Fixed

• Cross-node messaging now recovers on its own instead of stalling until the service is
  restarted. Previously, one unanswered request could stop this node from advertising itself
  and reconnecting to peers, until other nodes could no longer reach it.

• Sending a message to an agent on another machine no longer waits without limit when the far
  side accepts the connection and then never answers. Previously, such a send could hang
  indefinitely without reporting why.

• Persistent shells now restart automatically after the background service restarts, once their
  owning agent is online. Previously, eligible shells could remain offline until relinked by
  hand.

• A successful spt shell relink now reports binding while it waits for its handshake,
  instead of a successful launch reading as offline.

• Agents on other machines that were already known are now remembered across a restart of the
  background service, rather than disappearing until peers advertise them again.

• Service status and successful update completion now say when the running network layer is too
  old to serve node-prefixed documentation and serve controls, that loading them needs a full
  service restart, and that the restart stops hosted sessions. Successful updates no longer
  unconditionally advise restarting the service.

• Stale-session cleanup no longer signals a process whose identity does not match the recorded
  session; the stale record is cleared instead. If the identity cannot be verified, the request
  declines and leaves the process alone.

• Service status now reports the process id of the running service, taken from
  the running service itself; a recorded id that no longer matches is marked
  stale. Previously, status could display an obsolete process id from a file.

Internal

• Daemon logs now summarize healthy connection activity once a minute instead of recording
  every open and close.

Web serving. Files, directories, adapter documentation and the changelog are
reachable at node-prefixed addresses on the local server, and an address that
names another machine in the subnet is answered by the machine that owns it.
Messages can carry attachments the receiver pulls on demand, every message
gets a short ID to show or reply to, and a machine with no spt on it can be
handed the binary over the local network. The XFER access surface is retired.

Added

• spt serve add, spt serve rm, and spt serve list --json manage live file
  and directory references. Same-name registrations receive stable numbered
  suffixes; removing an entry never deletes its source. Only the same absolute
  path and kind may reclaim a retired name.
• Every registered adapter gets a core-owned web/ output directory.
  [adapter].web_short_path optionally gives it a short URL alias. Removing
  an adapter stops serving its output without deleting the files.
• spt adapter add names each manifest key it does not know on stderr
  (manifest: unknown key [<table>].<key> (ignored)) and still registers;
  a misspelled optional key is no longer visible only by its absence.

• WEB joins the access-control vocabulary. It is open by default within the
  subnet, but explicit WEB denies still govern. Existing file transfer is
  unchanged.

• A served resource's URL now works from every machine in the subnet: a
  request for /<peer>/… on the local loopback server is answered by the
  owning node through the local daemon. The body streams and nothing is
  cached; HEAD and Range requests are honored by the owner. An owner
  that refuses answers 403 naming WEB; an owner that cannot be reached
  answers 502 naming the node, within a bounded time.
• spt send --attachment <path> sends a file with a message. The file's bytes
  are captured as they are at send time, so later edits or a deletion do not
  change what arrives, and the receiver pulls them with spt fetch when it
  wants them. --ttl sets how long an attachment stays available (default 30
  days, a unit is required); expired attachments answer 404 immediately.
• Every message now carries a short ID. spt msg show <id> prints a message by
  it, and spt send --reply-to <id> marks what a message answers. Messages
  from another machine resolve through the machine that holds them.
• spt serve lan --bootstrap hands the spt binary to a machine that is not yet
  a node, over the local network on port 5470. It is off by default and off
  again after every daemon restart, serves only the binary, its release sidecar
  and an install command, and refuses to start by name when the applied update
  set is not signed or does not match. It prints a checksum per platform, and
  spt install gains --expect-sha256 and --release-json so what was
  downloaded can be compared before it is run. The documentation port is
  untouched and stays on loopback.
• [adapter].docs_dir publishes an adapter's own documentation at the docs
  segment of its address, beside the adapter's output directory rather than in
  place of it. A missing key, an unreadable manifest, a path that escapes the
  adapter's directory, and a directory that has since been removed all answer
  the same 404 naming what was asked for.
• The changelog is now one of the pages the local documentation server offers.
• A harness is told when a message it receives refers to a file the reader
  cannot open — an attachment to pull, or a path that belongs to another
  machine — instead of leaving the reader to discover it. For a path on
  another machine, that machine can be asked to publish it and answers with a
  link; it honors such a request only for its own endpoints, so no third
  machine can have someone else's file exposed.

Changed

• The loopback HTTP server now has a node-prefixed resource index with HTML
  and ?json views. / redirects to /<node>/; canonical docs URLs live at
  /<node>/docs/, while existing bare docs paths remain compatibility aliases.

Removed

• The XFER access surface is retired: attachments replaced the transfer it
  gated, so the entry leaves the access-control vocabulary along with the
  transfer itself. An existing rule that names XFER is kept and reported at
  load rather than dropped silently; it no longer governs anything. The shell
  channel's own transfer progress is unaffected.

Fixed

• Messages delivered by spt api listen now reach the receiver's incoming-message
  history and last-message state, for both queued backlog and live TCP delivery.
  A later hook poll does not record those deliveries again; filtered notifications
  are not recorded as delivered messages.
• A node's message and activity history reads back correctly once its log grows
  past a quarter of a megabyte. Positions no longer restart from the beginning,
  so a request for everything since a given point no longer comes back empty or
  repeats entries that were already seen, and an oversized position is answered
  with the current head instead of skipping a page.
• An agent's own saved context is no longer overwritten, unread, by the
  automatic summary that follows it. The automatic summary is filed directly
  and never writes to the file an agent saves its own context to.
• spt api bind no longer prints an engine-room probe line on a machine that
  has no engine room.

Documentation-only release. The manifest reference in the developer docs now
covers the [service] section — the always-on background process spt
supervises on an adapter's behalf — which was previously described only in
the CLI reference's spt adapter service entry.

Added

• Manifest reference — [service]. The developer docs' manifest
  reference now documents the [service] section: the command, start
  and stop_grace_ms keys; what registration reports when a service is
  declared; the environment a supervised process is started with
  (SPT_SERVICE_OPTION, SPT_SERVICE_DIR, SPT_BIN, SPT_HOME); the
  stop-requested, status-advisory and startup.capture files in its
  runtime directory; how a cooperative stop, an update hold and a startup
  fault behave; and what spt adapter service list and spt adapter service status report. The adapter integration checklist gains a matching line.

The now-signal — the situational-awareness feed a harness injects at turn
boundaries — now covers software updates, sealed-message education, and hints
from shell adapters; shells can watch who is attached to their endpoint; and
the automatic psyche-updating summaries called echo communes fire on a
15-minute cadence instead of at every turn end.

Added

• The now-signal gains an UPDATES category: when spt-core, the session's
  harness adapter, or a registered shell's adapter updates, the agent is told
  once, with the new version number.
• The now-signal gains a SEAL_BRIEF category: a two-sentence, once-per-session
  brief telling an agent what a sealed message proves and how to verify one.
• Shell adapters' [hints] are now read. Previously only the harness
  adapter's hints ever surfaced, so a shell's hints were dead text. A shell
  instantiated to the endpoint surfaces its full hint; one merely installed
  surfaces a one-line teaser naming the new spt adapter hints <adapter>
  verb, which prints the full text. At most one hint renders per source per
  message — the harness and each shell adapter get their own once-per-session
  slot, so one adapter's chatter can no longer silence another's hint.
• Shells receive attachment frames: when a controller or viewer attaches to or
  detaches from their owner endpoint, each linked shell is told the current
  attachment picture — whether the endpoint is controlled, from which node,
  and which nodes are viewing — plus which node just changed when exactly one
  did. Frames are current-state-carrying and ephemeral, like activity frames.
• An spt-hosted session that goes five minutes without any attached controller
  or viewer receives a one-time notice telling the agent to proceed but
  withhold user-aimed output until someone attaches; a short reciprocal notice
  fires when someone does. Endpoints without a hosted session are out of
  scope — nothing can attach to them.

Changed

• Echo communes now fire on an age gate: a turn end arms them, but they fire
  only once the oldest un-fired turn end is 15 minutes old, instead of at
  every turn end. Attention-change fires (detach, attention shift, suspend)
  stay immediate. A session boundary — clear or compact — now captures the
  departing session's history before the session id rotates, so the delta the
  boundary interrupts is recorded rather than lost.
• A subnet-join line in the now-signal now names its subject: it reads
  node <label> joined subnet <x>, and a member with no label renders as
  pubkey <prefix> so it cannot be mistaken for an endpoint name.

Internal

• The digest's echo record kind is renamed from echo_mirror to
  echo_commune: the old name claimed a mirror into the agent's running
  context that has never existed. Existing digest rows are unaffected.

A harness adapter can now see where one stretch of a session ends and the next
begins, and can report agent output produced partway through a turn rather than
only at its end. Diagnostic lines meant to be read by other programs now arrive
whole.

Added

• Session boot, clear and compact are now reported in a session's event feed as
  boundary events of their own, so a reader can tell where one stretch of a
  session ended and the next began. Previously these edges were not reported at
  all, and a reader could only infer them from the traffic around them. One
  event is reported per real edge: re-binding a session that is already bound is
  not an edge and reports nothing.
• spt api state busy accepts --mid, marking output an agent produced partway
  through a turn. Such output is reported as agent output like any other, with
  an added marker so a reader that cares can tell the two apart, and one that
  does not can ignore it and read the span as an ordinary end-of-turn report.
  --mid at idle, and --mid with no payload, are refused by name rather
  than accepted and silently reinterpreted.

Fixed

• Starting a session while the machine is heavily loaded no longer occasionally
  starts a second one. Previously a start that took longer than two seconds was
  presumed to have died, and a duplicate was created alongside it; a slow start
  is now waited on for as long as it keeps making progress. A start that stops
  progressing entirely is still taken over, and says so.
• An endpoint whose configuration declares no resume role is now skipped with a
  status saying so, instead of being recorded as a repeated failure. Previously
  every attempt counted against the failure budget reserved for a declared role
  that genuinely fails, and surfaced as error churn in the status an operator
  reads to find real faults.
• The published harness-contract schema no longer carries internal tracker codes
  in its descriptions. An adapter author reading the contract was previously
  shown references that resolve to nothing outside the project.
• Diagnostic lines written for other programs to read now always arrive whole.
  Previously, when two of them were produced at the same moment, one could
  appear split with the other's text inserted into the middle of it, leaving
  both unreadable to a program parsing them.

Internal

• Release and assembly tooling gained checks for build-cache free space and for
  the fidelity of changes carried between branches.
• Starting the background service now records how long each stage of its
  startup takes, so a slow start can be attributed rather than guessed at.
  The project’s own test and continuous-integration settings were adjusted to
  match the measured cost.

Persistent shells now come back with their endpoint instead of staying down
until someone notices, and a harness adapter can read a session's own input and
output as an ordered feed it polls at its own pace.

Added

• spt api io-events --session-id <sid> returns a session's input and output
  events in order, oldest first, and remembers where that session stopped
  reading — so asking again returns only what has arrived since. A caller that
  tracks its own position can pass --after <n> instead. A call carrying
  neither is refused by name rather than answered with an empty result that
  would read as nothing happened. A session's first call returns nothing and
  starts from that moment. --limit caps one answer and says that it capped,
  deferring the rest to the next call rather than dropping it. The feed is
  authenticated like spt api poll, and for the same reason: it hands back the
  session's own text verbatim.

Fixed

• A shell set to stay running is now restored when its owner endpoint comes
  online, and not only when the daemon finds that owner already up as it
  starts. Previously, whether restarting a node left such shells down came down
  to ordering: an endpoint that came up after the daemon's one-time pass was
  never revisited, and its shells stayed down until a spt shell cmd woke them
  or they were relinked by hand.
• The published harness-contract schema described resume-session selection as
  triggered by a --resume <session> argument that no longer exists — a
  spelling that is now refused outright — so an adapter author reading the
  contract could conclude the role was unreachable. It now names the real
  triggers (spt endpoint resume <id>, spt go <id> on an offline endpoint,
  and Resume from history in the picker), and states that resume always
  continues the most recent session, with no verb accepting a session argument.
  It also documents the RESUME_NO_HARNESS_SESSION notice, printed when no
  harness session is on record yet: a fresh session starts, and a declared
  resume template does not run at all.
• When more than one endpoint has been bound from the same shell, spt no longer
  guesses which one a command came from. It says so and stamps the command with
  its origin instead, and points at binding each endpoint from its own session.

An agent session can now ask spt one question — spt api now-signal — and get
back only what changed since it last asked, instead of polling several commands
to piece the picture together. Harnesses that opt in can also hand spt the
turn's text and let it handle message tags and seal requests itself, and a
commune that fails to save is no longer silent.

Added

• spt api now-signal <id> --session <sid> answers what changed that I should
  know about: new messages, message-send outcomes, shell and endpoint changes,
  and matched keyword hints, printed as XML under a single <SPT-NOW-SIGNAL>
  block. It is delta-only per session — a call with nothing new prints nothing
  at all, not an empty block — so a harness can run it at every turn boundary
  cheaply. A new session is entitled to the full picture once; every later call
  is thin. Pass the turn's text with --user-input / --agent-output so the
  categories that read it can fire.
• The picture can be narrowed and capped: --spec-manifest reads the
  [io.now_signal] settings (only, without, max_lines) from the adapter
  manifest, and --spec-file <path> takes the same shape as a JSON file
  composed per call and wins when both are passed. A missing, unreadable or
  malformed spec falls back to the default picture instead of refusing, so a
  typo in one cannot break a running session.
• spt api state busy|idle can carry the turn's text: --payload-stdin or
  --payload-file <path>. Passing both is refused by name with
  STATE_PAYLOAD_AMBIGUOUS. Sending no payload behaves exactly as before, so
  an already-installed adapter keeps working untouched.
• Adapter manifests gain an [io] section. compliance = true hands the
  parsing of an agent's own turn text to spt; shortform = false keeps that
  parsing off while staying compliant. Both are off by default, so an adapter
  that declares neither sees no change.
• With [io] compliance declared, spt recognizes @<target body @> message
  tags and ;;-marked seal requests directly in an agent's output. Text inside
  fenced code blocks or backticks is invisible to that scan, so a tag can be
  quoted, documented or pasted as an example without sending anything. An
  unclosed or empty tag sends nothing rather than guessing.

Changed

• Saving a commune is now observable to a linked shell: both a commune being
  taken up and a commune failing to be taken up are reported. A failed save
  previously left nothing but a log line, so agents could lose context saves
  without anyone being told.
• spt api hint is now a thin alias for the hint part of now-signal and
  shares the same once-per-session state, so an adapter injecting both is
  injecting the same line twice — inject one.
• Sending a message now reports delivered and no perch as distinct
  outcomes, where an unreachable target, a refused target, an ambiguous target
  and an empty body all reported the same thing before. The exit codes an
  operator sees are unchanged.
• For adapters that declare IO compliance, the shells listing that arrived as
  its own message at session start now arrives through now-signal instead.
  Adapters that do not declare compliance keep receiving it as before.
• The harness-contract documentation, the integration checklist and the
  machine-readable documentation index now cover these surfaces; the frames
  page they are specified in was previously reachable only by direct link.

Sealing with Windows Hello now works on a real machine: enrolling this
machine's authenticator refused on every box before this, and the Hello
prompt now appears as documented. A sealed send tells you the token it
minted instead of leaving it on the terminal, and a commune no longer goes
missing when several agents save their context at the same time.

Fixed

• spt seal enroll-authenticator can now actually enroll on Windows. It
  previously refused on every machine with
  SEAL_AUTHENTICATOR_UNAVAILABLE: the Hello key could not be opened (NCrypt error 0x80090027) — not an environment problem and not something a Hello
  setup could fix: the backend asked the Microsoft Passport (NGC) key store
  for a plain key name, which that store refuses by design, so the
  "key not held yet, create it" path was unreachable and enrollment died at
  the first step every time. The backend now uses the supported Windows Hello
  application surface (WinRT KeyCredentialManager); the Hello prompt appears
  and the key is created and used as documented. (releases#222)

Changed

• The enrollment record's backend_kind for Windows Hello is now
  hello-kcm-rs256, and the previous hello-rs256 token is retired
  unminted. No record anywhere can carry the old token: the code path that
  would have minted it never completed on any machine, and a census of this
  fleet found no enrollment records at all (only code-ceremony seals). A
  record claiming the retired token is refused by name as an unknown backend.
  Enrolled public keys are now the Hello store's own DER SubjectPublicKeyInfo
  bytes, still carried as lowercase hex. (releases#222)
• A sealed send now tells you the token it minted: the answer reads
  SENT:doyle seal=n2czzem8hc. Before this, the only place the token appeared
  on the sending side was a line left behind in the terminal, which nothing
  could read back — a script or an agent had no way to learn what it had just
  minted. The token rides every answer a sealed send can give, including a
  queued or deferred one, because the ceremony happens before delivery is
  attempted: a message that only spooled still minted a seal you may need to
  cite. Once the ceremony admits, the overlay now clears without leaving that
  line behind; a ceremony that fails or is cancelled still says so.
• spt api seal describe reads like something written for a person. The
  minter's machine shows its name beside the key prefix —
  SPT_DEV:lia@HFENDULEAM (14efb80c…) — and the mint time reads
  2026-08-25 14:07 CEST in your own timezone instead of a raw number. The
  name is only shown when the record's short key prefix matches exactly one
  machine this node knows; if it matches none, or several, the prefix stays as
  it was rather than naming the wrong machine. Both are rendered from your
  node's roster and clock, so treat the output as something to read, not to
  parse — the seal record itself is still the machine-readable answer.
• spt api seal verify no longer fails over a trailing newline. seal mint
  seals the trimmed text, so piping the same text back in with echo used to
  present different bytes and answer NOT-BOUND for no reason a person could
  see. Verify now checks the exact bytes first and, only if they miss, the
  same trim the mint applied — content deliberately sealed with its whitespace
  binds exactly as before, and anything differing by more than leading or
  trailing whitespace is still NOT-BOUND.
• A verify verdict no longer repeats token, content_hash and
  ceremony_kind. The verdict line already carries the token, and a mismatch
  already prints both hashes; those fields belong to describe, which still
  shows all of them.
• Communes no longer go missing when several agents on one machine save their
  context at the same time. Their saves used to collide over the shared store
  and one could fail; a failed save left the file on disk but never reached the
  durable context, and after three tries the loss was silent. Saves now queue
  and wait for each other instead of colliding, and a save that still cannot go
  through leaves your file untouched rather than consuming it.
• When an agent's context ingest is failing, the brief it resumes from now says
  so, naming the fault and how long it has stood, instead of presenting
  possibly-stale context as current.
• spt update now exits with the worst outcome of its legs rather than the
  last one: a refusal (3) can no longer hide a failure. This was reachable
  under spt update --restart, where a leg runs after the adapters leg — if
  adapters failed and the finish then refused, the command reported the
  refusal. Scripts branching on 3 can now trust it to mean "nothing changed".
• An access rule about an endpoint is now honoured the same way by every local
  delivery verb. spt ring used to judge such a rule against whatever
  --from label the caller typed, and notifications against a display label
  that no rule could ever match, so a rule an operator wrote could silently
  cover some verbs and not others.

Added

• spt endpoint list now shows where an endpoint's commune must be written —
  as a commune drop dir: line under your own pin, and as a drop_dir field
  on every local endpoint in --json (previously only your own). A commune
  written anywhere else is never picked up, and this is how you check. The
  self-update and echo-commune documentation pages carry the details.
• Writing an access rule whose subject is a <endpoint>@<node> label — the
  form shown in notifications — is now refused when you write it, naming both
  ways to say what you meant. Such a rule could never match anything.

A wax seal can now be authorized with the machine's own presence check —
Windows Hello — instead of a typed code, and the seal it mints carries a
signature any member node can check for itself.

Added

• Sealing with a platform authenticator. spt seal enroll-authenticator
  enrolls this machine's authenticator (Windows Hello) into a subnet's
  security material, gated by the usual code ceremony. Once enrolled, minting
  a seal on that machine opens the operating system's own presence prompt
  instead of asking for a code — completing the gesture is the ceremony. An
  enrollment is permanent in this release: a machine already enrolled on a
  subnet refuses by name rather than replacing its key. On Linux the command
  refuses by name, stating that its authenticator support arrives later.
• Seals minted that way carry a signature covering the sealed content, its
  minter and its mint time together, so spt api seal verify now checks the
  signature as well as the content, on any node of the binding subnet. A seal
  whose signature does not check answers NOT-BOUND, as does one that claims
  the ceremony without carrying a signature. spt api seal describe shows the
  ceremony used and whether a signature is present.
• E on the code overlay enrolls and seals in a single ceremony when the
  machine is not yet enrolled on the binding subnet: the presence prompt sets
  up the key, and the one code entered afterwards both enrolls the machine and
  mints the seal — both or neither, never half of each. An already-enrolled
  machine is never offered E.

Changed

• Code entry remains the fallback for every seal ceremony, on the same
  overlay. Dismissing the presence prompt returns to code entry rather than
  failing the ceremony, while Esc still cancels everything, minting nothing
  and spending nothing. A signature that cannot be checked refuses by name and
  does not count against the attempt limit. Controllers attached from another
  machine get the ordinary code overlay without an error, since the signing
  key stays on the machine where it was enrolled.
• The published CLI reference now documents every command at every depth.
  Twenty-two commands were previously missing from it, among them
  spt api seal verify, spt endpoint access allow and
  spt endpoint monic add.