replacement character ([#2638](https://github.com/ThinkFlowLab/FlyBot/issues/2638)).
- A person's own line in a face-to-face room is now capped at 18 000 code points instead of UTF-16 units, so an emoji at the bound is kept whole rather than stored as half a surrogate pair that every later UTF-8 write shows as a replacement character ([#2641](https://github.com/ThinkFlowLab/FlyBot/issues/2641)).
- The `social`, `timeline` and `workflow` plugins now resolve `$DSH_HOME` the way the core does — a blank or whitespace value counts as unset, `~` expands, and the root is always absolute — so `bot/flybot-social.json`, `bot/flybot-timeline` and `bot/flybot-workflow` no longer move with the process's working directory ([#2643](https://github.com/ThinkFlowLab/FlyBot/issues/2643)).
- A copied line no longer loses the front of a word that only starts with a Bot's name: `Development plan is ready`, `Devices are offline`, `Released v0.2.26`, `Reviewers disagree` and `Chief concern about the tip` copy exactly as the preview reads them, while a real `Dev → Reviewer` delegation trace is still removed ([#2645](https://github.com/ThinkFlowLab/FlyBot/issues/2645)).
- A friend's Bot can no longer put its own CSS on your page: the image URL in its published look is checked where it enters and again in the page-wide mention stylesheet, so a value carrying a quote, a parenthesis, a backslash or a control character is dropped and the Bot is drawn with its colour and mask instead of its photo ([#2646](https://github.com/ThinkFlowLab/FlyBot/issues/2646)).
- A Bot's stored GIF avatar now reaches friends as the picture itself instead of a generated shape, and a look Bot Social refuses is no longer recorded as synced: saving the same picture again retries it instead of being silently skipped ([#2649](https://github.com/ThinkFlowLab/FlyBot/issues/2649)).
- The Project board reads every page of its GitHub pull-request and issue lists instead of the first hundred rows, so its seven-day merge and close medians and its day counts now cover the whole window rather than roughly the newest three days ([#2650](https://github.com/ThinkFlowLab/FlyBot/issues/2650)).
- A `define_workflow` call that replaces a saved graph now stores its `stepTimeoutMinutes` instead of returning success while keeping the old value, and refuses a value outside 1..120 the way the create branch does; the `workflow/graph` save applies the same rule, while a save that omits the field still keeps what is stored ([#2654](https://github.com/ThinkFlowLab/FlyBot/issues/2654)).
- The Inbox lists failed workflow runs again: the shell now reads the workflow pack through the plugin's `flybot/workflow/state` endpoint instead of the bare `workflow/state` the host refuses, so a failed run reaches the Needs list and its badge ([#2656](https://github.com/ThinkFlowLab/FlyBot/issues/2656)).
- An issue fast-line run no longer ends `failed` after its pull request was already opened: a Triage step that prints its delivery as its own `OUTPUT pr: 2657 (verified)` — or as `OUTPUT merged: <40-character sha>` — now counts as work done, so the run continues to `gate`/`enqueue`/`attest` and its record keeps the pull request number instead of dying on a missing `state` line ([#2658](https://github.com/ThinkFlowLab/FlyBot/issues/2658)).
- Two `run_workflow` calls that land in the same millisecond now start two runs instead of sharing a generated task id, so the second call is no longer silently dropped and no longer overwrites the first run's brief; a repeated dispatch that passes the same `task` explicitly is still de-duplicated ([#2662](https://github.com/ThinkFlowLab/FlyBot/issues/2662)).
- Adding three or more Bots to one Parallel step in the New workflow dialog no longer gives two of them the same node id, so Create succeeds instead of failing with `Node n2 is listed twice` ([#2663](https://github.com/ThinkFlowLab/FlyBot/issues/2663)).
- A card that has already finished — `accepted`, `cancelled` or `failed` — now refuses a late `handoff` with `A finished task cannot be handed on` instead of reopening itself as `open`, `not-started` and 0% under the next role, so a card that shows 100% can no longer slide back to the start of the board; the refusal is written the way the same card's "waiting on a question" write already is, and the refused write lands nothing at all, with `claimedBy` and the card's terminal state kept. A `result-ready` card still hands on, because that column is allowed to go back to working ([#2667](https://github.com/ThinkFlowLab/FlyBot/issues/2667)).
- A workflow node is now told which `OUTPUT` lines it owes from its own declared outputs **and** from the outputs its outgoing edges read, with the accepted values spelled out (`OUTPUT state: <one of: ready, blocked>`), so a node that declares no outputs no longer runs every step into `Missing OUTPUT state` and fails ([#2669](https://github.com/ThinkFlowLab/FlyBot/issues/2669)).
- A second, read-only DSH window on the same home no longer reaps or disposes the writer's live workflow: loading the plugin and closing that window both leave the run, its step Bots and the stored progress alone, and the writing host's own load-time reap decides ([#2673](https://github.com/ThinkFlowLab/FlyBot/issues/2673)).
- A second, read-only DSH window on the same home no longer onboards a Bot Social home or writes the shared credentials file: it starts the social layer from the credentials the writable window already saved, so friends and messages stay visible, while the window that holds the team is the only one that can create a home or change that file ([#2675](https://github.com/ThinkFlowLab/FlyBot/issues/2675)).
- A workflow step no longer fails because its own answer quotes `could not answer your message` while auditing that sentence: the host marks its real failure notice structurally, and an old host without the marker is read only from the notice shape at the start of the reply ([#2677](https://github.com/ThinkFlowLab/FlyBot/issues/2677)).
- A turn that DSH ended at the model's output limit is no longer reported as a normal finish or as a member that chose silence: the activity feed marks `turn.end` with `limited: true`, the ended-turn view keeps the turn (with `silent` and the streak when it wrote nothing, and its own sentence in the chat instead of "could not run"), and a group member cut off before it answered is recorded as "no answer" instead of a pass ([#2679](https://github.com/ThinkFlowLab/FlyBot/issues/2679)).
- A workflow file written by a newer FlyBot is no longer rewritten by an older one: the workspace store refuses to save over a definition whose `version` is higher than the one it writes and leaves it byte-identical, and lists it as a newer file instead of showing a definition that has lost fields it could not read. The workflow plugin does the same for `workflows.json` — `workflow/state` now answers `store-newer-version` with the version that wrote it, and every write is refused, so the owner's workflows, runs, claims and `seq` can no longer be replaced by the factory fixture ([#2681](https://github.com/ThinkFlowLab/FlyBot/issues/2681)).
- A declared `pr`/`pull` OUTPUT now counts as delivery evidence only when its value is the pull number itself — a positive integer, an optional leading `#`, an optional trailing parenthetical such as `2657 (verified)` — so a step that says it has no pull request is no longer read as one, and a loop's `until` output reaches the step body the same way a `when` condition does, so a looping node is told the line it must print instead of failing for silence ([#2685](https://github.com/ThinkFlowLab/FlyBot/issues/2685)).
- The timeline's OTLP exporter no longer follows a redirect from the collector: a `307` reply that points at another origin is an export failure (warned, not counted as delivered, retried on the next flush) instead of a replay of `otlpHeaders` and the span payload at a host the operator never named. A normal `200` still counts as delivered ([#2687](https://github.com/ThinkFlowLab/FlyBot/issues/2687)).
- An external room participant whose answer line grows past the 4 KB stdout buffer is now reported to the room as `answer exceeded 4096 bytes` and keeps its process for later turns, instead of the answer being dropped as if the process had never spoken ([#2689](https://github.com/ThinkFlowLab/FlyBot/issues/2689)).
- A Bot or group-chat name written in either Unicode canonical form, or carrying an invisible format character such as a zero-width space, is now one identity: the duplicate guard refuses the twin, `@Name` and every lookup reach the same record, and a stored name keeps only the characters that show on screen ([#2691](https://github.com/ThinkFlowLab/FlyBot/issues/2691)).
- A sibling Bot name, a member's role label and a memory topic written in either Unicode canonical form are now one identity each: `create_child_bot` refuses a child whose name only spells the sibling's name the other way, a queued task card reaches the member whose role label is the same role, and one topic is one file — a file written under an older spelling is still the topic's file, so nothing already saved is lost ([#2692](https://github.com/ThinkFlowLab/FlyBot/issues/2692)).
- A friend's Bot or owner display name is now cut on code points at its 60-character bound, so a name whose bound falls inside an emoji keeps the emoji whole instead of being stored as half a surrogate pair that every later UTF-8 write shows as a replacement character; the file names, outbound drafts and error lines the plugin also caps follow the same rule. A name already stored with a lone surrogate keeps that value: this change fixes new values and does not rewrite stored ones ([#2693](https://github.com/ThinkFlowLab/FlyBot/issues/2693)).
- The host now creates its own files private: a Bot's memory and its snapshot, `state.json`, the chat index, the decision log, the OCR cache and `inflight.json` are `0600` in a `0700` folder whatever `umask` the process inherited, and a rewrite keeps the mode the file already has, so a `chmod 0600` the owner made by hand is no longer undone by the next `remember` ([#2697](https://github.com/ThinkFlowLab/FlyBot/issues/2697)).
- A room line no longer tells the other homes in the room about this machine: a picture that could not be read is named by its file name and size instead of its absolute path (a Bot's own chat still names the path for itself), and a crashed external Bot's line reports only how it ended (`exit 1`, `signal SIGKILL`) while the child's last `stderr` words stay in this host's log. Every stored room line also passes this host's secret redaction before it is kept or sent, so a pasted key cannot ride a line to a friend's Bot ([#2699](https://github.com/ThinkFlowLab/FlyBot/issues/2699)).
- A Feishu webhook message whose answer was lost is no longer posted a second time: a timed-out or aborted send gets one attempt and says the message may already be in the chat, instead of claiming Feishu refused it ([#2660](https://github.com/ThinkFlowLab/FlyBot/issues/2660)).

### Security

- A room request naming one room in `id` and another in `roomId` no longer mints, reads or withdraws the other member's link, nor returns another member's live round: on the invite and round-read endpoints the permission gate and the handler resolve the room the same way, and such a request is refused ([#2652](https://github.com/ThinkFlowLab/FlyBot/issues/2652)).

## [0.2.26] - 2026-11-08

### Added

- FlyBot has a community WeChat group; the README now carries its QR code, with a note that the code expires and how to ask for a fresh one ([#775](https://github.com/ThinkFlowLab/FlyBot/issues/775)).

### Changed

- A team can now cap its model turns per team-local day (`prefs.turnBudget`, 200 for a fresh team, `0` turns the budget off). At or over the cap only a turn the user starts themselves is still dispatched; scheduled reports, tidy passes and rounds a Bot starts are refused before a model call, with one line in the host log ([#645](https://github.com/ThinkFlowLab/FlyBot/issues/645)).

### Fixed

- Face-to-face room names, role labels, platform lines and surface Bot Social's own failure text now cap on character boundaries instead of UTF-16 units, so an emoji at the cut is no longer split into a half character and shown as a replacement character ([#2438](https://github.com/ThinkFlowLab/FlyBot/issues/2438)).
- The timeline's on-demand OTLP export no longer fails as a whole when the trace holds an old or hand-edited record without a usable time: a turn or tool call whose timestamps cannot be read is skipped, and the complete spans in the same trace are still exported ([#2442](https://github.com/ThinkFlowLab/FlyBot/issues/2442)).
- Workflow failure text, task cues, co-seat room shares, workflow avatars and role lines, and timeline labels now cut on character boundaries instead of UTF-16 units, so an emoji is never split into a half character and rendered as a replacement character ([#2581](https://github.com/ThinkFlowLab/FlyBot/issues/2581)).
- A workflow step that ends without the `OUTPUT state:` line its gate reads no longer kills the run when it has already done the work: a Triage node that opened a pull request or claimed the issue keeps its `done` status, the run continues, and `run.outputMissing` / `run.producedPull` record the slip and the pull request ([#2583](https://github.com/ThinkFlowLab/FlyBot/issues/2583)).
- The Diagnostics report and its downloaded log survive a corrupt line in `logs/diagnostics.jsonl`: a line with no level or source, or a timestamp JSON parses as `Infinity`, is shown with that part defaulted instead of throwing the whole report away ([#2591](https://github.com/ThinkFlowLab/FlyBot/issues/2591)).
- The meeting list — and every write that echoes a record back — keeps a stored meeting whose `level` is not one of ordinary, major or severe instead of throwing the whole list away; a write still refuses an unknown level ([#2592](https://github.com/ThinkFlowLab/FlyBot/issues/2592)).
- A task update refused for an invalid priority, progress or column no longer leaves the card partly changed: `task-update` reads and validates the whole request before it writes, so a refused call leaves every task record exactly as it was ([#2596](https://github.com/ThinkFlowLab/FlyBot/issues/2596)).
- A `track_tasks` batch that is refused no longer leaves the cards it had already created on the board: the whole list is validated on a staged copy of the board and only committed once every item passed, so a refused batch leaves `state.tasks` exactly as it was and posts no claim line for a card that never landed ([#2597](https://github.com/ThinkFlowLab/FlyBot/issues/2597)).
- A workflow save that the store refused no longer leaves a half-created workflow in memory: the refusal is returned and the graph, its creation line and the sequence number are dropped, so the next successful save cannot persist a workflow the caller was told was not created; a refused rename keeps the name it could not save ([#2598](https://github.com/ThinkFlowLab/FlyBot/issues/2598)).
- A workflow store that cannot be read is no longer answered as a clean list: `workflow/state` now reports `store-unreadable` with the file and the reason instead of the factory fixture, so the Workflows page says the store is unreadable instead of showing workflows that are not yours, and the first save keeps the unreadable bytes in `workflows.json.broken-<stamp>` before it writes a fresh store ([#2603](https://github.com/ThinkFlowLab/FlyBot/issues/2603)).
- The Diagnostics report and its downloaded log now say when `logs/diagnostics.jsonl` could not be read at start-up, instead of reporting `No host errors recorded.` for a log that exists and holds errors: the report names the reason (`not read (EACCES)`), says that the errors the log holds are not shown, and the entry list and the download carry that reason rather than an empty answer, while the errors this host recorded since start-up stay listed ([#2604](https://github.com/ThinkFlowLab/FlyBot/issues/2604)).
- Deleting a Bot now ends its seat in every group chat in the same save: the group's member list and a shared room's guest roster stop naming it, and the next membership change can no longer write the deleted id back into the room, also after a reload ([#2607](https://github.com/ThinkFlowLab/FlyBot/issues/2607)).
- Opening, previewing or reading the bytes of a workflow whose id is not a plain file name no longer reaches a JSON file outside the workspace's `workflows/` folder: the read path now accepts only the same ids the save path always did, so an id such as `../outside/stolen` — or a stored default naming one — answers `workflow/not-found` instead of returning that file's definition ([#2609](https://github.com/ThinkFlowLab/FlyBot/issues/2609)).
- A group shared with a friend's Bot now shows the room's recent messages right after the share, and every message that arrives afterwards, instead of an empty room that stayed empty until the host's message count reached the number the share carried: the guest numbers its mirrored copy of the room locally, so it no longer takes the host's line counter as the point where its own history starts, and a malformed counter in a share can no longer be stored or blank the room ([#2612](https://github.com/ThinkFlowLab/FlyBot/issues/2612)).
- A workspace's `workflows/` folder that is there but cannot be listed no longer answers "no workflows": the host now says `workflow/unreadable` and names the folder, a save that landed still reports `wrote: true`, and opening a workflow by name keeps working ([#2614](https://github.com/ThinkFlowLab/FlyBot/issues/2614)).
- Removing the DSH Agent no longer drops a Session added while its earlier Sessions are still being archived: the removal applies its own archives to the live record, keeps any Session that arrived meanwhile, and asks you to remove the Agent again instead of leaving that Session orphaned ([#2616](https://github.com/ThinkFlowLab/FlyBot/issues/2616)).
- The Project digest header now names the same Asia/Shanghai calendar day the digest is filed under, so a digest built between 00:00 and 08:00 no longer prints yesterday's date — including one held by quiet hours and replayed later ([#2618](https://github.com/ThinkFlowLab/FlyBot/issues/2618)).
- The timeline panel's **Copy report** now prints the window's hours in your own time zone, the same hours the header above the button shows, instead of the Bot host's: the panel sends its browser zone with the request and the host formats the report in it, including the `(+1 day)` suffix on a window that crosses your midnight. A zone the host cannot use falls back to its own clock, as before ([#2619](https://github.com/ThinkFlowLab/FlyBot/issues/2619)).
- Renaming a Bot now moves the DSH Session title before the stored record, so a refused title write leaves the Bot, its group chats and `state.json` under the old name instead of showing the new one until a restart silently reverts it ([#2622](https://github.com/ThinkFlowLab/FlyBot/issues/2622)).
- Deleting a Workflow whose store write is refused now puts the workflow and its lane, run, log, route, claim and brief records back before the refusal reaches the page, so the list and `workflows.json` cannot disagree and the delete can be retried instead of answering `No such workflow` until a restart ([#2623](https://github.com/ThinkFlowLab/FlyBot/issues/2623)).

## [0.2.25] - 2026-11-07

### Added

- The instance now answers `GET /api/health` without a session: a JSON object holding exactly `ok`, `version`, `commit` and `startedAt`, so a person or a monitor can ask which build is running instead of counting startup banners. It is served ahead of the sign-in wall as an exact route, keeps the wall's Host/Origin fence (loopback or a trusted authority only), answers `GET` only, and reports `commit: null` when the install has no git checkout of its own ([#2128](https://github.com/ThinkFlowLab/FlyBot/issues/2128)).
- Settings → Plugins can turn the Bot Social, Tree, Timeline and Workflow plugins off and back on ([#2564](https://github.com/ThinkFlowLab/FlyBot/issues/2564)). The switch is kept in FlyBot's own `state.json` and applies at the next start: a plugin that is off registers no tools, panels or endpoints, and the packages stay installed so nothing has to be reinstalled.
- A keyless browser suite now runs in CI: the scripted mock drives the same bench and web adapter as the real-model suite, so the web UI's message-and-reply path is measured on every pull request that touches `core/` or `plugins/` instead of only existing as a nightly that skips without a secret. The job reads no secret, its step summary names each check it ran, and the real-model `live` job is unchanged. ([#2565](https://github.com/ThinkFlowLab/FlyBot/issues/2565))

### Fixed

- A long message the context steward reads now spends its 1,500-character budget in characters at both ends: the start keeps 1,000 characters and the end keeps 500, so a message dense in emoji shows the whole budget instead of only its first 1,000 characters, and the marker reports the 100 characters really left out instead of counting the surplus UTF-16 units a second time. ([#2552](https://github.com/ThinkFlowLab/FlyBot/issues/2552))
- The memory review's two-ended cut of the user's own line now spends its 3,000-character budget in characters at both ends: a line of 3,500 emoji keeps 3,000 characters (2,000 head, 1,000 tail) instead of 1,503, so the review no longer drops half of a long message written with characters outside the BMP. ([#2553](https://github.com/ThinkFlowLab/FlyBot/issues/2553))
- A memory review line that carried an unpaired surrogate now reaches the prompt as one whole character instead of half a pair: both of the review's render paths flatten the text first ([#2556](https://github.com/ThinkFlowLab/FlyBot/issues/2556)).
- The memory review now leaves out only the one entry it cannot keep and lands the rest of the answer: an over-long entry beside a valid remove or edit used to discard the whole answer and read the same lines again next turn, without a bound on the repeats. The review warns once about what it left out, applies the changes it can, and moves its cursor past those lines. ([#2558](https://github.com/ThinkFlowLab/FlyBot/issues/2558))
- The memory review no longer asks the model over and over for the same lines it cannot change. Two failures at one cursor stop the retries with a single warning instead of one per turn, and the review resumes once a review succeeds or the user writes again, so a Session whose review keeps failing stops rereading the same messages forever. ([#2561](https://github.com/ThinkFlowLab/FlyBot/issues/2561))

## [0.2.24] - 2026-11-06

### Added

- The diagnostics report now lists the backups the store leaves beside the team file — `state.json.v1` and the `state.json.broken-<stamp>` copies — with their size and age, newest three broken copies plus a count of the rest, or `state backups: none`; a backup this host cannot read is named with its reason, and no backup is ever opened ([#2434](https://github.com/ThinkFlowLab/FlyBot/issues/2434)).
- A workflow assignment resolves its brief from the task card, so re-dispatching the same card to another lane keeps the same facts and records one handoff line.
- The Settings header, the details drawer, the Inbox and the Memory panel now draw a **Reload** beside the host's read-only sentence, so a window that was told to reload can do it where it stands instead of closing the panel and reaching for the sidebar ([#2502](https://github.com/ThinkFlowLab/FlyBot/issues/2502)).
- A scheduled task can be run once from its own row even when its last run went fine: **Run now** joins **Retry**, a run in flight or a paused task offers neither, and running a task now leaves its next DSH run where it was ([#2507](https://github.com/ThinkFlowLab/FlyBot/issues/2507)).

### Fixed

- An open face-to-face room a home is a member of no longer disappears from that home's sidebar row list: a stored `hidden` flag is cleared by the room's open snapshot, and the sidebar's past-room and hidden-row filters never drop an open face room.
- A workflow card re-matched into another workflow now leaves one `Task re-matched · <task> → <destination>` line on the source graph's own log, so the graph that lost the card says where it went instead of the card silently vanishing ([#1668](https://github.com/ThinkFlowLab/FlyBot/issues/1668)).
- A read-only window's Settings → **Projects** page now draws no write the host would refuse: no name field, no **New Project**, no **Bind to {name}** choice on a Project row and no **Unbind** on a Project or on a binding, because `project-create` and `project-bind` are writes a reading window is refused. **Open board**, the Project rows with their names, working folders and members stay readable, and a writable window draws exactly the tree it drew before. ([#2305](https://github.com/ThinkFlowLab/FlyBot/issues/2305))
- A read-only window's Project board now draws no settings write the host would refuse: opening **Project settings** shows the host's own read-only sentence and **Back to board** instead of **Bind**, **Unbind**, the digest **Save** and **Save memory**, because `project-bind`, `project-assistant-owner` and `project-memory-write` are writes a reading window is refused. The board, its rows, the **Members** panel and the record stay readable, and a writable window draws the panel exactly as before. ([#2306](https://github.com/ThinkFlowLab/FlyBot/issues/2306))
- In a read-only window the New-Bot form now draws the host's own read-only sentence where **Create** was, instead of a form whose only answer from the host was `bot/read-only`; a writable window is unchanged ([#2307](https://github.com/ThinkFlowLab/FlyBot/issues/2307)).
- A held message now says why it is waiting: the host's reason is drawn under the sender line on the session dock's approval card and on a held reply's own bubble in a chat, instead of living only in a hover title on the card and nowhere at all on the bubble. The visible line stops at 200 code points with an ellipsis and the whole sentence stays in the title, so a long reason is readable without hiding its end, and a reason that is empty or only whitespace draws no line at all ([#2422](https://github.com/ThinkFlowLab/FlyBot/issues/2422)).
- The diagnostics report's state line no longer promises a read it could not make: a `state.json` that is a link to a plain file this host cannot read now keeps the same sentence as a link to a folder (`not a plain file (nothing is read or written)`), instead of saying the store reads the team file through the link directly above a `Read-only` row that reports that read failing with `EACCES`. The target's read permission is asked with `access()`, which opens nothing and reads no byte ([#2428](https://github.com/ThinkFlowLab/FlyBot/issues/2428)).
- The tree model now treats a Bot retired with `archive_bot` as out of the tree everywhere: it no longer occupies its parent's `maxChildren` slot, and its children move up to its own parent instead of being stranded under a Bot that cannot be messaged ([#2430](https://github.com/ThinkFlowLab/FlyBot/issues/2430)).
- A workflow's read-only run flowchart now names each wire for a reader and gives every route a 10px hit target of its own: pointing at one wire marks it and dims the rest, and the plane still writes nothing ([#2431](https://github.com/ThinkFlowLab/FlyBot/issues/2431)).
- A Bot's Sharing card in a read-only window keeps **People with access** (who has this Bot, and its Auto-send state) and drops only its writes — no Revoke, no invite, no Share with a friend ([#2446](https://github.com/ThinkFlowLab/FlyBot/issues/2446)).
- Fixed a room-share envelope being dropped when a chat line's own text carried one unbalanced brace, which lost the sent line and the join history copied into a `join` envelope ([#2447](https://github.com/ThinkFlowLab/FlyBot/issues/2447)).
- A Bot retired with `archive_bot` now appears in the sidebar's Archived section at once, instead of up to one 10 s roster poll later ([#2450](https://github.com/ThinkFlowLab/FlyBot/issues/2450)).
- A Workflow run frozen by a **Stop** whose Bot could not be released no longer holds its lane slot forever: the step deadline it was already counting now retries the release and ends the run as `paused-expired`, freeing the slot, and re-arms itself while the Bot still will not go. Before this, the deadline was consumed by the paused run and nothing ran again, so the workflow stayed at its `maxConcurrent` limit until the owner pressed Stop a second time ([#2428](https://github.com/ThinkFlowLab/FlyBot/issues/2452)).
- `project_state` no longer reports a Project State file it cannot read as if the folder held none: a `PROJECT.md` that is a folder, or a file the process may not read, now answers `unreadable: PROJECT.md (<reason>)` beside the rows that could be read instead of the listing answering `no Project State files in this folder`, which said there was nothing to read while something was ([#2461](https://github.com/ThinkFlowLab/FlyBot/issues/2461)).
- A read-only window no longer draws the write controls on the seven Settings pages that still had them: **General** (theme, accent and the notification switches), **Bots** (both Main Bot choices and the animation picker), a Bot's own settings, a group chat's settings, **Connectors**, **Capabilities** and **Secrets**. Each page now states its facts as plain text — the theme and accent in use, who holds the Main Bot role, the animation setting, a Bot's role, model, folder and instructions, a group's members and notice, each connector's state, each capability and each stored key with who may use it — because the host refuses every one of those writes with `bot/read-only`. **New Bot** stays as an entry, since the form behind it already explains the lock, and a writable window is unchanged. ([#2474](https://github.com/ThinkFlowLab/FlyBot/issues/2474))
- A workflow assignment's brief is now the caller's to clear. An explicit `brief` replaces the facts cached on the lane, and `brief: ''` clears them instead of falling back to the old text; deleting a workflow drops the facts it cached, so a later assignment carries nothing from it and records no handoff naming a lane that no longer exists ([#2475](https://github.com/ThinkFlowLab/FlyBot/issues/2475)).
- A workflow card handed to a Bot now leaves the same `Task re-matched · <task> → <destination>` line on the source graph's own log that a hand-over to another workflow already wrote, and a hand-over into a workflow that is already running the card writes it too — the graph that lost the card says where it went instead of the card silently vanishing ([#2480](https://github.com/ThinkFlowLab/FlyBot/issues/2480)).
- A face-to-face room's **Hide from sidebar** switch now holds: the hide a person chose survives the poll that re-reads the room every few seconds (and turning it back off survives too), while a `hidden` an older state left behind is still cleared by the room's open snapshot, as #1605 asked ([#2482](https://github.com/ThinkFlowLab/FlyBot/issues/2482)).
- A workflow card a lane is holding can now be handed straight to a Bot from the panel, and the lane that lost it writes the same `Task re-matched · <task> → <destination>` line a hand-over to another lane already wrote — the source graph no longer drops the card silently when the destination is a Bot ([#2485](https://github.com/ThinkFlowLab/FlyBot/issues/2485)).
- A workflow card whose facts were cleared no longer brings them back when it is re-matched into another lane: the re-match path now passes the card's current brief — its text when it holds facts, an explicit empty one when it does not — so the lane cache can no longer resurrect instructions the author removed ([#2486](https://github.com/ThinkFlowLab/FlyBot/issues/2486)).
- In a window that holds the team read-only, Settings → Projects no longer tells the reader to create a Project: with no Project the empty state reads `No Project yet.` instead of `No Project yet — create one.`, which pointed at the **New Project** section the same page had already hidden ([#2489](https://github.com/ThinkFlowLab/FlyBot/issues/2489)). A writable window and the Project board's own empty state keep the shared sentence.
- In a read-only window a face-to-face group's Settings page names each person's Bots under them, and states who answers and the room's working folder, instead of drawing every person as **Human** while its own header counted the Bots.
- Handing a card to a Workflow from the panel now carries the card's own facts into the run instead of dropping them: the assign body sends the card's `brief` verbatim, and an explicit empty one when the card holds none, so a brief cached by an earlier call cannot come back ([#2495](https://github.com/ThinkFlowLab/FlyBot/issues/2495)).
- In a read-only window neither group-creation form now draws a **Create** control the host would refuse: **Settings → Group chats** and the `New…` menu's **New group chat** keep their pickers as a preview and show the host's own read-only sentence where **Create group chat** was, so no press reaches the host for an answer that could only be `bot/read-only`; a writable window draws both forms exactly as before ([#2496](https://github.com/ThinkFlowLab/FlyBot/issues/2496)).
- In a read-only window the new-chat composer no longer writes: pressing **Send** or Enter sends nothing, several picks create no room, and a picker row pressed with a line typed opens the session without sending that line; the host's own read-only sentence stands where the **Send** button was. A writable window is unchanged ([#2499](https://github.com/ThinkFlowLab/FlyBot/issues/2499)).
- In a read-only window a new group chat that already picked its admin no longer draws a **Send** arrow that does nothing: the composer draws no send control at all, and the host's own read-only sentence stays once, on the To: line where **Create group chat** would be. A writable window is unchanged ([#2503](https://github.com/ThinkFlowLab/FlyBot/issues/2503)).
- A read-only window's New… menu no longer offers **Add coding agent**: `addAgent` is a write the host answers `bot/read-only`, so the row is not drawn at all while the other rows stay as a preview, and a writable window keeps the row ([#2506](https://github.com/ThinkFlowLab/FlyBot/issues/2506)).
- A read-only window's face-to-face room lead card no longer offers **Change**: `social/face-lead` is a write the host answers `bot/read-only`, so the card draws the lead's name and its own sentence only — no picker, no **Use the default lead**, and not the "Only the person who created this room can change it." hint — while a writable window keeps all of them.
- A failed workflow run's Open in the Inbox now lands on Settings → Workflows: the row asked for a page named `workflow`, which is not a Settings key, so the dialog quietly fell back to General. The test renders the Settings dialog and reads the page it shows instead of trusting the name the call carried.
- In a read-only window the Board, the New chat pane and the Project settings panel now draw the host's sentence with a **Reload** beside it: each is a full-screen overlay that covers the sidebar's own entry, so the reader had to close it to answer the sentence at all. The entry runs the client's own team read (never a page reload), one per overlay, and a writable window is unchanged.
- In a read-only window, **Settings → Workflows** no longer prints the host's read-only sentence twice: with a workflow graph open, the graph's edit bar drew a second copy of the sentence the Settings header already carries, under its own `role="status"`, so the same words sat on one screen twice and a screen reader announced them twice. The edit bar now shows **Back** only, the header's **Reload** stays the way out, and a writable window keeps **Edit** exactly as it was ([#2524](https://github.com/ThinkFlowLab/FlyBot/issues/2524)).
- A read-only window's plain-group Settings page states who answers and the group's working folder as text, the way a face-to-face room's page already did ([#2528](https://github.com/ThinkFlowLab/FlyBot/issues/2528)).
- A workflow task that failed and was then run again to a green finish no longer keeps its **Failed** card in the Inbox, or its place in the sidebar's *Needs you* count, for the whole seven-day window: the success retires the card ([#2534](https://github.com/ThinkFlowLab/FlyBot/issues/2534)).
- A workflow's tool calls are exported one span each even when two turns number a call the same way: the OTLP export pairs a call with its own turn, so no tool span goes missing and none hangs under another turn.
- Closing the Workflow graphs page that an Inbox card opened now brings the Inbox back, instead of leaving you in the chat under it; a Settings page opened anywhere else still closes to the view beneath it ([#2541](https://github.com/ThinkFlowLab/FlyBot/issues/2541)).
- A Bot that was busy across the whole window is no longer left out of the team report as if it had done nothing: a turn that began before the window now reports the share of the window it worked, instead of reading as a Bot with no turns.
- The long-message view the context steward reads is now measured and cut in characters, not UTF-16 units: an emoji or any other character outside the BMP at either cut stays whole instead of reaching the model as half of a surrogate pair, and a message that fits in 1,500 characters is no longer shortened with a marker claiming characters were left out ([#2546](https://github.com/ThinkFlowLab/FlyBot/issues/2546)).
- A save over a team file that is a link no longer writes through it: the name becomes a regular file of this home's own, the file the link pointed at keeps every byte and its last write time, and the window says so once (`Saved as a separate file; the file the link pointed at was not changed.`) — the count carries the host process's generation, so a restart cannot swallow the first notice, and a signed-in deployment receives it too.
- A Workflow run frozen by a **Stop** whose Bot could not be released keeps the step deadline that retries it when the graph is saved, so an unchanged save from Settings → Workflow graphs no longer takes away the only path out of the lane: the deadline releases again, ends the run as `paused-expired` and starts the task queued behind it. Before this, the save cleared that timer and the run held its `maxConcurrent` slot with nothing left to free it until the owner pressed Stop again ([#2459](https://github.com/ThinkFlowLab/FlyBot/issues/2459)).
- A run frozen by a Stop that could not release its Bot is now named **Paused** wherever it is read: the stage strip says `Paused` instead of the `Pause` action's name, and the Runs tab keeps the run's `paused` flag instead of drawing the frozen run as `Running` while it hands nothing on.
- A workflow node prompt, the task brief handed to a run, and the reply a step hands on now stop on their character bound without splitting the character there: the cut counts code points like a task title already did, so a prompt or reply that ends in an emoji or another character outside the BMP no longer carries half of it as a replacement character.

## [0.2.23] - 2026-11-05

### Added

- A scheduled task's row now says which connectors its unattended run will carry, in the words of the Bot's own switches at the moment it fires: turning Composio on for that Bot changes what a task written weeks ago uses, and the row names it instead of the owner learning after the fact ([#2323](https://github.com/ThinkFlowLab/FlyBot/issues/2323)).

### Changed

- Settings → Feedback's **Clear** now says what it actually did: the same sentence when the log is gone, one that names the leftover `logs/diagnostics.jsonl.1` when the rotated copy could not be removed, and one that does not claim a cleared log when the file is a link or a shared name ([#2360](https://github.com/ThinkFlowLab/FlyBot/issues/2360)).

### Fixed

- Settings → Feedback no longer offers **Clear** in a read-only window: Clear truncates the shared `logs/diagnostics.jsonl` on the host, so a window that only reads now leaves that file alone and keeps **Download**, **Show**, **Copy** and **Report on GitHub**. The host refuses `diagnostics-clear` from a reading window with `bot/read-only` instead of erasing the log a bug report is supposed to carry ([#2302](https://github.com/ThinkFlowLab/FlyBot/issues/2302)).
- A window that holds the team read-only no longer draws **Retry**, **Reject** or **Approve** on an approval card or on a held reply's bubble in a chat: none of them can succeed there, because the host refuses the decision, so each card keeps the message, who it is for, and says why in the host's own sentence ([#2310](https://github.com/ThinkFlowLab/FlyBot/issues/2310)). A plugin's own approval card is told the window is read-only too, so it can hide its buttons the same way.
- A refused action away from any form now names the host's own error code in its toast, so a second-holder refusal reads `bot/read-only` instead of leaving the reader to guess what failed. When the code is `bot/read-only` the toast also carries **Reload** in place: it asks for the client's full-state read, so the window becomes writable once the other holder let go, without a page reload that would drop what is in the composer. Every other failure keeps the sentence and **Details** it had. ([#2312](https://github.com/ThinkFlowLab/FlyBot/issues/2312))
- `gate-ruleset` now finds `main`'s ruleset by the ref it governs instead of by its display name, so the live `main merge queue` reads as gated rather than as "main is unprotected": `--check` names the live id and reports drift in both directions (a context the file wants and the ruleset lacks, and a context the ruleset requires and the file does not carry), `--apply` updates that ruleset instead of creating a second one and refuses a body that would drop a live-required context or the `merge_queue` rule before it sends the request, and `--rollback` deletes the same rows it matched. `policy-sign` also names the comments that can sign the tip when it refuses for a missing or stale signature ([#2314](https://github.com/ThinkFlowLab/FlyBot/issues/2314)).
- An image in a chat bubble shows its picture again instead of only the alt text: the bubble's Markdown is no longer wrapped in a delegate of its own, so the host's image resolver and file opener reach it again and a local `[x](path#L12)` link keeps its chip. A link is still taken by FlyBot's own browser panel, now from a capture-phase click on the bubble or on the person's own line, while a mention, a file link and a modified or middle click are left to the host (#2319).
- The host judged a text bound in UTF-16 units while it cut in code points, so a character outside the BMP spent two of a limit's budget: a 300-character message was cut by a 400-character limit and came back short through `read_own_chat` and search rows. Bounds now judge with `fits()` in `core/src/shared/text-boundary.js`, `clip` and `excerpt` use it, and the third copy of `clip` in the memory review is the shared one ([#2321](https://github.com/ThinkFlowLab/FlyBot/issues/2321)).
- the changelog's version headings link to their release comparisons again, and `[Unreleased]` compares from the newest release.
- The memory-review user line and the room/board one-line fields still judged their limit in UTF-16 units while they cut in code points, so a line of characters outside the BMP was cut while it was already under its own limit: a 1,497-character user line reached the review as 1,497 emoji under a 3,000-character bound and lost about 1,400 of them, and a 40-character holder name or an 80-character card title came back at 19 and 39. Both bounds now judge with `fits()` in `core/src/shared/text-boundary.js`, with the maxima and the cuts unchanged ([#2339](https://github.com/ThinkFlowLab/FlyBot/issues/2339)).
- Settings → Feedback's **Clear** now removes the rotated `logs/diagnostics.jsonl.1` too: past 1 MB the log moves aside, and the truncate alone left every rotated line on disk after the page said the error log was cleared. The removal runs in the same write chain and behind the same leaf guard as the truncate, so a log that is a link is still left untouched ([#2345](https://github.com/ThinkFlowLab/FlyBot/issues/2345)).
- `read_browser` no longer splits a long page between the two halves of a character: a part used to end on a UTF-16 unit, so a cut that landed inside an emoji handed the model two parts that each carried U+FFFD and printed a continuation point inside the character as well. The hard cut and the plain-text part now end on a code-point boundary and a `from` that lands inside a pair moves back to that character's first half, so the two reads join back into the original page and no character is dropped between them ([#2349](https://github.com/ThinkFlowLab/FlyBot/issues/2349)).
- A window that opens the host state read-only no longer creates or rewrites the state journal: opening the writer is itself a write, so it now happens on the first save that got past the write lock instead of at host start, while `rt.journal.status()` and the diagnostics line answer as before on a host that may write ([#2351](https://github.com/ThinkFlowLab/FlyBot/issues/2351)).
- A schedule row no longer names a connector whose connection failed, or one still connecting, as carried by its unattended run: the host unmounts a failed connection before it writes `error` and a `connecting` one has no tools yet, so only a `ready` connector appears in the row's `Runs with …` sentence, while the Connectors page keeps the switch that reconnects it ([#2354](https://github.com/ThinkFlowLab/FlyBot/issues/2354)).
- Settings → Feedback's **Clear** now truncates the log even when the rotated copy cannot be removed: that removal reports itself in one line on stderr instead of stopping the truncate, so "Cleared the error log." matches the file on disk again ([#2358](https://github.com/ThinkFlowLab/FlyBot/issues/2358)).
- Settings → Feedback's **Clear** now says so when the log file cannot be truncated (a read-only `logs/diagnostics.jsonl`, e.g. after one `sudo` run): it prints one `[ds-bot] diagnostics log not truncated: <code>` line on stderr instead of leaving the window reading as cleared while every line stays on disk. A Clear that does not empty the leaf has no side effect at all: the truncate runs before the rotated copy is removed, so `logs/diagnostics.jsonl.1` keeps the only copy left of those lines, and the recent errors and the Download still list what is still on disk instead of reading "0 recent errors" next to "not cleared" ([#2364](https://github.com/ThinkFlowLab/FlyBot/issues/2364)).
- The diagnostics report no longer says the state journal is `recording` before this host has saved the team: a journal whose writer has not opened yet now reads `state journal: not started (opens with the first save)`, so a window that never saves stops promising lines it never asked the file for ([#2373](https://github.com/ThinkFlowLab/FlyBot/issues/2373)).
- Settings → Feedback's **Clear** no longer writes `[ds-bot] diagnostics log not truncated: ENOENT` when there is no log file on disk yet: a home whose `logs/` folder does not exist has nothing to empty, so the Clear stays silent on stderr and the window's `Cleared the error log.` is what happened. A leaf that is there and refuses the truncate (`0444`, `EACCES`) still names the code on exactly one line, and the answer for it is still `leaf: 'kept'` ([#2379](https://github.com/ThinkFlowLab/FlyBot/issues/2379)).
- A window that holds the team read-only no longer draws **Approve** or **Reject** on a shared room's "Waiting for your approval" card in the details drawer: a decision is a write, so the host refuses it there and the two buttons could only produce a refusal after the click. The card keeps its headline, its count and each request's own text, and says why in the host's own sentence. A decision the host still refuses — in a writable window, or in a room with several members — now writes that reason on the card in one alert line instead of disappearing ([#2381](https://github.com/ThinkFlowLab/FlyBot/issues/2381)).
- The diagnostics report behind Settings → Feedback's **Report on GitHub** now says whether FlyBot's own error log is being written: `diagnostics log: recording` while appends land, `not written (EACCES)` (or the code the disk gave) after an append it refused, and `not written (not a plain file of its own)` when `logs/diagnostics.jsonl` is a link or another file's second name. A support bundle therefore no longer lists recent errors whose file is missing or short without saying why; a host with the log turned off adds no line ([#2383](https://github.com/ThinkFlowLab/FlyBot/issues/2383)).
- A write the host refuses in the details drawer's own Settings view now says so above the page instead of at the top of the scrolling box: pressing **Pin**, **Hide**, **Make admin** or **Remove** at the bottom of a group's page wrote `bot/read-only` above the viewport, where the card and its switches never changed and the press looked ignored ([#2385](https://github.com/ThinkFlowLab/FlyBot/issues/2385)). The refusal line is drawn as a sibling above the scrolling body, the shape the Settings dialog has used since #2194, and a write that succeeds draws no line.
- A read-only window's group settings in the details drawer now say so instead of drawing the live form: the drawer's read-only branch was written for a Bot only, so a group kept its name, notice, who-answers, folder, member, **Pin**, **Hide** and **Delete group** controls while every write it offered could only be refused with `bot/read-only` ([#2387](https://github.com/ThinkFlowLab/FlyBot/issues/2387)). The branch now reads the window lock rather than the Bot, so a group gets the host's own sentence in a `role="status"` line in place of `GroupSettingsForm` and a writable window keeps today's form unchanged.
- The diagnostics report behind Settings → Feedback's **Report on GitHub** now names the file the state journal records into, beside `state journal:`: `journal file: ~/.dsh/.../state.jsonl (<size> bytes, last written <ISO UTC>)` for a plain file of the host's own, `journal file: none yet` before the first save creates it, and `journal file: not a plain file (nothing is read or written)` when the path is a link or a file with a second name. The line is built from `lstat` alone — the file is never opened or read — so a report can say how large the journal is and when it was written without needing permission to read it, and a host whose journal is off adds no line ([#2388](https://github.com/ThinkFlowLab/FlyBot/issues/2388)).
- The details drawer's overview view in a read-only window now says so instead of drawing write entries the host would refuse: a Bot's name is plain text rather than a rename control, and its model, permission and working-folder entries are gone, with the host's own sentence in a `role="status"` line at the top of the page ([#2391](https://github.com/ThinkFlowLab/FlyBot/issues/2391)). A write refused there — a rename, say — is reported in an `bt-error` line above the scrolling body instead of inside it, the shape #2194 and #2385 already gave the Settings views, so the answer to a press is where the press happened. A group's overview is unchanged.
- The diagnostics report behind Settings → Feedback's **Report on GitHub** now names the team file itself, right after the table that counts the team: `state file: ~/.dsh/state.json (<size> bytes, last written <ISO UTC>)` for a plain file, `state file: none yet (this computer has not saved the team)` before this computer has one, and `state file: not a plain file (nothing is read or written)` when the path is a directory, a link or a file with a second name. The line is built from `lstat` alone — `state.json` holds the members, the messages and the saved keys, so the report may describe the file and never opens or reads it — and a read-only window draws the same line ([#2394](https://github.com/ThinkFlowLab/FlyBot/issues/2394)).
- A Bot's memory row — in its details pane and in its settings — now says why a memory read failed instead of sitting on `Loading…`: `useMemoryCount` keeps the refusal and `memoryCountText` draws it as a sentence, while an empty memory still reads as empty and a count that arrived is still a count ([#2395](https://github.com/ThinkFlowLab/FlyBot/issues/2395)).
- A read-only window's group overview in the details drawer now draws no write control: the group's name is plain text rather than a rename button, an invited share no longer offers **Remove my Bot**, and a shared room's "Waiting for your approval" card keeps its headline and rows but drops **Approve** and **Reject**, with the host's own sentence in the single `role="status"` line at the top of the page ([#2400](https://github.com/ThinkFlowLab/FlyBot/issues/2400)). A writable window keeps every control unchanged.
- A memory row's refused read is now announced, not just drawn: the sentence moves out of the `Manage` button — whose `aria-label` replaced the text inside it — into a `role="status"` note under the row, while the button label, the wording and the empty/count states stay as they were ([#2402](https://github.com/ThinkFlowLab/FlyBot/issues/2402)).
- The diagnostics report behind Settings → Feedback's **Report on GitHub** no longer describes a linked `state.json` as `not a plain file (nothing is read or written)`. The store reads the team file through that link and its next save replaces the name, so the `state file:` row now says `not a plain file (described only; the store reads the team file through the link and the next save replaces the name)` instead of contradicting the `Read-only` row right below it, which can only say the file could not be read because the read happened. A directory or a check that cannot run keeps the earlier sentence, and `journal file:`, `state journal:`, `diagnostics log:` and the `Read-only` row are unchanged ([#2404](https://github.com/ThinkFlowLab/FlyBot/issues/2404)).
- An approval card now says how long its request has waited. The dock card and the held reply's bubble read `Waiting for approval · 12 min`, and a shared room's overview rows carry the same age beside the request's text; the four existing strings in `text.js` `relativeShort()` do the wording, so a wait under a minute reads `just now` and one that crossed midnight falls back to a date. A card whose record carries no `createdAt` draws nothing extra ([#2409](https://github.com/ThinkFlowLab/FlyBot/issues/2409)).
- A refusal the host sends with no message of its own no longer reaches the screen as a blank error: the client's `api/bot` wrapper answers it with `Request failed`, so a surface that prints the failure says what went wrong instead of drawing nothing — and a Bot's memory row settles on that sentence instead of sitting on `Loading…` ([#2411](https://github.com/ThinkFlowLab/FlyBot/issues/2411)).
- The diagnostics report no longer says a linked team file is read through the link when the link points at a folder: `readFile` fails on a folder (`EISDIR`), so the store lands in `stuck` and no save ever replaces the name. `state file:` now keeps `not a plain file (nothing is read or written)` for a link to a folder or to nothing, and keeps the read-through-the-link sentence only when the link resolves to a plain file. The target is asked with `stat` for its metadata only — the bytes behind the link are never opened.
- A read-only window no longer draws the write controls on a local Bot's Sharing card or on a local group's Members card: making an invite link, sharing a Bot with a friend, People with access, Create link and Withdraw are all writes that the host refuses there, so each card says why the window cannot write instead of offering a button that can only fail ([#2418](https://github.com/ThinkFlowLab/FlyBot/issues/2418)).
- The timeline panel's "Who waits on whom" table no longer prints `0 ms` under **Total wait** for a handoff nobody has answered yet: an edge with no answer has no median, slowest or total wait, and all three now read `–` instead of a zero beside `Not yet 1`.

## [0.2.22] - 2026-11-04

### Added

- Hand a task to a Workflow now names each lane's Project on its target row, so two Workflows that share a name but belong to different Projects are told apart before a card is handed over; a lane with no Project draws no badge (#2241).

### Changed

- The gate signature now covers the queue gates it enforces: a pull request that changes `.github/scripts/enqueue-guard.mjs` or `.github/scripts/enqueue-rules.mjs` must carry a `Policy-sign:` line naming a comment by someone other than its author, and that comment must name the head, exactly as a change to `merge-gate.mjs` already did — a pull request can no longer loosen what may enter the merge queue without a second person's signature ([#2093](https://github.com/ThinkFlowLab/FlyBot/issues/2093)).
- A `Live E2E` run no longer publishes a key the suite itself refuses: the preflight that decides whether any step runs, the bench starter and the run guard now read `DEEPSEEK_API_KEY` through one module, so the mock's key or one under 16 characters is skipped with its own warning — saying plainly that nothing ran — instead of reaching a bench that refuses it and failing the night for a reason the skip exists to avoid. A key long enough but not real is not detected here; only the endpoint can judge that ([#2214](https://github.com/ThinkFlowLab/FlyBot/issues/2214)).
- **Hand a task to a Workflow** now names the picked target on its confirm button — `Assign to <lane> · <Project>`, or the Bot when the card goes to one Bot — so two lanes that share a name are told apart at the click; the confirm body is unchanged. ([#2254](https://github.com/ThinkFlowLab/FlyBot/issues/2254))
- **Hand a task to a Workflow** keeps the picked card in the twelve it draws after the card list is folded again: a card picked past the twelfth is drawn first, so the rows never hide the card its confirm button is about to send. The count row and the assignment it sends are unchanged. ([#2257](https://github.com/ThinkFlowLab/FlyBot/issues/2257))
- The gate list is derived from `docs/testing-layers.json` now instead of being retyped: a workflow the manifest marks `gate: true` is a `Policy-sign:` gate file by construction, so `merge-gate.yml`, `enqueue-guard.yml` and the container-image build `docker.yml` joined the list, together with `gate-check.mjs`, the script that writes the `enqueue-guard` check run — `policy/gates.test.mjs` pins each gate workflow to the scripts it runs in both directions, so a pull request can no longer weaken a gate's switch or move a rule under another workflow without a second person's signature ([#2303](https://github.com/ThinkFlowLab/FlyBot/issues/2303)).

### Fixed

- The gate-change signature is now judged by the copy of the checker in the pull request's base commit instead of the copy in its own tree, so a pull request can no longer weaken or delete `policy-sign.mjs` and pass the check it just edited — the `Gate change signature` step still runs before the suite, and a signature is still a comment by someone other than the author that names the head ([#2099](https://github.com/ThinkFlowLab/FlyBot/issues/2099)).
- A review asking for changes stopped nothing: the state was dropped on the way in and an empty body matched no stop, so both the enqueue guard and the queue entry answered ok. The review's state is now read — `CHANGES_REQUESTED` refuses with or without a body, names the review, and a later approval or a dismissal clears it. The written request and the review's request are read apart, so approving the review answers the review and leaves a hold written in a comment standing.
- The gate-change signature is a job of its own (`policy-sign`) instead of a step inside the `Test` suite, and `main`'s ruleset file names it next to `tests-ok` and `enqueue-guard`: required contexts are job names, so deleting the step used to leave the suite green, while the suite now needs the signature job and cannot run without it — a pull request that removes it loses a required context instead of passing. The live ruleset still has to be given the same context, which is the owner's edit: until then the job reports without being required ([#2124](https://github.com/ThinkFlowLab/FlyBot/issues/2124)).
- A card in the Project board's **Done** group keeps its title, its priority and the board it opens: the done column no longer draws `#<task-id>` with no priority, and clicking the card opens the Bot or group the work lives on ([#2198](https://github.com/ThinkFlowLab/FlyBot/issues/2198)).
- A link picked in a chat message now opens in FlyBot's own browser panel: the host used to open it in its right sidebar, a tab this panel's fixed layer covers, so the content area looked blank with no error to explain it. The bubble's Markdown is delegated to FlyBot's panel now, and a window without the Desktop bridge opens the page itself.
- A refused Rename, Delete or Create in the Workflows panel is announced once now: the dialog that holds the host's sentence is the only `role="alert"` for that refusal, and the section no longer draws a second copy behind the mask that a screen reader read out as well. A refusal with no dialog open is still reported once on the page. In the same family, a read-only window no longer prints the host's read-only sentence twice on Settings → Workflow graphs: the Settings header draws it once for every page, so the workflow page drops its own copy (#2202).
- The main view no longer hands the shell a conversation its session list does not know, so loading a Bot stops throwing the two uncaught `sessions.retain: unknown session` errors from the landing timer: a part the list has not listed yet falls back to the chat it replaced, and when the list knows none of them the view simply stays where it is ([#2206](https://github.com/ThinkFlowLab/FlyBot/issues/2206), reported in [#1306](https://github.com/ThinkFlowLab/FlyBot/issues/1306)).
- A read-only window no longer offers the Stage write controls that core refuses: Hand a task to a Workflow, Re-match, Pause/Resume/Stop, Edit and the drag palette, plus Reset, are gone from the Stage a workflow row opens, and the Stage prints the host's own read-only sentence instead (#2213).
- A read-only FlyBot window no longer offers Bot Social's write entries: it keeps the section, its share requests, accept notices and past rooms as reads, and no longer draws Dismiss, Ask them to share a Bot, Leave, Approve, Reject or Auto-send from now on, offers no Bot Social row in the sidebar `+` menu, and opening a past room whose local mirror is gone returns the stored room instead of creating one ([#2219](https://github.com/ThinkFlowLab/FlyBot/issues/2219)).
- The reorganization notice in the sidebar no longer offers `Undo` and `Dismiss` in a read-only window: the card still shows what the last run changed and what an undo kept, but the two buttons are writes the host refuses, so they are not drawn while `roster.readOnly` is set ([#2220](https://github.com/ThinkFlowLab/FlyBot/issues/2220)).
- A workflow row with live runs now says how many: the number sits beside the dot and is part of the row's accessible name, so a reader who cannot see the colour can tell one running run from five; an idle row draws no dot, no count and no digit. Opening the list in a read-only window no longer sends `workflow/ingest` for every open card — the Project filter still fills, and a writable window still ingests every open card (#2222).
- A read-only FlyBot window no longer draws the Bot Social room overview's Leave, Auto-send switch or invite: the room view keeps its status chip (and a waiting room keeps its wait code and roster) and offers no write control, while a writable window keeps the same controls and the two-tap Leave ([#2228](https://github.com/ThinkFlowLab/FlyBot/issues/2228)).
- A Workflow row with live runs no longer replaces its accessible name with `{name} · {count} running`. The count rides in a visually hidden span beside the `aria-hidden` dot instead, so a reader gets everything the row's content gives — the lane's name, the `Workflow` badge, its Project and its preview — plus how many runs are live. Two lanes that share a name are distinguishable again, and a read-only window still hears the count (#2230).
- A read-only FlyBot window no longer rewrites `flybot-social-settings.json` from its read endpoints: `social/remote-bots` and `social/friends` still derive the inbound backfill, the hidden-remote aging and the accept-notice cleanup in memory, but they write nothing, so opening a second window cannot create that file, age a hidden friend on it, or put an older copy back over what the writable window saved ([#2231](https://github.com/ThinkFlowLab/FlyBot/issues/2231)).
- A read-only FlyBot window no longer draws the scheduled-task writes the host would refuse — the Quiet hours toggle and window fields, New task, Edit, Copy, Pause/Resume, Delete and Retry — and a refused Pause, Resume, Delete or Retry now says the host's own sentence on that row instead of nothing, announced to a screen reader ([#2232](https://github.com/ThinkFlowLab/FlyBot/issues/2232)).
- A refused Hand a task to a Workflow now says so inside the dialog that stays open: the host's sentence is the only `role="alert"` for that refusal, the page draws no second copy behind the mask, and re-opening the dialog starts clean instead of inheriting the previous attempt's sentence (#2237).
- A Bot's right-click menu in a read-only window no longer offers **Copy invite link**: the entry needs `social.createInvite`, which the host refuses there, so it is hidden instead of painting a failure. Writable windows keep the entry unchanged ([#2238](https://github.com/ThinkFlowLab/FlyBot/issues/2238)).
- Hand a task to a Workflow no longer cuts its card and Bot lists at twelve without saying so: each list draws twelve and a row says how many are left, and expanding it offers every card and every local Bot ([#2244](https://github.com/ThinkFlowLab/FlyBot/issues/2244)).
- **Hand a task to a Workflow** keeps **Assign** disabled while no target is picked: with no Workflow defined the dialog no longer looks ready and no longer posts an empty `workflowId` that the host answers with "No such workflow".
- A read-only FlyBot window's sidebar banner now offers **Reload** in both the wide and the rail shape: it re-reads the whole team instead of reloading the page, so the banner and every refused control clear as soon as the other window has let go, and an unsent composer line is not lost. ([#2247](https://github.com/ThinkFlowLab/FlyBot/issues/2247)).
- A read-only FlyBot window no longer draws the task-board writes the host would refuse — the **Add task** form, **Start**, **Complete** and card dragging — and a drop on a column no longer sends a move; the rail, the three columns, the cards and the Done stamps stay readable ([#2248](https://github.com/ThinkFlowLab/FlyBot/issues/2248)).
- Settings now takes keyboard focus when it opens: the dialog is the focused element, so Tab starts inside it and Escape reaches it even when the message box had focus. Closing returns focus to the still-connected control that opened it (#2251).
- A read-only FlyBot window no longer draws the Bot and group right-click menu's writes — Pin and Unpin, Duplicate, Make Main Bot, Remove Main Bot role, Hide from sidebar, Rename group, Delete and Delete group — because the host refuses every one of them; Edit Bot, Group settings, Mark as Unread and Copy conversation ID stay, and a writable window is unchanged ([#2253](https://github.com/ThinkFlowLab/FlyBot/issues/2253)).
- A workflow lane that holds more cards than its page listed now offers the rest: `workflow/state` takes a `heldLimit` (20 by default, 200 at most), and the stage's dead `3 more held tasks` line is a **Show 3 more held tasks** button that unfolds every held id — each still re-matchable — and folds back to **Show less** (#2256).
- A workflow lane whose held list runs past the host's 200-id page cap no longer promises ids a click cannot reach: the folded **Show N more held tasks** count is what pressing it actually reaches, and the unfolded list draws **Showing 200 of 250 held tasks** instead of hiding the remainder behind **Show less**. ([#2260](https://github.com/ThinkFlowLab/FlyBot/issues/2260))
- Settings → Feedback's error list now offers **Show more** under the newest eight errors: the title has always reported the whole log (`Recent errors · 60`) while the list stopped at eight with nothing to open the rest, so the ninth error could not be read at all. Expanding draws every loaded error and folds back to **Show less**; a report of eight or fewer keeps the list and its title exactly as they were.
- In a read-only window the panels that only read now draw instead of reporting `bot/read-only`: the Projects panel, a Bot's task list, the folder picker's list and the connector status line answer again, while every write keeps its refusal ([#2267](https://github.com/ThinkFlowLab/FlyBot/issues/2267)).
- Closing Settings no longer pulls focus back to its opener after you clicked somewhere else while the dialog was fading out: the focus hand-back now runs only while the dialog still holds it (#2270).
- A read-only FlyBot window no longer offers the DSH Agent menu's Pin/Unpin and Remove DSH Agent, or a Session menu's Rename and Archive: the host refuses every one of those writes, so the row only produced a failure toast (#2271).
- A read-only window's task board now says inside the board itself why Add task, Start, Complete and dragging are gone: one line above the columns carries the host's own read-only sentence, which the full-screen board had covered until now. A writable board draws nothing new. ([#2273](https://github.com/ThinkFlowLab/FlyBot/issues/2273))
- In a read-only window a Bot's Memory panel no longer draws the **Remove** button or the **Ask or update** form the host would refuse, and says why in the host's own sentence, while the entries and **Regenerate summary** keep working ([#2276](https://github.com/ThinkFlowLab/FlyBot/issues/2276)).
- In a read-only window a Bot's details drawer no longer draws the Settings form, which the host would refuse, and says why in the host's own sentence instead; a writable window keeps the form unchanged ([#2279](https://github.com/ThinkFlowLab/FlyBot/issues/2279)).
- In a read-only window the chat's `ask_user` card no longer draws an answer control, and the answers a card already holds stay readable ([#2283](https://github.com/ThinkFlowLab/FlyBot/issues/2283)).
- A read-only window's Inbox now keeps every row and its **Open** action and draws no write the host would refuse: no answer field or **Submit** on a question or a task input, and no **Accept** or **Send back** on a result. One sentence at the top of the dialog carries the host's own read-only words, the same hint the other read-only surfaces draw. An approval keeps **Reject** and **Allow**, because `approval-answer` is one of the reads a read-only channel allows, and a writable window draws exactly the tree it drew before. ([#2284](https://github.com/ThinkFlowLab/FlyBot/issues/2284))
- A Bot's **Scheduled tasks** card in a read-only window draws nothing when the Bot has no scheduled tasks, instead of the bare heading over an empty body; a writable window keeps its **New task** row, and a locked card that has tasks keeps its heading and rows ([#2286](https://github.com/ThinkFlowLab/FlyBot/issues/2286)).

## [0.2.21] - 2026-11-03

### Added

- A pull request that edits an acceptance gate (`policy/gates.json`) must carry `Policy-sign:` naming a comment by someone other than its author that also names the tip it signs, so a signature cannot be carried over to a later push, and `Test` fails the pull request otherwise — a pull request can no longer change what "pass" means on its own ([#2054](https://github.com/ThinkFlowLab/FlyBot/issues/2054)).
- A task card in the Done column now says when it finished — a relative time (`2 h`, `Sep 22`) beside the assignee, on a Bot's board and a group's alike ([#2066](https://github.com/ThinkFlowLab/FlyBot/issues/2066)). The moment is the first terminal entry in the card's history (`accepted`, `cancelled` or `failed`), so editing a finished task no longer moves the time; a card recorded before that history existed falls back to its last update, and one with no usable stamp shows no time at all.
- With `stateJournal` on, the diagnostics report now says whether the state journal is recording or why it stopped, and `journal.status()` answers the same question to a host ([#2134](https://github.com/ThinkFlowLab/FlyBot/issues/2134)).
- A wire on the Settings → Workflows flowchart now says which two cards it joins and can be pointed at: two wires that end at the same port used to be one stroke to the eye and the wire layer was invisible to a pointer and to a screen reader, so a narration that named a hand-off left no way to find that wire on the picture. Each route now carries a 10px transparent hit path of its own, names both ends (`Reviewer → Deployer` — a hover tooltip and an `aria-label` inside a named `Connections` group), and while the pointer is on it that wire is drawn in the accent colour with the others dimmed. Read-only, this only points at a wire; it commits nothing ([#2142](https://github.com/ThinkFlowLab/FlyBot/issues/2142)).
- A window that holds the Bot team read-only now says so in the Settings header, in the host's own sentence, above every page that still offers its write controls: General, Bots, Groups, Secrets, Connectors, Capabilities, Scheduled tasks and Projects. Pressing a control there is refused by the host, and until now nothing on the panel explained why nothing moved. The standing sentence sits above the line that reports one refused write, and a blank or missing sentence draws nothing ([#2199](https://github.com/ThinkFlowLab/FlyBot/issues/2199)).
- The messages a Bot's chat loads above the current part are now messages you can act on: the reaction and reply buttons on a bubble from an earlier part used to do nothing, because the bubble was drawn without the identity a reaction is stored under and without a session to quote into. A reaction picked on such a bubble now sticks to that message and stays there when another page is loaded above it, and **Reply** quotes the line into the open chat instead of into the part it was said in. ([#2136](https://github.com/ThinkFlowLab/FlyBot/issues/2136)).

### Fixed

- A room board opened from a Bot board now counts each active card once in its rail: the bot board's read stayed in the rail's own list after the switch, so a room that draws two cards read `1/3` instead of `1/2` ([#2069](https://github.com/ThinkFlowLab/FlyBot/issues/2069)).
- The state journal now asks what its folder and its file are when it writes, not only when the host starts: a `home/journal` folder swapped for a link is refused with one warning and recording stops, and a `state.jsonl` swapped for a link is never written through, instead of silently appending a snapshot into a folder or a file outside the home. The append path refuses the write; the prune path replaces the link with a fresh file in the verified folder, so nothing is written through it ([#2074](https://github.com/ThinkFlowLab/FlyBot/issues/2074)).
- `memory/journal.jsonl`, a workspace `workflows/<id>.json` and `workflows/project.json` are asked as files before a write, the way their folders already were: a missing file is created, a plain file is written, and a link or a directory is not written through ([#2079](https://github.com/ThinkFlowLab/FlyBot/issues/2079)). A linked journal file drops that one record with a warning and the memory write still lands; a linked workflow file refuses the save with `workflow/not-a-file` and one warning.
- The decision log and the diagnostics log now ask what their file is before they write, the way the state journal does: a `decisions.jsonl` or `logs/diagnostics.jsonl` swapped for a link is refused instead of appending the line into whatever the link points at. A refused decision is dropped with one warning and the tool answers `Not recorded: the decision log is not a plain file.`; the diagnostics log drops the line with one line on stderr, keeps it readable in memory, and `clear` no longer truncates a file behind such a link.
- A memory write and a frozen prompt snapshot are no longer written through a link left at their temporary name: `MEMORY.md.<pid>.tmp` and `<session>.md.tmp` are asked as files before the write, so a link there refuses the save (one warning, the memory file keeps what it had) instead of landing the bytes outside the home and replacing the file with the link ([#2097](https://github.com/ThinkFlowLab/FlyBot/issues/2097)). A window between the check and the write remains, as with every `lstat`-then-write guard.
- The memory panel can now tell a folder it could not read from a Bot that has never saved anything: `memory-view` carries a `blocked` entry (scope and the folder that failed) for each memory scope the host refused, and the panel prints one line naming that folder above its empty title instead of telling the user to save something that cannot be written. A folder that is merely empty, or not created yet, still renders exactly the copy it rendered before.
- The decision log's housekeeping no longer writes through a link left at its temporary name: it lands through `<home>/decisions.jsonl.tmp` and renames it over the log, and that name is now asked as a file before the write. A link there refuses the trim — one warning, the new entry is still appended and the retained log simply grows past its bound — instead of writing the whole retained log outside the home and replacing the log itself with the link; the tool then answers `Written: … — the log was not trimmed` rather than `Recorded:` ([#2103](https://github.com/ThinkFlowLab/FlyBot/issues/2103)). A window between the check and the write remains, as with every `lstat`-then-write guard.
- The memory panel now names a refused memory folder even when the other memory scope has entries: `entries` is own and team merged, so the line added for the empty state disappeared as soon as either scope held a single entry. A second pure helper answers the same sentence from the view's `blocked` scopes alone, and the panel draws it above the summary and above the entries list; the empty state keeps its own copy and a view with nothing refused renders exactly what it rendered before.
- A link left at the temporary name a write lands through no longer takes the write: the team state, the OCR cache, the Automation-tasks defaults, the Bot Social server choice and the workflow store ask `<file>.<pid>.tmp` as a file before writing, so a link (or a folder) there refuses the save, with the temp name in the message, instead of putting the bytes outside the folder and renaming the link into place. A window between the check and the write remains, as with every `lstat`-then-write guard. ([#2109](https://github.com/ThinkFlowLab/FlyBot/issues/2109)).
- The timeline trace now asks its temporary name before a segment write lands through it: a symbolic or hard link left at `trace-000001.json.tmp`, or a directory, refuses the write with one warning, so a preset name can no longer take the bytes outside the trace folder or put a link where the segment belongs. The segment is neither created nor replaced on a refusal; a missing temp name stays the writer's to create and the plain leftover of a crashed writer is still overwritten.
- The Bot Social credentials file, its per-server backup and the settings file are written only after the path is asked what it is: a symbolic or hard link left there was followed, so an onboarding token, the owner id and the display name could land in a file outside the Bot's home. The write now refuses before the first byte, the file behind a link keeps its bytes, and the start fails with one line naming the path rather than running on a link.
- The run flowchart in Settings → Workflows now routes every wire on its own lane: a fork and a join no longer collapse onto one stroke, a wire leaves the card at its real bottom edge and never cuts through the card below it, and a back edge loops outside the cards as a visible return path instead of a stub. The dashed parallel frame is drawn from the measured card boxes with an equal margin on all four sides (#2122).
- A message with no text painted a row of its own: a turn that ended in tool calls only left the Bot avatar and a bubble holding nothing under the trace row. An empty or whitespace-only text is now no row at all, in a Bot's own chat, a group chat, a friend's line and the exchange sheet; a line that carries files keeps them and loses only the empty bubble.
- The state journal now refuses a `journal/state.jsonl` that is a hard link: its bytes are also a name outside this home, so the start-up read and the append both require the file to carry only this one name (`nlink === 1`). A shared inode is refused exactly like a symbolic link — one warning, nothing read, chmod-ed or appended — while a journal with one name records as before.
- A loop wire in the workflow flowchart turns in the gap above or below its row, so it no longer runs behind the card beside it ([#2138](https://github.com/ThinkFlowLab/FlyBot/issues/2138)).
- A start that moves to another server now asks the backup name before it asks the server for a home: the `.bak` copy (`flybot-social.json.<tag>`) is named from the credentials file already on disk, so a link left at that name refuses the start instead of spending a home on the server first and refusing afterwards. A free name still keeps the old server's credentials there, and a refused `.bak` leaves the credentials in use byte for byte ([#2140](https://github.com/ThinkFlowLab/FlyBot/issues/2140)).
- The Scheduled tasks page and a Bot's scheduled-tasks line no longer answer "No scheduled tasks yet." when the list is only narrow: once a member is signed in, each member sees their own tasks, so a list that dropped another member's rows now says "No scheduled tasks you can see." and adds either that another member's tasks stay hidden (the page) or that you can add one (the line). A list where nothing was hidden, and a host that narrows nothing, keep the plain empty state. ([#2145](https://github.com/ThinkFlowLab/FlyBot/issues/2145))
- A state journal rotation now refuses a file whose name stands for a symbolic or a hard link ([#2146](https://github.com/ThinkFlowLab/FlyBot/issues/2146)): until now the rotation read the other file's lines as the team's history and its `rename` dropped the second name, while recording went on without a warning. The rotation asks the same question the append already asks; a journal with only its own name rotates as before.
- A wire between two cards on one row of a workflow flowchart — a loop across a parallel layer, or a skip across a row — now runs outside that row instead of through the card between them: the run fell back onto the row's own column and the card, drawn on top, covered it, so the stroke looked like a link to the neighbour. The two horizontal runs now sit in the space beyond the row's own cards, and the vertical run between them keeps clear of every card it passes, the two ends included ([#2151](https://github.com/ThinkFlowLab/FlyBot/issues/2151)).
- A diagnostics report from a window that another dsh keeps read-only no longer says `state journal: recording`: that window never reaches the journal write, so the line now says `state journal: paused (this window is read-only)` instead, while a journal that really stopped keeps its own reason ([#2153](https://github.com/ThinkFlowLab/FlyBot/issues/2153)).
- The state journal no longer stays stopped for the rest of the run after one failed open or write. The next save asks once more whether it can record again: a folder or file repaired meanwhile resumes recording, appending the change that save carried, while a journal that still refuses stays stopped and that save still lands. The asking is silent, so a refusal is warned once rather than once per save ([#2154](https://github.com/ThinkFlowLab/FlyBot/issues/2154)).
- A Condition link that cannot be honoured is now refused instead of saved as a plain Link: a blank output name, or one the graph will not accept (`result_ok`, `ready.now`, `with space`), names the reason in the Settings alert and writes nothing, where it used to land as an unconditional edge that fired whether or not the condition held. Settings keeps **Add link** disabled for a Condition until an output name is typed, and a loop's `until` follows the same rule — absent still means no early stop, a partially filled one is refused ([#2155](https://github.com/ThinkFlowLab/FlyBot/issues/2155)).
- A file that another name also holds is no longer written through at its leaf: the decision log, the diagnostics log, the memory journal, and a workflow definition or project file that is hard-linked to a name outside the home are refused exactly like a symbolic link there — one warning, the other name keeps its bytes, the record is dropped or the save is refused — instead of the append or the truncate landing in the shared inode ([#2079](https://github.com/ThinkFlowLab/FlyBot/issues/2079), [#2114](https://github.com/ThinkFlowLab/FlyBot/issues/2114)). The leaf now asks the same `nlink === 1` rule the temporary name already used, so the two answers for one file cannot disagree; a file carrying one name is written as before, and a missing file is still created ([#2159](https://github.com/ThinkFlowLab/FlyBot/issues/2159)).
- A wire that leaves a row for one below now clears the tallest card in that row instead of running through a shorter neighbour: the corridor is measured from the row's lowest measured bottom, so a 96px card beside a 48px source no longer hides the horizontal run behind its own body ([#2160](https://github.com/ThinkFlowLab/FlyBot/issues/2160)).
- A wire or a reconnect in the workflow drawer that would repeat a pair the graph already lists now adds nothing, instead of committing the duplicate that the host refuses: before, that save failed with `Link A → B is listed twice` and the plane shows only `workflow.edges`, so the drag left no edge, no change and one red line nobody asked for. Reconnecting an edge onto a target its source already reaches now keeps exactly one edge and drops the one that was dragged, and a wire to a Bot that was not connected yet still adds its edge as before ([#2163](https://github.com/ThinkFlowLab/FlyBot/issues/2163)).
- A wire that leaves a row for one below turns in the corridor under that row and never below the next row's top: at the factory 108px row pitch a card beside a 48px source can reach past that top, and the turn is then clamped a pixel above it instead of landing inside the cards below ([#2164](https://github.com/ThinkFlowLab/FlyBot/issues/2164)).
- The state journal recovers a last line a crash left half written instead of refusing the file on every start and every save: when the complete prefix before it replays, the journal is replaced with that prefix, the dropped line is warned once, and recording continues from it, so a person no longer has to delete `journal/state.jsonl` ([#2166](https://github.com/ThinkFlowLab/FlyBot/issues/2166)). A broken line above the last one, a `seq` gap, a `prev` mismatch or an unknown op still refuses the whole journal and leaves it as it is.
- The `Read-only` row of a host diagnostics report no longer says another dsh holds the team when it does not: a team file saved by a newer FlyBot reads `update FlyBot` and an unreadable one reads `could not be read` with its cause, exactly the sentence the sidebar shows, while a window that really lost the team to a live `state.lock` keeps the other-dsh wording ([#2167](https://github.com/ThinkFlowLab/FlyBot/issues/2167)).
- **Add link** in Settings → Workflow graphs now reads the graph before it submits: a pair the graph already links is a no-op instead of a save the host refuses and discards whole, a pair given a different kind says which link is already there instead of the host's `listed twice`, and the **To** list marks the targets the chosen node already reaches ([#2173](https://github.com/ThinkFlowLab/FlyBot/issues/2173)).
- A window that holds the team read-only no longer offers **Edit** on Settings → Workflows: the page draws the host's own read-only sentence in its place, drops rename and delete, and never asks the host to save a graph, so a layout is not built only for the save to be refused ([#2176](https://github.com/ThinkFlowLab/FlyBot/issues/2176)).
- A Condition (`when`) or Loop (`until`) link in Settings → Workflow graphs now offers the output names the **From** node declares instead of asking for one to be typed, so a name the host would refuse is never submitted; **Add link** waits for a declared name, and a node that declares no outputs keeps the text box ([#2178](https://github.com/ThinkFlowLab/FlyBot/issues/2178)).
- While another dsh holds the Bot team, a window can only show it: Settings → Workflow graphs now says so in the host's own words and offers no **Edit**, **Add link** or wire port, instead of taking a change core refuses with `bot/read-only` and then drops ([#2187](https://github.com/ThinkFlowLab/FlyBot/issues/2187)).
- The host's read-only sentence now stays visible when the sidebar is collapsed to the rail, clipped to one line with the full sentence on hover and in its accessible name, instead of disappearing until the window is wide again; a host that sent an empty or whitespace-only sentence draws no hint in either shape ([#2188](https://github.com/ThinkFlowLab/FlyBot/issues/2188)).
- A write the host refuses in Settings now shows its sentence under the dialog heading instead of at the top of the scrolling page: after scrolling down to the switch that was pressed, the refusal used to land above the viewport, so the window looked as if the click had done nothing. The line sits outside `.bt-settings-scroll`, in view wherever the page is scrolled ([#2194](https://github.com/ThinkFlowLab/FlyBot/issues/2194)).
- While another dsh holds the Bot team, the Workflow list in the sidebar no longer offers **New**, **Rename**, **Delete** or **Hand a task to a Workflow**: a read-only window shows the list only, instead of taking a change that core refuses with `bot/read-only` ([#2200](https://github.com/ThinkFlowLab/FlyBot/issues/2200)).
- A write that lands through a temporary name now refuses a hard link left there as well as a symbolic one: `lstat` reports a hard link as a plain file, so the team state, the OCR cache, the Automation-tasks defaults, the memory files and snapshot, the decision log's trim and the Bot Social server choice could still be written into an inode another name held outside the Bot's home. The guard asks for a file with only its own name (`nlink === 1`), while the plain leftover a crashed host leaves behind stays replaceable.
- The Scheduled tasks page lists tasks on a host where a member is signed in — the list no longer needs a Session in its request — and each signed-in member is shown only their own tasks.

## [0.2.20] - 2026-11-02

### Added

- A decision row on the Project board now opens: activating a `decisions/*.md` row (by mouse or keyboard) shows that file's text under the row, and activating it again closes it ([#2041](https://github.com/ThinkFlowLab/FlyBot/issues/2041)) — before this, the board could list 200 decision files and open none of them. The text comes from a new host read that accepts only a name the board's own listing produced, including one past the 200-row cut, so a name like `decisions/../outside.md`, an absolute path, a name one level down or a symlink answers `not listed` without touching the disk; a file over 200,000 bytes answers `too large` rather than being cut, and a row whose file was deleted answers `absent` and stays a row.

### Changed

- A Project board's Blocked group now says how long a card has been stuck, and lists the card stuck longest first ([#2029](https://github.com/ThinkFlowLab/FlyBot/issues/2029)): the row kept the card's own reason and read the same whether the card had been blocked for three days or three minutes, and the group was unsorted. The host now answers `since` / `waitedMs` from the question's own `requestedAt` stamp — a card whose ask wrote no stamp shows no duration rather than an invented one — and the board draws `reason · 2d`, ordering the group oldest first the way Waiting already is.
- A Bot's Scheduled tasks line in its details panel says how many tasks the Bot has and, past the three rows it draws, one **2 more not shown** row opens the full list ([#2030](https://github.com/ThinkFlowLab/FlyBot/issues/2030)).

### Fixed

- Renaming a group chat now reaches the guests already seated in it ([#1949](https://github.com/ThinkFlowLab/FlyBot/issues/1949)): the host pushed a membership envelope only when the notice changed, so a shared room kept its old title on the other homes until the next chat line, and a quiet room kept it indefinitely. A rename rides the same one `join` the notice edit already used — the envelope carries the name field it always carried — and a settings save that changes both the name and the notice still sends a single envelope, while a save that writes back the values the room already holds sends nothing.
- The architecture-docs gate no longer starts git through a shell ([#1954](https://github.com/ThinkFlowLab/FlyBot/issues/1954)): on Windows the gate handed `git rev-parse --verify origin/main^{commit}` to cmd.exe, `^` is cmd's escape character, so the `^{commit}` never reached git and every scheduled Windows row reported `arch-docs: FAIL — cannot diff against origin/main` on a checkout where `origin/main` existed. git now runs with its arguments as a list, the ref verbatim, and the fail-closed behaviour on a genuinely missing base ref is unchanged.
- The task card's three 2,000-unit text bounds now cut on a code point boundary: the result summary a Done move copies from the card's note, the criteria stored at create, and the summary a return writes drop a surrogate pair whole instead of storing a lone surrogate that the card shows as U+FFFD ([#1956](https://github.com/ThinkFlowLab/FlyBot/issues/1956)).
- The task card's title and note and a dispatched card's title and note are cut at 300 characters on a code point boundary, so a bound that lands inside an emoji or other astral character keeps whole characters instead of storing a lone surrogate the card shows as U+FFFD ([#1958](https://github.com/ThinkFlowLab/FlyBot/issues/1958)).
- A room turn and the stored `room.log` no longer split a surrogate pair at a character bound: the status stub's hundred units, the transcript clip, and the card, board and presence fields now cut on a code point boundary, so a title or a Bot essay that ends on an emoji keeps the whole emoji instead of an unpaired half the encoder turns into U+FFFD ([#1960](https://github.com/ThinkFlowLab/FlyBot/issues/1960)).
- A group settings change now leaves one line in the room: renaming the room, editing or clearing the notice, switching the reply mode, or naming a new admin or task lead posts a single quiet event that says what changed and who changed it, opens no Bot turn, and stays quiet when a patch writes back the values the room already holds or when an unnamed room's title follows its members ([#1962](https://github.com/ThinkFlowLab/FlyBot/issues/1962)).
- A text bound no longer keeps an unpaired surrogate the caller handed in ([#1963](https://github.com/ThinkFlowLab/FlyBot/issues/1963)): every character bound in the host goes through the shared `cut`, and that helper moved its cut point off a pair it was about to split but copied a string that already carried a lone surrogate straight through, so a card title, a note or a name that arrived broken was written to `state.json` as the same broken value — read back as U+FFFD by any encoder. `cut` now flattens its input with `toWellFormed()` before it bounds, so the stored text is well formed; U+FFFD is one UTF-16 unit for the one it replaces, so a well-formed input keeps its exact prefix and its "was cut" flag.
- The one line a group-settings save leaves in the room now names the person who saved it on the default single-user setup ([#1967](https://github.com/ThinkFlowLab/FlyBot/issues/1967)): the web UI has no member session, so the save reached the host with no name and every rename, notice, mode or admin change read "Someone updated the group notice". The line now takes the room's implicit owner — the local person whose Bots sit in it — while a signed-in member and a Bot saving through its own tool still win, and only a room with no owner at all falls back to "the user".
- Renaming a Bot now reaches the guests already seated in every unnamed group it sits in ([#1968](https://github.com/ThinkFlowLab/FlyBot/issues/1968)): the host recomputed the room's title from its members and retitled the room locally, but pushed nothing, so a shared group kept its old title on the other homes until the next chat line and a quiet group kept it indefinitely. The automatic rename now rides the same one `join` an explicit rename already used (#1949) and carries the new name, while a rename that leaves the computed title alone — a Bot outside the group, a group with a chosen name, a group with no remote guest — still sends nothing.
- The Windows Compatibility job no longer fails on a test case that can only run on POSIX ([#1973](https://github.com/ThinkFlowLab/FlyBot/issues/1973)): the case proving the arch-docs gate never hands git's arguments to a shell observes that by running a fake `git`, which has to be an executable script with an interpreter line — Windows cannot launch one and would fail the job with `ENOENT`. The case is now marked skipped on Windows rather than quietly passing, and the same job's Lint step still runs the real gate there, so the platform stays covered.
- A restart no longer renames an unnamed group to `You, …` or drops its remote guests ([#1976](https://github.com/ThinkFlowLab/FlyBot/issues/1976)). On load the host compared the stored title with the name computed from the room's people and guests, then wrote a title computed from the member Bots alone: the owner became `You`, every remote guest fell out of the name, and because that name could never match again the file and the group's Session title were rewritten on every boot. Both the comparison and the write now use the one name that sees the room, so a restart migrates an old title once and then leaves it alone.
- Six bounds on text another home or another person supplied no longer cut on UTF-16 units ([#1979](https://github.com/ThinkFlowLab/FlyBot/issues/1979)): a connector item name (80), a role label another home set on a face-room seat (80), a cross-home group name (200), a capability description from a peer server (2,000), a remote home's own error text (157) and an abbreviated remote reply (80) used a bare `slice`, so a bound that landed between the halves of a surrogate pair produced a lone high surrogate — read as U+FFFD by any encoder and shown to the owner that way. Each now goes through the shared `cut`, which keeps the longest prefix that stops before a split pair within the same budget; the error preview's `…` and the reply's trailing-period strip still apply to the cut value.
- The host's turn lines no longer split a surrogate pair at their character bounds ([#1984](https://github.com/ThinkFlowLab/FlyBot/issues/1984)): a failed turn's 500-unit message, the 200-unit message of its one-line reason, the 79-unit step a running call shows, an approval card's 300-unit description and 400-unit command, and the 160-unit reason a failed turn leaves for the inbox now cut on a code point boundary, so a line that ends on an emoji keeps the whole emoji instead of an unpaired half the encoder turns into U+FFFD.
- The name a friend's Bot keeps is cut on code points at both places the chat stores it: creating the chat (40) and refreshing its name (40) used a bare `slice`, so a name whose bound fell between the halves of a surrogate pair became a lone high surrogate — shown as U+FFFD once `roster.createBot` bounded it again. Both now go through the shared `cut`, so the longest whole-code-point prefix within the same 40-unit budget is kept, and a short name is stored word for word ([#1990](https://github.com/ThinkFlowLab/FlyBot/issues/1990)).
- An approval card now stores the command "Allow once" runs instead of clipping it at 400 units: the description and command bounds are 2,000 and 4,000, a value that still has to be cut ends with an ellipsis inside that bound, and the card wraps and scrolls a long command rather than drawing it as one clipped line ([#1992](https://github.com/ThinkFlowLab/FlyBot/issues/1992)).
- The last five text bounds in `core/src/host/` no longer cut on UTF-16 units ([#1993](https://github.com/ThinkFlowLab/FlyBot/issues/1993)): the quoted first line of a checkpoint's kept tail (80), an approval record's reason (500), a mention receipt's reason line (240), the title given to a DSH Agent's Session (80) and a schedule run's failure reason (200) used a bare `slice`, so a bound that landed between the halves of a surrogate pair stored a lone high surrogate — read as U+FFFD by any encoder. Each now goes through the shared `cut`, which keeps within the same budget the longest prefix that stops before a split pair; none of the five maxima changes.
- The title of a group without a chosen name follows its seats now ([#1995](https://github.com/ThinkFlowLab/FlyBot/issues/1995)): a friend's Bot invited to such a group appears in its name and in the group's Session title the moment the seat exists, and a seat that leaves drops out of both instead of staying in `state.json` until a restart. Before this, only a settings save or a renamed Bot recomputed that name, so inviting or removing a guest left the title reading the old set of people while the roster had already changed. A group created together with a guest was opened under the narrow name — `You, Chief A, Chief B`, with the guest missing — and was corrected in `state.json` without ever reaching the Session the user reads. A group with a chosen name keeps it.
- `recall` now says when it cut its hit list ([#2001](https://github.com/ThinkFlowLab/FlyBot/issues/2001)): a keyword search with more than 30 matches ends with `N more entries match; narrow the query or read a topic` and the exact count (`1 more entry matches; …` when exactly one is left out), and a `semantic: "true"` search asks the index for one entry past the cap and ends with `more entries match this meaning than are shown; narrow the query or read a topic`. Before this, a Bot with 35 matching entries was shown 30 and told nothing, so entry 31 read as not existing. The cap stays 30 and a reply that shows every match adds no line.
- A connector or MCP server's error no longer reaches the owner's card as U+FFFD ([#2002](https://github.com/ThinkFlowLab/FlyBot/issues/2002)): the 300-unit `reason` in `core/src/host/connectors.js` used a bare `slice`, so a message whose 300th UTF-16 unit landed inside a surrogate pair was stored with a lone high surrogate. It now goes through the shared `cut`, which keeps within the same 300 the longest prefix that stops before a split pair; a message under the bound is stored word for word.
- A guest already seated in a group without a chosen name learns the new name as soon as another seat joins or leaves ([#2004](https://github.com/ThinkFlowLab/FlyBot/issues/2004)): before this the host moved its own name and Session title while the other homes kept the copy they arrived with, and only a guest arriving after the change was told, so the drawer and the group settings could still read a set of seats that had already changed. The seat that changed keeps its one targeted join; the guests already in the room get one more carrying the same text the host holds. A group with a chosen name, a mirror of another home's room and a face-to-face room still send nothing for a seat change.
- Five Project-panel bounds now cut on a code point boundary, so a dossier or a board card no longer carries half an emoji: the assistant digest's 77-unit card title, the board's 200-unit one-line reason and decision title, and the dossier's capped name, role, persona, model and color, plus its 4,000-unit memory head — that last one is bounded where the memory is read, so the character is dropped whole instead of reaching the panel as U+FFFD ([#2005](https://github.com/ThinkFlowLab/FlyBot/issues/2005)).
- Four memory bounds now cut on a code-point boundary, so the news line, a `recall` query, the saved summary and the memory panel's ask prompt can no longer keep half an emoji, which every encoder shows as U+FFFD ([#2006](https://github.com/ThinkFlowLab/FlyBot/issues/2006)). Each bound still holds its 160, 120, 8,000 or 2,000 units and the character that would not fit is dropped whole.
- Adding or removing a person in a group without a chosen name now tells the guests already seated the new name ([#2009](https://github.com/ThinkFlowLab/FlyBot/issues/2009)): before this a human seat moved the host's own name and Session title while the other homes kept the copy they arrived with, because only a Bot's seat change sent the one `join` a guest holds. A group with a chosen name, a mirror of another home's room and a face-to-face room still send nothing for a seat change.
- A group without a chosen name that is renamed when FlyBot starts now tells the guests already seated the name it settled on ([#2010](https://github.com/ThinkFlowLab/FlyBot/issues/2010)): before this the load rewrote the name and the group Session title while every other home kept the copy it arrived with, so the two sides disagreed until that guest happened to join again. A group with no remote guest, a mirror of another home's room and a face-to-face room still send nothing.
- A connector's failure text no longer stops at 300 units without saying so ([#2016](https://github.com/ThinkFlowLab/FlyBot/issues/2016)): the `reason` stored on the owner's connector card now holds up to 2,000 — the bound another server's own description already uses — and a message that still has to be cut ends with `…` inside that bound, so the card says what it abridged instead of showing a sentence that stops mid-word as the server's whole answer. A message at or under 2,000 is stored word for word.
- A Workflow node's avatar now shows the first character of its name ([#2017](https://github.com/ThinkFlowLab/FlyBot/issues/2017)): the circle took the name's first UTF-16 unit, so a node called `🚀 Deployer` showed half an emoji on the flowchart and in the run view. It takes the first code point instead, and a node with no name still shows `?`.
- The Project board now keeps the newest 200 decisions and says how many it found ([#2021](https://github.com/ThinkFlowLab/FlyBot/issues/2021)): the read sorted the decision paths ascending and took the first 200, so a Project past the cap dropped the files it had just written, and a full list and a truncated one both read as the same number. The cut takes the tail now — the order on screen is still oldest first — the decisions read answers `total`, taken after the one-row-per-path dedup and before the cut, the meetings read answers `decidedTotal` / `pendingTotal` per list, and the board draws one `N more not shown` / 还有 N 条未显示 line under each list it shortened, with `data-decisions-total` beside the rows-drawn count. A list at or under its cap answers the same rows as before, plus the count.
- A Bot's Scheduled tasks block in its details panel now lists the Bot's paused and finished tasks instead of claiming the Bot has none, and each row says when it runs next — `Next: …`, `Paused` or `Finished` — rather than only the repeat rule ([#2024](https://github.com/ThinkFlowLab/FlyBot/issues/2024)).
- A failed connector's error text is now copyable in one click ([#2027](https://github.com/ThinkFlowLab/FlyBot/issues/2027)): since [#2022](https://github.com/ThinkFlowLab/FlyBot/issues/2022) a row in the `error` state can carry up to 2,000 characters of the host's own failure text, but its only actions were `Try again` and `Disconnect`, so passing that sentence on meant selecting it by hand — close to impossible on a phone. The row now offers `Copy error` next to `Try again`, which puts the exact stored text on the clipboard through the shared helper and reads `Copied` when it landed and `Could not copy the error` when the page has no clipboard or the write was refused, never a quiet success ([#1347](https://github.com/ThinkFlowLab/FlyBot/issues/1347)). `ready` and `off` rows are unchanged.
- A decided meeting's row on a Project board no longer reports `decision file gone` for a file that is still there ([#2033](https://github.com/ThinkFlowLab/FlyBot/issues/2033)): the board lists only the newest 200 decision files ([#2021](https://github.com/ThinkFlowLab/FlyBot/issues/2021)), and the lookup behind a meeting's own file name was built from that cut list, so every decided meeting whose file fell off the oldest end claimed its file had been deleted — while the same read reported the full count. The lookup now falls back to the names this read actually saw in the folder, so a file past the cut is named and only a name the folder no longer holds reads as gone; the fallback takes names from that read, never from the filesystem, so `../outside.md` still yields no path.
- A Bot's details panel no longer says "No scheduled tasks yet. Add one" before it has read the Bot's scheduled tasks: the line kept the shared view's `null` (nothing read yet) and treated it as an empty list, so the first frame — and every frame after a first read that failed, since the error was swallowed and the shared view stayed `null` — offered the new-task form on a Bot that may well have tasks. It now draws nothing until a read answers, the way the settings card beside it already did, and the empty state is kept for a read that answers zero ([#2035](https://github.com/ThinkFlowLab/FlyBot/issues/2035)).
- A decision file name can no longer reach outside the project, and a symlinked Project State file is no longer read ([#2037](https://github.com/ThinkFlowLab/FlyBot/issues/2037)): the board accepted any name that started with `decisions/` and ended in `.md`, so a hand-edited `decisionFile` or a crafted folder name such as `decisions/zz/../../../outside.md` put a file outside the folder in a row — with its `path` and its first line as `title` — and the same name could come back through the `known` fallback past the 200-row cut. One rule now decides a decision name at the point the listing is produced: exactly one segment under `decisions/`, ending in `.md`, used by the listing, the reader and the fallback alike; a symlink is refused too, and `project_state` answers `absent` for a symlinked file instead of handing over the text it points at.
- A group chat's details panel now lists the scheduled tasks that room owns. Before, a task could target a group chat — the new-task form offered `Group chats`, and Settings grouped tasks by room — but the room itself showed nothing, so "is the 9am task on this room still there?" meant leaving the room for Settings. The panel draws the three newest of the room's tasks, a title carrying the real count and `N more not shown` past three, and only tasks that carry this room's `roomId` and no `botId`: a Bot's task and another room's task stay out. Rows open the settings list, a room with no tasks draws nothing at all, and a face-to-face room gets no such section ([#2039](https://github.com/ThinkFlowLab/FlyBot/issues/2039)).
- The Inbox's Done group draws at most 20 rows, and it no longer hides the rest silently: when the model had more finished cards than it drew, one **5 more not shown** line under the Done rows says how many were left out, in the same words the Project board uses for its own capped list. A Done group of 20 or fewer, and the empty group, read exactly as before ([#2042](https://github.com/ThinkFlowLab/FlyBot/issues/2042)).
- The Bot's own-chat dock no longer drops rooms past the fourth silently: when it is at work in more than four, it draws four rows and then `1 more room` / `N more rooms` ([#2043](https://github.com/ThinkFlowLab/FlyBot/issues/2043)).
- The task board's Done column is one archive page of 20 cards, and until now it presented that page as the whole story: a Bot with 45 finished tasks read **Done 20**, and its rail row read **20/22** as if 22 were everything. When the archive page is full the column heading now reads **20 newest** and the rail row reads **20+ done** — what was drawn, and that there is more; a page under the limit, and the empty board, read exactly as before ([#2045](https://github.com/ThinkFlowLab/FlyBot/issues/2045)).
- The task board's group rail reads a Bot's own slice of the room's cut archive page as `done/total`, so a Bot with 18 of the newest 20 finished cards says `18/18` while the room holds 45. A full page is now a lower bound for every Bot on it (`18+ done`), and a page under the limit still reads its exact counts ([#2048](https://github.com/ThinkFlowLab/FlyBot/issues/2048)).
- The Inbox counted the finished tasks its Done group left out but gave no way to see them: with 29 finished tasks the group drew 20, said `9 more not shown`, and those nine were unreachable anywhere in the UI. The model now keeps every finished row and the Done group has a **Show all** / **Show fewer** control that draws the rest in place; collapsed, and at or under the cap, the group reads exactly as before.
- A decided meeting that saved no folder keeps the cards it decided, so its decision text is open to the same readers as one that saved a folder ([#2052](https://github.com/ThinkFlowLab/FlyBot/issues/2052)): before this a record written with an empty `decisionDir` was listed from the Project's own `decisions/` folder with no cards behind it, and a member of the same Project who could not see the meeting's card could still read the text, while the same file saved into a folder was refused as `not listed`. A record that decided no card still answers through the role list, and a name the folder did not list still opens nothing.
- A Project folder's `decisions/` must itself be a real directory: a link to another folder, a link to a path that does not exist and a plain file all read as no decisions at all, so `project_state`, the Project digest and the board's decision rows never list, hash or open another folder's files ([#2055](https://github.com/ThinkFlowLab/FlyBot/issues/2055)).
- A journal folder that is a symlink now records nothing, instead of letting the host change the permissions of the folder it points at and write the team's state journal there ([#2056](https://github.com/ThinkFlowLab/FlyBot/issues/2056)): the folder that holds `<home>/journal/state.jsonl` must be a real directory, checked before anything is created, permissions changed or written, so a link to a folder outside the home stops recording with one warning the same way any other journal problem does. A real journal folder records exactly as before.
- A memory or workflows folder is now read as empty, and refused as a write target, when it is a symlink ([#2057](https://github.com/ThinkFlowLab/FlyBot/issues/2057), [#2068](https://github.com/ThinkFlowLab/FlyBot/issues/2068)): one resolver walks every segment of `<home>/memory` — the root, `memory/bots`, the Bot's or team's own folder — and the same rule covers `snapshots`, `summaries`, `archive`, `reviewed.json` and `journal.jsonl`, plus a workspace's `workflows/`. Readers take only a real directory, so a link to a folder outside the home no longer feeds another folder's `MEMORY.md`, topics, prompt snapshot, summary or workflow definitions into a prompt, a listing or a page; a host write or delete still creates a folder that is not there yet, as before, and refuses a linked one instead of writing or deleting through it, and the entry writers behind `remember`, `edit` and `forget` refuse it the same way. A linked folder is named once per folder and process in one warning, because "nothing saved" and "nothing readable" look alike otherwise. A single `*.md`/`*.json` file that is a link is still read (unchanged), and a local process that can write inside the home can still win a redirect race.
- A decided meeting whose archived file cannot be read no longer takes the cards of the Project folder's same-named row ([#2061](https://github.com/ThinkFlowLab/FlyBot/issues/2061)): `archivedOf` now answers three mutually exclusive states (`none`, `unreadable`, `read`), so only a record that named no folder at all reaches the legacy card backfill while a record that named a folder keeps its cards off a row of a different folder — the answer no longer depends on the order the meetings happen to be stored in.
- A room board's rail counted only the newest page of the room's finished cards, so a Bot whose four cards were all still open read `0/1` on a board that also held one finished card, and the numbers disagreed with the cards drawn in the column beside them. The rail now counts the room's active cards as well, so the same Bot reads `1/4` and every Bot on the page reads the same total ([#2063](https://github.com/ThinkFlowLab/FlyBot/issues/2063)).
- The task board's Done column now follows the rail: switching from one Bot to another re-reads that Bot's archive page instead of keeping the one the board loaded for the previous Bot, which had left the newly selected Bot's Done column empty until the dialog was reopened ([#2070](https://github.com/ThinkFlowLab/FlyBot/issues/2070)).

## [0.2.19] - 2026-11-01

### Changed

- Project board: a role-pool entry in the team block reads `@id` beside its rank instead of a Dossier control — `project-team` answers rows keyed by the Project's own Bots, so the old pool click opened a dossier the host never sent; the Chief and my-agent rows keep theirs ([#1892](https://github.com/ThinkFlowLab/FlyBot/issues/1892)).

### Fixed

- The Project memory box now counts its 600-character bound in characters rather than UTF-16 units, so a note of 600 emoji — 1,200 units — is saved instead of refused as *A Project memory entry is at most 600 characters*, and 601 characters is still refused in both writers ([#1886](https://github.com/ThinkFlowLab/FlyBot/issues/1886)).
- The Project settings memory box warns about its bound before the click: a `N/600` counter under the field counts code points like the host, a 601st code point turns the counter and the Save button into their over-limit state, and an empty or whitespace-only box disables Save, so neither state calls `project-memory-write` or writes anything ([#1887](https://github.com/ThinkFlowLab/FlyBot/issues/1887)).
- CI now runs `node scripts/ds-bot-patches.mjs canonical`, which fails when `generate` would rewrite `patches/ds-bot/`: `check` proves the committed series applies and reproduces `core/`, not that it is the split the generator writes, so a drifted series landed green between #1883 and #1889. `npm run verify` runs the same gate. ([#1890](https://github.com/ThinkFlowLab/FlyBot/issues/1890))
- Host character limits count code points, so a character outside the BMP costs one instead of two ([#1895](https://github.com/ThinkFlowLab/FlyBot/issues/1895)): a memory entry at 300, a `MEMORY.md` at 4,000 and its size note, a scheduled task's name at 120, a Bot-to-Bot message at 20,000, and the Project memory entry at 600 in both writers now measure what a reader counts, and a refusal prints that code-point number.
- The Project board's wait label now carries seconds under a minute, so a card that waited 40 seconds reads `40s` instead of `0m`; the three duration metrics (PR merge time, issue close time, task completion) use the same label, and a span over zero never floors to `0s`. Unknown and negative spans still render nothing. ([#1896](https://github.com/ThinkFlowLab/FlyBot/issues/1896))
- An incident entry's `trigger`, `wrong` and `right` are bounded at 600 characters counted as code points, not UTF-16 units ([#1899](https://github.com/ThinkFlowLab/FlyBot/issues/1899)): 300 emoji no longer fill the 600 budget, a 600-character emoji entry is stored rather than refused as 1,200 units, and an entry already on disk that is over 600 UTF-16 units but within 600 characters loads again through the same check on the read path.
- Project board: the five-second refresh no longer re-reads the team dossier — `project-team` is read once when the board opens and handed back to each poll, so an open board stops re-reading persona and memory files (about 192 KB a minute) for an answer only an edit changes; a dossier that fails to read now leaves the rows, the done group and the tasks on screen with an empty team block instead of showing "No Project yet" ([#1900](https://github.com/ThinkFlowLab/FlyBot/issues/1900)).
- The task board's typed question and answer (2,000) and its handoff, evidence and lease bounds (300, 200, 200) now count characters rather than UTF-16 units ([#1901](https://github.com/ThinkFlowLab/FlyBot/issues/1901)), so a 2,000-character emoji question is accepted instead of refused as 4,000.
- `read_own_chat` now says what a cap left out instead of reading as the whole chat: a search that fills its 20 hits ends with `N more not shown; search with narrower words, or read around one of these anchors.`, and a bare read of a part with more than 12 messages is headed `newest 12 of 15, oldest first`. The caps stay; exactly at the cap nothing is added. ([#1906](https://github.com/ThinkFlowLab/FlyBot/issues/1906))
- A clipped or excerpted line no longer ends on half of an emoji ([#1907](https://github.com/ThinkFlowLab/FlyBot/issues/1907)): the host cuts `read_own_chat`, checkpoint and handoff lines, the memory review input and the error sentences on a code point boundary, so what a client receives is the whole character instead of a replacement character.
- Project board: a refused `project-team` read at open is no answer yet, not an empty team — the next five-second poll asks again, the block fills when the answer lands, and it stays frozen for the rest of the open; before this the refusal was normalised to `{ rows: [] }` and served by every later poll ([#1910](https://github.com/ThinkFlowLab/FlyBot/issues/1910)).
- A decision or a meeting archive no longer stores half of an emoji ([#1912](https://github.com/ThinkFlowLab/FlyBot/issues/1912)): the host's one `cut` helper stops a bounded prefix before the surrogate pair it would split, and every archive writer now uses it instead of `slice(0, max)` — `decisions.jsonl`, `decisions/<date>-<slug>.md`, and the claim line, diagnostics report, activity-feed label and browser text beside them — so the stored record round-trips through UTF-8 as the whole character instead of U+FFFD.
- The Project board's Dossier panel now re-reads the team dossier when it opens, so a memory head written
  after the board opened is one click away instead of stale until the board is closed and reopened. A
  refused refresh keeps the rows the panel already had, and the five-second poll still does not read the
  dossier.
- Eight more places stopped storing or showing half of an emoji ([#1916](https://github.com/ThinkFlowLab/FlyBot/issues/1916)): the claim cue's fallback reference, the task lead's name in a member's prompt, a failed group Session's error text, `read_own_chat`'s query and anchor, an open page's address and title, a diagnostics browser-log line, and a friend's Bot name now cut on a code point boundary. The rule itself moved to `core/src/shared/text-boundary.js`, so the shared label code and the host's `cut` use one implementation instead of two.
- The memory review now keeps whole characters in what it shows the model and writes to the log ([#1918](https://github.com/ThinkFlowLab/FlyBot/issues/1918)): the two bounds in `core/src/host/memory.js` — the 800-unit context line and the 3,000-unit two-ended user line — go through the shared boundary rule, so a cut that lands inside an emoji steps back instead of leaving half a pair, and the tail it keeps is never longer than the budget it had. The exported `clip` in `core/src/host/text.js` also makes its reason optional: a two-argument call now reads `… (cut)` instead of the literal `… (cut; undefined)`, while a call that passes a reason keeps `… (cut; <reason>)` byte for byte.
- The diagnostics report's stack summary stopped showing half of an emoji ([#1919](https://github.com/ThinkFlowLab/FlyBot/issues/1919)): the `<details><summary>Stack: …` line now cuts the message on a code point boundary, so the character the 80-unit bound would split is left out of the summary entirely and the line shows a whole-character prefix instead of ending in U+FFFD.
- A friend's Bot name no longer shows half of an emoji ([#1923](https://github.com/ThinkFlowLab/FlyBot/issues/1923)): the published name stored from the roster, the group member line, the room label `othersInRoom` returns and the envelope's name, handle, ownerName and roster fields now cut on a code point boundary, so such a value that straddles its 60 (or 40) cap keeps the whole character instead of U+FFFD. The envelope's message body and its fitTransport shrink loop are untouched.
- A room-share envelope keeps whole characters in the text it copies to another owner's FlyBot ([#1928](https://github.com/ThinkFlowLab/FlyBot/issues/1928)): the history line a join copies (bounded at 2,000 units on both the host that builds the envelope and the guest that copies it) and a line fitted to Bot Social's 4,000-character transport limit now stop before a character that straddles their bound instead of leaving half of it, so a guest no longer reads U+FFFD where the sender typed an emoji — a family emoji fitted to the transport reproduces the old break. The 18,000-unit bound on a line envelope's body goes through the same rule for consistency; it is not reachable on its own because the transport fit already shortens the body to 4,000.
- The host's own bounded lines no longer end in half of an emoji ([#1930](https://github.com/ThinkFlowLab/FlyBot/issues/1930)): the busy acknowledgment's 600-unit task text and 1,500-unit message text, `cleanName`'s 60-unit peer name (the one that lands in `fenceUntrusted`'s `from="…"` attribute), the `list_bots` group line's 100-unit notice and 120-unit job line, the group answer echo at 300 and a rework card's note at 200 now cut on a code point boundary, so a value whose cap falls inside a surrogate pair keeps the whole character instead of U+FFFD. Every cap is unchanged.
- A join to a shared room keeps the group notice even when the room's Bot roster has to shrink to fit ([#1932](https://github.com/ThinkFlowLab/FlyBot/issues/1932)): the roster used to be trimmed after the notice, and the notice was cut by the whole envelope's overflow, so a room with enough Bots emptied it and a guest never heard an edited or cleared notice — an explicit clear (an empty notice) was dropped along with it. The roster now gives its rows first, the notice is cut only by what is left over once the roster cannot give more, and a present empty notice arrives as the clear it is. No limit changes: a join still fits Bot Social's 4,000-character transport.
- A joined room's notice and the pane line copied from another owner's FlyBot keep whole characters ([#1933](https://github.com/ThinkFlowLab/FlyBot/issues/1933); [#1928](https://github.com/ThinkFlowLab/FlyBot/issues/1928) covered the envelopes, and these are the two host-side readers it left on a raw code-unit cut): the guest bounds the notice it stores at its own 2,000 units and the history line it draws at the same 2,000-unit bound it already stores, both by backing up to a code point boundary, so a text whose 2,000th unit is half of a surrogate pair no longer leaves that half in the notice or in the pane — it reads as U+FFFD no more. The pane used to be shown the sender's raw `entry.text`, longer than the line the guest's own log kept; it now draws exactly the bounded prefix the log holds.
- A peer name that arrives with half of a surrogate pair — a string JSON accepts but is not well formed — is now made well formed before it is cleaned, so the message header a person reads (`[Message from …]`), the `from="…"` attribute of an untrusted-message fence and the recorded `senderName` carry the replacement character instead of a lone half that would not survive a UTF-8 round trip. The same repair now happens when a shared room's envelope is parsed: the notice, a roster entry's name and owner name and a copied chat line are handed on well formed, so the room's standing prompt and the guest's copy of a line no longer carry a broken character. The 60-character name bound, the notice's 2,000-character bound and their code point boundaries are unchanged ([#1937](https://github.com/ThinkFlowLab/FlyBot/issues/1937)).
- The notice the host edits in a group's settings now reaches the friends' Bots already in the room ([#1939](https://github.com/ThinkFlowLab/FlyBot/issues/1939)): editing or clearing it pushes one room-share `join` with the same roster and only the notice changed, and a settings save that leaves the notice alone sends nothing.
- A peer's display name is now made well formed before it is cleaned: when a roster name, an owner or lead label, an inviter name or a face seat arrives with half of a surrogate pair — a string JSON accepts but that is not well formed — the label carries the replacement character instead of a lone half that shows as an empty box and does not survive a UTF-8 round trip. The 60-character name bound and its code-point boundaries are unchanged, so a name that is already well formed comes back exactly as it was ([#1940](https://github.com/ThinkFlowLab/FlyBot/issues/1940)).
- A line that arrives from another home with half of a surrogate pair in its body now has the body made well formed before it is used: the stored room line, the line the pane draws and the text handed to the Bot that was called all carry the replacement character instead of a lone half that would not survive a UTF-8 round trip. The line is still accepted and still calls that Bot — a broken character never silences a peer's message — and a body that is already well formed, including one with a real emoji, is passed through exactly as it arrived ([#1943](https://github.com/ThinkFlowLab/FlyBot/issues/1943)).
- A group's notice and name are now cut on a code point instead of a UTF-16 unit ([#1945](https://github.com/ThinkFlowLab/FlyBot/issues/1945)): a 2000-unit notice or a 60-unit name that ended in a whole emoji used to store a lone surrogate, which every encoder downstream turned into U+FFFD; the bound now drops the straddling character whole, the way every other cut in the host already did.
- A room whose roster had to shrink to fit one share envelope no longer drops the host's cleared notice ([#1946](https://github.com/ThinkFlowLab/FlyBot/issues/1946)): the roster now gives while the envelope overflows with the notice field in place, so an explicit empty notice — the host clearing it — reaches the guest as empty instead of disappearing and reading as "change nothing".
- A line that a remote seat writes into a room of this home is now made well formed before it is used: the stored room line, the line the pane draws and the text handed to the Bot the line calls all carry the replacement character instead of half of a surrogate pair that would not survive a UTF-8 round trip. The line is still accepted and still calls that Bot, and a body that is already well formed — a real emoji included — is passed through exactly as it arrived ([#1950](https://github.com/ThinkFlowLab/FlyBot/issues/1950)).

## [0.2.18] - 2026-10-31

### Added

- We worked a workflow (a workflow now belongs to a Project: its definition carries projectId, the run is bound when it starts, and Settings shows the Project) — [#1856](https://github.com/ThinkFlowLab/FlyBot/issues/1856).
- Every Project now gets its own Chief, created with the Project: the record carries `chief: { botId, sessionId, createdAt }`, the Chief Bot carries the Project binding, and `project-delete` retires it with the Project. It speaks for that one Project only, never for the user's main Chief (#1859).
- A Project's page now opens with its **Project team**: the Project's own Chief, the assistant that speaks for you there, and the role pool (Owner, Maintainers, Members) together with the rank you hold and the ranks you may switch to. Each of the two Bots opens that chat straight from the board, and a Project that has no Chief yet keeps the row and reads **Not set** instead of hiding it ([#1860](https://github.com/ThinkFlowLab/FlyBot/issues/1860)).
- A meeting can now record who a Project Chief or an owner's agent speaks for: positions carry `speaksFor`, the archived decision file names the proxy beside that position, and a `severe` decision is refused when one side rests only on a proxy whose person has neither taken a position nor been recorded silent ([#1861](https://github.com/ThinkFlowLab/FlyBot/issues/1861)).
- Workflows can now record a shadow verdict for a handoff before anything depends on it: the pool contract of #1853 runs on the handoff a caller passes to `assign`, and the answer lands on the run record as `shadow: { verdict, code?, reason? }` and as one `shadow: <verdict>` line in the run's own stage log. Nothing reads it — the run, the card and the pull request fast lane behave exactly as they did, which is the point of the shadow step ([#1862](https://github.com/ThinkFlowLab/FlyBot/issues/1862)).
- The Project board shows each Project Bot's dossier — persona, memory head and topic names, and attached skills — from one read-only `project-team` read, with a `Dossier` control on the Chief, my-agent and role-pool rows; the owner's own Bot chat header now has an entry that opens the Project assistant's chat, without un-hiding it in the global Bot list ([#1864](https://github.com/ThinkFlowLab/FlyBot/issues/1864)).

### Fixed

- Settings → Workflows follows a live run instead of freezing at the moment the page opened: while any workflow has work running the page re-reads `workflow/state` every 2 seconds — the room drawer's own beat — so a step that goes running → done changes its chip without reopening the page, an edit in progress suspends the refresh, and the page stops asking when the last run finishes or it is closed ([#1810](https://github.com/ThinkFlowLab/FlyBot/issues/1810)).
- The Project board's queue rows beside the columns now read **运行中** for a live claim and **已停滞** for a stalled one in the Chinese interface, instead of printing the host's lowercase `running`/`stalled` ids ([#1813](https://github.com/ThinkFlowLab/FlyBot/issues/1813)).
- The Project role switch answered `bot/not-found: Unknown endpoint project-role` on a host with a
  member session: `channel.js` dispatched it and `store.js` implemented it, but authz's explicit
  `TASK_ENDPOINTS` list never named it, so the gate refused before the handler ran. It is listed
  there now, with a guard test that holds every endpoint the channel dispatches to a gate answer
  that is not "unknown endpoint".
- A Project role name is now matched against the rank table's own keys instead of the prototype chain: `toString`, `__proto__` and `constructor` answer `unknown-role` and leave the record untouched, where they used to demote a Maintainer to Member and report success ([#1838](https://github.com/ThinkFlowLab/FlyBot/issues/1838)).
- A Main Bot can no longer rewrite, retire or stop another owner's Bot. On a deployment where the owner rule is enforced, `update_bot`, `archive_bot` and `stop_bot` now accept a target only when it belongs to the Bot's own owner or is granted to that owner — the same rule `list_bots` and the HTTP side already kept — so the instructions, retirement and running turns of another owner's Bot stay untouched ([#1844](https://github.com/ThinkFlowLab/FlyBot/issues/1844)). The three refusals also read one sentence, `No Bot named <name>.`, whether the Bot is missing or foreign, and no longer name the rest of the team. Single-owner installs behave exactly as before, and the refusal text is aligned with no other behaviour change.
- Project settings now shows the caller's own **Pause the daily digest** switch: the panel read a field the Project record never carried, so a digest its owner had paused always opened unticked, and pressing **Save** on that row sent `off: false` and quietly resumed it the next morning. `project-read` now answers the caller's own assistant record (`assistantMine`) beside the Project, the panel reads the box from it, other owners never see each other's switch, and a Save that changes nothing no longer writes or sends `schedule-resume` ([#1845](https://github.com/ThinkFlowLab/FlyBot/issues/1845)).
- Project Assistant: the 09:00 digest now reads the Project's own board instead of an actor-less one, so a signed-in install no longer gets "no change since the previous digest" every day and the archived watermark stops hiding finished cards ([#1846](https://github.com/ThinkFlowLab/FlyBot/issues/1846)).
- The Project memory box now refuses what the Project Assistant's own writer always refused: an empty entry is answered with *A Project memory entry needs text* and one over 600 characters with *A Project memory entry is at most 600 characters*, in the interface language in the panel, and neither writes a row or touches the Project. Before this the endpoint stored a blank entry, or cut a long one to 600 characters, and still reported success ([#1847](https://github.com/ThinkFlowLab/FlyBot/issues/1847)).
- The Project board's running table now reads the cards of the board it belongs to instead of the whole deployment's task store, so another Project's claimed card no longer hands out its title and holder; the same list is carried by every branch of the metrics read, so the table stays populated when the GitHub source is unavailable or fails, and the done-task median is this board's cards too ([#1848](https://github.com/ThinkFlowLab/FlyBot/issues/1848)); a five-minute cache entry shared by two Projects on the same repository no longer hands one Project's done-task median to the other ([#1880](https://github.com/ThinkFlowLab/FlyBot/pull/1880)).
- An unknown `timeZone` in a Project board read no longer takes the whole board down: the zone is resolved once in `project-metrics.js`, an unknown name falls back to the named `UTC`, and the answer says which zone it used (`timeZone`), while rows, queues and decisions keep answering and a valid zone reads exactly as before ([#1849](https://github.com/ThinkFlowLab/FlyBot/issues/1849)).
- Expanding **Projects** in the left sidebar now lists the Projects you can see, each with the role you hold there, and a right-click can switch that role: the sidebar had been asking the host for an endpoint that does not exist, so the list was empty on every deployment. The duplicate **Project board** button is gone from the Tasks dialog, so a Project opens from the sidebar only ([#1854](https://github.com/ThinkFlowLab/FlyBot/issues/1854)).
- The Project board no longer opens on a wall of finished work: a Project with months of history shows the cards still in flight, and every finished card lives in one **Done cards** group that starts collapsed, with the header still counting them (`Done: 191`). Only the finished column left the rows — a rework, blocked or waiting card is still a row, and the queue groups, the row shape and the metrics are unchanged ([#1855](https://github.com/ThinkFlowLab/FlyBot/issues/1855)).
- A workflow no longer ends early because an output value merely contains `open-pr`: a declared OUTPUT now counts `open-pr` (and `tip-unchanged`) only as a whole word, so a triage brief that names `data-open-project` lets the run continue to Claim instead of finishing with every successor still queued ([#1866](https://github.com/ThinkFlowLab/FlyBot/issues/1866)).
- A Workflow step that runs past its lane's `stepTimeoutMinutes` is now reported as having reached its deadline (`step deadline reached (45 min)`) instead of `no reply for 45 minutes`, so a step that was still working no longer reads as a Bot that went silent; the stage line and `run.failure` carry that wording, and the `define_workflow` tool accepts `stepTimeoutMinutes` (1–120) so a new lane does not silently inherit the 45-minute default ([#1868](https://github.com/ThinkFlowLab/FlyBot/issues/1868)).
- `workflow/assign` now delivers the brief it is given. The brief is stored on the task, kept on a parked card (so `workflows.json` and `workflow/state` show what the node was actually told) and handed to the node as its instruction, with the title used only when no brief is given; `run_workflow` treats a brief the same way and takes its title from the brief's first line, and a field `assign` does not read is now named back in `ignored` instead of being dropped in silence ([#1869](https://github.com/ThinkFlowLab/FlyBot/issues/1869)).
- The Project board's task-completion median now counts a card the way the task store finishes it — `status: 'accepted'`, timed from the last terminal `actors[]` entry — instead of the `completedAt` field the store never writes, so the number stops reading `—` on a real deployment ([#1884](https://github.com/ThinkFlowLab/FlyBot/issues/1884)).

## [0.2.17] - 2026-10-31

### Added

- Projects gain the three roles the governance matrix names, and a way in: the Owner is derived from `ownerUserIds` (an older record without `roles` reads owner-only), `project-role` sets a Maintainer or Member only after the host re-checks who may re-role whom, refusing `not-owner` / `cannot-self-promote` / `last-owner` without touching the record. The sidebar's **Projects** row now expands to the Projects you can see with your role there and opens that board straight, and its right-click **My role** menu offers only the ranks the host says you may switch to.
- Project board: seven metrics (today's opened/merged PRs and issues, 7-day medians) and a running-task table, read from GitHub REST plus the local tasks behind a 5-minute cache. A missing credential or a failed read renders \`—\`, never \`0\`.
- Decision cards carry a level (ordinary, major, severe) and the people they are addressed to; a severe card never advances on its own and says why. The Project board shows the level badge and recipients, and a card row names its claim holder and the user the Assistant speaks for.

### Fixed

- A Bot Social read served from the channel answers only for the Bot the actor owns: a `body.botId` the actor does not own is refused with `bot/forbidden` before the handler registers that Bot's identity or syncs its grants ([#1788](https://github.com/ThinkFlowLab/FlyBot/issues/1788)).
- A Project board lists a decision file archived in the Session's working folder, not only a file in the Project's own folder: the meeting record now names the folder it wrote to, and the board reads the union of the Project folder and each decided meeting's file ([#1809](https://github.com/ThinkFlowLab/FlyBot/issues/1809)).
- The Project board now reads itself again every five seconds while it is open: a lease that expires during the visit turns its card `stalled` and a card that moves from waiting to in flight moves too, without closing and reopening the page; a poll that fails keeps the last good board on screen, and reads pause while the tab is hidden or a row's own board is open ([#1814](https://github.com/ThinkFlowLab/FlyBot/issues/1814)).
- Retiring a Bot now disarms the tasks armed in the group Sessions it speaks through as well as those in its own chat; a group's own reminders are left untouched ([#1816](https://github.com/ThinkFlowLab/FlyBot/issues/1816)).
- The Project settings panel's **Save memory** button now saves: it sends one of the two memory kinds the host knows (the free text is recorded as a decision) instead of a `note` kind the host refused, so the success line appears and the entry reaches the Project Assistant's memory. A refusal the panel can surface is shown in the interface language instead of the host's English sentence ([#1820](https://github.com/ThinkFlowLab/FlyBot/issues/1820)).
- A line typed in a Bot's own chat while its turn is running now reaches that turn at its next step instead of waiting as a separate queued turn, so a mid-run correction changes what the Bot does next ([#707](https://github.com/ThinkFlowLab/FlyBot/issues/707)).

## [0.2.16] - 2026-10-30

### Added

- Settings has a **Projects** page beside Bots and group chats ([#1766](https://github.com/ThinkFlowLab/FlyBot/issues/1766)): create a Project with a name and an optional working folder chosen from the folder picker, open its board from the row, and bind or unbind a Bot or a group. A Project-less board now offers the page that creates one instead of a dead end.
- The Project board now lists the Project's decisions beside its cards: every `decisions/*.md` file in the Project's working folder with its date, title line and sha256, and the meetings that reached `decided` — a meeting still deliberating or blocked is listed apart and never as a decision. A folder with no decision file says which folder was read instead of drawing an empty box, and a decided meeting whose file was deleted stays listed with no path.
- The Project board now shows the work beside its columns: cards waiting for a role (oldest wait first, with the role and how long), the member holding each card and whether its lease is live or stalled, and blocked cards with their one-line reason, plus waiting / in flight / blocked / done counts in the header. An unreadable queue reads "unknown", never 0 ([#1768](https://github.com/ThinkFlowLab/FlyBot/issues/1768)).

### Fixed

- Retirement now reaches the host paths that resolved a Bot without `findTeamBot`: a retired Bot takes no task, group turn, capability, memory write, new or resumed schedule, or held or restarted delivery, the task drive no longer wakes it, and `archive_bot` pauses the tasks armed on its own chat and fails the cards it still holds ([#1709](https://github.com/ThinkFlowLab/FlyBot/issues/1709)).
- The Workflow stage drawer's Edit plane no longer squeezes a two-Bot parallel step: a pair the drawer's fitted plane left 4px apart is now drawn at the row width the Read-only Flow tab gives it, so the Reviewer and Tester cards keep their gap and neither card's out-port or remove button lands under its neighbour, while the parallel frame encloses both cards and the "Parallel branches · Merge after all pass" label stays on one line inside the 364px panel ([#1738](https://github.com/ThinkFlowLab/FlyBot/issues/1738)).
- A member keeps its one work slot free once its result is delivered for acceptance, so the next queued item is offered to it instead of stalling a one-member role; a `result-ready` (or blocked) card no longer counts as work in progress ([#1744](https://github.com/ThinkFlowLab/FlyBot/issues/1744)).
- Project board: the **Project settings** and **Members** buttons now open panels ([#1749](https://github.com/ThinkFlowLab/FlyBot/issues/1749)). Settings saves bindings, the Project Assistant's digest setting and its memory through the existing host write paths; the Members panel lists the Project's owners and the members its cards name, read-only for now.
- The Project board now opens as a real modal: a dimming scrim sits in front of the board and covers the shell, so the bot tree and workflows no longer read as extra board rows, and a click beside the board closes it ([#1750](https://github.com/ThinkFlowLab/FlyBot/issues/1750)).
- A Project whose assistant was created while DSH automation tasks were off kept `error: "Automation tasks are off in DSH"` forever: switching automation back on left Scheduled tasks empty, and calling `project-create` again answered `created:false` without scheduling ([#1751](https://github.com/ThinkFlowLab/FlyBot/issues/1751)). The assistant now reconciles every Project whose assistant exists without a `scheduleId` — when the schedule service comes online and on a repeated `project-create` — writing the 09:00 Asia/Shanghai digest once and clearing the recorded error.
- Settings → Workflows now fits the authored graph into the canvas instead of clipping it: one scale on a wrapper shrinks cards, the dashed parallel frame and the wires together (never past half size), and the frame is drawn around every member, so a parallel card the editor stored lower stays inside its branch box, its status chip is no longer cut to `Q…`, and the Claim → 取证 wire ends inside the canvas instead of on the clip line ([#1752](https://github.com/ThinkFlowLab/FlyBot/issues/1752)).
- The room's Flow panel now paints the last run's node statuses for an idle workflow, the same statuses Settings → Workflows draws, instead of showing every node as Queued; a workflow that never ran shows Idle in both views ([#1753](https://github.com/ThinkFlowLab/FlyBot/issues/1753)).
- The `meeting` tool archives a decision that lists the cards it produced: the file now carries `- Tasks:` with the produced ids in order, every produced task is pre-flighted before anything is written (a refused or unauthorized task leaves no card, no temp file and no decision file behind), the day's second decision takes the next free name (`…-2.md`) instead of refusing `exists`, and a blocked meeting can be resumed with an answer and then decided, while a decided one stays closed ([#1754](https://github.com/ThinkFlowLab/FlyBot/issues/1754)).
- The Project Assistant settings — the digest opt-out, the quiet window and the zone — can now be written by the Project's owner from the product: `project-assistant-owner` is dispatched by the host channel and authorization-checked like the other Project writes, so a non-owner gets `bot/forbidden` instead of `Unknown endpoint` ([#1759](https://github.com/ThinkFlowLab/FlyBot/issues/1759)).
- A meeting that cannot archive its decision no longer leaves a card behind: the archive folder is claimed before any produced card is created, so an unwritable `decisions/` folder fails the decide with no card, no decision file and the meeting still open, and an attempt that fails after the cards exist keeps their ids on the meeting record so a retry reuses that card instead of creating a second one ([#1763](https://github.com/ThinkFlowLab/FlyBot/issues/1763)).
- Renaming a face-to-face room no longer fails with "A group chat needs at least two Bots": the host applies that floor only to a patch that actually changes membership, so a name, notice or reply-mode edit goes through in a face-to-face or inbound-share room while a normal room's membership patch still needs two Bots ([#1764](https://github.com/ThinkFlowLab/FlyBot/issues/1764)).
- Settings → Workflows no longer cuts off the left side of a graph that is too wide for the canvas: below the half-size floor the leftover width is reserved on the left of the stage instead of spilling out of both edges, so the leftmost card and the dashed frame are drawn where they can be seen and the rest scrolls to the right — a scroller cannot scroll left of zero, which is why those pixels could not be brought back before ([#1769](https://github.com/ThinkFlowLab/FlyBot/issues/1769)).
- A Workflow step that ends without printing a declared `OUTPUT` its next gate reads now fails the step and the run instead of closing as `✓ 完成`: the downstream branch is held rather than skipped, and the run record names the step and the missing contract (`Missing OUTPUT verdict`), so "upstream emitted nothing" is no longer indistinguishable from "upstream emitted a non-PASS verdict" ([#1773](https://github.com/ThinkFlowLab/FlyBot/issues/1773)).
- A meeting is now a record on disk instead of a decoration of the live process: every write of the `meeting` tool (`open`, `position`, `decide`, `block`, `resume`) reaches the team file before the tool answers, so reopening the app shows the meeting in the state the caller was told — the `core-host` contract that a meeting survives a restart now holds for every write verb. A decided meeting stays `decided` — a retry made by a reader that saw it as `deliberating` is refused with `closed` instead of writing a second `decisions/…-2.md` and a second card — and an open meeting keeps its recorded positions. A decision also saves the ids of the cards it produced before anything further is written, so a restart between the cards and the archived file keeps those cards instead of doubling them ([#1774](https://github.com/ThinkFlowLab/FlyBot/issues/1774)).
- Fix the team run report printing `1000.0k` for a count between 999,950 and 999,999; it now carries into the next unit and reads `1.0M` ([#1779](https://github.com/ThinkFlowLab/FlyBot/issues/1779)).
- The timeline report's `## Team` roll-up now names the same Bots its own per-Bot sections flag: a Bot whose failed turns began before the window (so it has more failures than turns inside it) appears under `needs a look` again instead of being dropped while its section still reads `3 of 3 turns failed` ([#1780](https://github.com/ThinkFlowLab/FlyBot/issues/1780)).
- Bot Social no longer prints `1024.0 KB` for a file just under a megabyte: a size that rounds up to 1024 KB is shown as `1.0 MB` ([#1782](https://github.com/ThinkFlowLab/FlyBot/issues/1782)).
- The timeline panel no longer prints a duration its own unit cannot hold: a turn that took 59.999 s reads `1m 00s` instead of `60 s`, and 9.999 s reads `10 s` instead of `10.0 s` ([#1783](https://github.com/ThinkFlowLab/FlyBot/issues/1783)).
- A retired Bot is no longer billed a memory review or have its archived memory rewritten when another member's turn ends; a live lagging member is still reviewed ([#1786](https://github.com/ThinkFlowLab/FlyBot/issues/1786)).
- The timeline report no longer prints its own window backwards when the range crosses local midnight: `Window: 23:50–00:10` and the one-line summary now read `23:50–00:10 (+1 day)`, while a range inside one local day keeps exactly the text it had ([#1787](https://github.com/ThinkFlowLab/FlyBot/issues/1787)).
- Settings → Workflows no longer draws a node the run skipped as **Queued**: the chip now says **Skipped**, the same word the Room's Flow panel uses for that node, so a run with an untaken branch no longer reads as stuck ([#1789](https://github.com/ThinkFlowLab/FlyBot/issues/1789)).
- A Bot retired with `archive_bot` now leaves the tree panel the way it already left the sidebar's own tree, and it is listed in the Archived section with a `retired` tag, so its chat stays reachable instead of the retirement looking like it did nothing ([#1793](https://github.com/ThinkFlowLab/FlyBot/issues/1793)).
- The timeline panel no longer understates a wait when you look back: in an **Earlier** window an unanswered request's label and row measured to the window's right edge, so a request still waiting read `waiting 2.0 s` where it had waited `4.0 s`; the wait is now measured to the present, while the line itself still stops at the edge ([#1797](https://github.com/ThinkFlowLab/FlyBot/issues/1797)).
- A retired Bot no longer keeps a task armed in an earlier part of its own chat: archiving now disarms every part it owns, not only the current one ([#1799](https://github.com/ThinkFlowLab/FlyBot/issues/1799)).
- Retiring a Bot now clears its sharing, so a friend's Bot that was granted the record can no longer wake it from outside ([#1801](https://github.com/ThinkFlowLab/FlyBot/issues/1801)).
- A card waiting for its rework keeps its holder when its lease expires instead of being returned to the role queue: the open rework child is the card in flight, so the original is not re-offered to the role that sent it back and cannot be taken again by its producer ([#1804](https://github.com/ThinkFlowLab/FlyBot/issues/1804)).

### Security

- The four Project endpoints that delete a Project or expose and change its assistant memory — `project-delete`, `project-memory`, `project-memory-write` and `project-assistant-owner` — now ask the Project's owner first: a signed-in member who does not own the Project gets `bot/forbidden` and the Project, its private memory and the other owner's digest settings are unchanged, instead of a deletion, a read of another member's memory, a write into the digest's source, or a rewrite of another owner's quiet window and opt-out ([#1740](https://github.com/ThinkFlowLab/FlyBot/issues/1740)).

## [0.2.15] - 2026-10-30

### Added

- A task card now carries a typed contract: `taskClass` (`work`, `rework`, `release`, `triage`, `meeting`), `reworkOf` for a card that fixes a rejected one, `handoff` naming the roles it moved between and why, `evidence` for the sha/PR/check pointers that prove the work, and `lease` for the claim on it. Every field is validated on write and refused by name, a review rejection opens exactly one rework card beside the original instead of flipping its status, an expired lease returns a queued card to the queue while a live one refuses a second claim naming the holder, and the Project board reads the same row without a second copy. A card stored before this slice reads back unchanged ([#1720](https://github.com/ThinkFlowLab/FlyBot/issues/1720)).
- Role queues now carry a stated cap (8 by default, override per graph), every claim runs in its own worker with no shared state, and one owner recovers an expired lease — once — recording it on the card's evidence.
- A Project board card now carries an `audit` block: the handoff, the evidence, the rework chain and the current lease rendered from the task record itself, with no new endpoint or page. A rework cycle is counted as one accepted delivery instead of two, so the counters no longer double after a rejection.
- Meetings are now recorded in FlyBot: a meeting moves `open → deliberating → decided | blocked`, requires a position from every invited participant and a named decision owner, archives one `decisions/<date>-<slug>.md` on `decided` (and nothing on `blocked`), and creates the follow-up tasks with that file as evidence ([#1731](https://github.com/ThinkFlowLab/FlyBot/issues/1731)).
- Each owner of one Project now gets their own 09:00 digest, built from one board read with their own memory and their own decisions list, with a per-owner quiet window that holds a due digest and delivers it once when the window ends, an opt-out that stops generation and pauses the 09:00 task until it is turned back on, a refusal that names the boundary when one owner asks for another's memory, and failure isolation so one owner's broken render still leaves the other owner's digest delivered ([#1733](https://github.com/ThinkFlowLab/FlyBot/issues/1733)).

### Fixed

- The Inbox no longer shows a task that was never started as "In progress", and no longer ages it from its creation: the Inbox and the Board now read one task row, so the status label and the counter agree and a card's age comes from the moment the row started.

## [0.2.14] - 2026-10-30

### Added

- A Bot that needs `PROJECT.md`, `ROADMAP.md`, `docs/governance.md`, a decision file or `LESSONS.md` can now read it through the `project_state` tool, which lists the Project State files of its working folder with a sha256 content hash, byte size and last-modified time, or returns one file whole up to 200,000 bytes. A missing file, an oversized file and a folder without `.git` each answer with the reason instead of an empty string ([#1702](https://github.com/ThinkFlowLab/FlyBot/issues/1702)).
- A Project now has a board of its own: one read-only view over the work under it, grouped by where it lives (Bots, groups, workflow runs), showing each row's column, assignee and the run and node it came from, with every row opening the task it comes from. A Project with nothing under it says so instead of failing. Only the Project's owner sees the management controls, and the host refuses a binding or a Project change from anyone else rather than relying on the page to hide a button. Open the board at `#project=<id>` ([#1710](https://github.com/ThinkFlowLab/FlyBot/issues/1710)).
- A Main Bot can retire a Bot with `archive_bot`: it leaves the tree (freeing a `maxChildren` slot) and the default Bot list, while its chats, memory and history stay readable and it can be restored. Deleting a Bot stays the owner's own action in the UI ([#638](https://github.com/ThinkFlowLab/FlyBot/issues/638)).
- A Project now carries its own assistant: one hidden Bot and Session, memory private to that Project (decisions, open questions, the last digest), and a 09:00 Asia/Shanghai digest that answers what merged, what closed, what is still in progress and on whom, and the next slice, from the Project State files and the board rows only. It posts as the install's own GitHub account and never as the shared app: with no connector signed in, or on a host with more than one member, it refuses and escalates, and every write names the assistant and the login it posts for. Deleting a Project removes its assistant, its schedule and its memory ([#1712](https://github.com/ThinkFlowLab/FlyBot/issues/1712)).

### Changed

- The workflow stage drawer now looks like the rest of FlyBot: the Bot details drawer's title, role line and pill tabs, soft pill buttons, chat-bubble node cards and run card, the system font stack, and accent tints mixed from the theme's `--bt-accent` instead of a fixed blue, so every theme recolours it ([#1654](https://github.com/ThinkFlowLab/FlyBot/issues/1654)).
- A Bot that is busy now acknowledges a new message with one short, natural sentence written by a quick model call, in the message's language, instead of a templated line that quoted a truncated piece of the message; when the model does not answer within 3 seconds only the pending dots show ([#1665](https://github.com/ThinkFlowLab/FlyBot/issues/1665)).

### Fixed

- A Bot turn the provider refused with a requests-per-window `429` (`Limit type: requests`, `Remaining: 0`) is now asked again after a backoff — 2 s, 8 s and 30 s — instead of spending the turn, and the group round or sender keeps waiting for the same exchange. A refusal that outlasts every attempt ends the turn once, in the visible failure line the chat already draws, naming the provider text. A budget or quota refusal is not asked again ([#1308](https://github.com/ThinkFlowLab/FlyBot/issues/1308)).
- The new-task form in Scheduled tasks no longer opens with the first Bot already chosen: the **Send to** picker starts on "Pick a Bot or group chat", and **Create task** stays disabled until a Bot or group chat is picked, so a task can no longer be created for whoever sorts first on one click ([#1334](https://github.com/ThinkFlowLab/FlyBot/issues/1334)).
- Retrying a Workflow task no longer leaves two indistinguishable run rows: every attempt keeps its row, the older finished attempt is marked `superseded by <run>` and the newer one `retry of <run>`, and the room opens on the newest attempt for that task. Two live attempts for one task are both shown unmarked. ([#1507](https://github.com/ThinkFlowLab/FlyBot/issues/1507))
- A human message sent while a foreground tool or job wait has been open for more than 60 seconds now stops that turn the way **Stop** does and keeps the message in the inbox, so the line is claimed at once instead of waiting for the command to finish. Shorter waits, finished waits, group rooms and idle Bots are untouched ([#1509](https://github.com/ThinkFlowLab/FlyBot/issues/1509)).
- A run that ended early on `needs-human`, `already-claimed`, `tip-unchanged` or `open-pr` no longer reads as a failed step: the run log ends with `⏹ 提前结束 · <reason>` and still quotes the Bot's reply, instead of saying the node failed and stopped there ([#1577](https://github.com/ThinkFlowLab/FlyBot/issues/1577)).
- A Workflow node that names no model now runs on the profile default whichever surface started the run, so the same graph no longer changes model, cost and tool capability with whoever pressed start; the connector ceiling and the refusal of a run started by a friend's Bot still hold ([#1582](https://github.com/ThinkFlowLab/FlyBot/issues/1582)).
- The face-to-face room no longer closes itself a few seconds after `face-start`: one snapshot that lists no peer no longer counts as every other home leaving, so the room ends only when two polls in a row find no other home, or the server sends the leave event. Seats a room has listed are remembered per room, so a dropped peer no longer looks like a room of one ([#1606](https://github.com/ThinkFlowLab/FlyBot/issues/1606)).
- The room approval dock no longer tells you another owner is waiting when the card is yours: the "Waiting for the owner's approval" card (no buttons) now waits until both approval lists it polls have answered and neither holds a card for this room, so a list that is one 5 s poll behind leaves the dock quiet instead of hiding your own Approve / Reject buttons ([#1607](https://github.com/ThinkFlowLab/FlyBot/issues/1607)).
- An attempt a Workflow graph edit stops no longer loses its `superseded by` marker: the history row that edit writes now carries the id of the run it ended, so once the same task is handed to the workflow again the Runs tab names the stopped attempt as superseded by the retry. A legacy demo record that stores a run id keeps it in the migrated row too ([#1611](https://github.com/ThinkFlowLab/FlyBot/issues/1611)).
- A face room no longer closes itself when the member list is still catching up: the "everyone left" count advances only on a poll, so the `face-start` response no longer spends its one poll of slack and a single lagging poll after **Enter chat** keeps the room open. The second agreeing poll, or a snapshot carrying the leave, still ends it ([#1612](https://github.com/ThinkFlowLab/FlyBot/issues/1612)).
- A run Bot the host could not remove after a Workflow run ended, was stopped, or the app closed is no longer forgotten: its id stays on the run record, so the next load retries the removal instead of leaving a hidden Bot that no screen can find again. ([#1616](https://github.com/ThinkFlowLab/FlyBot/issues/1616))
- Workflow room Runs tab keeps the HH:MM clock in its own column with a gap before the status chip, and a Failed row without a host reason shows the Failed chip once instead of also painting a clipped red F.
- Deleting a workflow, and a graph edit that ends a running node, no longer drop a run Bot's id before the release that can fail: an id the host would not remove stays on the archived run or in the store's own `orphans` list, and the next load's reap retries it instead of leaving a hidden Bot no state names.
- After a message is sent on DeepSeek Harness 0.2.1, the Bot avatar and shimmering status line under the transcript show again: the activity row finds `RunningStatus` even when it sits inside the `conversation.chat.flow` slot ([#1626](https://github.com/ThinkFlowLab/FlyBot/issues/1626)).
- The busy-ack bubble no longer repeats one canned sentence. While a Bot is working, a new message gets a short one-line ack composed on the spot from what you wrote and what the Bot is doing (e.g. 「看到你说「帮我改周报」了，我正在跑命令，弄完马上接上。」), in the language of your message, with varied wording that never repeats the previous ack — still instant, no extra model call ([#1629](https://github.com/ThinkFlowLab/FlyBot/issues/1629)).
- Deleting a Workflow no longer leaves its task claim behind, so the task matches again on the next board write instead of failing with `No such workflow`; a store that already holds a claim for a deleted Workflow drops it when the plugin loads. ([#1632](https://github.com/ThinkFlowLab/FlyBot/issues/1632))
- The busy ack now quotes your own message exactly: typing `{d}` or `{t}` in a line no longer makes the ack swap in the running tool's words (or drop it) ([#1634](https://github.com/ThinkFlowLab/FlyBot/issues/1634)).
- An opened thinking row no longer prints its first line twice: the folded row still names a line of its reasoning next to 思考过程, and once you open it that preview steps aside so only the full text below shows the sentence ([#1636](https://github.com/ThinkFlowLab/FlyBot/issues/1636)).
- A room's own pending approval card is no longer announced as "Waiting for the owner's approval": the dock also reads the room's own `pendingApprovals` — the array its `pendingCount` counts — so the one 5 s poll where its own lists are behind stays quiet instead of hiding your own Approve / Reject buttons, while a card it never draws (decided on its reply bubble or in the Bot's chat) keeps the waiting line ([#1638](https://github.com/ThinkFlowLab/FlyBot/issues/1638)).
- The "Waiting for the owner's approval" card in a group chat now says where the room's approval is decided: in a Bot's chat, with one button that opens it, or on the reply bubble above it, which is already on screen. When the dock cannot place the card it says only what it said before ([#1640](https://github.com/ThinkFlowLab/FlyBot/issues/1640)).
- The folded thinking row's one-line preview now skips fences and horizontal rules, cuts on a character boundary instead of halving an emoji, and ends a clipped line with an ellipsis; reasoning that is nothing but markup says how many lines it has instead of showing a fence fragment ([#1642](https://github.com/ThinkFlowLab/FlyBot/issues/1642)).
- A tool result now closes its foreground wait, so the 60-second steering line only aborts a turn that is genuinely waiting: a human line that arrives after a turn has merely been running for a while, with every tool already returned, no longer interrupts it. The Bot's "running tool" chip also clears as soon as the tool returns. ([#1644](https://github.com/ThinkFlowLab/FlyBot/issues/1644))
- A member Bot busy with a tool in a group chat now acknowledges a person's line there, the same one short line the own-chat path already speaks (`#1646`). The ack is keyed by the member's room Session and drawn on that member's row in the room flow — the host's line, or the same blinking indicator #1656 draws while that line is still on its way, never a fixed sentence; a line that reaches no running member, and every own-chat case, is unchanged.
- A Workflow no longer keeps a task forever: when the card's own fields later name another live Workflow or local Bot, its stored claim and route are dropped and the card is matched again, so the task moves instead of staying on the old target. Re-ingesting the same target is still a no-op, and a trigger or a card that names nothing leaves the claim alone. The Workflows panel now lists, per Workflow, the task ids it holds (bounded to 20 ids plus a count) and gives each one a Re-match action that drops just that claim through the existing ingest call, with no second polling loop. ([#1647](https://github.com/ThinkFlowLab/FlyBot/issues/1647))
- A person's line in a group room now lets a member's 60-second wait go instead of being held until it returns: when the member turn the round is waiting on has had a tool running for over a minute, the host ends that turn the way Stop does and the next round answers the line, while the person's message waits in the room's own queue. ([#1650](https://github.com/ThinkFlowLab/FlyBot/issues/1650))
- Editing only the name of a scheduled task no longer rewrites its repeat: an interval that is not a whole number of minutes, such as 90 seconds, now reads as **Every 90 seconds**, the form holds that exact value in its seconds unit, and saving a task whose repeat was not touched leaves the stored interval alone instead of rounding it to 2 minutes ([#1651](https://github.com/ThinkFlowLab/FlyBot/issues/1651)).
- The workflow drawer's flowchart is laid out from its steps again: nodes and the parallel-branch frame no longer fall back into normal flow (a CSS order bug kept them `position:relative`), wires are routed orthogonally from the drawn and measured node boxes with one fork and one join point, the graph fits the drawer width, and a long run summary is clamped to three lines with a Show more toggle ([#1652](https://github.com/ThinkFlowLab/FlyBot/issues/1652)).
- The busy-ack bubble no longer falls back to the fixed line 「看到了，这步做完就接着处理你这条。」 while the host's acknowledgment is on its way: it shows only the Bot's mark and a short blinking indicator, and the host's context-aware line replaces it when it arrives ([#1656](https://github.com/ThinkFlowLab/FlyBot/issues/1656)).
- A line a person sends to a group room while a member is being let go is no longer dropped: it stays queued for the room, nothing is steered into the stopping member, and the round answers it exactly once ([#1664](https://github.com/ThinkFlowLab/FlyBot/issues/1664)).
- Steer now lets a busy Bot's long tool wait go after 60 seconds in the case it was built for: a person's line reaches the Session as `agent/inbox/spliced` while the tool blocks, so the own chat and a group room both stop the wait instead of holding the line until the command finishes. The line still waits in the inbox and is answered at once ([#1666](https://github.com/ThinkFlowLab/FlyBot/issues/1666)).
- The drawer's Edit tab keeps a parallel step's cards apart: in a 364px drawer three or more branches used to be fitted onto each other, so the later card took the click and a branch's out-port could not start a wire. While a parallel layer's cards do stay apart the plane draws exactly what it drew before, and a two-branch graph is unchanged ([#1677](https://github.com/ThinkFlowLab/FlyBot/issues/1677)).
- A person's line sent to a busy Bot is acknowledged the moment it arrives, not only when the turn gets round to claiming it: the ack is composed from the inbox splice DSH writes on arrival, and the later claim no longer composes a second one for the same line ([#1678](https://github.com/ThinkFlowLab/FlyBot/issues/1678)).
- Pressing **Stop** while a requests-per-window `429` had a Bot's answer waiting on a backoff timer now drops that wait: a stopped round is not asked again, so it costs no model call and no tools, and the answer it would have produced is no longer thrown away afterwards. A stop that lands after the retry already went out still cancels the running turn, a `429` with no stop retries exactly as before, and a retry a newer turn in the same Session is already waiting on is left alone ([#1679](https://github.com/ThinkFlowLab/FlyBot/issues/1679)).
- A busy Bot acknowledges a person's line once, not twice: the line id ledger that keeps one line from earning a second model call now outlives the ack entry, which the end of the turn clears, and is bounded — its fixed-size filter is rebuilt before it saturates, so a long-lived chat keeps getting acknowledgments ([#1684](https://github.com/ThinkFlowLab/FlyBot/issues/1684)). A person's line sent to a member that is speaking in a room is acknowledged at arrival too, instead of waiting for the claim the relay never makes ([#1646](https://github.com/ThinkFlowLab/FlyBot/issues/1646), [#1678](https://github.com/ThinkFlowLab/FlyBot/issues/1678)).
- Dragging a node or dropping a Bot in the flowchart drawer's **Edit** plane no longer rewrites the stored coordinates: in the laid-out plane where parallel branches would overlap, a drag now changes only the graph's structure and the plane says where layout lives (Settings), so a drag that used to move the same node on the Settings canvas no longer does ([#1686](https://github.com/ThinkFlowLab/FlyBot/issues/1686)).
- The workflow drawer's Edit plane now draws a parallel step's dashed frame around the cards it actually laid out and routes every wire around those cards: at a narrow drawer the frame no longer leaves the canvas on both sides, its bottom edge no longer runs under the cards, and no wire cuts through a card of another line. The fitted plane and the Read-only plane draw exactly what they drew before ([#1693](https://github.com/ThinkFlowLab/FlyBot/issues/1693)).
- The chat no longer acknowledges the message that starts a turn as if it had arrived while the Bot was busy: an idle conversation now answers with no generated "on it" line and no extra model call, while a line that really lands during a running turn keeps its one acknowledgment ([#1698](https://github.com/ThinkFlowLab/FlyBot/issues/1698)).
- The tools that resolve a Bot through `findTeamBot` no longer accept a retired one: `message_bot`, `stop_bot`, `update_bot`, `create_group`, `update_group` (`add_members`, `admin`, `task_lead`) and `archive_bot` refuse it with the familiar "No Bot named …" line instead of waking a Bot the owner just put away. `list_bots` and the Bot's readable chat are unchanged ([#1700](https://github.com/ThinkFlowLab/FlyBot/issues/1700)). Other host paths that resolve a Bot by name (task assignee, group `@Name`, capability attach, memory scope) are tracked in [#1709](https://github.com/ThinkFlowLab/FlyBot/issues/1709).
- Project and roster ids resolve only from their table's own keys: `project-read {id: "__proto__"}`, `project-bind {kind: "bot", id: "__proto__"}` and `project-of` no longer answer from `Object.prototype`, a binding request can no longer write `projectId` onto it (which made every unbound Bot and group report one Project until the next restart), and `findBot` / `findRooms` stop returning it as a member or a group ([#1704](https://github.com/ThinkFlowLab/FlyBot/issues/1704)).
- A workflow run that fails now reaches the Inbox: one *Needs you* row per graph, naming the graph and the node that failed with the failure text as its reason, bounded to that graph's newest failure inside the same 7-day window the Done list uses ([#1706](https://github.com/ThinkFlowLab/FlyBot/issues/1706)). **Open** goes to Settings → Workflow graphs, because a failed run has no chat to land in and there is no per-graph deep link yet. A run that is still going, and a failure older than the window, stay off the list.
- A folded thinking row stays inside the message column: a long reasoning line without a break is clipped at the row with an ellipsis instead of widening it past its column, and the opened row wraps that line instead of scrolling sideways ([#1718](https://github.com/ThinkFlowLab/FlyBot/issues/1718)).

### Security

- Host lookups that index a saved table with an id or name from the request now read only that table's own keys, so `__proto__` is no longer a Bot, a conversation, a task or a capability: `update-bot`, `task-update` and `set-flags` can no longer write a field onto `Object.prototype`, `set-main` no longer persists it as a Main Bot, and `capability-delete` refuses a name that does not exist instead of answering success, an invitation revoke no longer writes `revokedAt` onto `Object.prototype`, a member removal refuses an id that is not an own member, and a grants write for a nonexistent Bot is refused instead of re-pointing the grants table ([#1711](https://github.com/ThinkFlowLab/FlyBot/issues/1711)).
- A Project board now paints only the cards the asking member could open through the task list: `project-board` carries the signed-in actor into the board and drops every card the same member would be refused there, so one member can no longer read another member's Project cards while `tasks` already refuses them. A card stays visible to its requester, to the owner of its Bot or an ancestor of it, and to the admin of the room it came from; an empty board is still an answer, not an error ([#1723](https://github.com/ThinkFlowLab/FlyBot/issues/1723)).

## [0.2.13] - 2026-10-29

### Changed

- FlyBot now builds, tests and installs on DeepSeek Harness `0.2.1-rc.2`, the current npm `latest`; the README commands, the CI workflows, the container image and the install help all pin that version ([#1384](https://github.com/ThinkFlowLab/FlyBot/issues/1384)). The container now runs with host networking and the web server binds the host's `127.0.0.1` itself, because DSH 0.2.1 refuses a wildcard host — same loopback-only exposure as before, Linux Docker only.

### Fixed

- The "Hand a task to a Workflow" dialog now selects the first card of the Tasks board as soon as the board arrives, so `Assign` posts the task instead of closing on a silent no-op, and an empty board leaves it disabled. When the Tasks board cannot be loaded the dialog shows the error with a `Retry` control instead of claiming there are no tasks to assign, and `Assign` stays disabled while the load is in flight or failed. ([#1457](https://github.com/ThinkFlowLab/FlyBot/issues/1457), [#1458](https://github.com/ThinkFlowLab/FlyBot/issues/1458))
- Workflow: unloading the plugin now releases the run Bots of every live run in a workflow, not only the last one, so a workflow with two concurrent runs no longer leaves hidden Bots that no saved record names ([#1472](https://github.com/ThinkFlowLab/FlyBot/issues/1472)).
- Fixed workflow Stop and Reset writing the state change before the run's Bots were released, which erased the only id record of a Bot whose release failed. A failed release now keeps that id named on the still-live run, so the next Stop, Reset, dispose or reload retries it. The run is left Paused with `releasePending`, so it hands off nothing more and `resume` is refused; Stop again is the retry, and a whole-workflow Reset freezes every run it did not reset. ([#1476](https://github.com/ThinkFlowLab/FlyBot/issues/1476))
- The Workflow settings page now reports a failed host call instead of staying on "Reading workflows…": a workflow read, graph save or model change whose host call throws, rejects or never answers ends on the page's own alert, a failed read offers "Try again", and a failed save no longer claims changes are saved automatically ([#1504](https://github.com/ThinkFlowLab/FlyBot/issues/1504)).
- The Workflow stage chat scrolls itself only while it is already at the bottom. A workflow node's own reply is filtered out of the stage, so it no longer drags the chat down, and a reader who scrolled up keeps their place. ([#1518](https://github.com/ThinkFlowLab/FlyBot/issues/1518))
- A `workflow/reset` with no task to keep is now refused before it clears the lane, so a workflow that is waiting with queued tasks and no live run keeps its queue instead of losing every queued task to a refused reset, and a run whose Bot instances were never given a task no longer disappears with them ([#1531](https://github.com/ThinkFlowLab/FlyBot/issues/1531)).
- The failure recovery edge added by #1529 reset only the recovery target and the failing node, so a node on the way back stayed `done` and the retry was fed the output it had just rejected. Recovery now resets every node from the target through the failing node and re-runs them in order. ([#1541](https://github.com/ThinkFlowLab/FlyBot/issues/1541))
- The failure recovery added by #1529 accepted a `max` from 1 to 8 but never recovered on `max: 1`: the first failure already read as the limit, so the run failed at once and the attempt counter stayed empty. `max` now counts recoveries, so `max: 1` recovers once and `max: 8` still means at most eight. ([#1542](https://github.com/ThinkFlowLab/FlyBot/issues/1542))
- A step that only mentioned `needs-human` or `already-claimed` in its reply ended its own run, so quoting an issue title, writing `No needs-human label on this issue`, or reporting the label as absent stopped the pipeline. A run now ends early only on a structured signal: a declared output equal to the marker, or a reply line that is exactly `EARLY-END needs-human` / `EARLY-END already-claimed`. ([#1546](https://github.com/ThinkFlowLab/FlyBot/issues/1546))
- Deleting a running node from the workflow canvas no longer strands its run: the edit ends that run the way Stop does — the node is failed, the run is archived `failed`, its node Bots are released and a queued task takes the lane. Before, the run stayed `running` with a queued-only node map and no timer, so under `maxConcurrent: 1` nothing could ever start behind it. ([#1549](https://github.com/ThinkFlowLab/FlyBot/issues/1549))
- Opening a face-to-face room for the first time no longer fails its history with `Maximum call stack size exceeded`. The header effects now coalesce a synchronous session notification instead of re-entering themselves, so the room's transcript renders on the first open ([#979](https://github.com/ThinkFlowLab/FlyBot/issues/979)).

## [0.2.12] - 2026-10-28

### Added

- A scheduled task can now be copied to another Bot or group chat: **Copy** on the task's row asks for the target and creates the same title, instruction and timing there, keeping the task's next run instead of re-anchoring it ([#1287](https://github.com/ThinkFlowLab/FlyBot/issues/1287)).
- The workflow engine has its running layer's pure half: given a job card, the definition and the facts just read, `workflow-run.js` says which node cards may open and, for every node that may not, repeats the definition's own refusal sentence — a card is queued for the node's role rather than mentioned, exists once per job and node across a restart, opens nothing while the job is held, and the job is done when its terminal node's outputs are current (#1272, step 4; [#1316](https://github.com/ThinkFlowLab/FlyBot/issues/1316)).
- A Workflow is a group-shaped chat of local Bots. The sidebar opens the run, the flowchart can be dragged into a new graph, and a board task can start a saved pipeline such as 发布交付流水线. A Bot starts one with `run_workflow` or defines one with `define_workflow`. An open task whose title, tags or assignee names a Workflow or a local Bot is handed to that runner; a task that matches nothing stays for a manual pick (#1318).
- A Workflow run now makes one temporary Bot per node from that node's prompt, role, model and tools. Those Bots do the step and are removed when the run finishes, fails, or is cancelled, and they stay out of the sidebar. The prompt and the flowchart can be edited in Settings → Workflow graphs, on the flowchart, or with `define_workflow`. ([#1373](https://github.com/ThinkFlowLab/FlyBot/issues/1373))
- Settings → Workflows lists user-owned Workflows with rename and delete controls; `workflow/rename` and `workflow/delete` RPC persist changes and clean up runs ([#1434](https://github.com/ThinkFlowLab/FlyBot/issues/1434)). Factory presets remain read-only.
- **Settings → Workflow graphs** is now canvas-first with a per-node inspector panel. Select a node to edit its system prompt, role, and tools — no more wall of textareas. **Workflow stage chat** reuses the normal FlyBot conversation UI (same message bubbles and spacing as Bot/group chats), replacing the previous pipeline-log card style. **Sidebar Workflows list, Hand-a-task modal, and flowchart drawer** now show visual mini-flowcharts instead of text chains like "Planner → Writer → Coder", with a unified visual language across all surfaces. **Hand-a-task modal** overflow fixed: content scrolls, Cancel/Confirm footer is sticky and always visible. **Flowchart drawer** defaults to showing the graph collapsed; system prompts expand only when a node is selected. **Workflow runs** now advance only along graph edges when ephemeral Bots finish — no timer-based demo-step bypass for live runs. The `workflow/demo-step` endpoint remains for replaying canned demos only and refuses while a live run exists.
- Workflow graphs now support choosing a model for the whole Workflow. Settings → Workflow graphs and the Details panel show the chosen model; when set, every ephemeral Bot in a run uses it instead of the seated Bot's model.
- **Workflow failure recovery:** A node can now recover from failure by returning to an upstream node and retrying, instead of stopping the run. Define a failure recovery edge with `onFail: true` pointing from the failing node back to the recovery target, with a configurable `max` attempts bound (1–8, default 3). Example: `{ from: 'review', to: 'draft', onFail: true, max: 3 }` — when Review fails, the workflow resets to Draft and runs through Review again, up to 3 times total. After attempts are exhausted, the run fails cleanly. Does not interfere with existing `failOnce` retry or success-path `loop` edges.

### Changed

- A Workflow run now waits for each node's Bot to reply before the next node starts, and that reply is the chat line. A second task queues instead of replacing the run that is already going. Replay demo stays a separate script and does not move a live run; after a live run finishes, the stage keeps that run until Replay steps the script, and from then on the graph follows the demo rather than the finished run. Each node can name its inputs and outputs, and a required input with no upstream provider refuses the start. A dispatch that does not land stays unhanded, is named in the chat, and is sent again on the next hand-off. An older saved demo still replays, and a task waiting on its own Workflow's `maxConcurrent` cap starts when a run of that Workflow finishes, ahead of a newer assign. A 429 mentioned in a successful reply does not fail the step. A loop edge is the only cycle: it stops at max (1–8, default 3) or when its until output matches, and a when edge chooses a branch while the other is skipped. The next pass of a loop can take the other branch. Each node is an ephemeral Bot for that run, removed when the run ends, and it has the same file and shell rights as a normal Bot, while a connector is available only when its node's `tools` names it and `spawn` passes that list through. ([#1402](https://github.com/ThinkFlowLab/FlyBot/issues/1402))
- Workflow concurrency is now configurable per Workflow in Settings → Workflow graphs. The host-wide 6-run cap is removed; each Workflow's own `maxConcurrent` limit (1–8, default 2) is the only gate. [#1525](https://github.com/ThinkFlowLab/FlyBot/issues/1525)
- Workflow Settings says the run's full access is a normal Bot's instead of a per-Bot permission choice, and the delivery template lists only connectors a node really calls (`github`). The README says plainly that naming `bash` grants nothing.

### Removed

- The repository metrics panel is gone ([#1363](https://github.com/ThinkFlowLab/FlyBot/issues/1363)). Opening Tasks shows that Bot's task board: there is no Today / 7-day GitHub block, no Retry or Diagnose, and no "from the package" repository header. The per-Bot task board and Workflow stay.
- The leftover delivery-board helper is gone ([#1376](https://github.com/ThinkFlowLab/FlyBot/issues/1376)). `issue-ref.js` exports only the matcher the dispatch and the task store call (`issueRefs`, `namesIssue`, `cardNamesIssue`): `issueCardForTask` and the private half it alone used (`cardMentions`, `mentionOf`, `MENTION`, `asNumber`) were deleted with the board that read them, and `core-host.md` no longer lists them.
- Workflow stage no longer offers Replay demo, Run demo, or stepped canned playback ([#1443](https://github.com/ThinkFlowLab/FlyBot/issues/1443)). Assign and live runs still spawn ephemeral Bots per node; `workflow/demo-step` remains for tests only.

### Fixed

- In a group with a task board, the admin's `@Name #1234 …` work dispatch is a board assignment now, not a round: the host writes (or updates) that member's card and wakes it in its own chat, and the room opens no group part for the line. A question, a remark, an `@all`, a line from a member who does not divide the board, and a face-to-face room keep their group turn. A card that is parked (`result-ready` or `blocked`) is restarted to `working` so the wake actually reaches the member, a card already blocked on an input is reused instead of duplicated, and a dispatch whose card write fails falls back to the member's group turn instead of dropping the line. ([#1254](https://github.com/ThinkFlowLab/FlyBot/issues/1254))
- Copying a scheduled task, and editing one, now reads only a task of your own user: a copy from another member's Bot or from a shared room's task is refused instead of carrying that task's title and prompt into a new one, and the same holds for Edit, whose source the room-membership rule used to let a seated member through. The refusal is the existing `No such task` sentence, so a peer's task reads exactly like an unknown one. A deployment with nobody signed in keeps the single-human behavior it had. ([#1321](https://github.com/ThinkFlowLab/FlyBot/issues/1321))
- A group work dispatch now reuses a member's card only when that card names the issue itself. `title` and `target` are read first, and a card's `note` counts only when neither of them names any issue — so a card for `#999` whose note says "blocked on #1234 first" is no longer rewritten and restarted for `#1234`, and the dispatch opens `#1234` its own card. One issue still gets one card: a card that names the issue only in its note is still reused. ([#1331](https://github.com/ThinkFlowLab/FlyBot/issues/1331))
- The workflow planner no longer reads a blank hold as a hold. A hold now names its holder or it is no hold at all: `''` — the shape a pull-request query that answered nothing arrives in — and `'   '` plan exactly like no hold, and a hold no name can be read from is treated as no hold instead of refusing every node of a job with either no sentence or nobody's name. A real holder is unchanged: every card-less node is still refused, with that name and the definition's own hold sentence. ([#1337](https://github.com/ThinkFlowLab/FlyBot/issues/1337))
- The Bot settings drawer opens wide enough for its own controls: at 320px the "Name" field's label broke into "Nam" and "e", the "Test connection" button into "Test connecti" and "on", and Main Bot's "Change" into "Ch", "an", "ge". The Details panel now opens at 380px, a row's label stays on one line, a button never breaks its own words, and below 300px — the panel's floor in a narrow window — the row stacks so nothing is clipped to fit a width that is not there. A preview in the sidebar shows the words of a line and never its untrusted fence or the fragment an older write left behind (`from="User"> …`). A Bot chat with nothing said yet, which the shell draws with no header at all, now names itself above the composer and says it is empty instead of being a blank column with a composer. The details drawer's copy button is named for what it does ("Copy conversation", not "Share conversation") and says "Conversation copied as Markdown" when the copy lands, or reports why it did not. The mode word beside the chat title no longer draws as a filled chip that looks clickable and is not. A provider failure stored as a cut-off JSON body — a real Inbox showed `404: {"code":"UnsupportedModel","message":"The requested model does not support …` — now reads as a sentence naming the feature and where to change the model, in the chat's failure lines and in the Inbox ([#1347](https://github.com/ThinkFlowLab/FlyBot/issues/1347)). A chat message can no longer paint over a dialog, a sheet or a scrim. The chat column had no stacking context of its own, so anything the browser gave its own composited layer — a new row's entrance animation, a filter, a sticky box — was ordered against the page root instead of against the column, and could sort above a dialog's layer. With the column made one stacking context that sits below the panel and the dialogs, a right-aligned message stays behind **Tasks**, **Settings** and the **Inbox** scrim. Dialogs and popovers also moved to separate tiers (dialogs 120/121, popovers 130, palette 140), because the context menu and the reaction strip shared z-index 60 with the Settings dialog and a later-opened popover could paint over it ([#1347](https://github.com/ThinkFlowLab/FlyBot/issues/1347)). A modal also covers what is behind it now: the scrim was translucent enough that the thread stayed legible through it, and each overlay layer is its own stacking context so the scrim and its dialog move as one ([#1347](https://github.com/ThinkFlowLab/FlyBot/issues/1347)).
- Settings → Workflows lists the factory pipelines and the workflows saved on this machine, and opens the flowchart so a node can be dragged. A list that cannot be read shows an error with Retry instead of staying on “Reading workflows…”, and the page no longer leads with the `workflows/<id>.json` note (#1364).
- Clicking a Workflow, New, or Hand a task in the sidebar opens that chat or dialog. The Workflows section stays in the sidebar. ([#1375](https://github.com/ThinkFlowLab/FlyBot/issues/1375))
- Settings → Workflows says the Workflow plugin is not installed or not enabled when `@flybot/workflow` is missing, instead of `Unknown FlyBot endpoint workflow/state`, and keeps Retry (#1381).
- Disposing the Workflow plugin now releases every run Bot before the saved record drops its id, and hands that release back as a promise the host waits on, so a slow or interrupted shutdown can no longer strand hidden Bots that no state can find or remove. A released run Bot also gives its name back instead of keeping it for the lifetime of the process ([#1387](https://github.com/ThinkFlowLab/FlyBot/issues/1387)).
- A workflow run that a restart interrupted was never cleaned up: the run stayed `running` and its run Bots stayed hidden with no way to remove them. Loading the plugin now releases those Bots and records the run as `failed` ([#1388](https://github.com/ThinkFlowLab/FlyBot/issues/1388)).
- Settings → Workflows can now set each node's **system prompt** in edit mode, the way the sidebar flowchart already did, so a run Bot's prompt is configurable where the graph is drawn (#1393).
- Settings → Workflows keeps the "Use this" entry on a factory preset that already has a live copy, so the preset can still be copied into a workflow of your own. ([#1396](https://github.com/ThinkFlowLab/FlyBot/issues/1396))
- Voice mode no longer reads a reply's framing aloud: the host header, a reply's delegation trace (`Chief → Product`) and the untrusted-fence markers a stored remote line carries are stripped along the same text chain a row preview reads, so `speechSynthesis` says the words and nothing else.
- Copying a conversation in the details drawer now copies each reply's own words, keeping the line breaks the reply was written with: the `untrusted-message` fence and a delegation trace whose first hop is one of the Bot's own names are dropped, while a line like `Settings → Models 页面` is kept as written ([#1406](https://github.com/ThinkFlowLab/FlyBot/issues/1406)).
- Plugin unload no longer persists workflow runs as `running` after their ephemeral Bot map is cleared; the next load also ends live runs that were already left in that zombie shape ([#1414](https://github.com/ThinkFlowLab/FlyBot/issues/1414)).
- The label-hygiene sweep no longer stops at the first label it cannot remove. A `404` on one DELETE means that label was already gone and is skipped; any other refusal — including the `422` that the live `#1356`/`#1359` runs returned, with the label still on the item — is collected together with the response body the request answered, the items behind it are still cleaned, and the run exits non-zero at the end naming what failed. The read-back after the sweep stays the criterion. ([#1418](https://github.com/ThinkFlowLab/FlyBot/issues/1418))
- The Bot exchange sheet showed and copied a stored turn's routing along with its words: a leading `Chief → 助手` delegation trace, and a remote writer's `<untrusted-message …>` fence, appeared in the bubble and in Copy as if the writer had typed them. Every stored line now goes through one reader, `exchangeText()`, which unwraps the fence while keeping its line breaks, drops the leading trace and the leftover fence fragments, and trims only the ends — so the paragraph breaks of a multi-paragraph reply survive, and the displayed text and the copied text are the same ([#1423](https://github.com/ThinkFlowLab/FlyBot/issues/1423)).
- A run ended by a restart, by a step that threw, or by stopping it kept the nodes it had been running: the run said `failed` while the flow strip still painted "Running now" for that node. Ending a run now marks those nodes `failed` with it, from one helper every path goes through ([#1424](https://github.com/ThinkFlowLab/FlyBot/issues/1424)).
- A conversation part that a job still held when the Bot moved on to a fresh part is archived once that job ends, instead of staying active for the life of the instance. Nothing is force-stopped: a job, turn or subagent is left to finish, and the part is asked for once more, with no options, when its holder is reported ended — the job registry's own settlement, or the Session's next idle — keeping the id while a job, turn or subagent still holds it. A scheduled task keeps the existing stop-then-archive path ([#896](https://github.com/ThinkFlowLab/FlyBot/issues/896), [#1433](https://github.com/ThinkFlowLab/FlyBot/issues/1433)).
- A single throttled context-steward call no longer moves the conversation on to a fresh part: a rate limit, a timeout or a 5xx on that one request is now retried (up to three times, honouring the retry delay the provider names when it names one), and if it still fails below the point where the part must move, the round is spent instead of the part and the next round asks again only after a cooldown. Over that point, and for a refusal that retrying cannot change, the part still moves on, and the handoff now records the real reason instead of the default "the previous part grew long" ([#1447](https://github.com/ThinkFlowLab/FlyBot/issues/1447)).
- Settings → Workflow graphs now displays live run state (running, done, failed) instead of showing every node as Idle during active runs.
- Fixed Workflow stage layout so the flowchart stays inside its panel ([#1450](https://github.com/ThinkFlowLab/FlyBot/issues/1450)), hid ephemeral node Bot dialogue from stage chat, wired the Hand-a-task modal to live Tasks board cards, and added sidebar right-click delete/rename for workflows.
- Deleting a Bot now takes its connector tools away from any Session that deletion emptied — its own chat, its earlier parts, its group Session and the parts of that Session — so a tool call already in flight is refused with `the Bot this Agent works for could not be determined` instead of running on the owner's connectors; the owner's own Sessions, an id no Bot ever had, and a live Bot or room that holds one of those ids are unchanged, and the record is in the team file so a reload still refuses (#1453).
- Workflow stage now shows short task summaries with pause, resume, and progress tied to live runs only; sidebar status never mirrors scripted or seeded runs (`demos[]` and `workflow/demo-step` removed). Factory workflows such as the delivery preset can be removed from the sidebar via Delete (confirm), not reset-only ([#1454](https://github.com/ThinkFlowLab/FlyBot/issues/1454)).
- Workflow stage: fix flowchart wire alignment, compact sidebar thumbnails, a breathing border on the running node, no message composer on the stage, and stop ephemeral node replies from appearing in persistent Bot chats (e.g. Chief). Progress stays on the workflow row and graph. ([#1459](https://github.com/ThinkFlowLab/FlyBot/issues/1459))
- The Workflow stage chat renders a message line in full instead of clipping it at 240 characters; the 240-character preview is now used by summaries only, so an owner brief and a Bot reply are readable to the end. ([#1460](https://github.com/ThinkFlowLab/FlyBot/issues/1460))
- A board card a Bot records itself with `track_tasks` now starts the Workflow it names, or queues on that lane when it is at `maxConcurrent`; the Workflow panel also says when a host does not pass board writes to the plugin, instead of looking manual-only by design ([#1462](https://github.com/ThinkFlowLab/FlyBot/issues/1462)).
- Workflow stage: each concurrent live run gets its own progress strip with Pause, Resume, and Stop; the Runs list matches `activeCount`; flowchart wires use orthogonal routing with parallel frames behind nodes (Fixes [#1463](https://github.com/ThinkFlowLab/FlyBot/issues/1463)).
- Fixed workflow UI polish issues: deduplicated Chief in assign modal and made workflow cards compact; idle workflows now show "Failed" badge instead of "Queued" when the last run failed; stage event lines show full text on hover and wrap properly; control buttons (Pause/Progress/Flow) stay on one row consistently. ([#1468](https://github.com/ThinkFlowLab/FlyBot/issues/1468), [#1469](https://github.com/ThinkFlowLab/FlyBot/issues/1469), [#1470](https://github.com/ThinkFlowLab/FlyBot/issues/1470), [#1471](https://github.com/ThinkFlowLab/FlyBot/issues/1471))
- Workflow UI polish: Chinese sub-labels in flowchart nodes are now more readable (12px font, higher contrast); status badges in the 运行记录 tab are vertically centered with comfortable row padding; Details tab key-value pairs have improved padding and wrapping.
- Settings → Workflow graphs shows "Reading workflows…" loading state on first open instead of briefly displaying "No workflows yet" while data loads.
- Settings → Workflow graphs hides edit-only UI ("Select a node to edit", Add link form) in read-only mode until Edit is clicked.
- Settings → Workflow graphs Edit mode now shows "Changes are saved automatically" hint next to "Finish editing" button to clarify auto-save behavior.
- Settings → Workflow graphs no longer nests a scrollbar inside the settings page: the canvas scales the graph to the width it has, so the page keeps the only scroll axis and every node and edge stays inside the canvas. Its wires are drawn with a stronger stroke, and dragging a node still follows the pointer at that scale.
- Workflow stage no longer shows the shell's message composer. Tasks are handed to the graph; the stage provides only pause/resume/progress controls. ([#1486](https://github.com/ThinkFlowLab/FlyBot/issues/1486))
- Workflow stage header titles no longer duplicate the issue number, and task titles are shown without mid-text truncation. ([#1487](https://github.com/ThinkFlowLab/FlyBot/issues/1487))
- Workflow sidebar rows show schedule previews in English when the UI locale is English. ([#1488](https://github.com/ThinkFlowLab/FlyBot/issues/1488))
- The Workflow stage timeline now follows the shell language — task assigned, queued, workflow created, paused, resumed, stopped, the failure, hand-off and hand-off-retry lines, the deadline timeout, the retry and recovery frames, the parallel start/join and done frames, reset, and the canned Delivery replies read English in an English shell and Chinese in a Chinese one; each row keeps its Chinese text as the fallback for timelines written before the key existed. Every timestamp is computed from the line's own time, so Done and historical runs show their real age instead of a frozen 「刚刚」, and the stamp is 12px on the readable ink token. ([#1489](https://github.com/ThinkFlowLab/FlyBot/issues/1489))
- Workflow stage Progress button now ensures the drawer opens and switches to the Runs tab. ([#1491](https://github.com/ThinkFlowLab/FlyBot/issues/1491))
- Settings → General → Notifications: the first toggle row now shows the title "In other chats" alongside its description. ([#1492](https://github.com/ThinkFlowLab/FlyBot/issues/1492))
- Workflow stage now shows failed sibling runs in the header and timeline, not only in the Runs tab, and a Runs row shows when the run ended and why it failed. ([#1493](https://github.com/ThinkFlowLab/FlyBot/issues/1493))
- Fixed the Workflow flowchart's node role sub-label in dark themes: #1484 had replaced its theme token with a hardcoded grey that read 1.05–1.15:1 on the dark node cards, and the colour now follows `--bt-ink-2` again, which keeps every dark theme at 5.60–6.33:1 and the light themes at 4.42–5.11:1 ([#1495](https://github.com/ThinkFlowLab/FlyBot/issues/1495)).
- Workflow Runs and timeline rows now show the whole task title (`#id · title`) with a single-line CSS ellipsis and the full text in the tooltip, so a title containing an emoji or a CJK Ext-B character can no longer be cut mid-character and render as a replacement character ([#1508](https://github.com/ThinkFlowLab/FlyBot/issues/1508)).
- The Workflow room's right-hand Flow tab fits the whole graph to its 400px panel: every node, wire endpoint and parallel-branch frame stays inside the panel, labels wrap instead of being cut mid-word, and the inner horizontal scrollbar is gone. The drawer stays editable — drag and drop still store the same world coordinates, now divided by the fit scale — while Settings keeps its scrolling canvas. ([#1513](https://github.com/ThinkFlowLab/FlyBot/issues/1513))
- Settings → Workflow graphs → Edit now draws the Add link panel with the dialog's own form: a 14px section heading, a responsive field grid, a `Pick a node` placeholder in both node selects, and a primary `Add link` button that stays disabled until both ends are chosen. Node handles are smaller and theme-accent, sit beside the connection line instead of on it, and only gain full opacity and a halo on hover, focus or while a wire is dragged; the settings page also injects the workflow stylesheet when it opens without the sidebar section ([#1514](https://github.com/ThinkFlowLab/FlyBot/issues/1514)).
- The node inspector's **Tools** field now says what it does: it names the connectors the run Bot may use (`github` → `mcp__github__*`, `composio` → the Composio connector), file and shell access is always a normal Bot's full access, and a node that names no connector gets none, in English and in Chinese. Its placeholder names `github, composio` instead of advertising `bash`, `read` and `edit` as if they granted something. Typing a second connector one character at a time now keeps it: the field holds a local draft and saves on blur or after a short pause, where before every keystroke saved a list the host re-normalized, so `github, composio` typed by hand became the single useless token `githubcomposio` and the connector was silently refused. ([#1520](https://github.com/ThinkFlowLab/FlyBot/issues/1520))
- The Workflow stage controls — graph save, Reset, Pause, Resume and Stop — now report a refused or unanswered call in the stage alert instead of leaving the button dead, and a call that does not answer within 10 s is reported as a failure. ([#1521](https://github.com/ThinkFlowLab/FlyBot/issues/1521))
- **Workflow ephemeral node Bot replies no longer leak into persistent Bot chats.** Previously, ephemeral workflow node Bot replies (e.g., Review / Verify / Rework results) could appear as queued `[Reply from …]` messages in Chief or other persistent Bot conversations when deliveries bypassed send middleware (deferred, resumed, retried flags) or after workflow release. The fix expands the `gated()` check in `hooks.js` so ephemeral bot deliveries ALWAYS route through middleware (ensuring `stepResult` advances the workflow), while the workflow send hook denies delivery to persistent Bot chats. Removed ephemeral bots are tombstoned so late replies cannot leak. Ephemeral Bot outputs stay strictly on the workflow run surface. (#1524)
- **Workflow runs no longer hang on a step (#1530):** a step whose request never reaches its Bot, or whose Bot never replies, used to leave the run marked 运行中 forever. A dispatch that does not land is now retried twice with a short backoff, and a step that is still unanswered after 10 minutes fails: the run ends as `failed`, its ephemeral Bots are released, and the stage chat names the step and the reason. Pausing a run holds no deadline, and Stop, Reset and plugin unload clear it. A reply that arrives after its step is gone is now reported through `warn` instead of being dropped silently.
- Every Workflow node Bot now has the file and shell permissions a normal sidebar Bot has, and its node's `tools` selects connectors only: `github` grants `mcp__github__*`, `composio` grants `mcp__composio__*`, and a node that names neither reaches no connector. File and shell access no longer depends on that list, and `EPHEMERAL_DENIED_TOOLS` still refuses the team tools at the guard and approval layers. This replaces the earlier rule that every node Bot inherits every registered tool (#1534).
- Workflow Claim nodes now detect when an issue is already claimed and skip claiming again. When a step's output contains `already-claimed` or the text indicates the issue has `agent-working` label / `Claimed-by` comment, the workflow run ends immediately instead of proceeding to Implement.
- Workflow runs now end properly when any step marks an issue as `needs-human`. Previously, the run would stay Running on that node; now the run settles (status=done, earlyEnd=needs-human) without spawning further nodes.
- A connector a Bot switched off can no longer be reopened by a Workflow. The run Bot a node spawns records who started the run (`createdBy`) and which Bots' switches cap it (`cappedBy`: the caller and the Bot that saved the graph), and the host refuses a connector turned off for any of them — with `turned off for <name>; the step's tools list cannot turn it back on` — and masks it out of the run Bot's list, so naming `github` on a node cannot turn a switch back on. A run started from the board, the canvas or the API has no caller and is capped by the graph's author; a graph saved with no Bot behind it has no ceiling, and an older graph keeps today's behaviour. ([#1544](https://github.com/ThinkFlowLab/FlyBot/issues/1544))
- A run Bot started through a friend's Bot no longer reaches a connector: the two Workflow tools have no `visibleTo`, so a remote caller could start a run whose node `tools` alone decided what it reached, and one that started a run is now read as "every connector switched off" — the guard refuses with `… not available to a run started by a friend's Bot`, and the tool mask takes the connectors out of the run Bot's list. An in-team caller whose own switch for a connector is on, and whose node names it, is unchanged, and a run with no caller (the owner, the board) keeps the answer it had. ([#1555](https://github.com/ThinkFlowLab/FlyBot/issues/1555))
- Workflow auto-assign now matches an ASCII trigger only as a whole word, so `notice` no longer routes a card that merely says `noticeable`, and `pr` no longer routes `Improve`, `Prepare` or `Sprint`. The whole word still routes (`notice`, `pr`), and non-ASCII triggers such as `周报` keep matching inside a longer title. The two-character trigger guard is unchanged. ([#1559](https://github.com/ThinkFlowLab/FlyBot/issues/1559))
- The workflow stage reads `workflow/state` once per 2-second tick while a run is live instead of twice — two effects were polling the same condition. A read the host refuses now shows its error on the stage and retries, instead of ending as an unhandled rejection and painting the stage as "No workflows yet.". ([#1564](https://github.com/ThinkFlowLab/FlyBot/issues/1564))
- A failed turn in a hidden Bot's own chat no longer leaves a card in the Inbox that cannot be opened or dismissed; a failure in a group is still listed, because the group's row opens there, and *In progress* is unchanged. ([#1566](https://github.com/ThinkFlowLab/FlyBot/issues/1566))
- On a read-only host — another `dsh` holds this team — `workflow/advance` and `workflow/reset` no longer move a run or write `workflows.json`: both refuse with `{ ok: false, code: 'read-only', error: 'The host is read-only' }` before they touch the run, the same way `pause` does. A node Bot's reply that would advance a run is reported once through the plugin's warning path instead of being swallowed, and a writable host is unchanged. ([#1569](https://github.com/ThinkFlowLab/FlyBot/issues/1569))
- **Workflow early-end stops tip-unchanged and open-PR loops (#1570):** Claim/Verify (and any step) that signals `tip-unchanged` or an already-open PR now ends the run immediately — including on the fail/onFail path — so loop and recovery edges cannot burn their max attempts on the same tip SHA. Preferred markers are OUTPUT values or a whole-line `EARLY-END <reason>`; common phrases (`tip unchanged`, `has open PR`, …) are honored when a Bot forgets the structured marker. `needs-human` and `already-claimed` stay. Factory guidance is in `EARLY_END_GUIDANCE`.
- **Workflow step deadlines arm without an ephemeral Bot map (#1571):** a live running step now gets the ten-minute `STEP_DEADLINE_MS` even when the host cannot spawn run Bots, so a silent step cannot hold a lane forever. A test covers expiry with no reply and no ephemeral map.
- Dragging the leftmost, rightmost or topmost node in the workflow drawer moves the node under the pointer instead of leaving it pinned while the fit re-centres and rescales the rest of the graph; the fit is now fixed for the whole gesture, so a drag commits the coordinates the user saw. ([#1575](https://github.com/ThinkFlowLab/FlyBot/issues/1575))
- **Timeline report counts failures against the larger population (#1578):** the team report divided `errors` by `turns`, but `turns` counts only the turns that *began* in the window while `errors` counts every overlapping failed turn — so one failed turn from before the window read as `1 turns, 3 failed (300%)`, exactly the reading `docs/subsystems/timeline.md` invariant 5 rules out. The digest now divides by `Math.max(turns, errors)`, the denominator `health.js` already uses; the per-Bot line, the `## Team` line and the one-line summary all follow it, and the count is printed in the singular when it is one (`1 turn`, `3 turns`). A share is printed only below 100%, because with every counted turn a failed one the numbers cannot tell the window's own turn from a failure that overlapped it. `utilization.turns` and `errors` in the window are unchanged, and so is `health.js`; a clean window's report is byte-identical to before.
- **Workflow steps get the time the work needs (#1580):** a live step used to be killed after ten minutes, and ten minutes is shorter than implementing or reviewing a change takes, so every step that did real work failed mid-flight and the run was lost. The deadline is now per workflow: `stepTimeoutMinutes`, an integer from 1 to 120, given when the workflow is created or through the new `workflow/step-timeout` call, with 45 minutes as the default. A value outside that range is refused when it is written instead of silently falling back, and the timeout message names the number that applied.
- With no run active and the last attempt failed, the workflow **Runs** tab listed that same attempt twice: a phantom row for the live run plus its own history row. It now lists one row per attempt — the failed attempt appears once, marked `Failed` — while a real retry still shows the earlier attempt and the current one ([#1583](https://github.com/ThinkFlowLab/FlyBot/issues/1583)).
- A human message accepted while a Bot is busy (queue or steer, including long background job waits) now gets a short spoken acknowledgment in the chat promptly, instead of silence until the job finishes ([#1584](https://github.com/ThinkFlowLab/FlyBot/issues/1584)).

### Security

- A Workflow run Bot is no longer a team member: `tools` on its node only decides connectors, so the host now refuses every team-reaching tool (`message_bot`, `stop_bot`, bot/group/capability writes, `request_secret`, schedule writes, the social and workflow tools, `recall`, …) with one sentence, hides the same names from the run Bot's own tool list, and answers `rejected` for them in the approval seam (#1445).

## [0.2.11] - 2026-10-27

### Added

- Settings has a **Workflows** page: the factory presets, your own definitions as `workflows/<id>.json` in the workspace, and which one this project uses. A definition is edited as a node table — id, name, role, inputs, outputs, guards, refusal — with the flowchart drawn above it from the same table and each guard showing the sentence it would print right now, or saying the fact could not be read. *Customize* copies a preset into a new file and never edits the shipped one, and saving an unedited definition writes identical bytes (#1272, step 3).

### Changed

- A finished task card leaves the task board's active list, and the Done column shows the newest 20 archived cards; a group's overall card now completes when its last child finishes, is cancelled by a rejected approval, or fails because its Bot was deleted, and a Bot's board asks for that Bot's own finished cards (#1252).
- Feishu (Lark) is now connected on Settings → Connectors (左下角「连接应用」), not through the Secrets page or a config file. The one Feishu row offers two modes — a custom-bot webhook (outbound only, as before) or a self-built app with its long connection — and renders one field per credential: the App ID is kept in the record because it is not a secret, the App Secret only in `secrets.json`. App mode proves the pair with one tenant token, opens the socket from the row, answers a message back into the same Feishu chat as the app, and offers `Choose Bots`; the row also carries **允许的飞书用户** — nobody by default, the sender who was turned away listed with Allow, and a field to paste an `open_id` — so a stranger's message never spends the owner's tokens. `Disconnect` closes the socket and clears both credentials. A replayed `event_id` still lands once, and a half-saved pair dials nothing and says so. The app pair is no longer read from `FEISHU_APP_ID` on the Secrets page, and `feishu` is now a reserved capability name. ([#1266](https://github.com/ThinkFlowLab/FlyBot/issues/1266), [#1292](https://github.com/ThinkFlowLab/FlyBot/issues/1292))

### Fixed

- Claiming or assigning a card in a group now posts the one public line the room notice asks for — `接了 #1253，第一步是 …` — in the claiming member's voice. The line goes into the room log without opening a round or waking anyone, takes the card's own note as the first step, and is not repeated for the same card within 30 minutes; progress stays on the card. ([#1253](https://github.com/ThinkFlowLab/FlyBot/issues/1253))

## [0.2.10] - 2026-10-27

### Added

- A group's board can now be a pull queue: the lead enqueues an item for a role (`track_tasks` with `queue` and `role`, no assignee), an idle member of that role claims it with `claim` and one item is handed to exactly one member, and a member that cannot finish returns it with a one-line reason and a `retryAt`; the room board shows one line per role with its depth and oldest wait ([#1247](https://github.com/ThinkFlowLab/FlyBot/issues/1247)).
- The delivery board now reads the repository this instance actually works in, and the header says which one it read and where the name came from: `delivery.repo` in the instance settings first, then the workspace's git `origin`, then the package's own repository as a labelled default (#1250). An instance with none of the three refuses with `no repository — set delivery.repo` instead of showing another repository's numbers.
- Feishu (Lark) connector, phase 1: paste a group's custom-bot webhook URL on Settings → Connectors and this instance can post a text message into that group. The row is a sender — no Bot tools, no per-Bot switch — it proves the webhook with one test message when you connect, shows the reason on the row when Feishu refuses, and sends on demand with the existing retry policy (a rate limit is retried, a refused signature is not). The URL is kept as a secret and never appears in `state.json`, the view or a log line. ([#1263](https://github.com/ThinkFlowLab/FlyBot/issues/1263))
- The Delivery board and the task board now draw their cards through one component, and a card says which side it came from: a repository card is keyed `owner/name#number` — one key for an issue and the pull request that closes it — and a task card `task:<id>` (#1265, first step).
- The Delivery board can read more than one repository: `delivery.repos` names a list (the older `delivery.repo` still works as a list of one), every name resolves with its own source, and the page draws one block per repository with its own state. A repository that cannot be read leaves the others on a partial board instead of emptying it (#1265, step 4).
- Feishu (Lark) connector, phase 2: a message the owner types in Feishu can start a turn here over the long connection. The app pair `FEISHU_APP_ID` / `FEISHU_APP_SECRET` is saved through `secret-set` and stays out of `state.json` and the view; the connection is off until `feishu.enabled` is true, dials only from an app pair that is complete, and only the owner's messages start a turn. A replayed `event_id` lands once — the id is remembered only after the message reached its chat, so a handover that failed is retried rather than dropped — the message arrives through the same chat seam a friend's Bot uses, and the answer leaves again on the same `FEISHU_WEBHOOK` the connector already posts with, so one chat has one way in and one way out. ([#1266](https://github.com/ThinkFlowLab/FlyBot/issues/1266))

### Changed

- A group turn now shows who is working: one line per member that holds an open card on that room's board, with the card number, column, progress and how long it has been open, and an explicit `idle (no open card)` line for a member that holds none — read from the board at the turn, with nothing new written and no one having to post a status ([#1213](https://github.com/ThinkFlowLab/FlyBot/issues/1213)).
- A Bot condenses its conversation earlier: the steward's check line is now 45% of the model's usable window instead of 80%. Every call re-sends the fixed block and the conversation is most of each prompt, so condensing sooner cuts the prompt of a long turn by about a quarter; the cost is that a checkpoint arrives sooner and a condensed conversation keeps less detail. `checkRatio` still overrides it in the profile ([#1233](https://github.com/ThinkFlowLab/FlyBot/issues/1233)).
- A round-trip now exists to bring back a fact the room did not have: independent reads go in one call, a fact already read is quoted with its anchor instead of fetched again, and the same message carries the tip sha, the CI state and the files read, because every avoidable round-trip re-sends the whole context ([#796](https://github.com/ThinkFlowLab/FlyBot/issues/796), [#1235](https://github.com/ThinkFlowLab/FlyBot/issues/1235)).
- A group chat now carries neither the composio tools nor the four `schedule_*` tools: eight tool schemas, about 20.4k characters re-sent on every call of every group turn, that a room round does not use. A Bot reaches an outside app and manages its schedules in its own chat, and the refusal says so. The github tools and every built-in tool stay in the group, and a Bot's own chat is unchanged ([#1237](https://github.com/ThinkFlowLab/FlyBot/issues/1237)).
- A connector call refused in a group room now says the tool is not available there, instead of pointing the caller at its own chat — a friend's Bot has no composio tools in its chat either ([#1271](https://github.com/ThinkFlowLab/FlyBot/issues/1271)).

### Fixed

- The delivery header prints its "as of" time once while today is still running: the partial-day hint now follows the single time instead of repeating it from a second clock rendering, in both English and Chinese. A day whose runs the host could only count by their total now shows the same red share in the header row as the point drawn on the line beside it, instead of a dash next to a dot ([#1244](https://github.com/ThinkFlowLab/FlyBot/issues/1244)).
- A part handoff keeps a repeating task exactly where it was: the same id, the same delivery history and the same instant it was already due, instead of re-anchoring the next run to the handoff and hiding the move in a reset history. ([#1245](https://github.com/ThinkFlowLab/FlyBot/issues/1245))
- The delivery board reads `delivery.repo` however the instance wrote it — nested (`delivery: { repo: … }`), as a literal dotted key, or flat (`deliveryRepo`) — instead of only the flat one, so the setting the page and the hint name really names the repository ([#1258](https://github.com/ThinkFlowLab/FlyBot/issues/1258)). A workspace that is a linked `git worktree` now resolves its `origin` through the worktree's `commondir` rather than falling back to the package default, and a repository name with a `.` or `..` segment is refused instead of being turned into `/repos/../../issues`.
- A line sent into a group chat while a member is speaking now reaches that member inside its turn: the round watches the same Session queue it drains, logs the line at once and steers it into the speaker's running turn with a header saying it arrived after the turn started, so the member's next step answers it instead of reading it after a long turn as if it had been there all along. The line leaves the relay queue, so it is neither logged nor answered twice. The one exception is an explicit stop (停, 停下, 停止, 别做了, 不要做了, stop, stop it): the speaking slot is marked stopped by the user, its turn is cancelled and its answer is not posted, and the line stays queued to be answered as a fresh line by the room ([#1267](https://github.com/ThinkFlowLab/FlyBot/issues/1267)).
- A Bot whose tool list has to be rebuilt for a group room no longer ends up with every tool listed when one name in the mask cannot be restricted: the host keeps the narrowing it can enforce and warns, instead of dropping the whole mask after lifting it ([#1271](https://github.com/ThinkFlowLab/FlyBot/issues/1271)).
- A turn no longer stays open because making room before its next step never returns: the pre-step compaction now carries a deadline (`COMPACT_DEADLINE_MS`, `config.compactDeadlineMs`, five minutes) beside the turn's own signal, and a summary request still retrying when it passes ends that turn with a warning instead of parking it — `turn/end` runs, the queued messages stay for the next turn, and `stop_bot` is no longer the only way out ([#1285](https://github.com/ThinkFlowLab/FlyBot/issues/1285)).

## [0.2.9] - 2026-10-26

### Added

- The delivery board draws the last seven days instead of two numbers per metric. New issues, Closed issues, New pull requests, Merged pull requests and the CI red share all get a 168×28 line beside the existing **Today** / **7 days** columns, where a count's week number is a Σ total and the CI share, a ratio, never takes one. Every point carries a title, a day that could not be read breaks the line instead of reading as zero, and a total over an incomplete window wears a star the footnote explains. Below 900px the line moves under its row, and a snapshot without the series says so in one line instead of drawing empty charts. ([#1212](https://github.com/ThinkFlowLab/FlyBot/issues/1212))
- The delivery board's numbers now come with the seven days behind them: `metrics.daily` carries one entry per Asia/Shanghai day, oldest first and today last, each with the issues opened and closed, the pull requests opened and merged, and the CI share of the runs that actually counted that day. A day the host could not read is `null` rather than `0`, so a gap stays a gap instead of reading as a quiet day, and a week that could not be read at all leaves the whole series `null` instead of drawing seven zeros. The seven-day CI share is read over the same week its own row covers — it used to be a week out of step, because the CI windows were walked backwards from the start of the week. ([#1222](https://github.com/ThinkFlowLab/FlyBot/issues/1222))

### Changed

- A claimed card now gets one line in the room — `Claimed #1234 — first step: …` — so a member who is working is not read as idle; progress still lives on the task board and nothing else is narrated ([#1213](https://github.com/ThinkFlowLab/FlyBot/issues/1213)).

### Fixed

- A delivery board that cannot read part of GitHub now says which part, why, and what to do about it, instead of looking like an instance that was never connected: the first load counts its seconds, a failed refresh keeps the old board with the reason beside it, a round that runs past 90 seconds lands with what it has, and a CI number that could not be read is unknown rather than 0. A 诊断 button and `core/scripts/delivery-probe.mjs` print the same five endpoint statuses, and after a failure the next attempt backs off 10 s, 30 s, then two minutes without dropping the reason. ([#1211](https://github.com/ThinkFlowLab/FlyBot/issues/1211))
- A window that only reads the Bot team — because another dsh holds it — can open the delivery board and its probe again instead of being told `bot/read-only`; both are reads, and every write in that window is still refused. ([#1225](https://github.com/ThinkFlowLab/FlyBot/issues/1225))
- The failure screen now counts down instead of freezing: `Retrying in 120 s` drops a second at a time while a retry is really scheduled, and a fresh or loading board starts no timer at all. The rate-limit and timeout hints also say who retries — `while this page is open it retries on its own` — because the host keeps no timer and a closed page retries nothing. ([#1227](https://github.com/ThinkFlowLab/FlyBot/issues/1227))

## [0.2.8] - 2026-10-26

### Added

- Each Bot keeps a task list it updates from the conversation, and a board shows Not started, In progress and Done for that Bot, a child Bot, and — for a group admin — the tasks member Bots are tracking in the group ([#1058](https://github.com/ThinkFlowLab/FlyBot/issues/1058)).
- Settings → Bot Social now lists friends and links each of your Bots to People with access, so sharing and revoke are findable without opening each Bot first. Add friend stays on the + menu, and the same panel is also on that page ([#1074](https://github.com/ThinkFlowLab/FlyBot/issues/1074)).
- A group's Tasks board shows one overall task and the per-Bot subtasks under it. Bots record that plan with track_tasks, continue the highest-priority unfinished task, and ask the user or the group when a task is waiting on an answer ([#1099](https://github.com/ThinkFlowLab/FlyBot/issues/1099)).
- A Bot with unfinished conversation tasks keeps working without a new message. The host starts a continue turn for the next task, in that Bot's own chat or in the group session that owns the subtask, and stops when the work is done or waiting on an answer. In a group, members with their own subtasks are woken in the same pass ([#1109](https://github.com/ThinkFlowLab/FlyBot/issues/1109)).
- A task that names the issue or PR it came from now says where your answer goes, and the Bot writes it there itself ([#1154](https://github.com/ThinkFlowLab/FlyBot/issues/1154)): the result card shows a *Comment goes to …* link, accepting or sending back leaves one comment for the Bot to post with its own GitHub connector, and a comment that could not be posted says so once on the card instead of failing silently.
- The team can set quiet hours — a window (off by default) that a new or edited scheduled task's time must fall outside, checked when it is saved rather than at delivery: a task inside the window is refused with a sentence naming when it ends, and nothing is created or moved. Repeat and cron tasks are still allowed and the page says they may run inside the window, because DSH decides when they fire (#1166).
- The task board dialog gains a **Delivery** view (#1173): one read-only snapshot of the repository's GitHub issues, pull requests and CI runs, in five columns — original issue, ready to start, in progress, in review, and done today — with a verdict/CI badge per pull request and a header that reports today against the last 7 days. It is repository-wide, so the per-Bot rail does not appear, and it never writes to GitHub: the host serves a cached snapshot built only from `GET` requests, and the token stays host-side. The view replaces the board with one honest line when no GitHub connection is set up.
- A CI scan (`.github/scripts/check-mojibake.mjs`) now fails a pull request whose tracked text files contain U+FFFD — the three bytes `EF BF BD` a lossy decode writes in place of every character it could not read — and names each file with its occurrence and line counts, so the fix reads as "regenerate", not "retype the text". Binary assets are skipped by content (a NUL byte in the first 8 KiB), which is the rule that makes the gate usable at all: decoding the tree instead reports 22 binary files and ~2,065,422 replacement characters on a clean `main`. `AGENTS.md` now says why a file rewritten from an outside source, or regenerated, is re-read as bytes and re-encoded by its generator. See [#1188](https://github.com/ThinkFlowLab/FlyBot/issues/1188).
- A Bot can be spoken for by a supervised external process in rooms (#198): `create_bot` takes an `external` block (`driver: subprocess`, an argv array, optional `cwd` and `env`), and `room-participant.js` routes that member to a new driver while every other member keeps its DSH Session. The process is started per room and Bot, answers one JSON line per turn, and its start, clean exit, crash and timeout are explicit states — a crash is posted as the Bot's own line in the room, and a turn that reaches a dead process ends with a failure instead of silence.
- A finished task can now be accepted or sent back right in the inbox ([#401](https://github.com/ThinkFlowLab/FlyBot/issues/401)): the result card shows the Bot's evidence links and model, **Accept** closes the task as done, and **Send back** asks for one line about what should change and returns the same task to the Bot.

### Changed

- Removing one of a friend's Bots now says which link keeps the friend in the list: the question names the Bots of theirs that are still shared ("Bob stays a friend: still shared through Writer."), instead of only saying the owner is not unfriended and leaving the row unexplained ([#1001](https://github.com/ThinkFlowLab/FlyBot/issues/1001)).
- The new-chat menu offers joining and starting as two rows, so one label no longer names both: **Join by number or link** carries the number and the invite link, and **Start a face-to-face room** opens the same screen under its own name without the link and scan fields, because those are ways into a group that already exists ([#1021](https://github.com/ThinkFlowLab/FlyBot/issues/1021)).
- A fresh 6-digit code no longer answers with an empty-result line. When nobody is waiting, the dialog's primary line is **Start a new room with …** and **Start a new room** is the first button; the note under it still says to ask for an invite link if that room already opened ([#1053](https://github.com/ThinkFlowLab/FlyBot/issues/1053)).
- A face-room line the server sends without an `event_id` is still keyed by the line itself, but the key now carries a bounded digest of the text instead of the whole sentence: `seen` lives in the owner's settings, so on a server that stamps no ids it would otherwise fill up with a copy of the conversation (#1062). The key stays stable across polls, so the duplicate `#1045` fixed does not come back.
- A `Verdict:` now counts only when the workstation that claims to have written it signed it: each reviewing workstation holds one Ed25519 private key, its public key sits in `.github/agent/signers.json`, and the gates verify `Signed-by:` / `Nonce:` / `Signature:` offline over the pull request, the full tip SHA, the verdict and the workstation — so a PASS written in a Reviewer's name on the shared account is no longer a conclusion, it is listed as unverified ([#1110](https://github.com/ThinkFlowLab/FlyBot/issues/1110)).
- The social panel's group and dock surfaces are usable at phone width: below 640 px its buttons and inputs (including the invite-preview and waiting-room footers) are 40 px tall, its row controls at least 32 px, a long unbroken run in a held reply wraps inside its card, the dock clears the home indicator, and the phone block now closes the stylesheet so no later rule of equal specificity can override it (#1147, #1149).
- A group picks one task lead to divide the board. That Bot, or the admin when none is picked, assigns each part; the card is claimed and the assignee starts it in the group without waiting for a confirmation. A question stays in the group ([#1182](https://github.com/ThinkFlowLab/FlyBot/issues/1182)).
- The merge gate now refuses a tip whose only review is a comment from the pull request author's own GitHub account. A PASS from that login counts when the comment header carries `Attestation: <full sha> role=<Bot>` for this tip, the role matches `Written-by`, and the role is not an Owner of the pull request. A review posted by a different GitHub account is unchanged ([#644](https://github.com/ThinkFlowLab/FlyBot/issues/644)).

### Fixed

- Accepting a friend's invite again now shares your Bot back with them ([#1000](https://github.com/ThinkFlowLab/FlyBot/issues/1000)): the two of you can message each other right away instead of one direction staying silently absent until they share again.
- Coming back to a group nobody has spoken in yet shows the invite link the room already has, instead of minting another one on every visit — the strip now reads the room's links first, as the Members card does, counts a dated link live until its deadline passes, and never keeps the previous room's link when the dock moves to another group ([#1019](https://github.com/ThinkFlowLab/FlyBot/issues/1019)).
- Re-accepting an invite from a Bot Social server whose invite info names no `bot_id` now grants to the peer id `list_friends` lists instead of a `friend_home` the server never receives ([#1024](https://github.com/ThinkFlowLab/FlyBot/issues/1024)): the pair becomes two-way again, and when no listed friend names that home the accept no longer claims a share that did not happen.
- A window that showed the Bot team read-only because another dsh held `state.lock` now takes the lock on its next write once that window closes, instead of staying read-only until a `state` read happened to refresh it (#1027). New work that changes the state outside a request belongs in `rt.mutate(fn)`, which follows what the other host left before applying the change, so neither side's work is lost.
- The Add friend result no longer stacks a second "Your" on a Bot whose owner already named it that way — a Bot called `Your Bot` reads as "Your Bot is shared back, so they can reach you too." instead of "Your Your Bot …" ([#1037](https://github.com/ThinkFlowLab/FlyBot/issues/1037)).
- The group strip no longer offers **Invite by link** before it has read the room's own links, so a fast click cannot mint a second ticket the panel was about to discover, and a chat that draws no strip (a face room, a Bot chat, a chat with turns) no longer issues that read at all ([#1038](https://github.com/ThinkFlowLab/FlyBot/issues/1038)).
- A turn that dies before writing anything is no longer invisible: when a model call is refused (a provider budget cap, a 429), the chat shows one line naming the provider's own error above the composer, and a run of them says how many turns in a row died, so a quota outage reads as an outage instead of a Bot that chose to stay silent. A turn that already wrote text adds no line, and a completed turn clears the count ([#1044](https://github.com/ThinkFlowLab/FlyBot/issues/1044)).
- A face-room line the server sends without an `event_id` is posted into the room once: the poll keys it by the line itself (type, sender, server time, text), instead of appending a second copy on the next poll — the duplicate the room drew as the same sentence twice, often seconds after both people had left ([#1045](https://github.com/ThinkFlowLab/FlyBot/issues/1045)).
- A window that was read-only only because the other dsh had the team open now takes the free lock for the writes that were still inline, instead of dropping them or refusing with the read-only error: a friend's first line and the unread mark, a team exchange, and every DSH Agent change (add, adopt, archive, remove). The change the other host left survives, because the write adopts and re-resolves its records before it applies ([#1048](https://github.com/ThinkFlowLab/FlyBot/issues/1048)).
- Typing a room number that is not exactly six digits keeps Join disabled and shows "Enter 6 digits" under the field (Chinese: 请输入 6 位数字). An empty field stays quiet, and six digits still join ([#1052](https://github.com/ThinkFlowLab/FlyBot/issues/1052)).
- When someone accepts your invite, the sidebar says who joined and People with access lists them even if the grant list is still empty, with one step to ask them to share a Bot back ([#1054](https://github.com/ThinkFlowLab/FlyBot/issues/1054)).
- Two identical lines from one person inside the same second in a face room now both appear: a line the server stamps in whole seconds is told apart by its own cursor (or, without one, by its place in the snapshot) instead of being read as the same line twice, so the second one is no longer dropped ([#1063](https://github.com/ThinkFlowLab/FlyBot/issues/1063)).
- A group invite link seats the guest's Bots when they claim it, even if the accepting knock never arrives, and the group opens in the guest's sidebar. A claim the host cannot finish is named on the group's Members card ([#1064](https://github.com/ThinkFlowLab/FlyBot/issues/1064)).
- A friend DM shows when the other home's Bot could not reply (for example it has no API key) instead of staying on "Weighing the options…" ([#1068](https://github.com/ThinkFlowLab/FlyBot/issues/1068)).
- A friend's Bot that shares a local Bot's display name no longer wears that local Bot's picture: two default Chiefs both store the blue whale, and the friend's row now steps to a different shape while the local Chief keeps its own look ([#1069](https://github.com/ThinkFlowLab/FlyBot/issues/1069)).
- A face room that Bot Social no longer lists is marked Closed on the hosted room, so it leaves the active sidebar list and stays as one Past rooms row. When Bot Social sends `closed_at`, that time is the row's time on every home ([#1070](https://github.com/ThinkFlowLab/FlyBot/issues/1070)).
- **People with access** asks before **Revoke** (`Revoke <name>?` with **Revoke** and **Keep**, naming the rooms that share is used in), and the row separates the handle from "In use in N rooms" with a middle dot (`@handle · In use in 3 rooms`) instead of running the two together ([#1073](https://github.com/ThinkFlowLab/FlyBot/issues/1073)).
- Enter chat in a face-to-face room no longer shows "internal error" after the other person has joined. The start request sends an empty JSON body, which Bot Social accepts ([#1085](https://github.com/ThinkFlowLab/FlyBot/issues/1085)).
- Dismissing an Enter-chat error and typing in the room composer no longer shifts the window sideways. The page and the app frame cannot scroll horizontally, and the error toast stays inside the viewport ([#1086](https://github.com/ThinkFlowLab/FlyBot/issues/1086)).
- A friend's direct chat says "Waiting for their approval" (等对方批准) while you wait for their reply, instead of a generic thinking line such as "Sorting out the details…", so a reply their home is holding for approval is not presented as this side still working it out (#1087).
- A friend's Bot in the @ menu and in a mention chip uses the same picture as its sidebar row. A face-room Chief no longer shows a handle-seeded green moon there while the sidebar shows the stored blue whale ([#1088](https://github.com/ThinkFlowLab/FlyBot/issues/1088)).
- A face room you start alone shows your Chief's own avatar in the room header, instead of a blank grey circle, until someone else joins ([#1089](https://github.com/ThinkFlowLab/FlyBot/issues/1089)).
- A message no longer disappears when the team's next write fails. The friend-line mark and the exchange record are written before the message is handed to the Bot, so a failed write (another window took the team over, or the disk refused) used to drop the whole line; now it is logged once and the message still arrives (#1096).
- Face lobby names and face-room titles stay readable. Labels under the avatars wrap, and the sidebar, header, and session title show both names instead of cutting the second one to an ellipsis ([#1102](https://github.com/ThinkFlowLab/FlyBot/issues/1102)).
- When the other side leaves a face room and that leave closes the room, the room says so once: the "left the room. Room closed." banner is the only line, so the short platform leave no longer appears next to it. A leave that leaves the room open still posts its short line ([#1103](https://github.com/ThinkFlowLab/FlyBot/issues/1103)).
- Ordinary group lines to a friend's Bot no longer keep stopping on "Waiting for approval" after Auto-send is on for that pair (the card's Auto-send from now on, or Sharing → People with access). A line Bot Social held only because the text looked like an instruction (a word such as "token", with no secret, file, or instruction-override) goes out; a real finding still waits for approval (#1113).
- An ordinary @ or reply in a shared group no longer stops on "Waiting for the owner's approval" when the other home has not turned Auto-send on. Seating both Bots in the room is the consent for that text. A file, a DLP finding, a risk flag, or an instruction-override still waits for approval. A face-room line held as policy still waits for the owner (#1118).
- Starting FlyBot on DSH no longer stops before the Main Bot is ready: the task drive registers its handle with Cordis `provide` instead of a property write the host rejects ([#1120](https://github.com/ThinkFlowLab/FlyBot/issues/1120)).
- A Bot that already shares a live local group, including a group a link seated, can @ the other home's seated Bot with the `@…home` mention, and each successive line is delivered in the group, without a separate Sharing grant. A direct message to a Bot outside every shared room is still refused, and leaving the group restores that refusal (#1126).
- A Bot's existing group sessions follow a model change, including when the record already says that model is applied, so a turn no longer asks a provider the Bot was moved off (#1127).
- **Share with a friend** used to report success for a Bot the other home no longer runs. A row whose Bot is gone from the roster that home is still listed in now says so — `<Bot> was removed from that home. Sharing with it cannot reach anyone.` — and its **Share** is disabled; a click that still reaches the host is refused with `bot/removed-bot` and sends no grant, so the list stops claiming a share that would reach nobody. The row is judged on both the peer id and the handle (`list_remote_bots` entries carry both), and a home missing from the cached roster, or a roster read that failed or came back empty, decides nothing — it shares as before rather than guessing (#1128).
- Needs you rows in the Inbox can be answered there. An ask_user card shows its options and a short answer — one option sends at once, a multi-select toggles until Submit — a task that is waiting on input takes a short answer, and a listed tool approval still clears with Allow once or Reject, so Open is not the only way through a group that has no card (#1140).
- A group @ inserts the seated Bot's name, and Bots that share a live group can message each other without a separate friendship. A deleted friend home is dropped from the room and its chat is hidden ([#1141](https://github.com/ThinkFlowLab/FlyBot/issues/1141)).
- Two controls in the social panel that stayed at their desk size on a phone are now touch-sized: the face-to-face room header's small buttons are 40 px instead of 22 px, and the account menu's links keep a 40 px hit area instead of collapsing to a 12 px text run (#1156).
- A group invite link seats the joiner even when the host's FlyBot has been open, and the joiner's sidebar shows the group. The host was re-reading every open link on each inbox poll and, once Bot Social answered "Too many attempts. Try again in 10 minutes.", previewing again before that cool-down elapsed, so a new claim was never seen; a room share whose text was outside 1–4000 characters was refused, and a join that stayed on an approval card was treated as already sent. ([#1161](https://github.com/ThinkFlowLab/FlyBot/issues/1161))
- The external room driver now ends a stop it is ignored: after `{ type: 'stop' }` and a `SIGTERM` grace it escalates to `SIGKILL`, and a seat whose stop is still in flight is never handed the next turn, so a child cannot outlive its membership. A crash line carries the last ~200 characters of the child's `stderr` (flattened and capped) instead of only `exit N`, and the room-turn timeout reads as "timed out" rather than "process timeout" (#1164).
- Removing someone's Bot from a shared group now drops that room on their home. The other home was still listing the room and could keep receiving and sending in it, because the leave was sent only after the seat had already gone and a later line could open the room again. ([#1167](https://github.com/ThinkFlowLab/FlyBot/issues/1167))
- A decision comment that never went out now stops asking for it ([#1172](https://github.com/ThinkFlowLab/FlyBot/issues/1172)): after two wakes the reminder ends, and a day later the card says the comment could not be confirmed instead of the Bot being woken about it for ever. A task that is still real work keeps waking the same way.
- Pasting a group invite link for a room this home already holds no longer ends on "Asked to join": the preview now says the group is already in the sidebar and draws no Join card, when the link seated the room and when the host added one of these Bots to it by add-member (#1176).
- Needs you cards in the Inbox show the whole ask. The title and the reason wrap, including on a phone, so a sentence is not cut off before the in-place answer (#1177).
- The delivery board links an issue to a pull request only when the pull request closes it, and a verdict past the first hundred comments still decides the badge ([#1189](https://github.com/ThinkFlowLab/FlyBot/issues/1189)).
- The quiet-hours warning on the Scheduled tasks page now renders the host's `quietUnchecked` flag instead of scanning the task list a second time (#1199), so the line and the check cannot drift apart, and it still appears at once after the window is switched on. The subsystem page no longer calls the window one team-wide clock: a task's due time is read in that task's own zone.
- A group turn shows a character-budgeted room history, with long CI and merge essays collapsed, and a compact task-board snapshot. Assigning, claiming, and progress go through that board (overall task, subtask, assignee, column, and progress); @ only wakes a member ([#1203](https://github.com/ThinkFlowLab/FlyBot/issues/1203)).
- A group card wakes its assignee in that Bot's own chat. Assigning, progress, and handoff are board writes; the group stays quiet, and a Bot @ whose open card already shows the line passes ([#1205](https://github.com/ThinkFlowLab/FlyBot/issues/1205)).
- **An `@` that could not reach the other home** used to be swallowed: when a person's line had to go out as the old envelope on a server that stamps typed lines, the other home read it as a Bot's line, so the named Bot was never called and only a log line said so. The room now gets one quiet notice naming the friend's Bot whose call was lost (`No call went out for @x: this connector token may not attest typed lines, so the other home reads this line as a Bot's.`); the words still go out, a probe that did not answer adds no notice, and a server that cannot stamp keeps the old behaviour where the labels still call the Bot (#997).

## [0.2.7] - 2026-10-25

### Added

- A group made with **Create group chat** now shows its own strip above the composer while it has not been used yet — the group's name, who is in it, and **Invite by link** — instead of only a sidebar row; the first message hands the top of the chat back to the session header, so the two never appear together ([#998](https://github.com/ThinkFlowLab/FlyBot/issues/998)).

### Fixed

- A room number is now exactly the six digits stored for a room: a stored value that is not one (`1234567`) is no number at all — cut to six it would name a different room — so the approval card, the waiting card and the room title fall back to the room's own name or to the code you typed. Two live rooms with no number and the same name no longer share one label: each card adds a short, fixed tag from the room id (`the room Loft · a3f1`), the same room keeping its tag on every render ([#1005](https://github.com/ThinkFlowLab/FlyBot/issues/1005)).
- **People with access** now lists one row per Bot instead of one per person, named `Bot (Owner)` and carrying that Bot's handle, so a friend who runs two Bots shows two rows and each **Revoke** takes back only the row it sits on — before this, one Revoke removed every grant that friend had ([#995](https://github.com/ThinkFlowLab/FlyBot/issues/995)).
- A six-digit number whose room has already opened no longer answers "Nobody is using 482913 yet." — the prompt now says **Nobody is waiting under 482913.**, points a late joiner at an invite link when the room already opened, and its button reads **Start a new room**, so nobody is led into opening a second room while their friend waits in the first ([#999](https://github.com/ThinkFlowLab/FlyBot/issues/999)).

## [0.2.6] - 2026-10-24

### Added

- Pasting or scanning a room invite now shows the room before anyone joins it: the join dialog asks the host for the preview and draws the room's name, its lead, how many people are in it, and how long the link lasts, with **Join** and **Clear** on that card. The name is cleaned before it is shown; a preview that cannot be fetched (a 404 or a timeout) drops the card and joins the way it did before, and an older Bot Social says invites need a newer server instead of trying a route it does not serve ([#798](https://github.com/ThinkFlowLab/FlyBot/issues/798)).
- A PASS posted as a review body whose `Written-by:` names someone outside `writers` in `.github/agent/review-policy.json` was silent: `#797` made the `pass` label job say so for a comment, but a review body fired no job at all, so the reviewer saw no label and no note while `review-gate` and `merge-gate` both refused the conclusion. A separate read-only workflow (`permissions: contents: read`, the script from `main`, no secrets) now prints one warning and the same sentence in the run summary, naming the writer, the tip and the file to edit, and stays green ([#801](https://github.com/ThinkFlowLab/FlyBot/issues/801)).
- The sidebar gets an `Archived (N)` section: archived Bots still stay out of the default Bot list and out of the tree, but one collapsed list opens their chats like any other row, and says `archived · merged into <name>` for a Bot a merge replaced ([#810](https://github.com/ThinkFlowLab/FlyBot/issues/810)).
- Two `create_child_bot` calls that are in flight at the same time and belong to the same project or domain become one group: a single lead for that group, reused when it exists, with both new Bots under it, instead of each landing in whatever broader group it fits ([#810](https://github.com/ThinkFlowLab/FlyBot/issues/810)).
- Merging on the code fork is now refused by GitHub, not by a script somebody remembered to run: a new required check, `enqueue-guard`, is written onto every pull request head from the same decision `node .github/scripts/enqueue-guard.mjs --pr <n>` prints — a `hold`, a tip with no PASS naming it, a PASS that lists no `Ran:`, a missing `agent-pr` or a body that names no issue all turn it red, and it flips green without a new commit when the label or the conclusion arrives. `.github/agent/merge-gate-ruleset.json` is the ruleset that requires it next to `tests-ok` (branch `refs/heads/main`, `bypass_actors: []`, strict checks off so every open pull request does not have to rebase); `node .github/scripts/gate-ruleset.mjs --check` reports the live state and `--rollback` removes it ([#812](https://github.com/ThinkFlowLab/FlyBot/issues/812)).
- The upstream fast-forward is written down and checked instead of remembered ([#815](https://github.com/ThinkFlowLab/FlyBot/issues/815)). `docs/release-runbook.md` records the one-window-per-version sequence — the release commit as the tag target, the dry-run's five gates, `PUT` to disable the ruleset, a `force: false` fast-forward, the restore in a `finally` and the read-back that proves it, then upstream's own release with the same four assets — with every read and write as a `node` snippet, because the box that runs it has no `curl` and no `jq`. `node .github/scripts/upstream-sync.mjs --check` answers the two questions the window needs, read-only: both `main` SHAs with `ahead_by`/`behind_by`, and the ruleset's enforcement with its bypass list; it exits 0 only when the two mains are the same commit and the ruleset is `active` with no bypass actor, and it exits nonzero naming the condition that failed. `--commits` names the commits the fast-forward would carry.
- A friend's Bot that is in a group now answers in that group: a line that names it travels on the room's share envelope carrying the handles it calls, the receiving FlyBot opens one turn for the Bot those handles name, and the answer goes back as a line of the same room instead of landing in the friend's Bot's own chat ([#825](https://github.com/ThinkFlowLab/FlyBot/issues/825)). Bots can answer each other's lines in the room up to the room's hop limit (3 by default) and a line is answered once, so two Bots cannot call each other forever; an answer the friend's owner has not approved yet, or refuses, still says so in the group in one line. The old "sent — its replies appear in its own chat" receipt is gone, because it is no longer true for a Bot in the room.
- A room's invite link can now be used as an invitation: the link carries a ticket, the inviter's FlyBot answers with the room it belongs to, and only the accepting side is admitted, one home per ticket ([#852](https://github.com/ThinkFlowLab/FlyBot/issues/852)). Nothing in the invitation can create a room, seat a member, or use up the ticket, and a refused seat gives the ticket back. One field now reads both link shapes — this server's `/r/<ticket>` and a room on another FlyBot, `/r/@handle/<ticket>` — and a link into another FlyBot's room is answered as itself ("That link opens a room on another FlyBot") instead of being sent to Bot Social as a ticket it never issued.
- A local group’s Members card has an **Invite by link** row: make a link, show it as a QR code, copy it, watch its countdown, or withdraw it. Someone who is not a friend can paste or scan that link in the Face-to-face dialog, see the group first, and join it with the Bots they pick.
- A room's invite link now has the endpoints the Members card works through: read the live link, mint one, withdraw it, and knock at a link someone else handed you — first for the preview, then again with `accept: true` when Join is clicked ([#876](https://github.com/ThinkFlowLab/FlyBot/issues/876)). The knock leaves from one of your own Bots and names the Bot to knock on from the link, never from the request body; a link into a room on another FlyBot, a bare ticket, and a ticket outside the 16–64 character shape are each refused in one sentence and send nothing.
- FlyBot now talks to Bot Social's record of a room link ([#883](https://github.com/ThinkFlowLab/FlyBot/issues/883)): making a link for a room that lives in your FlyBot registers it with Bot Social, a guest's Join claims it there, and the room's own messages travel between your Bot and the guest's Bots under that room only. Anything else to a Bot that is not your friend — a plain message, another room, another Bot — is still refused.
- A room that lives in your FlyBot can now seat someone who is not your friend: a link Bot Social records admits one home with the Bots it brings, all of them in one step, after this FlyBot reads the claim back from the server ([#884](https://github.com/ThinkFlowLab/FlyBot/issues/884), [#878](https://github.com/ThinkFlowLab/FlyBot/issues/878)). A room can have several links live at once, one per person invited, and each is withdrawn on its own. A guest's Bots get the room's lines and nothing else of yours — no friendship and no sidebar entry — and lose the room when its link is withdrawn, they leave, or the room is deleted.
- The merge gate now reports a **silent revert**: a pull request built on an old copy of `main` re-uploads whole files, so work `main` merged after the branch was cut disappears even though everything is green — `#887` deleted `#869`'s 84 test lines the same hour, and `#907` deleted `#909`'s whole fix 40 minutes after it merged, both `mergeable` with `tests-ok` passing ([#914](https://github.com/ThinkFlowLab/FlyBot/issues/914)). It compares the lines `main` added after the merge base with the lines the pull request deletes from `main` and writes one warning per affected file plus a total line into the `merge-gate` job summary. Report only: it never comments, labels, blocks or merges, and a pull request already rebased onto `main` reports nothing.

### Changed

- `Live E2E` no longer fails every night when the repository secret `DEEPSEEK_API_KEY` is not configured: the steps that need the key are skipped and the run warns instead, and its summary says plainly that nothing ran and nothing was measured. A failure inside the suite still fails the run ([#794](https://github.com/ThinkFlowLab/FlyBot/issues/794)).
- `AGENTS.md` no longer gives a Main Bot a removal right it has no tool for: it gets `create_bot` and `update_bot`, `stop_bot` only ends a running turn, and deleting a Bot stays the person's action in the UI (`delete-bot`). The team paragraph now says that, and points at [#638](https://github.com/ThinkFlowLab/FlyBot/issues/638) for the open decision on a retire tool ([#841](https://github.com/ThinkFlowLab/FlyBot/issues/841)).
- A group's invite link no longer expires and is no longer single-use: anyone you give it to can join with their Bot until you withdraw it, and withdrawing stops new joins without removing people who already joined. The Members card's Invite by link section lines up with the card, the note on who leads the group sits with the members again, the + menu entry reads "Join or create by number or link", and a group joined by link shows its own name in the sidebar.
- Group chats use fewer tokens per turn: a member's group conversation now reads the group's notice, members and rules from its standing instructions instead of receiving them again with every turn, and a turn after a notice edit says only that the notice changed ([#894](https://github.com/ThinkFlowLab/FlyBot/issues/894)).

### Fixed

- The main view no longer jumps to the Main Bot when the roster drops a Bot whose chat is still open ([#261](https://github.com/ThinkFlowLab/FlyBot/issues/261)): `landingPart` asks the session list whether that conversation exists, so a revoked share or a removed Bot leaves the open chat (or its blank chat) in place, while a New Session the user opened and a session archived with its Bot still go to the Main Bot.
- The Session header shows the subagent catalog again ([#803](https://github.com/ThinkFlowLab/FlyBot/issues/803)). FlyBot claimed the shell's whole Session header as a single slot, so the child seats that header renders — the lineage title and the subagent catalog button among them — were never drawn and a started subagent had no way in from the header. The Bot pill now sits in the header's utilities list beside those seats instead of replacing the header, and the floating header style FlyBot drew over the Session header is gone with it (that change is visible in every chat). Because the shell draws the utilities — and the pill with them — only while its chrome shows, everything the pill does to the page (the friend-Bot empty-chat hint, the visit ledger, the composer placeholder, the room and face flags) is now installed once from the client plugin and follows the Session being looked at, so a Session without a first message keeps all of it. Nothing is claimed for it: `conversation.session.header.corner`, the other seat the shell draws in every state, already belongs to the shell's own right-sidebar button, and a second registration there fails the plugin.
- In a group, a member's `@Admin` is now always answered: the per-member turn cap used to drop it whenever the admin had already spoken twice in that round, so the one message that says "I am free, give me work" vanished with no notice and the coordinator went on believing the member was busy ([#804](https://github.com/ThinkFlowLab/FlyBot/issues/804)). The cap still bounds a chain of Bots naming each other; it no longer bounds a report to the room's admin, and the round's own turn limit still bounds the round.
- The tree no longer asks the host for the Bot list twice per refresh: the sidebar's structure entry and the archived-Bots list share one feed, so a mounted sidebar reads the roster once every 10 s instead of once per consumer, and the poll stops when the last of them goes away ([#816](https://github.com/ThinkFlowLab/FlyBot/issues/816)). The README now says the archived list is registered at `order: 88` and the reorganization notice at `order: 89`, and a slot renders ascending — so the archived Bots sit above the notice instead of being pushed down by it.
- Joining a room with a link now asks the host once for every Bot picked in the join dialog; before, only the first Bot was put in the room and the others were silently left out. A Bot that cannot join is listed by name while the ones that did still bring the room up. The link asks once for the whole ticket when nothing can change for the next Bot (an unknown, expired or withdrawn invite, a room that has ended, a room that is full) and once per Bot when the refusal is only about that Bot (already in the room, its token revoked) ([#817](https://github.com/ThinkFlowLab/FlyBot/issues/817)).
- The sidebar no longer draws a separator for a section that has nothing to show: the `Archived (N)` group, and the reorganisation notice beside it, left an empty wrapper behind that drew a 1 px line with 8 px of margin over nothing, so a fresh install showed two rules with nothing between them ([#818](https://github.com/ThinkFlowLab/FlyBot/issues/818)). The archived section also reads the roster the sidebar already has instead of fetching it a second time on its own 10 s timer, so a tick is one roster read rather than two; an expanded group stays expanded across a tick.
- A lead created for two simultaneous `create_child_bot` calls no longer claims a Bot it does not hold: a call that only reuses an existing Bot creates nothing, so it is no longer counted as a member of the group, and a burst of one new Bot plus one reused one makes no lead at all ([#819](https://github.com/ThinkFlowLab/FlyBot/issues/819)).
- The invite card now strips untrusted fence markers from a room's `name` and `lead` until the string stops changing, as the server's `stripFaceMarkers` does. One pass could remove a match and assemble a new one — a nested `<untrusted-<untrusted-filemessage>` lost its inner match and left a complete `<untrusted-message>` behind — so a remote room could put marker text into the card a person reads ([#822](https://github.com/ThinkFlowLab/FlyBot/issues/822)).
- An invite card no longer shows an unknown member count as `0 / 8 in the room`: an empty or non-numeric value is treated as missing, while a real `0` still shows as a real count ([#823](https://github.com/ThinkFlowLab/FlyBot/issues/823)).
- Pressing **Join with link** again while the preview card for that link is already on screen no longer asks the server for the same room twice: the card stays up with its countdown, a different link in the field previews once, and **Clear** lets the same link be looked up again ([#824](https://github.com/ThinkFlowLab/FlyBot/issues/824)).
- `upstream-sync.mjs --check` now fails, naming the read and the HTTP status, when it cannot ask how far apart the two `main` refs are, instead of reporting `CHECK ok` on equal SHAs ([#826](https://github.com/ThinkFlowLab/FlyBot/issues/826)).
- The live-e2e secret guard now decides whether a step reads the key from the value YAML parses, not from quotes that happen to appear on the line: a plain `run:` where `#` opens a comment no longer counts as a carrier, and a double-quoted value with an escaped quote before `#` (in `run:` and in an `env:` value) is counted again, so a step that really receives the key cannot pass the check ungated ([#834](https://github.com/ThinkFlowLab/FlyBot/issues/834)).
- A burst of two `create_child_bot` calls with the same name and role made one lead whose role text
  named that Bot twice; the lead now names it once, and a burst with different names still lists every
  member once (#840).
- A face-room invite preview now names the room lead instead of printing `Lead: object Object`: Bot Social sends the lead as a member object, and the card reads it with the same label the member list uses — `Lead: Chief (SelfTest A2)` — while a string answer keeps working ([#846](https://github.com/ThinkFlowLab/FlyBot/issues/846)).
- A friend's Bot added to a local group chat now reaches that friend's FlyBot with no approval card: the host clears Bot Social's blanket hold on the room's own `FLYBOT-ROOM-SHARE` envelope (the same allow-list a face-room line uses), so the invited home sees the shared room as soon as the Bot is added and each later group line goes out with it. A hold with a finding of its own keeps its card, and a card that does appear reads one plain sentence (the invite, or the group message) instead of the raw envelope and its local ids ([#847](https://github.com/ThinkFlowLab/FlyBot/issues/847)).
- A group created from the sidebar now names the person who invited a friend's Bot, not "a friend": the social plugin keeps the owner-level name and home on each Bot's member record (from `whoami`), and the share envelope reads them when no human participant is in the room. A room that does have a human participant still names that human, and a room mirrored from an inbound share forwards its original inviter instead of this home's owner ([#848](https://github.com/ThinkFlowLab/FlyBot/issues/848)).
- A held group line now reads as that line even when its text carries a `}` or a quote: the approval card's envelope scan knows JSON strings and escapes, so it no longer stops inside the text and falls back to the generic `Group update for … in a group chat` sentence. A broken face-room tail also keeps its `To the room:` prefix off the card ([#855](https://github.com/ThinkFlowLab/FlyBot/issues/855)).
- A face-room invite preview now names what kind of room it is when Bot Social has no name for it: the card's first line reads `Face-to-face room` instead of `A room with no name`, which was the first thing a person saw before deciding to join. The lead, the `n / 8 in the room` count and the deadline are unchanged ([#859](https://github.com/ThinkFlowLab/FlyBot/issues/859)).
- A room-only Bot Social identity that is promoted by a person grant keeps the owner-level name and home the share envelope reads, instead of dropping them and leaving the next group invitation saying `a friend` (with an empty `inviterHome`) until the process restarts. When the record never had either, promotion fills them from `whoami` right away ([#863](https://github.com/ThinkFlowLab/FlyBot/issues/863)).
- Auto-send decides on Bot Social's `hold_reason` instead of guessing from `reasons` ([#865](https://github.com/ThinkFlowLab/FlyBot/issues/865)): the two outbound paths clear only `blanket_outbound`, and `risk`, `attachment`, `policy` and any value this build does not know keep their card for the owner. The face-room path also clears `face_room_auto_send_off`, which is nothing but that Bot's own room Auto-send switch on a clean line, so the switch the owner turned on keeps sending ([#457](https://github.com/ThinkFlowLab/FlyBot/issues/457)). A server that does not send the field keeps the old rule, and when the field and `reasons` disagree the field wins.
- A room shared into a FlyBot home is now named after the person who invited it, not after the Bot that carried the invitation across Bot Social. The receiving side reads the inviter from the share envelope (`inviterName` / `inviterHome`) and falls back to the transport only when the envelope names nobody, so the room reads **Shared room from Alice** instead of **Shared room from Chief**. A projection recorded under the transport's identity before this fix is still recognised as the same room rather than appearing twice, and chat lines keep their own speaker ([#873](https://github.com/ThinkFlowLab/FlyBot/issues/873)).
- A Bot that only shares a room with a friend's Bot can message it again: both send paths name the room on `send_as_member` when the two Bots are live in one face room this home has not left, so Bot Social decides on the room-scoped reach the two already hold instead of answering that they are not friends. Lines outside a room, into a local room, and after leaving the room name no room, and a room-scoped refusal now reads as the room's own sentence ("that room is closed between these Bots now…", "the room no longer lets these Bots reach each other…") instead of "you are not friends with this Bot" ([#881](https://github.com/ThinkFlowLab/FlyBot/issues/881), [#866](https://github.com/ThinkFlowLab/FlyBot/issues/866)).
- A link withdrawn on Bot Social (a `204` answer) no longer ends the FlyBot process, and a guest reads the inviting owner’s name rather than the host’s own “You”.
- In a group joined by link, the guest can write too, under their own name, and lines arrive as written. The guest’s Bot no longer drops out of the inviter’s group after the first message. A ticket the guest never claimed opens nothing.
- A tree coordinator no longer gets its whole system prompt re-sent every time one of its children starts or ends a turn: children's load is read with `list_children` instead of a prompt line that changed at each boundary ([#895](https://github.com/ThinkFlowLab/FlyBot/issues/895)).
- A Bot chat whose earlier part had an armed scheduled task now archives that part when it hands off: the switch waits for the task move to finish before archiving, and if a task could not be moved it archives the finished part with that task stopped, instead of leaving it active forever with a warning only in the log; a part held by a running job or turn is left alone, as before. The task keeps running on the new part when it moves ([#896](https://github.com/ThinkFlowLab/FlyBot/issues/896)).
- A group link now works when the host's or the guest's Bot used a face-to-face room before: that room-only identity is promoted before the link is made or joined (and for links made earlier, when FlyBot starts), and the Join dialog says "already joined" only when the group is really in your sidebar; otherwise it says who you are waiting for and Join asks again ([#899](https://github.com/ThinkFlowLab/FlyBot/issues/899)).
- A group joined through an invite link now lists the host's Bots instead of only your own: the join notice carries the host room's Bot roster, the Members card shows each Bot by name and owner, and a message keeps the Bot that wrote it. A Bot the host has not connected to Bot Social shows as "Not connected", and a host Bot this side cannot confirm yet shows as "Unconfirmed" rather than as a friend's Bot.
- A group round's closing report no longer folds a member that was addressed with `@` and never answered into the same sentence as a member that read the line and passed: the two now get separate sentences, so "he had nothing to add" can be told from "he was called and said nothing". A member the line did not name still appears under `Stayed silent:` ([#913](https://github.com/ThinkFlowLab/FlyBot/issues/913)).
- A conversation that is still in the middle of its work stays on the same part after a checkpoint. The context meter was still counting messages the checkpoint had already replaced, so the part looked too long and moved on anyway ([#917](https://github.com/ThinkFlowLab/FlyBot/issues/917)).
- A group that a friend's Bot joined through an invite link now reaches that guest instead of asking Bot Social about a friendship the two homes never had: the seat the link admitted is the one pair the link opened, read from the seat itself or from the link's own record of who it admitted, so a group message or update goes out under the room rather than sitting on an approval that could not be approved. A Bot added to the group by hand is not a link pair and is unchanged ([#923](https://github.com/ThinkFlowLab/FlyBot/issues/923)).
- A shared room whose invite link was accepted before the link recorded which homes it seated now reaches that guest again: the pair is read from the link's own record of who it admitted, so a room that predates `homes` no longer falls back to a friendship the two homes never had ([#929](https://github.com/ThinkFlowLab/FlyBot/issues/929)).
- A Bot that names another member with `@Name` now gets that member called in the shape that used to lose the call: a line posted into the group while a round is running calls the members it names inside that same round (under the usual per-member and per-round caps, exactly once — the re-delivered line calls nobody again), and a late line after the round limit still calls the member it names instead of letting `quiet` swallow the name while the admin answers. A name outside the group, the sender's own name, and a member's failure or stop notice still call nobody ([#932](https://github.com/ThinkFlowLab/FlyBot/issues/932)).
- A group joined through an invite link now shows the other home's messages in the conversation, on both sides, including the host's recent lines from before the guest joined ([#939](https://github.com/ThinkFlowLab/FlyBot/issues/939)). The member count includes the remote Bots the roster already lists.
- A Bot that joined a face-to-face room by its number can write its 1:1 line to the seat it shares that room with: the room is the only consent such a Bot has, so the host's owner policy now reads it instead of refusing a Bot that holds no person-grant, and the line goes out naming that room so Bot Social checks the same consent — with no shared room the refusal is the same sentence as before ([#948](https://github.com/ThinkFlowLab/FlyBot/issues/948)).
- An @ of a Bot in a room joined by invite link now starts that Bot's turn. The name the @ menu inserts (`Chief (owner)`, `Data (Friend)`) is a call, including for a Bot that has no Bot Social handle; a fenced or quoted @ stays literal text ([#949](https://github.com/ThinkFlowLab/FlyBot/issues/949)).
- A message to a friend's Bot that no longer exists now reads one sentence — the Bot is no longer shared with you, so ask its owner for a new invite — instead of repeating "no such remote bot. Try again. Try again.", and the failed hold it leaves offers no **Retry**, because sending again cannot succeed ([#954](https://github.com/ThinkFlowLab/FlyBot/issues/954)).
- **People with access** no longer prints every room a share is used in on one endless line: the hint names at most three rooms, says how many are left (`+12 more`) and keeps the full list in its tooltip, and a room the grant row already named is not repeated under **This room only** ([#955](https://github.com/ThinkFlowLab/FlyBot/issues/955)).
- A friend's Bot that leaves your shared list no longer takes its whole conversation off the sidebar: the row stays, marked as no longer shared, with its history and its way back, and it returns as an ordinary chat when the share comes back. Hiding a chat yourself still removes the row, and the two states stay apart in the state file ([#956](https://github.com/ThinkFlowLab/FlyBot/issues/956)).
- Your own Bot keeps its color after a friend with the same name is added. The @ mention, the group icon, and that Bot's messages stay on the local look; the friend's Bot stays on its own ([#963](https://github.com/ThinkFlowLab/FlyBot/issues/963)).
- A friend's Bot picked from the `@` menu now inserts the name people read — `@Chief (Bob)`, the same string as its sidebar row — and the sent message draws it as an `@` chip in the bubble and the preview instead of a bare handle. The handle stays the routing key underneath, so the message reaches the same Bot, and a line written before this change keeps its chip. Two friends' Bots with the same name stay apart in the label, and a friend the core does not list yet, offered by Bot Social's own `@` row, inserts that name too. ([#967](https://github.com/ThinkFlowLab/FlyBot/issues/967))
- A failed card that can never succeed no longer offers **Retry** on any surface: the chat bubble and the dock now ask one shared predicate instead of reading only "failed", so a Bot that is gone or no longer shared, or a send refused as not permitted, shows the reason without a button that cannot work, while temporary failures (busy, rate-limited, timed out) keep theirs ([#968](https://github.com/ThinkFlowLab/FlyBot/issues/968)).
- A send to a friend's Bot whose owner took the share back now reads as one short line — the same "not shared with your Bots" sentence the app already used — instead of Bot Social's *peer has not granted chat.public* followed by a **Try again.** that could never work. Both that refusal and the earlier `bot_not_shared` are now marked as not retryable, so no card offers a Retry for them ([#971](https://github.com/ThinkFlowLab/FlyBot/issues/971)).
- **Share with a friend** now shows one row per Bot of a friend instead of one row per person: each row is named `Bot (Owner)` with that Bot's handle, and the **Share** click grants to that row's Bot, so the receipt says which Bot got it. Before, a friend with two Bots collapsed to a single row labelled with the person's name while the grant went to whichever Bot was listed first ([#973](https://github.com/ThinkFlowLab/FlyBot/issues/973)).
- **Share with a friend** filters per Bot, not per person: a friend who runs two Bots used to disappear from the list entirely once either Bot had yours, and the panel then said they already had it — true for that Bot and false for the other one. The other Bot is offered again, under its own name, and the click grants that Bot ([#981](https://github.com/ThinkFlowLab/FlyBot/issues/981)).
- **Share with a friend** no longer drops to "No friends left to share with" when reading the friend list fails or is overtaken by a **Revoke**: the rows the last successful read drew stay on screen, a failed read is named with a **Try again**, and the empty sentence now prints only after a read that succeeded and actually returned nobody ([#984](https://github.com/ThinkFlowLab/FlyBot/issues/984)).
- When sharing a Bot with a friend fails, the Sharing card keeps that message as the share's own: it no longer offers a **Try again** that only reloads the friend list, and a later successful reload no longer wipes it. The friend-list read keeps its retry and its empty state, and the two errors no longer stand in for each other ([#987](https://github.com/ThinkFlowLab/FlyBot/issues/987)).
- A refusal that a peer has not granted a capability other than chat, such as profile.read, stays a normal error you can retry, instead of the "not shared with your Bots" line. A withdrawn chat share (*peer has not granted chat.public*) still reads as that one line, with no Retry ([#988](https://github.com/ThinkFlowLab/FlyBot/issues/988)).
- A held face-to-face line's approval card now names the room it will go to: `Chief → the room 482913` when this home knows the number the room was joined by, else `Chief → the room <title>` for a room entered by link, so two open rooms never both read `the room` while the owner is deciding which one gets the line ([#991](https://github.com/ThinkFlowLab/FlyBot/issues/991)).
- The Sharing card now shows both facts at once: a failed **Share** and a failed friend-list read each keep their own message, so clicking Share no longer erases the list error and its **Try again**, and the five-second refresh no longer erases what the share told you. A successful refresh settles only the list error, and a successful share settles only its own line ([#992](https://github.com/ThinkFlowLab/FlyBot/issues/992)).
- The share receipt names the Bot the click granted — `Shared Chief with Writer (SelfTest B2).` — using the label the row already shows, instead of falling back to the friend's home slug (`Shared Chief with selftestb2.`) when Bot Social's answer carries no names; a caller that sends no label gets a plain `with your friend`, never the slug ([#994](https://github.com/ThinkFlowLab/FlyBot/issues/994)).
- The enqueue guard now accepts a cross-repository issue reference, `Fixes owner/repo#<n>`, next to the bare `Fixes #<n>` it already knew ([#809](https://github.com/ThinkFlowLab/FlyBot/issues/809)). Pull requests are opened in the code fork while issues stay upstream, so the bare spelling there points at a number the fork does not have; every such pull request was refused at the last step before the queue. The refusal text now names both spellings.

### Security

- An inbound room share and a room-scoped line are now trusted by the transport that delivered them, not by the envelope that describes them: a share naming a room of yours is refused (`not-inviter`) unless it arrives from the home the room belongs to, a line for a room nobody shared no longer opens one (`unknown-room`), and a `@handle` signature is shown only when it traces to the sending Bot, a remote seat of that room or its inviter — otherwise the line is kept and attributed to the Bot that delivered it, marked unverified ([#909](https://github.com/ThinkFlowLab/FlyBot/issues/909)).
- A shared room no longer takes an inviter's handle from another home as that inviter's signature: a line that presents the inviter handle but arrives from a different home is kept and shown under the Bot that delivered it, marked unverified, instead of being signed as the inviter ([#918](https://github.com/ThinkFlowLab/FlyBot/issues/918)). Only a `join` records which home invited a room — a line can no longer rewrite it, which is what made the signature check agree with itself.

## [0.2.5] - 2026-10-24

### Added

- A face-to-face room now shows its 6-digit number as a QR code, and FlyBot can scan one instead of typing: the waiting dialog and the room panel draw `FLYBOT-` plus the number locally (byte mode, error correction M, version 1 — every module computed in the browser, no request and no image service), the code disappears when joining ends or the room opens, a QR from anywhere else is refused in one sentence, and a scan ends in the same `social/face-join` the number field uses. A browser without `BarcodeDetector` says so before it asks for the camera, a refused camera gets one sentence, and typing the number keeps working either way ([#773](https://github.com/ThinkFlowLab/FlyBot/issues/773)). An open room also offers **Invite by link** (`data-flybot=face-invite`): **Create link** asks Bot Social for one and draws the link itself as the QR, so a phone camera opens the room and FlyBot's scan joins with the same ticket; the card shows the link, **Copy link**, the deadline, and **Withdraw link**. Pasting or scanning accepts only `https://…/r/<ticket>`, and each refusal — expired, withdrawn, full, closed, already in it — is one sentence. The card stays off on a server without the `face_room_invites` feature, which says *Invites need a newer Bot Social. The 6-digit number still works.*
- `core/dev/token-report.mjs` reads the usage ledger into the numbers #796 asks for: per Bot, per Session and per day, with fresh input, cache read, cache write and their sum (prompt) as separate columns, per-call prompt percentiles, the top Sessions by prompt, and each Session's prompt growth between consecutive calls, splitting at a compaction or a new part instead of counting it as a negative delta. It opens the ledger read-only, defaults `--db` to `$DSH_HOME/usage.sqlite`, and exits non-zero naming the path when it is missing. The first report is [docs/reports/2026-10-23-token-spend.md](../docs/reports/2026-10-23-token-spend.md) ([#799](https://github.com/ThinkFlowLab/FlyBot/issues/799)).

### Fixed

- `create_team` now refuses a team before it writes anything when the lead's name or a member's name is already taken anywhere on this home: it names every clashing name and the path of the Bot that holds it ([#764](https://github.com/ThinkFlowLab/FlyBot/issues/764)). Previously it created the lead first, so a member whose name was taken was dropped and the team was left half-built with a childless `<team> Lead`.
- A PASS whose `Written-by:` names someone outside `writers` in `.github/agent/review-policy.json` is refused by `review-gate` and `merge-gate`, but until now only a log line said so: the reviewer assumed a conclusion that counted, nobody enqueued, and the pull request waited with every check green. The `pass` label job now leaves one comment per tip naming the author, the tip and the file to edit, and still adds no label for it ([#767](https://github.com/ThinkFlowLab/FlyBot/issues/767)).
- An image that no model can read now arrives as a placeholder that names its file on disk (`<home>/attachments/v1/objects/<first two>/<sha256>`), so a Bot can pick the bytes up with its own file tools instead of asking the user to describe the picture. The path is given only when the file is really there, and only when the file sandbox can open it; a chat and a group relay share one placeholder ([#779](https://github.com/ThinkFlowLab/FlyBot/issues/779)).
- Handing the Main role to another Bot now moves the tree's root with it on the next turn: exactly one root remains, the previous Chief is demoted and placed in the tree, and the new Main gets the tree tools instead of waiting for a restart ([#748](https://github.com/ThinkFlowLab/FlyBot/issues/748)). A tree that already sits at `maxDepth` stays inside it on the swap: the demoted root's branch is re-attached under the new root instead of being placed one level too deep.

## [0.2.4] - 2026-10-23

### Added

- A plugin the host allows to make a model call can now also get its own default model: `flybot.modelFor` (`{ '<plugin>': '<provider/model>' }`) is used when the call does not name one, so a host can keep a cheap plugin cheap while the rest of the team stays on the team default. A plugin the host did not name is unchanged, a model the call names still wins, and an entry that is not a non-empty string is ignored rather than passed through ([#579](https://github.com/ThinkFlowLab/FlyBot/issues/579)).
- A **Copy report** button on the timeline turns the window into a short Markdown run report — per Bot its turns and failures, busy share, tokens, top tools and unanswered requests, then the team rollup and the longest open wait — and copies it with one click, in the same hours the panel shows ([#582](https://github.com/ThinkFlowLab/FlyBot/issues/582)).
- A new read-only `timeline/alerts` endpoint turns the timeline window into durable alerts: a Bot that fails most of its turns (`errors`), a Bot whose request went unanswered (`waiting`) or a handoff that has waited past 15 minutes (`stuck`) opens one alert that records when it started, and the alert resolves itself when the condition clears and stays readable for a minute after. Polling again never opens a second copy, a look-back window never resolves a live alert, and nothing new is written to the trace ([#584](https://github.com/ThinkFlowLab/FlyBot/issues/584)).
- `bot_schedules` lists every scheduled task of the calling Bot across all of its sessions — its own chat, the earlier parts of it, and the group chats it speaks in — with each task's next run, state and owning session, so a task the owner sees in the UI can no longer look missing from the one session a Bot happens to be in ([#628](https://github.com/ThinkFlowLab/FlyBot/issues/628)).

### Changed

- Every one of your own Bots now gets your saved keys (such as `$DSH_SECRET_GITHUB_TOKEN`) and your connector tools (GitHub, Composio) on every turn: group rounds, Bot-to-Bot messages, scheduled turns, turns of a Bot you share with a friend, and work a Bot does in a sub-agent. The "also when others use it" connector switch is gone; each Bot keeps one on/off switch per connector. A friend's Bot still never gets your keys or connectors, and a key you set to Chosen Bots still goes only to those Bots. Bots now use the GitHub connector first and the shell token only as a fallback, for example for `git push` ([#601](https://github.com/ThinkFlowLab/FlyBot/issues/601)).
- Typing two or three short lines in a row in a Bot's own chat now opens one turn instead of one turn per line: the host holds the lines for 1.5 seconds and hands them over together, in the order they were typed, each on its own line. A line sent while the Bot is already answering still lands on its own, and a group chat is unchanged ([#642](https://github.com/ThinkFlowLab/FlyBot/issues/642)).
- Making a Bot or a group chat no longer starts a turn: a new Bot is sent no greeting and waits in the sidebar until you write to it or a parent Bot messages it, a new group posts no opening round, and picking a Bot's model applies it without speaking to the Bot. Text you type in the composer before creating a Bot is sent to it as your first message, so it answers you, and it is never saved as the Bot's instructions; making a team costs no model turn ([#645](https://github.com/ThinkFlowLab/FlyBot/issues/645)).
- Bots stay idle until you address them, they are @-mentioned in a group, or their parent Bot gives them a task: the prompt no longer tells a coordinator to dispatch work or a Bot to report and claim on its own, so a team with nothing to do stops producing status traffic, while a Bot that is addressed answers exactly as before ([#699](https://github.com/ThinkFlowLab/FlyBot/issues/699)).
- `list_children` now describes the routing fields it already answers ([#733](https://github.com/ThinkFlowLab/FlyBot/issues/733)): `load` for every child, and `openForMs`/`stalled` for a child with an open turn, so a coordinator can send new work to an idle child instead of learning the shape from the implementation.

### Fixed

- `list_bots` tags a Bot whose outbound message waits on the owner's decision with a count (`Writer (Write, 1 to approve)`), so a coordinator sees who is blocked instead of an idle-looking roster. The tag is a count only — never the held message's text — and clears once the owner decides ([#587](https://github.com/ThinkFlowLab/FlyBot/issues/587)).
- `turn-origin` now treats a message source kind it does not recognise as `other` instead of "nobody's request", so an unknown or future source arriving in a Bot's own chat no longer inherits the owner's standing approval: only DSH's own notice kinds and the documented mention/handoff cases carry no verdict ([#620](https://github.com/ThinkFlowLab/FlyBot/issues/620)).
- A Bot-to-Bot message that repeats what the same sender already delivered to that Session within the last minute now makes one turn instead of two, and the drop is recorded in the host log as `delivery: dedupe <sender> -> <session>`; a relayed conclusion no longer stacks up in a coordinator's queue twice, while the same line to another Session (a group copy, another Bot) is still delivered ([#641](https://github.com/ThinkFlowLab/FlyBot/issues/641)).
- A Bot's shell now says which saved key it withheld and why, instead of looking like the key was never saved: `DSH_SECRETS_WITHHELD` lists `NAME:reason` (never a value), `list_secrets` and `request_secret` name the same reason, and a key the owner scoped to one Bot still reaches that Bot's own scheduled turn while it is shared ([#651](https://github.com/ThinkFlowLab/FlyBot/issues/651)).
- A Bot whose saved key is withheld on a turn can run its shell again: `DSH_SECRETS_WITHHELD` is now declared to the shell environment, so the bash call no longer fails with "undeclared key" ([#653](https://github.com/ThinkFlowLab/FlyBot/issues/653)).
- On the newer DeepSeek Harness (`0.2.1-alpha.1`) the composer's run-stats footer is no longer a single `stats` entry — the turn and step counts moved into an `activity` pill — so FlyBot's "1 turn" / "1 step" wording stopped replacing the shell's "1 turns 1 steps". FlyBot now wraps whichever counts pill the installed shell publishes, on both versions ([#659](https://github.com/ThinkFlowLab/FlyBot/issues/659)).
- A message to a friend's Bot right after that friendship was removed is now refused at once with the usual *not a Bot a friend shared with you* reason, and the Bot leaves the list, instead of being held for approval and then lost when the approval is clicked: the send policy asks Bot Social about the friendship itself rather than trusting the cached roster, and a removal event drops that cache ([#666](https://github.com/ThinkFlowLab/FlyBot/issues/666)). The same check runs again when a held card is approved, so a line whose friendship was removed while the card waited fails with a reason instead of being sent into a refusal.
- Creating a Bot from the composer now always opens the new Bot's chat: if sending the line you typed as its first message fails, you land on that chat with the failure shown instead of on a card that answers "a Bot with that name already exists". An older team's setup line (`[Bot team setup]`) is no longer drawn as a message from the parent Bot in the current part of its chat, matching how the earlier parts already hid it ([#698](https://github.com/ThinkFlowLab/FlyBot/issues/698)).
- The multi-pane layout no longer overflows a narrow window: the Details panel shrinks before it starves the conversation, every pane can shrink, and long values wrap, so nothing is clipped and no blank strip is left between the panes (#705).
- Deleting a Bot now drops its open-turn records from the tree's load tracker. The tracker used to keep counting the deleted Bot forever, so a coordinator could read a Bot that no longer exists as busy ([#732](https://github.com/ThinkFlowLab/FlyBot/issues/732)).
- A hold that arrives with the status `pending_approval` — the spelling Bot Social's own outbound hold already uses — is now treated as waiting by both places that draw it: the held-reply card keeps its Approve / Reject buttons, and the approvals overlay offers the same decisions instead of drawing a settled "Not sent" note, so such a hold can no longer become unanswerable. One shared rule (`pending` and `pending_approval` wait; `approved`, `auto`, `failed` and a missing status do not) decides it, and a failed send still reads "Not sent: delivery failed" with Retry ([#734](https://github.com/ThinkFlowLab/FlyBot/issues/734)).
- A Bot whose Auto-send is on for a friend no longer goes silent: a line the Bot sends is delivered, instead of waiting on Bot Social's own outbound approval with no card anywhere to decide it. The send path now clears that hold itself, the way a typed line and a face-room Auto-send line already did, and only when Bot Social named no DLP finding on it — a flagged line still waits on its owner's card, exactly as with Auto-send off ([#737](https://github.com/ThinkFlowLab/FlyBot/issues/737)).
- A hold whose status is `pending_approval` is now answered by the host the same way the client draws it: Approve and Reject go through instead of being refused as "already decided", the reply's bubble stays a waiting card instead of reading "Not sent", the hold counts against the approval cap, is not cleaned up while it waits, and counts toward the Bot's wait badge. Host and client now read that judgment from one module, so the two spellings of "waiting" cannot be added on one side only ([#754](https://github.com/ThinkFlowLab/FlyBot/issues/754)).
- Durations in the run report no longer overflow their own unit: a wait of 59.6 s reads `1m` instead of `60s`, and 1h59m50s reads `2h00m` instead of `1h60m` ([#761](https://github.com/ThinkFlowLab/FlyBot/issues/761)).
- The first Main Bot created during onboarding, and a duplicated Bot, are now announced to plugins like any other new Bot, so @flybot/tree adopts them immediately instead of only after a restart (or not at all, if the server had been running before the first open).
- Auto-send now clears a Bot Social hold only when Bot Social held the line for its blanket approval rule alone: a reason it does not know, `dlp.blocked`, or any risk flag keeps the line on its card instead of sending it without the owner, and a hold the server has not listed yet is logged with its approval id instead of failing silently ([#766](https://github.com/ThinkFlowLab/FlyBot/issues/766)).
- Hiding a friend's Bot chat from the sidebar ("Hide from sidebar") now sticks: the remote-chat sync no longer clears that hide on the next publish of the friends' list, and a hide the user set now survives the Bot leaving the published list and coming back, while a chat whose Bot left still disappears and a returning Bot still reappears ([#611](https://github.com/ThinkFlowLab/FlyBot/pull/611), [#631](https://github.com/ThinkFlowLab/FlyBot/issues/631)).
- A part switch now saves the new segment, the pointer and the rescued mark before the handoff turn can start, so a failure in that turn can no longer begin a second switch against an uncommitted part — which lost the previous part's handoff note and dropped the messages the second move should have left out; a failed handoff still rolls back to the old part, keeps its input and can be rescued again ([#751](https://github.com/ThinkFlowLab/FlyBot/issues/751)).
- A part switch that fails (a save error, or the fresh Session cannot take the handoff) now leaves the old part current and hands the stopped turn's input on there, instead of opening an empty fresh part with no handoff package and dropping the input ([#740](https://github.com/ThinkFlowLab/FlyBot/issues/740)).
- A turn that finished while the plugin was not listening (a plugin reload, or a crash right after DSH recorded the end) is no longer picked up as "restarted while you were working" and repeated: the durable Session log decides, and only a turn the restart really cut is resumed.
- A restart's pickup no longer loses the work it was about to resume when a delivery fails or the app stops during the pickup: the inflight notes stay until each turn or queued message is handed over successfully ([#747](https://github.com/ThinkFlowLab/FlyBot/issues/747)).
- Approving every waiting card now works for Bot Social holds too (the button was missing or skipped them), and a local hold whose send failed reads Not sent with its error and a Retry instead of offering Approve / Reject that silently do nothing.
- The Bot Social settings file no longer grows forever with one entry per approval hold ever seen: a decided, rejected or gone hold drops its waiting-notice entry, so the ledger stays as small as the pending queue.
- A Bot's role label for a face-to-face room is retried when the room refuses it (a dropped request or a server error) instead of being counted as sent and never synced; a room that is forgotten clears its per-seat role marks.
- Sharing a Bot with an existing friend now works on a Bot that has never been invited or shared: opening Share with a friend registers the Bot's Bot Social identity on demand instead of failing with “has no Bot Social identity yet”.
- Switching the Bot Social server now turns that server's face-to-face rooms into read-only past rooms instead of leaving them open and accepting lines that can never be delivered, and a line sent to an ended room is refused with a clear message ([#729](https://github.com/ThinkFlowLab/FlyBot/issues/729)). Only a change of address counts: renaming this home on the same server leaves that server's rooms open, and a switch that fails ends none of them.
- OTLP export no longer drops a span whose record shares the millisecond the previous batch ended on (a tool call that ends at the same millisecond it started, or a turn ending at the last record's time): the export cursor re-reads records at its last timestamp and deduplicates spans by id.
- A strict OpenAI-compatible gateway no longer rejects the whole chat: every tool FlyBot registers now sends an explicit `required` (empty when nothing is mandatory) and `properties` (empty when it takes no parameters), so an argument-less tool such as `bot_schedules` or `list_bots` cannot turn the tool list into `Invalid schema for function 'bot_schedules': null is not of type "array"`. Tools whose schema comes from an MCP server are passed through by DSH and are not covered by this change ([#768](https://github.com/ThinkFlowLab/FlyBot/issues/768)).
- Deleting a former Main Bot (after handing the role to another Bot) no longer flattens the team: its children move to the current root (or a fresh Root when there is none), so exactly one root remains and the new Chief's `list_children` and replies keep working ([#725](https://github.com/ThinkFlowLab/FlyBot/issues/725)).
- Renaming a Bot (or editing its role) now reaches the tree prompts on the next turn: a coordinator no longer calls a child by its old name, and a renamed Bot sees its new name in its own prompt, instead of waiting for a restart.

## [0.2.3] - 2026-10-22

### Added

- A question a Bot asks about work handed out from a group now shows in that group's sidebar row (waiting dot and "Waiting for your answer") and in the Agent inbox as a **Needs your answer** card whose **Open** takes you to the group, where the card takes the answer ([#552](https://github.com/ThinkFlowLab/FlyBot/issues/552)).
- The `flybot` service can now report approval activity: `flybot.approvals.stats()` returns, read-only, how many of each Bot's outbound sends were held and how many were approved, rejected or went stale, plus a team total. A plugin or a settings view can show it; nothing is changed by reading it.
- A Bot can now record a decision that mattered — an option it considered and whether it used or rejected it, and why — with `record_decision`. It goes into a local, append-only log (`<home>/decisions.jsonl`, capped) that a reviewer can read to see near-misses and judgment drift, and it is fired on the activity feed as `decision` so the Timeline or an audit view can show it. Off by default (`decisions: true` turns it on); a key, token or password is refused.
- When the tree merges two duplicate Bots, the archived Bot's own memory now moves into the Bot that keeps it, so a merge no longer drops what the duplicate had learned. It is capped at 20 entries and tagged `source: merged`. This uses a new plugin seam, `flybot.memory` (read a Bot's entries, append one), which is off unless the host names the plugin in `flybot.memoryPlugins`; without it the merge is unchanged.
- Plugins can now make a short, sanctioned model call. `flybot.model.ask({ prompt, system?, maxTokens? })` resolves `{ ok: true, text }` or `{ ok: false, code }` for a plugin the host allows — usably for a small classification, a title or a one-line summary that a plugin needs of its own. It is off by default (the host names the allowed plugins in `flybot.modelPlugins`), capped in input, output and rate, streams through the host's own model, returns text only (never a provider message) and refuses on a read-only host.
- The Timeline window now reports how each Bot's turns ended — completed, aborted, error or lost — and lists its recent failed or aborted turns with their error code, so the panel or a tool can see a Bot's reliability at a glance. It is read-only and part of the existing `timeline/window` answer, so nothing new needs configuring.
- The timeline window now also reports the open requests waiting longest (#469) and the tools each Bot used with their failures (#359), and `timeline/health` reduces the same window to per-Bot health signals and flags (#357).
- The Timeline window now reports the token spend per Bot — how many model calls, and the input, output and cached tokens they used, when the adapter reports them — so where the team's model quota goes is visible next to the turns it ran. Read-only, counts only (never message text), and part of the existing `timeline/window` answer.
- The tree can now group a Bot by meaning, not only by the words in its name and role. With `modelClassify: true` in the tree config (and the host allow-listing `flybot-tree` in `flybot.modelPlugins`), a Bot whose role the built-in vocabulary cannot place — a title it does not hold, a brief in another language — is sent to the model once for a single category, which is stored on the Bot and used the next time the tree reorganizes. It is off by default, asks at most once per role change, and the rules still win where they already found a category.

### Changed

- A Bot session on `workspace-write` without a usable sandbox backend now has a one-command preflight (`node .github/scripts/sandbox-preflight.mjs`) that names the missing backend and prints the unlock in one line, and the agent instructions say to report the block once instead of retrying every shell call ([#607](https://github.com/ThinkFlowLab/FlyBot/issues/607)).
- The integration guide now names the two plugin seams — `flybot.model.ask` and `flybot.memory` — with the host config that enables each (`flybot.modelPlugins` / `flybot.memoryPlugins`), so a plugin author finds them without reading the host source.

### Fixed

- Scheduled tasks no longer stop overnight in a group chat: the limit that let Bots start only three rounds there until you spoke again is turned off, because it blocked owner-set recurring runs without showing anything. Bot-to-Bot chain and per-round limits still apply ([#557](https://github.com/ThinkFlowLab/FlyBot/issues/557)).
- Sharing a Bot with a friend on a Bot Social server that lacks `grant_bot_to_friend` now tries the REST route and, when that is missing too, says *Bot Social needs an update to share with a friend. Invite links still work.* instead of showing the raw `MCP error -32602: Tool grant_bot_to_friend not found` ([#563](https://github.com/ThinkFlowLab/FlyBot/issues/563)).
- Sharing a Bot with a friend works again: **Share with a friend** names the friend by the friend's Bot id (the id `list_friends` returns) instead of an owner id the server never lists, the fallback route now matches Bot Social (`POST /v1/bots/:id/grants`), and a server that refuses the request says so in plain words instead of showing the raw `MCP error -32602` text ([#592](https://github.com/ThinkFlowLab/FlyBot/issues/592)).
- The approval card in a group's details panel wraps its buttons, so **拒绝** and **允许一次** stay reachable at common desktop widths instead of overflowing off the left edge of the panel ([#593](https://github.com/ThinkFlowLab/FlyBot/issues/593)).
- A Main Bot the tree adopts only after the server started (onboarding creates it while `dsh web` runs) now gets the tree's team-building tools (`create_team`, `create_child_bot`, and the other gated tools) on its first turn instead of only after a restart; the plugin-tool mask is recomputed when a turn starts, not only when the Agent is created ([#594](https://github.com/ThinkFlowLab/FlyBot/issues/594)).
- A group member Bot's line that arrives while the group's turn is still running no longer shows up in the message bar above the composer with the internal `[Group post from …]` header; it appears at once as that Bot's own bubble, and the round still gets it when the turn ends ([#595](https://github.com/ThinkFlowLab/FlyBot/issues/595)).
- A Bot's own failure, stop or resume notice that lands while its group chat is still in a round no longer flashes FlyBot's internal `[Group post from …]` routing header in the queued-message bar above the composer; it waits until the round is done and the round still shows it as that event ([#595](https://github.com/ThinkFlowLab/FlyBot/issues/595)).
- The decision log (`decisions.jsonl`) is now bounded on disk: the host trims it to the newest 2000 entries and at most 1 MB as it appends, and a read parses at most that byte cap instead of the whole file, so the log no longer grows without bound ([#603](https://github.com/ThinkFlowLab/FlyBot/issues/603)).
- "Always allow" now keeps working when DSH opens its own retry turn after the owner answered: a turn with no message verdict in a Bot's own chat uses the Bot's standing approval instead of showing the same card again, and a grant that a turn cannot use says why once in the log ([#608](https://github.com/ThinkFlowLab/FlyBot/issues/608)).
- The sandbox preflight now answers for the file policy it is given (`--mode`, or `FLYBOT_SANDBOX_MODE`) instead of assuming `workspace-write`, never reports a `danger-full-access` session as blocked, reports the Windows ACL runner as `unknown` rather than unavailable, and separates "proven blocked" (exit 3) from "cannot tell" (exit 4), so an agent no longer stops shell work on a probe it cannot complete ([#615](https://github.com/ThinkFlowLab/FlyBot/issues/615)).
- The answers to deleting a Bot, setting a Main Bot, removing the Agent and deleting a group chat now carry only the signed-in member's own scope, like every other team view, instead of the whole team.
- When someone has signed in, the one DSH Agent (and its Sessions: new session, adopt, rename, archive, remove) stays usable to that member while the team is alone, instead of every call being refused before it runs; with more than one member it follows the same shared-resource rule as adding the Agent.
- After switching the Bot Social server, the stopped social layer can no longer restart its poll from a face poll that was still in flight, so the old server is not polled (and does not deliver messages) after the switch.
- A hold on a send now blocks the task that was started last even when two tasks were started in the same millisecond: task order uses a strictly increasing stamp instead of the bare clock, so which task an untagged hold blocks no longer depends on timing.
- The team-health view no longer calls a Bot idle while it is busy in one long turn that began before the window, and its failure rate is never reported as more failures than turns; a Bot busy through the window is flagged busy.
- The timeline panel no longer issues a duplicate request when a window change supersedes a poll in flight and the tab is looked at again: a superseded answer no longer clears the in-flight guard of the request that replaced it.

### Security

- `set-main` no longer lets a member take another owner's Main Bot's place: the endpoint checks the Bot named in `replace` too, and `setMain` refuses a `replace` across owners, so a member cannot demote another owner's Main Bot or promote their own Bot over it ([#613](https://github.com/ThinkFlowLab/FlyBot/issues/613)).
- Untrusted-content fences are neutralized more strictly: a marker written with whitespace inside the tag (`< / untrusted-message>`) is now stripped too, since a parser that ignores whitespace reads the same closing marker. Text from friends' Bots and other untrusted sources stays data, never instructions.

## [0.2.2] - 2026-10-21

### Added

- An **Inbox** row at the top of the sidebar opens one list of your own Bots' work: **Needs you** (tool approvals, held messages, tasks waiting for you or failed), **In progress** (running turns and tasks) and **Done** (the last 7 days). Each card has one clear status and an **Open** button to its chat; tool approvals from a group chat can be answered right there with the same buttons as in the chat ([#349](https://github.com/ThinkFlowLab/FlyBot/issues/349)).
- FlyBot can run in a container that you build yourself: a `Dockerfile` and `compose.yaml` start `dsh web` with the FlyBot core and plugins as a normal user, with one data volume, no keys in the image, the port on the host's `127.0.0.1` only and a health check. A guide in English and Chinese, [Run FlyBot in Docker](docs/docker.md), covers start, stop, upgrade, roll back and back up; CI builds the image and runs a start check, and nothing is published ([#352](https://github.com/ThinkFlowLab/FlyBot/issues/352)).
- FlyBot now sends a system notification when one of your own Bots finishes or fails a turn while you are in another chat or app (`Coder finished`, `Coder failed: <reason>`), alongside the existing approval-waiting one; clicking it opens that chat, and it never approves, rejects or sends anything. Settings → General has a **Notifications** switch, on by default, that turns all of them off ([#353](https://github.com/ThinkFlowLab/FlyBot/issues/353)).
- Scheduled tasks can be edited and paused: in Settings → Scheduled tasks and a Bot's card, **Edit** opens the task in its form, filled in, and **Pause** / **Resume** stop and restart a task without deleting it. The docs now say what happens to a run missed while the app was closed: a recurring task runs once, for its latest missed time, never once per missed time ([#354](https://github.com/ThinkFlowLab/FlyBot/issues/354)).
- Settings → Connectors: pick Composio apps by searching Composio's app list instead of typing app names, and see for each picked app whether it is ready or still needs a sign-in ([#359](https://github.com/ThinkFlowLab/FlyBot/issues/359)).
- On a phone browser (about 400px wide) you can skim a chat, press **Approve** / **Reject** on a held reply and work the Agent inbox: approval buttons become full-size touch targets, floating approval cards span the screen beside the icon rail, and inbox cards put their buttons under the text so titles stay readable. Wider screens are unchanged ([#362](https://github.com/ThinkFlowLab/FlyBot/issues/362)).
- You can now see which model each turn used and which model each Bot runs on: a Timeline turn's tooltip ends with the model that turn ran on (`· deepseek-v4-pro`), and hovering a Bot in the sidebar tree or Bot list shows its model (`Coder · DeepSeek V4 Pro`). Nothing new stores keys; models are still chosen per Bot in its settings ([#366](https://github.com/ThinkFlowLab/FlyBot/issues/366)).
- Chief now places new Bots sensibly up front instead of piling them flat under itself. Before creating a Bot it can search the whole tree with `find_bots` and reuses a Bot that already has the same role, at any depth, instead of making a duplicate. `create_team` sets up a project as one lead with its roles under it (for example Chief → FlyBot Lead → Dev, Test, Maintenance, Repo), which takes one slot under Chief, and `create_child_bot` can put a Bot under one of the caller's own descendants; a later Bot of a group goes under that group's lead. A Bot whose parent is gone is moved back into the tree by role. A full level, orphans and duplicates stay the job of the tree's automatic reorganization ([#447](https://github.com/ThinkFlowLab/FlyBot/issues/447)).
- A guide, [Set a DeepSeek API key](docs/deepseek-api-key.md), explains the ways to give DeepSeek Harness your key (the key dialog, its credentials file, or `DEEPSEEK_API_KEY`), and the missing-key error and the no-model setup choices link to it ([#451](https://github.com/ThinkFlowLab/FlyBot/issues/451)).
- Notifications go further: an approval that is still waiting after 15 minutes gets one reminder (`Coder has waited 15 min for your approval`), Settings → General → **Notifications** has a separate switch for waiting approvals, finished turns and failed turns, and each chat keeps a single notification that a newer one replaces and that counts its updates ([#469](https://github.com/ThinkFlowLab/FlyBot/issues/469)).
- The Agent inbox now lists a turn of your own Bot that failed under **Needs you**, with the reason, until the Bot finishes a turn in that chat again, from the same events as the finished/failed notifications; and each inbox card shows a one-line **Latest:** row with what happened last in its chat ([#471](https://github.com/ThinkFlowLab/FlyBot/issues/471)).
- Each scheduled task in Settings → Scheduled tasks now says when it last ran and how it went (still running, finished, stopped, or failed with the reason). A run fails only when DSH could not deliver it or the Bot's turn errored; a failed run gets **Retry**, which runs the task once now with the same prompt, and the failure also shows up in notifications ([#473](https://github.com/ThinkFlowLab/FlyBot/issues/473)).
- Face-to-face rooms have one room lead (总负责人), a Bot from any home. The person who created the room picks it with the Room lead button in the room's details; until then it is the first Bot of the creator's home that joined, and everyone else sees it read-only. The lead sees everyone in the room with their roles, writes the one plan and gives out the parts; every other Bot, a Main Bot too, does only its own part or answers when named. With an older Bot Social server the default lead is used and cannot be changed ([#476](https://github.com/ThinkFlowLab/FlyBot/issues/476)).
- Share a Bot with an existing friend in one click from Sharing (no invite link); the new share appears in People with access and can be Revoked or declined as usual ([#500](https://github.com/ThinkFlowLab/FlyBot/issues/500)).
- Opt-in state journal for debugging multi-Bot bugs ([#511](https://github.com/ThinkFlowLab/FlyBot/issues/511)): with `stateJournal: true` in the `bot` config, every change to the saved team is recorded on this computer only (`<home>/journal/state.jsonl`, private to the user, kept 7 days or 20 MB), and the dev script `core/scripts/replay.mjs` rebuilds the team as it was after any recorded step. Off by default.
- Tool approval cards in a group and in the Inbox add **Always allow for this Bot** and **Always allow for this group** next to Reject / Allow once, so a Bot stops asking for the same kind of permission (for example a `bash` sandbox escalation to full access). Standing approvals are kept across restarts and listed under **Always allowed** in Bot settings and Group settings, each with Remove ([#540](https://github.com/ThinkFlowLab/FlyBot/issues/540)).
- Memory recall now finds entries by meaning, and shows what memory links. `recall` gains `semantic: "true"`, which ranks entries with a local, dependency-free TF-IDF score over words, word stems and CJK n-grams, so an entry whose wording differs from the query still matches; and `related`, which lists the topics a `[[topic]]` links to and who wrote a memory. The default exact-word recall is unchanged.
- The Timeline plugin can now be asked for an export on demand. `timeline/export` returns the current trace as one OpenTelemetry OTLP/HTTP JSON payload — the same mapping the timer exporter uses — so a tool or the panel can pull it now instead of waiting for the next flush. It is read-only, sends Bot and room ids only unless the caller sets `names: true`, and needs no configuration.
- The Timeline plugin can now export its trace as OpenTelemetry spans. Set `exporter: "otlp"` with an `otlpUrl` (https, or http on localhost only) to POST OTLP/HTTP JSON to any collector (Jaeger, Phoenix, Langfuse…), or `exporter: "json"` to append `dir/export.jsonl`. Finished Bot turns become `invoke_agent` spans and their tool calls `execute_tool` spans beneath them. Off by default; it exports only the same metadata the panel shows (never message text, tool arguments or output), sends Bot and room ids only unless `exportNames: true`, and an open turn is held until it ends rather than exported as finished.
- A tree coordinator can now see how busy its children are. Each Bot's running turns are counted from the activity feed, shown as one line in the coordinator's prompt (`Child load right now — Work: busy (2 running), Travel: idle`) and a `load` count on each entry of `list_children`, so a new part goes to a free child instead of a busy one. Nothing is stored; the counts start from zero on each start.

### Fixed

- Face-to-face rooms: a Bot now looks the same on every home and in every place (waiting tiles, chat bubbles, Members, sidebar). A Bot with no look of its own sends the look its home generates for it to Bot Social, before it joins, so the other home no longer invents a different one; your own Bot in the waiting dialog uses its roster look right after joining; a friend's Bot speaks in the room with the look its owner gave it. Other people show their initial on a color picked from their name instead of a grey silhouette ([#182](https://github.com/ThinkFlowLab/FlyBot/issues/182)).
- Past rooms list everyone who was in a face-to-face room (a home that stayed no longer drops the person who left), each row shows when the room ended, clicking anywhere on the row opens it, and the Past rooms fold stays open or closed across a reload ([#304](https://github.com/ThinkFlowLab/FlyBot/issues/304)).
- Face-to-face rooms: another person's line, or another home's approved Bot reply, that arrives while your Bots are answering now shows right away as that person's or Bot's bubble, never as a queued "[Group post from …]" row above the composer that Cmd/Ctrl+Enter could steer; a person's line breaks are kept on the receiving side ([#455](https://github.com/ThinkFlowLab/FlyBot/issues/455)).
- Face-to-face rooms: a Bot reply held for your approval shows only on its approval card, greyed, and becomes a room bubble only after you approve it; a rejected reply collapses to one grey "Not sent" line, also after a reload and in Past rooms. A decided card leaves no "Approved" / "Rejected" stub, the card names the Bot with its person ("Researcher (Alice) → the room"), and each Bot answers a person's line at most once ([#456](https://github.com/ThinkFlowLab/FlyBot/issues/456)).
- Face-to-face rooms are person-first: one tile and one Members row per person (Members counts people, and only people are "(you)"), every Bot named "Bot (person)" including your own, a mention of a friend's Bot stays with that Bot after it leaves, bubble headers show just the name with the handle on hover, and your own typed line keeps your name and colour. Auto-send in a face room is now one switch per Bot, off by default ([#457](https://github.com/ThinkFlowLab/FlyBot/issues/457)).
- Face-to-face rooms: a number nobody is using no longer silently opens a room. Join says "Nobody is using 111111 yet." with Cancel and Start a room, and a room nobody else ever joined (left, or run out) leaves no Past rooms entry. A room stays open while two or more people are in it; when you are the last one, it reads "Room closed." with one Close button, and Leave (or Close) takes you back to the chat you were in without opening Bot settings. Both homes count down to Bot Social's one deadline, even when a device clock is off or a tab was in the background. A room's turns no longer take over its Bots' sidebar preview, the room row leads with its number ("482915 · Alice, Bob"), Enter chat steps aside while "Leave this room?" asks, Join waits for all 6 digits, and a click outside the dialog closes it like Escape ([#458](https://github.com/ThinkFlowLab/FlyBot/issues/458)).
- Face-to-face rooms: a friend's plain line is now answered like your own: your Bots decide who answers it (usually one, the Bot that spoke last first), and a Bot's @mention in its answer no longer calls another Bot on, so Bots in two homes cannot set each other off ([#462](https://github.com/ThinkFlowLab/FlyBot/issues/462)).
- Face-to-face rooms: when a friend's Bot has already answered or posted a plan for a line, your Bots no longer have to answer it again (no forced "nobody answered" reply), a Bot that still speaks to a line for everyone adds only its own part, and a friend's Bot writing `@all` / `@所有人` no longer wakes all of your Bots; its `@YourBot` still calls that Bot ([#475](https://github.com/ThinkFlowLab/FlyBot/issues/475)).
- **People with access** keeps listing a friend after the two of you joined each other's invite, so the owner can still see and **Revoke** that share on both homes; FlyBot now uses Bot Social's `reply_only` mark to tell a real share from a talk-through grant ([#495](https://github.com/ThinkFlowLab/FlyBot/issues/495)).
- Accepting an invite for a friend's Bot you already have no longer shows red error text claiming the Bot is back. It now says `You already have Chief (SelfA1233).` in neutral text, and says `… is back in your list.` only when a Bot you had removed really comes back. The **Remove this Bot** confirm now says what it does: `Remove Chief (SelfB1233) from your list? Your own Bots stay shared. SelfB1233 can share it again.` ([#496](https://github.com/ThinkFlowLab/FlyBot/issues/496)).
- A friend's message to one of your Bots, the reply waiting for your approval, the Inbox count and the unread badge now show up in an open FlyBot window within a few seconds, instead of up to 15 seconds later, which looked like it needed a reload ([#497](https://github.com/ThinkFlowLab/FlyBot/issues/497)).
- A friend's Bot now has one name everywhere in a friend chat, on both homes: the sidebar row, chat header, tab, composer placeholder and @ menu all read `Chief (SelfB1233)`, from one shared formatter, and the @ menu no longer shows the handle as the Bot's name. A held message's approval card names the person who gets it (`Chief → SelfB1233`), the same before and after a reload, instead of `Chief → Chief (SelfB1233)` ([#498](https://github.com/ThinkFlowLab/FlyBot/issues/498)).
- Invites and friend chats are tidier. A friend's Bot chat always reads **Message Chief (Alice)** in the composer, from the first open and after every send, never the coding-agent copy. **Add friend** and a Bot's **Sharing** use one invite control: **Copy invite link for Chief** makes and copies the link, which then shows with **Copy link**, **Copy with instructions** and **New link**, and every copy says which Bot it is for (`Invite link for Chief copied.`). The Add friend paste box wraps, so a whole pasted link is readable; typing clears an old error, and after an accepted invite the panel shows the result for a moment, then closes and opens the new friend's Bot. The Sharing hint mentions Revoke only once someone has access ([#499](https://github.com/ThinkFlowLab/FlyBot/issues/499)).
- Host and zh copy that still said **Bot settings → Invite to this Bot** after #499/#504 now point at **Bot settings → Sharing → Copy invite link**.
- A friend's Bot in a group chat or face-to-face room is now named like everywhere else, Bot name plus its owner's username: `Reviewer (flybot682b8a43)` instead of `Reviewer · FlyBot 682b8a43 (flybot682b8a43)`. An owner name made up from the install id (`FlyBot <id>`) gives way to the username in member lists, message headers, @ menu labels and join, leave and room-lead lines; the full handle stays in the tooltip ([#526](https://github.com/ThinkFlowLab/FlyBot/issues/526)).
- A key you save, including the GitHub token and the Composio key a connector saves, is now for all of your Bots unless you narrow it; keys that were "No Bot" only because of the old connector default move to all of your Bots once. Settings → Secrets offers All my Bots, Chosen Bots or No Bot for each key ([#545](https://github.com/ThinkFlowLab/FlyBot/issues/545)).
- Group chats: every Bot at work shows as one row of the same shape in one place above the message box, the current speaker included, instead of one row on the left and another further right. Each row says what the Bot is doing and on what (for example `Running shell commands: npm test`), names a tool it has no phrase for instead of "On it", and keeps its elapsed time ([#546](https://github.com/ThinkFlowLab/FlyBot/issues/546)).
- Group chats: when a Bot works on something handed out in a group and needs to ask you a question, the question card now shows in that group instead of in the Bot's private chat. Answer it there and the Bot carries on with the work, reporting back in the group; the Bot's private chat stays untouched ([#550](https://github.com/ThinkFlowLab/FlyBot/issues/550)).
- Group chats and face rooms: the status rows above the message box and the member list show only work in that room, including work handed out from it. A Bot busy in another group or its own chat no longer shows there, and that room's commands no longer appear in a room with different members ([#553](https://github.com/ThinkFlowLab/FlyBot/issues/553)).

## [0.2.1] - 2026-10-20

### Added

- Bot settings → Model has a **Test connection** button: one click sends one short request to that Bot's model on the same route a run uses, then shows that it works or a short reason (no or rejected API key, model not found, cannot reach the endpoint, timeout, rate limit). The request may be billed, and the row says so; keys and provider text are never shown ([#409](https://github.com/ThinkFlowLab/FlyBot/issues/409)).
- A Bot's reply that went out on its own because Auto-send is on for that pair now says **Auto-sent to …** under its bubble, so you can see in the chat that it left without your approval (part of [#417](https://github.com/ThinkFlowLab/FlyBot/issues/417)).

### Changed

- README and README.zh now claim the friend-DM `Name is thinking…` line (fixed in [#360](https://github.com/ThinkFlowLab/FlyBot/pull/360) / [#332](https://github.com/ThinkFlowLab/FlyBot/issues/332)), matching face rooms.
- Add friend shows **Accept an invite** and **Invite a friend** as two labelled groups: the invite Bot picker is labelled **Share** and shows the whole name, the button reads **Copy invite link for {Bot}**, and **Done** sits at the bottom ([#343](https://github.com/ThinkFlowLab/FlyBot/issues/343)).
- A friend's Bot has one name everywhere: the Bot's name, then its owner in parentheses, like `Helper (Bob)`, and a friend's Chief the same way, `Chief (Bob)` (no more `Bob's Chief` or `Helper · Bob's Bot`). The same name shows in the chat header, tab title, composer placeholder, row tooltip, `@` menu, approval cards, face-room Members panel, waiting tiles, bubble header and mention chips; in a face room your own Bot reads `Chief (you)`. The `@` menu lists friends' Bots in its Bots section only, with the handle as the second line. Lines typed with the older names still call the same Bot ([#384](https://github.com/ThinkFlowLab/FlyBot/issues/384), [#305](https://github.com/ThinkFlowLab/FlyBot/issues/305)).
- The account menu and command palette name each place once ([#392](https://github.com/ThinkFlowLab/FlyBot/issues/392), [#393](https://github.com/ThinkFlowLab/FlyBot/issues/393), [#394](https://github.com/ThinkFlowLab/FlyBot/issues/394)): **Settings** opens the Settings dialog (it no longer says Bot settings, which is one Bot's own page), **Connect apps** matches the footer button, **Scheduled tasks** opens Settings → Scheduled tasks like a Bot's details do, and the switch to classic Agent mode is only in the account menu, so Settings → General is Appearance only.
- Friend chats no longer run out of turns, and there is no **Extend** any more (owner decision 2026-10-19). If Bot Social pauses a chat, the chat says so quietly, and your next message simply starts a new chat. Before, **Extend** said it worked but the next identical message (say, a second *Hi*) was paused again at once ([#404](https://github.com/ThinkFlowLab/FlyBot/issues/404), Bot Social [#28](https://github.com/Birfy/bot-social/issues/28)).
- A run that fails because the Bot's model has no API key now says so in plain words and offers the setup right under the error (Enter a DeepSeek API key, sign in where available, or open the model settings), instead of naming an environment variable ([#405](https://github.com/ThinkFlowLab/FlyBot/issues/405)).
- Settings polish ([#406](https://github.com/ThinkFlowLab/FlyBot/issues/406)): a Bot's **Sharing** (invite and People with access) is now one titled card right after Instructions instead of the end of the page, a group chat's last card is called **More** like a Bot's, and the message box shows a clearly darker border while you type in it.
- **Auto-send from now on** (it was Always approve) on a held reply now turns on Auto-send for that one pair, your Bot → that person, instead of a hidden switch for all your Bots. Each person row in a Bot's **Sharing** → **People with access** shows that Auto-send with a checkbox next to **Revoke**, so it can be seen and turned off; the toast names the person and that place. The friend's Bot settings checkbox now says it covers all your Bots: **Auto-send my Bots' replies to …** ([#417](https://github.com/ThinkFlowLab/FlyBot/issues/417)).

### Fixed

- The **NEW** divider no longer sits in a chat for the whole visit. Once you have seen it and the chat moves on (a friend's next line, or your own message), it goes, the same as when you leave the chat and come back. This also covers a friend's typed line in one of your Bots' own chats ([#275](https://github.com/ThinkFlowLab/FlyBot/issues/275)).
- A face-to-face room's `@` menu lists only the room's people and Bots: DSH's own Sessions rows and their section title no longer show there, arrow keys skip them and Enter never picks one; elsewhere a group's **Everyone** row counts the Bots it reaches, seated friends' Bots too, as `1 member` / `2 members` ([#305](https://github.com/ThinkFlowLab/FlyBot/issues/305)).
- When a friend's Bot tries to start a chat with one of your Bots that is not shared with them, Friends' Bots now shows a "Share this Bot?" card with **Share…** (opens that Bot's Sharing) and **Dismiss**; nothing is shared automatically. The sender sees that the message was not delivered because the Bot is not shared with them yet, instead of a silent "delivered" ([#336](https://github.com/ThinkFlowLab/FlyBot/issues/336)).
- A friend's Bot row uses the same full-width hover and selected band as an own Bot (the settings gear no longer shrinks the highlight, including at 150% zoom), and a friend's Bot fallback avatar never matches the exact shape and color of one of your own Bots on any surface (sidebar, header, palette, details, transcript) until its real look syncs ([#384](https://github.com/ThinkFlowLab/FlyBot/issues/384)).
- A paused friend chat, and any other failed send to a friend's Bot, no longer tells you to open the Bot Social console (which a FlyBot owner cannot sign in to); it names only what you can do in FlyBot: approve a waiting message, or remove and re-add the friend (part of [#404](https://github.com/ThinkFlowLab/FlyBot/issues/404)).
- **Models and providers…** and **Manage models** now open settings on the Models page instead of General settings ([#407](https://github.com/ThinkFlowLab/FlyBot/issues/407)).
- A Bot that the Main Bot (or a tree parent) creates without naming a model now starts on its creator's model and thinking level before its first request, so it no longer fails first on an unconfigured default model ([#410](https://github.com/ThinkFlowLab/FlyBot/issues/410)).
- A Bot's reply to a friend that waits for your approval now looks held where it is: its bubble is dashed, and **Approve** / **Reject** (with **Always approve**) sit on it instead of a separate card above the composer. The card names the person who gets the reply, and afterwards the bubble says **Sent to …** or **Not sent**, so a rejected reply never looks sent; the chat list preview no longer shows a reply that did not go, and the Bot's row shows the wait badge until you decide ([#418](https://github.com/ThinkFlowLab/FlyBot/issues/418)).
- A friend's Bot chat is quieter ([#419](https://github.com/ThinkFlowLab/FlyBot/issues/419)): no `Tool removed: create_child_bot · …` line from plugin tool masks (in any chat), no local turns/steps/tok/s footer (the friend's Bot runs on its owner's home), and the composer keeps `Message <Bot>` after a send instead of switching to the coding label.
- The run-stats footer under the composer says `1 turn 1 step` instead of `1 turns 1 steps` ([#419](https://github.com/ThinkFlowLab/FlyBot/issues/419)).
- A friend's line in one of your Bots' own chats is no longer easy to miss: the Bot's row (and the Main Bot's tile) gets the unread dot until you open that chat, also when the line came while FlyBot was closed, and a sender's first line opens with a quiet note such as `SelfB1238 is talking to Chief through Bot Social`. Add friend now also lists friendships and requests made through a per-Bot invite ([#420](https://github.com/ThinkFlowLab/FlyBot/issues/420)).
- Settings polish ([#421](https://github.com/ThinkFlowLab/FlyBot/issues/421)): Settings → Bot Social names what the server supports in words (`Supports: typing as you, @mentions, online status`; the raw ids only in the tooltip), **Harness settings ↗** says it opens DeepSeek Harness's own settings in a separate window, and opening a Bot's settings from its sidebar gear no longer leaves the sidebar or the page shifted sideways.
- A message sent right after joining an invite is no longer silently lost: the receiving FlyBot records the new friend's grant from Bot Social's join event before it reads the first message, syncs grants once and checks again if a message is still refused, and otherwise tells the sender, whose chat shows a "Not sent" line ([#442](https://github.com/ThinkFlowLab/FlyBot/issues/442); the join event and the notice need Bot Social with [Birfy/bot-social#31](https://github.com/Birfy/bot-social/pull/31)).
- Friend chat avatar and thinking row ([#443](https://github.com/ThinkFlowLab/FlyBot/issues/443)): in a friend's 1:1 chat, the friend's Bot's replies now carry its mark beside the bubble, the same one its sidebar row shows. One thinking row with that mark stays up from your send until the reply lands. It no longer flashes away after the send, and no second "… is thinking…" line appears below the reply.
- Bots made outside the tree (Chief's `create_bot`, the Bot list) now always join the tree under the same `maxChildren` and `maxDepth` limits as `create_child_bot`, instead of staying outside while the sidebar showed them under Chief. The tree organizes itself by role: a new Bot goes into the group that matches its role, and when a level is full, and once a day, related Bots are grouped under a suitable existing lead or a new lead with a clear role (for example "FlyBot Lead" or "Life Lead"); it never puts a Bot under an unrelated one. The daily pass also merges duplicate Bots and marks long-idle ones idle, archiving them after 30 days; nothing is deleted. Every change is logged, the sidebar shows what the last reorganization did with one-click Undo, and Chief knows about it ([#446](https://github.com/ThinkFlowLab/FlyBot/issues/446)).
- Tree reorganization moves / reparents existing Bots; it never renames them to `归档-` and recreates. Archived Bots are hidden from the default Bot list. A one-shot repair restores leftover `归档-*` / `Archive-*` names.

## [0.2.0] - 2026-10-19

First release under real semantic versioning (earlier cuts were `0.1.0` and the core package's `0.1.5-flybot.1`). The core package, the tag and this section now carry the same version, `0.2.0`; patch releases follow when changes land. Assets: `ds-bot` (the core) plus the `@flybot/social`, `@flybot/tree` and `@flybot/timeline` plugin tarballs.

### Highlights

- **Sharing is per Bot, and friends live in your sidebar.** There is no global "Published to friends" switch: every share is a grant from one of your Bots to one person (optionally scoped to a group), default deny, Chief included. Invite a friend to a Bot, or paste an invite (a link, a link without `https://`, or a bare code) under **Accept invite**; **Sharing** and **People with access** list each person once, with **Revoke**. Friends' Bots and live face-to-face rooms sit in the same sidebar list as your own Bots and groups; the separate Friends' Bots section is gone. A friend's Bot has its own compact settings sheet (**Auto-send**, **Remove this Bot**) opened from a gear on its row. (#90, #145, #160, #343, #384)
- **Approvals happen where the conversation is.** A message Bot Social holds for you shows as a compact card in the chat (**Approve** / **Always approve** / **Reject**; only the sender Bot's owner can decide), with a wait dot on the Bot's row and one pill in the corner. A line you type yourself goes out at once, as you. New friends start with Auto-send off. (#52, #114, #140, #260)
- **Face-to-face rooms.** People next to each other join one group by typing the same 6-digit number, each with one or more of their Bots (a Bot with no identity is registered for that room only). The room has a 10-minute countdown, **Enter chat**, one-click **Leave** (it asks first and lands on your main Bot), and **Past rooms** with a read-only transcript. A plain line gets one answer (each Bot decides whether it is for it; a follow-up goes to the Bot that spoke last; a line to everyone gets a short answer from each); `@Bot` works across homes and is sent to the friend's FlyBot as an explicit list. A friend's Bot shows **is thinking…** while it works. Lines you type are attested as yours (`typed_by_owner`), not as your Bot's. (#83, #92, #287, #293, #297, #299)
- **Connectors and Composio.** Settings → Connectors has a **Composio** row: paste one API key, pick apps (Gmail, Google Calendar, Slack, Notion, Linear and more), and every Bot can use them. Connector tools (GitHub, Composio) are **on by default for you** in every Bot, new and existing. When someone else drives a Bot (a friend, another room member, another owner's Bot), they are off unless you turn on that Bot's separate **also when others use it** switch. (#311, #335, #369)
- **Automation tasks work out of the box.** The first time FlyBot runs in a DSH profile it switches on DSH's Automation tasks bundle, so **Settings → Scheduled tasks** works at once; switching it off on the Plugins page keeps it off, and `automationTasks: false` opts out. (#378)
- **Bot Social server setting.** Settings → Bot Social shows the server FlyBot uses and its connection, and switches to another `https://` server (checked against `/v1/platform`, with a confirm because a new server is a new identity) without editing YAML or restarting. (#337)
- **About FlyBot** describes FlyBot: Star count, Source code, Release notes and Report on GitHub point at ThinkFlowLab/FlyBot, the version line shows the branch and short commit of a git install (and how far behind it is), and the DSH-update check reads FlyBot's own declaration. (#374, #379)
- **Bot Social, owner-chosen look and tracked tasks.** A Bot's avatar and color sync to Bot Social and show on friends' Bots, groups and rooms (#137). Requests can be tracked tasks with a stable id, acceptance criteria and a visible state (claimed, worked, blocked on an approval, returned, accepted or cancelled) in the task API; task views in the chat come later (#54, #202, #207).
- **`@flybot/timeline` (optional).** A new plugin records Bot turns, tool calls and Bot-to-Bot deliveries (ids, times and outcomes only, never message text) and draws swimlanes, a who-waits-on-whom map and per-Bot utilization. It is off by default: nothing is recorded or shown until the profile sets `enabled: true` (and `sidebarSection: true` for its sidebar row). Plugins also get the `flybot` activity feed (`turn.*`, `tool.*`, `exchange.delivered`), `flybot.warn` for the diagnostics log and the `flybot.settings.page` slot. (#68, #241, #281, #337)

### Changed

- **Sidebar + menu** is a short list of actions with a mark and a one-line hint each: **New chat**, **New Bot**, **New group chat**, **Face-to-face room**, **Add friend**, **Add coding agent**. Add friend names you (`You are @handle`) and lets you pick which Bot an invite shares. Your own handle with **Copy** sits at the top of the account menu. A Bot's right-click menu has **Copy invite link**, and renaming is in **Edit Bot**. (#131, #173, #181, #195, #385)
- **Create Bot** starts on the model your Main Bot runs on, then the DeepSeek Harness default, then the first available model. (#230)
- The sidebar footer button reads **Connect apps** and opens Settings → Connectors; the plugin panel is under **Plugins** in the account menu.
- **Branding.** The web UI says FlyBot (sidebar header, settings, About, update popups, Chinese copy) and uses the FlyBot mark. (#108)
- **Friends' Bots on a slow link** paint a cached roster at once with a small **Refreshing…** mark, load their data in parallel and poll approvals every 15 s (paused while hidden). Face rooms poll about every 4 s while live. (#96, #133)
- **Face-to-face UI.** Pick-and-wait tiles use each Bot's own avatar; rooms are one row each (name, avatar stack, status chip, Open, Leave); titles carry the people and the room number or time; the join dialog explains a wrong number and counts down as `m:ss`. (#107, #115, #132, #306)
- **Tree Bots** may create children directly under themselves (`create_child_bot`; `maxChildren` and depth limits stay), and a child is usable only by its creator's owner until it is granted. (#16)
- `list_bots` lists only your owner's Bots, Bots granted to that owner and Bots in the current room. (#53)
- Settings polish: no repeated titles on the Model and Main Bot cards, one back control in Create Bot, Bot Sharing shows the link first with **Copy link**. (#230)
- Internally, DSH group execution runs through a participant driver; room scheduling and permissions are unchanged.
- README: demos are re-recorded on the current UI, and face-to-face rooms, `typed_by_owner` / `mentions` / presence, Sharing grants and the FlyBot → Bot Social setup are documented.

### Fixed

- **Remove this Bot** is immediate and stays removed (a hide is forgotten only after two clean roster results); removing declines the grant on Bot Social, and joining again restores it. (#139)
- **Accepting an invite** shows the shared Bot at once, never lists the joiner's talk-through Bot as shared back, and gives plain messages for an unknown, used, expired or own invite. (#161, #228, #343, #347, #383)
- **A friend's Bot reply that waits for its owner** always has a visible card (the overlay no longer crashes, and one click leaves the message at once). A held line shows its text once, and a hold shows only in the room it came from. (#188, #254, #258, #306, #371)
- **Face-to-face rooms** keep consistent titles, times, status chips and **Past rooms** on every home; a Bot you bring in no longer gets a stray "left" line; a friend's multi-paragraph line arrives whole; the composer's `@` lists each room Bot once; `@` chips look the same on both homes; typing in a room never starts a Bot turn unless a Bot is mentioned. (#122-#125, #129, #158, #167, #170-#172, #182, #191-#194, #236, #302-#306)
- **The web UI** no longer stops at "Failed to load plugins", the main view stays on its chat when the session list reloads (#261), the tab title follows rooms and groups, and the raw "Tool removed: ask_user_question" line is gone.
- **Bot Social identity.** A taken home name retries `FlyBot2`, `FlyBot3`, … at first start (#136), and `@flybot/social` loads from a packaged install (#153).
- **Friend DMs.** Chat previews show a friend's words without the `<untrusted-message>` wrap; a paused conversation says so; a reply to a friend who wrote to a shared Bot is held for approval instead of dropped; a Bot that may not message a friend's Bot says why; the raw `@objectobject` access labels are gone. (#72, #130, #164, #272, #273)
- **Groups** hold friends' Bots and show up as shared rooms on their owner's FlyBot, and a group whose model did not apply the first time is repaired on the next refresh. (#289)
- **Tasks:** a held send blocks only its own task, and a returned result can be cancelled before it is accepted. (#111, #202)
- **About** no longer says "Up to date with main" after a reset or force-push, and shows the commit of a git install even when DSH hoists it. (#374, #379)
- **Timeline** shows a friend's Bot as a friend lane, no longer stays on Loading… in a background tab, and has clearer lane names, waits and a range footnote. (#248, #249, #255, #259, #269, #279)
- Smaller fixes to sidebar rows, the tree chevron hit target and the + menu popover (#177, #276, #283).

### Security

- **Private context stays home in shared rooms.** A Bot carries its owner's chat brief into a room with another owner only when the owner shares it for that room; memory reviews keep entries in the Bot's own memory; referencing a chat you cannot read is refused. (#53)
- **Held sends are bound to their owner.** Only the sender Bot's owner can approve, reject or retry a hold, you see only your own holds, and a decision is voided (never sent) when the request or the authority behind it changed. (#52)
- **Chat-reference chips** are author-checked, and Bot-authored posts drop them, so a private chat cannot ride into another owner's Bot. (#106)
- **Friend Bot lines are fenced** in every shared room, and peer-published names are sanitized so a display name cannot pose as another member. (#75, #98)
- **Face-to-face lines** show the authenticated sender, not a name the client chose; a Bot's room message cannot pass as its owner's typed line; and accepting a per-Bot invite grants only that Bot. (#118, #138, #179)
- **Connector tools** are decided per Bot and per turn, so a friend who reaches your Bot cannot use your mail, calendar or repositories through it unless you allow it. Composio's session address is no longer stored in `state.json`. (#335, #369)

### Upgrading

- No Bot is shared until it is granted: sharing from earlier builds does not carry over.
- Connector tools that an earlier build left off are on again for you; an explicit off you set stays off.
- Timeline needs `enabled: true` in the profile to record anything.
- Presence (**is thinking…**), `typed_by_owner` and `@` mentions need a Bot Social server that supports them; against an older server FlyBot falls back to the previous behaviour.

## [0.1.0] - 2026-10-14

First public FlyBot-branded cut (core package remains `0.1.5-flybot.1`).

### Highlights

- Peer plugins `@flybot/tree` and `@flybot/social` under `plugins/`
- Pristine ds-bot + FlyBot patches → `core/` at `0.1.5-flybot.1`
- Send middleware priorities ROUTING / DEFAULT / APPROVAL
- `types/flybot.d.ts` documents the browser `flybot` service

### Changed

- The core is now pristine upstream ds-bot (`ds-bot/`, pinned at Fei2411/DeepSeek-Bot@2b10c70) plus FlyBot's ordered patch series (`patches/ds-bot/`), applied into the committed `core/` (#34). Install paths move from `path:/ds-bot` to `path:/core` and `path:/plugins/{social,tree}`. The core's version is `0.1.5-flybot.1`.
- Send middleware can set a `priority` (`ROUTING` 100, `DEFAULT` 500, `APPROVAL` 900; `flybot.bot.send.priority`); names in `before`/`after` still work and win over priority. `@flybot/social` runs at `APPROVAL`.
- `types/flybot.d.ts` documents the browser `flybot` service and its slots.
- The plugins are peer packages at the repo root: `@flybot/tree` (`plugins/tree`, by recursive-bot) and `@flybot/social` (`plugins/social`, moved out of `core/plugins/social`). Each needs `ds-bot >=0.1.5-flybot.1`, tests itself against `core/`, and has its own CI job (`plugins (tree)`, `plugins (social)`, both required by `tests-ok`). Reinstall the social plugin from `path:/plugins/social`.

## [0.1.5] - 2026-10-13

### Added

- **Working folder**: a Bot can work directly in a folder you choose instead of the team workspace. Set it in the Bot's settings or details panel: type a path, pick one of your DSH projects, or browse. A group chat can set one folder for all its members there. You can also ask a Bot to change its own folder, or a Main Bot to change any Bot's or group's folder. A Bot that sets a folder outside the team workspace, or adds a Bot to a group that works in one, asks for your approval first when those Bots can only write in their folder. After a change, the Bot's chat goes on in a fresh part that starts in the new folder.

### Fixed

- A new Bot asks where to start in its first reply instead of on a question card, and follows its own instructions where they say otherwise.
- Bots no longer use DeepSeek Harness's own question card, which held the Bot until you answered it while messages from other Bots waited.
- A Bot that messaged a Bot stuck on earlier work was told "Delivered" every time, with no sign that nothing was read. It is now told how many earlier messages wait unread and when the other Bot waits for your approval, and after 10 unread messages `message_bot` fails and tells it to report the stuck Bot to you.
- On model providers that need every request to name its conversation, such as OpenCode Go, the memory panel, automatic memory updates, the context check of long chats and image reading for text-only models failed. They now work there too.
- The memory panel's summary, its "ask or update" and the memory review no longer stop when the Bot's model refuses the call or runs out of output budget: they try once more on the profile's default model. After you change the Bot's model, a failed summary is written again automatically. ([#116](https://github.com/ThinkFlowLab/FlyBot/issues/116))
- With the `ptc` agent preset, the team view and a Bot's character show the tool the Bot runs from its code, an approval card says what that tool does, and a question card asked from code is kept in chat search and in the next part of the chat. In a group chat, a member that only reads the chat or checks the team no longer leaves the round as if it had gone off to work.
- Switching from Bot mode back to Agent mode no longer leaves parts of the Bot interface on screen, such as the chat header or Bot messages without their styles, when one part fails to close. The other parts still close, and Bot mode opens normally again.
- DS Bot no longer sets DeepSeek Harness's work-details mode (Settings → General) to the most detailed one, and no longer hides that setting. Bot chats stay flat in every mode, and your choice applies again outside them. If you had chosen another mode before, choose it again once: DS Bot cannot tell which one it was.
- Your own messages in a Bot chat stay readable under dark skins that recolor message bubbles.
- A Bot chat now shows the cards of the files a Bot hands over with DeepSeek Harness's `present` tool, and of the files a turn changed, as DSH's own chat does. A file path in the reply links to the file when the turn made or delivered it.
- With the `ptc` agent preset, the chat shows the tools a Bot runs from its code again: group replies, question and key cards, and the lines for messages, Bots, groups and memory.
- A question or key card whose call is not on screen, such as one asked in an earlier part of the chat or in a Bot-to-Bot turn, waits above the message box. A card shows in one place only.
- With `DSH_HOME` empty or starting with `~`, DS Bot now keeps its data in `bot/` inside the folder dsh uses. Before, it used a folder relative to the one dsh was started in; to keep a team made that way, close dsh and move that `bot/` folder into dsh's folder.

## [0.1.4] - 2026-10-13

### Added

- Settings → **Capabilities**: share MCP servers and skills with the team, group them into packs, and choose which capabilities each Bot can use.
- A Bot that was working when DeepSeek Harness closed or restarted picks its work back up when DS Bot starts again. A group chat shows which member was cut off, and a Bot that was answering another Bot still sends its answer.
- The sidebar marks a Bot or group chat that waits for your approval. Where the system allows notifications, a notification also names the Bot.
- In a group chat, any Bot can hand work to another with @Name. The Bot does the work without holding up the group, and the group, the sidebar and the Bot's own chat show what it is doing. When it is done, it posts the result in the group. You can stop the work in the group's details.

### Changed

- What a group member posts after its round moved on is answered by the Bot that asked for the work, and no longer by the admin. Work you asked for yourself is left for you to read.

### Fixed

- When a model wrote its tool call as text instead of making it, nothing ran and the Bot stopped as if it were done. The Bot is now asked once to make the call, and the text of the call is kept out of group chats.

## [0.1.3] - 2026-10-12

### Added

- In a Bot's chat or a group chat, `@` lists the Bots you can mention first: a group's members and **Everyone**, or the other Bots. Picking one writes `@Name`.
- **Reference a chat** in the composer's **+** menu adds another Bot's chat, or a recent conversation outside the team, to your message as context.
- A Main Bot can stop another Bot's running turn. The Bot is told why, and its reply goes back to the Main Bot.
- In a group chat, a member that asks for an approval no longer holds up the round. You allow or reject the request in the group's details panel, and a line above the composer names the members who are waiting or at work. What a member says after the round moved on is posted in the group.

### Changed

- When a Bot messages another Bot that is working, the message reaches it at its next step instead of waiting until its current work is done. It answers once that work is done, and the reply comes back. A Bot can still queue a separate task behind the current work.
- Bots give a brief progress message when starting a multi-step task in their own chat with the user, and at meaningful milestones on long tasks.
- Every Bot can change its own name, role, color, model and instructions; only a Main Bot changes other Bots.
- Updating a copy installed from GitHub uses the repository's current address.
- The Usage page groups its statistics, chart, rankings and activity into one panel.
- Hover over an Activity day to see its token count.

### Fixed

- When DS Bot cannot save the Bot team, the change now fails with an error instead of being lost silently.
- A Bot team file that cannot be read is no longer replaced by an empty team; a damaged file is kept as a backup.
- Warnings in the host log hide keys and tokens.
- Bots receive the current time on their first model step and refresh it after ten minutes, even when their DSH preset does not supply a clock.
- In a group chat, a conversation referenced in a message reached none of the members, and a reference whose title started with a member's name called that member. Now the members who answer the message get the referenced conversation.
- In a group chat, typing `@` and a Bot's name and pressing Enter inserted a conversation reference instead of the Bot's name.
- Deleting a Bot or group chat also removes its scheduled tasks, including ones left on the Bot's earlier chat parts. Before, armed tasks stayed active and kept running the deleted Session; the archive that would have stopped them was refused and the failure was silent.
- A long conversation's fresh part keeps the Bot's model and thinking level. Before, the new part fell back to the default model.
- A provider adapter that cannot measure tokens no longer fails every turn. The context size is estimated instead, with one warning in the log.
- When the recent errors were too long for **Report on GitHub**, the new issue got no diagnostics at all. Now it keeps the versions, the system and the models, and only the errors go by the clipboard.
- The memory panel's summary works on models that think by default. The call asks for the model's lowest thinking level, and when the answer is cut off at the output limit it is written once more with a larger budget instead of failing or being saved half-written.
- A message sent to a group chat while a round is running joins that round before the next member speaks. Everyone still to speak sees it, and the members it is for answer it in the same round. Before, it waited for the whole round to end. A message with images or a referenced conversation still waits for its own round.
- In your own messages, `@Name` of a Bot shows as that Bot and opens its chat, instead of a file named after the first word. A group chat calls exactly the Bots a message shows as called: code, links, web addresses and file references such as `@docs/guide.md` call nobody.
- A Bot chat no longer stays stuck when the model keeps turning down its requests, for example over an image it cannot read. Images from finished turns are no longer sent with every later request. When a request is turned down on two turns in a row, the Bot moves on to a fresh conversation part and tells you that the last message could not be sent.

## [0.1.2] - 2026-10-11

### Added

- Settings → About DS Bot: the DS Bot and DSH versions, **Check for updates** and the update buttons, and links to the source code, the release notes and the feedback page. A **Star** button opens the GitHub repository and shows its star count.

### Fixed

- The update card offers a DSH update only when a DS Bot release names a verified DSH version. DS Bot 0.1.1 offered DSH `0.2.1-alpha.1`, which was not verified. In DSH Desktop the card shows a DSH update only when the update the app offers is the verified version.

## [0.1.1] - 2026-10-11

Tested with DeepSeek Harness `0.2.1-alpha.1` (DSH Desktop and DSH Web).

### Added

- Voice chat uses the local speech recognition of the official DSH Voice Input plugin (SenseVoice) when the plugin is on, and the browser's speech recognition otherwise. When the plugin has no speech model yet, the voice panel opens its settings.
- The update card also offers DSH updates, but only the DSH version that the newest DS Bot release was verified with (`dsBot.verifiedDsh`). A DSH installed with npm updates in one click; DSH Desktop opens its own update panel.
- Each Bot can pick a thinking level with its model, in the model menu or when the Bot is created. **Default** uses the model's own level.
- A permission setting in each Bot's details panel: **Read only**, **Workspace** or **Full access**, from the presets DSH offers. The Bot keeps it in its own chat, its group chats and its new conversation parts.

### Fixed

- A handoff note whose headings the model translated (for example `## 目标`) is kept, with the headings put back in English, instead of being written again. A note with a repeated or missing heading is still written again. Handoff notes keep file paths in full.
- Group the first model choices by provider, so models with the same name can be distinguished. Providers with the same display name also show their provider IDs.
- A turn with many steps shows one "Thought it through" row instead of one per step. The row holds the thinking of every step in order.
- The Usage page counts the calls of subagent Sessions too. Before, each scan skipped them and wrote one warning per subagent Session to the terminal.

## [0.1.0-dsbot] - 2026-10-10

The pre-FlyBot DS Bot preview lineage, retitled so its version anchor does not collide with FlyBot's `0.1.0`.

The first public preview. Tested with DeepSeek Harness `0.2.1-alpha.1` (DSH Desktop and DSH Web).

### Added

- A team of long-lived Bots. Each Bot is a DSH Session with its own name, role label, instructions, model and character. Every Bot runs on one model of its own, chosen from the models configured in DSH (the `list_models` tool lists them). Creating a Bot opens a form: pick its look, its model (the DSH default model comes first) and its name.
- Main Bots that create, change and remove other Bots. You can have more than one Main Bot, change the Main Bot in one step on Settings → Bots, and move one to the front; there is always at least one. A Main Bot wears a large star on its avatar.
- Messages between Bots, questions to you that do not stop the other Bots, and a view of what each Bot is doing.
- Group chats in which members speak in turn, can be called with `@name` and stay silent when they have nothing new to add. A new group chat starts with its admin, who wears a small star and manages the group. Every group chat has its own settings page: name, notice, who answers, members and admin, pin and hide, and delete.
- The DSH Agent: one plain DSH entry in the sidebar beside the Bots, with its own Sessions on the native DSH conversation page and none of the team tools.
- Long conversations that stay inside the model's window. The context lines follow the model's `contextWindow` (500,000 tokens when a model reports none), and the check line is a share of it (`checkRatio`, default 0.8). When a turn ends past the check line, a small separate model call decides once: condense the conversation in place into a checkpoint (a handoff summary plus the user's recent messages word for word) while the work is under way, or let the Bot write a handoff note and continue in a new part when the work has reached a stopping point. Neither leaves a marker in the chat. DSH's own compaction does not run on Bot conversations. Earlier parts and condensed messages stay in a local full-text index that the Bot can search.
- Memory. Each Bot keeps notes across all its conversations (`MEMORY.md` and topic files in the Agent Memory Repo format), and the team shares one more memory that Main Bots and group admins write. Bots use the `remember`, `forget` and `recall` tools, and after each turn the Bot's model reviews what is new and keeps, updates or removes entries itself (`memoryReview: false` turns this off). Each conversation reads the memory once, when it starts, so the prompt cache holds. Sizes are fixed, keys and tokens are refused, and `memory/journal.jsonl` keeps every change. `memory: false` turns memory off.
- The memory panel, opened from the Memory row in a Bot's details panel or settings, or from "Memory updated" in its chat: a summary that the Bot's model writes from the entries, every entry with remove, and "Ask or update" to ask about the memory or change it in plain words.
- Scheduled tasks for Bots and group chats: once, every day, every week on chosen days, or every so many minutes, hours or days. Add them from Settings → Scheduled tasks or from **Scheduled task** in the composer's **+** menu. A task sends its message to the chat when it is due. The tasks run on DSH's Automation tasks.
- A Usage page in Settings: token usage over the last 24 hours, 7 days, 30 days, 12 weeks or 12 months, or over days picked on a calendar, with the change from the period before, a chart by Bot or by model, a ranking of Bots and models, and a year of daily activity. Each Bot and each model opens its own page. The counts are kept in `usage.sqlite`. Tokens only, no cost.
- A Connectors page in Settings, with GitHub as the first connector: paste a GitHub token to use GitHub's tools for repositories, issues and pull requests. The token is kept as the `GITHUB_TOKEN` secret. `github: false` hides it.
- The `auto` web-search provider: the native search of the current model route, with a keyless fallback to public results pages.
- A Bot browser in DSH Desktop: each Bot has its own browser with tabs and its own storage partition, in the same side panel as the Bot's details. The Bot reads the open page as structured Markdown (headings, lists, tables, code blocks, open Shadow DOM, same-origin frames) and never reads password, card or one-time-code values.
- Secret cards: a Bot asks for an API key or token in its own chat, you choose which Bots may use it, and the Bot gets it only as a shell environment variable. Saved values are hidden as `[secret:<NAME>]` in tool results and model requests. Settings → Secrets manages them.
- Text descriptions of images for models that cannot read images, made by a configured model that declares image input.
- Customization of the name, role label, instructions, model, character, theme and accent color. The first Main Bot is a whale in DeepSeek blue.
- Avatar animation in three levels (Settings → Bots → Animation): **Quiet**, **Normal** (the default) and **Lively**. Panels, menus and controls move on springs.
- Settings with pages for General, Bots, Group chats, Connectors, Scheduled tasks, Usage, Secrets and Feedback.
- The interface follows the DSH language (English or Chinese).
- **Classic Agent mode** (Settings → General) gives the window back to the native DSH interface; the **DS Bot** button at the bottom of the sidebar brings the team view back.
- Settings → Feedback: the DS Bot and DSH versions, the system and the recent errors, with **Report on GitHub**, **Copy**, **Download** and **Clear**. Keys, tokens, saved secrets and the home folder are removed from the text. Errors are also written to `<home>/logs/diagnostics.jsonl` (`diagnosticsFile: false` keeps them in memory only), and a failed request shows a short notice with a **Details** link.
- Update checks: DS Bot looks for a newer release where it was installed from (the npm registry, or GitHub for a versioned git install) and shows a cloud button at the sidebar's top right when one exists. One click installs it; the new version runs from the next DSH start. `updateCheck: false` turns the checks off.
- One writer per team: when DSH Web and DSH Desktop share a DSH home, the second one opens the team read-only, says why, and takes over when the first one quits.

If you used the legacy `dsh-bot` package, remove it before you install `ds-bot`. The team data stays in `<DSH_HOME>/bot`, and the theme, Bot colors and browser settings move over the first time DS Bot opens.

### Known limitations

- Tested with DSH `0.2.1-alpha.1`, mainly on Linux and in DSH Web. DSH is an alpha, and a newer DSH can break the plugin.
- The Bot browser is in DSH Desktop only, and Bots can only read pages ([Bot browser](ds-bot/README.md#bot-browser)).
- Secrets are stored without encryption, and only exact copies of a value are hidden ([Secrets](ds-bot/README.md#secrets)).
- Only one DSH can change a team at a time; a second DSH on the same DSH home opens it read-only ([Data and backups](ds-bot/README.md#data-and-backups)).
- Group chats use many tokens: each member reads the group and answers in turn.

[Unreleased]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.33...HEAD
[0.2.33]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.32...v0.2.33
[0.2.32]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.31...v0.2.32
[0.2.31]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.30...v0.2.31
[0.2.30]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.29...v0.2.30
[0.2.29]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.28...v0.2.29
[0.2.28]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.27...v0.2.28
[0.2.27]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.26...v0.2.27
[0.2.26]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.25...v0.2.26
[0.2.25]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.24...v0.2.25
[0.2.24]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.23...v0.2.24
[0.2.23]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.22...v0.2.23
[0.2.22]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.21...v0.2.22
[0.2.21]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.20...v0.2.21
[0.2.20]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.19...v0.2.20
[0.2.19]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.18...v0.2.19
[0.2.18]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.17...v0.2.18
[0.2.17]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.16...v0.2.17
[0.2.16]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.15...v0.2.16
[0.2.15]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.14...v0.2.15
[0.2.14]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.13...v0.2.14
[0.2.13]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.12...v0.2.13
[0.2.12]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.11...v0.2.12
[0.2.11]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.10...v0.2.11
[0.2.10]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.9...v0.2.10
[0.2.9]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.8...v0.2.9
[0.2.8]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.7...v0.2.8
[0.2.7]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.6...v0.2.7
[0.2.6]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.5...v0.2.6
[0.2.5]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.4...v0.2.5
[0.2.4]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.3...v0.2.4
[0.2.3]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.2...v0.2.3
[0.2.2]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.1...v0.2.2
[0.2.1]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.2.0...v0.2.1
[0.2.0]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.1.0...v0.2.0
[0.1.5]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.1.4...v0.1.5
[0.1.4]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.1.3...v0.1.4
[0.1.3]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.1.2...v0.1.3
[0.1.2]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.1.1...v0.1.2
[0.1.1]: https://github.com/ThinkFlowLab/FlyBot/compare/v0.1.0...v0.1.1
[0.1.0]: https://github.com/ThinkFlowLab/FlyBot/releases/tag/v0.1.0
[0.1.0-dsbot]: https://github.com/Fei2411/DeepSeek-Bot/releases/tag/v0.1.0