Changelog

New

• Strike PRs merge on their own: an open strike PR with green checks now gets one automatic quick review per head. When the review approves it, the merge train schedules it ahead of the queue with the usual 5-minute cancel window, even while the train batches other work. A strike the reviewer flags stops, with the review on its PR. A strike in a project that holds for UAT still waits for your Merge click. (#5276)
• Reset-first CLIProxy routing and an accounts panel: when CLIProxy holds two or more logins for a provider, the host dashboard now sends new sessions to the account whose weekly quota resets soonest, so quota is not lost at the reset; running sessions stay on their account. Settings → Providers shows a CLIProxy accounts panel with each account’s usage windows, reset times and rank. (#5278)
• Keyboard shortcuts sheet: press ? anywhere outside a text field to see every dashboard shortcut. Press N on the Command Deck to start a new conversation. (#5287)

Improved

• The sidebar logo shows when Overdeck is busy: while an agent is running or a conversation is mid-turn, the satellite in the Overdeck mark orbits its ring, like the logo animation in the Overdeck videos. When everything is idle it rests in the normal logo pose. It stays still if your system asks for reduced motion. (#5280)
• Commits name the session that made them: commits made by Overdeck agents and conversations now end with an Overdeck-Agent or Overdeck-Conversation trailer, so Overdeck can show exactly which commits each conversation made. (#5281)
• CLIProxy upgraded to v8.0.71: Overdeck now writes the CLIProxy config in the v8 layout, keeps a conversation on one account (session affinity), turns on the management API on localhost with a key in ~/.overdeck/cliproxy/management-key, and keeps Codex-aliased model names off Claude accounts. Your config.extra.yaml keeps working: legacy keys are converted. Run pan restart --cliproxy once after updating to move a running proxy to v8. (#5282)
• The Flywheel page is a live lane board: the Status tab now shows every in-flight issue as a card in its lane (Plan, Build, Checks, Review, Merge, Deploy, Done today), with the full title, time in stage, cost, who drives it, its agent, and one plain sentence on why it is not moving, such as a typecheck queued for memory or CI failing on its PR. Needs-you items are action cards with why and since, a jump to the message, and a real control where one applies (the test-removal waiver, Start, Open). A health strip shows main CI, the deployed build against it, the gate queue, the next train batch and the last release, and a timeline lists what merged, deployed and released today. The header counts every card. (#5283)
• Tab shortcuts on Linux and Windows: switch Stage tabs with Ctrl+Alt+1 to Ctrl+Alt+9 and close one with Ctrl+Alt+W, because the browser keeps Ctrl+1 to Ctrl+9 and Ctrl+W. macOS keeps ⌘1 to ⌘9 and ⌘W. (#5287)

Fixed

• Needs-you rows are clickable: on the Flywheel page, click anywhere on a Needs-you row to open the flywheel conversation at the message that raised it. Issue, PR and item links in the row still open their own target. (#5275)
• Open epics no longer look shipped after one slice merges: the issue view used to show an open epic as Merged, tick every pipeline step, show the “Shipped” status and offer Close out as soon as one slice PR merged. Now the epic keeps its real state, the merged PR shows as a merged slice, Close out stays off, the merge agent no longer labels the epic merged or verifying-on-main, and pan close refuses an open epic unless the operator passes --accept-merged. (#5279)
• Long issue titles wrap in the issue view: the Stage view’s header title wraps to up to three lines instead of ending in an ellipsis. The drawer header still truncates. (#5279)
• Home project menu no longer cut off: the “In: project” menu under the Home composer opened upward and was clipped by the page header. It now opens below or above the chip, whichever fits. (#5280)
• Live agents no longer read as “no agent”: a Herdr agent that finished its turn and waits at its prompt now counts as live on the Flywheel page and in pan flywheel status, and a handoff conversation or a queued quality gate counts as the issue’s work in progress. (#5283)
• Quality gates no longer deadlock behind one gate that cannot fit in memory: a gate that waits on memory no longer holds every gate behind it. A later gate that fits now starts, and a head that has waited 5 minutes runs alone once the other gates finish, as long as it leaves the governor’s hard reserve free. A full npm test run no longer sets the memory estimate for single-file vitest run calls. Queued gates pick up a corrected estimate or a lowered governor_soft_reserve_gb without a restart, and every waiting gate prints why it waits and which gate is ahead of it. (#5285)

Improved

• One issue view everywhere: the issue tab in the Command Deck now shows the same conversation-first view as the issue drawer: the agent’s conversation first, with the pipeline, checks and pickup controls in one compact header, and the same tabs. The crew list and the status rail left the issue tab; the Command Deck’s issue tree and Awareness column show them. Details gains a “Create PR” link and spells out the next step. (#5246)
• More in the issue drawer: the drawer gains a Discussion tab, a PRD view beside the plan map, a Changes tab with Files, Checks and Artifacts, and a status history beside the activity feed. A banner under the pipeline says when an agent is waiting for you or something blocks the merge. Details now shows what the issue is doing, each agent’s model and cost, the merge gate, linked conversations and the workspace stack. (#5253)
• Fewer GitHub API calls: each GitHub webhook and pipeline refresh now costs a fraction of what it did. The dashboard ignores check events that cannot change a pull request, reads short pull request lists at a third of the price, and stops re-asking GitHub for issue states it already knows. (#5261)

Fixed

• Sidebar workspaces: the Workspaces list shows only workspaces you created or favorited. Session Vault scratch workspaces, agent-made workspaces and the “Pipeline worktrees” group no longer appear, and finished issue worktrees no longer pile up as live rows. (#5233)
• Bot connections that cannot use WebRTC say so: when a bot’s computer cannot reach the TURN relay or send UDP, pan mcp connector connect now stops with the code no-webrtc-egress and points to Public MCP, instead of asking the bot to retry a “direct connection failed”. Connector errors name the route that failed, and pan doctor shows whether this machine can reach the TURN relay. (#5242)
• A second pan start no longer kills a running work agent: when two starts raced for the same issue, for example a recovery pan start and the late auto-start after planning, the losing start closed the winner’s pane and left its own pane behind. Now only one start can launch an agent at a time. The second start prints that the agent is already running, names its pane and exits 0. A failed launch closes only the pane it opened itself. (#5243)
• Merge train batches always get CI: a one-member batch whose feature already contained main used to fast-forward onto the feature’s own commit, so GitHub ran no CI for the batch branch. The batch then dissolved and switched batching off for the whole project for a day, with a wrong notice telling you to add uat/** to the CI triggers. Batches now always get a new merge commit, and a fast-forwarded batch head no longer pauses batching. (#5269)
• Review feedback reaches handoff conversations: review, verification, UAT and CodeRabbit feedback on a PR that a pan handoff conversation pushed (and that has no work agent) now goes to that conversation while it is live, instead of raising Needs you. A stopped conversation is never restarted to receive it. (#5271)

New

• Merge train switch on the Flywheel page: the Flywheel header has a real Merge train switch next to Auto-pickup and Require UAT. With it on, normal-priority PRs wait and merge together as one batch once the batch’s CI is green: when 3 are ready, or when the oldest has waited 30 minutes. Strikes and issues labeled critical, blocks-main, P0, urgent, or both substrate-improvement and bug still merge on their own right away. If a batch’s CI fails, one PR is dropped and the rest merge without it. A PR only you may merge (held for UAT, an auto-merge you cancelled, or a Deft human-merge policy) gets its own batch for you and never holds the others back. Batching needs a CI workflow named CI that runs on uat/** pushes; without one, a batch waits at most 10 minutes, then its PRs merge one at a time. Batch size and wait are in Settings → Merge Train. (#4753)
• Edit any project file from the explorer: saving a file opened from a project’s main checkout creates an edit workspace, so the main checkout never changes. Open a PR from it and merge with one click when GitHub reports no conflicts, discard it, or send it through Overdeck’s review pipeline as a new issue. (#5191)
• pi harness: the Pi Coding Agent (pi) is a harness again, with its own runtime, launcher, extension, pan doctor check, model provisioning and dashboard picker entry. Stored pi conversations read as pi instead of oh-my-pi. Install it with npm install -g @earendil-works/pi-coding-agent. (#5212)
• Cancel a message while it is still sending: a message that shows “Sending…” now has a Cancel link. A message still waiting its turn is never sent, and its text comes back to the composer (or to the failed-message list if you have already typed something new). A message already on its way is stopped if the agent has not received it; otherwise it says “Already delivered, can’t cancel”. (#5237)

Improved

• pi is the default for non-Anthropic, non-OpenAI providers: Google, xAI, MiniMax, Z.AI, MiMo, OpenRouter, Nous, DashScope, Groq, Cerebras and Mistral models now launch on pi instead of oh-my-pi. An explicit providerHarnesses or role harness: ohmypi setting still wins, and existing oh-my-pi conversations keep resuming on oh-my-pi. (#5212)
• CodeRabbit findings survive a fast merge: when a PR merges before its work agent answers a CodeRabbit finding, Overdeck now files a follow-up issue quoting each unsettled finding, or raises Needs-you when it cannot. Nothing waits for CodeRabbit. Filing needs the GitHub App’s Issues: Read and write permission. (#5218)
• Issue notifications open the issue: tapping a finished, failed or stopped notification on your phone opens that issue’s sheet instead of Needs you. The sheet now shows what happened, the agent and whether it is live, the cost so far, the pull request with its review and checks, and the issue description. (#5219)
• Fewer GitHub API calls: the dashboard now relies on GitHub webhooks to notice pull request, review and check changes, and polls GitHub every 5 minutes instead of every 30 seconds while the webhook relay is running, cutting idle GitHub API use by more than half. (#5224)
• Terminal-dialog prompts open the terminal: clicking a needs-you entry or notification for an agent blocked on a terminal dialog (a tool-permission, rate-limit or session-resume prompt) now opens that agent’s terminal in the issue drawer, instead of a toast telling you to go find it. (#5235)
• Reload banner after an update: a dashboard tab that still runs the frontend it loaded before an Overdeck update now shows “A newer Overdeck is running. Reload to update.” with a Reload button, in the main dashboard, the phone browser view at /m and conversation pop-out windows. Reloading keeps unsent drafts, and the dashboard never reloads by itself. (#5236)
• Flywheel Needs-you items are clickable: an item can now carry a link (the loop ends it with <https://…>), and the row shows the item text as that link. Issue, PR and item links are underlined and focusable, cross-repo PRs written owner/repo#<n> link to GitHub, and “Show where this was raised” opens the flywheel conversation in the Command Deck at that message and highlights it for a few seconds. Rows with no known origin no longer show the jump button. (#5239)
• Issue drawer opens on the conversation: the agent’s conversation now fills the issue drawer. Status and controls sit in one compact header: the pipeline phases (select one to open that agent’s conversation), the pickup switches with Release, the checks, and the issue actions. The Overview tab is now Details and comes last, and skill settings have their own Skills tab. (#5244)
• Skills at project and issue level: each skill now has one switch that shows whether it launches, with the level the value comes from beside it. A pin button keeps the current value when the level above changes, and a reset button returns the skill to what it inherits. Skills you changed are listed first with Reset all, and the issue view opens on every skill instead of a filtered list. (#5245)
• Typechecks wait for memory: every tsc lane of npm run typecheck and the lint type guards now joins the machine-wide admission queue through scripts/tsc-admitted.mjs, and the queue checks memory as well as CPU. A typecheck, local Vitest run or verification gate waits while starting it would push available memory below resources.governor_soft_reserve_gb, using the peak memory measured on its earlier runs, so overlapping typechecks no longer exhaust the host. (#5248)

Fixed

• Turning the merge train off no longer stops merges: with the train off, every ready PR merges on its own as soon as it is green, as the switch promises. Before, off stopped automatic merging altogether. (#4753)
• Discard new files from the file explorer: Discard changes now works on untracked and newly added files. They move to the Overdeck trash instead of being refused, and a folder with both committed and new files keeps its committed files. (#5195)
• Close-out sees merged polyrepo work: pan close now compares each repository’s feature branch with origin/main after fetching it, so a stale local main no longer reports merged work as unmerged commits. For issues not tracked on GitHub, the review and tests rows accept merged GitLab MRs and member-repository PRs as landing evidence and record a skip that names what was not read. (#5209)
• OpenRouter and Groq models bind the right provider on pi-family harnesses: pi and oh-my-pi read the vendor segment of a bare vendor/model id as the provider, so an OpenRouter openai/gpt-oss-20b ran on Groq. Launches now pass openrouter/<vendor>/<model> and groq/<id>. (#5212)
• Google models on pi-family harnesses get their API key: pi and oh-my-pi launches for Gemini models now receive GEMINI_API_KEY; before, they got only the Claude Code proxy settings and no key. (#5212)
• Flywheel needs-you rows: each row in the Needs you block now has its own jump button (“Show where this was raised”) instead of the whole row acting as a button. Issue and PR links inside a row are ordinary controls again, so keyboards and screen readers reach and name each one. (#5217)
• pi conversations started from the dashboard receive their first message: the launch now waits for the pi extension’s ready signal instead of reading the terminal screen, which timed out on Herdr, so the first message is delivered and pi replies. A failed start names the real harness, and pi and oh-my-pi no longer add a second, incomplete row to the session index. (#5223)
• pan follows pan reload: after a reload, the shell pan command now runs the newly activated build instead of the previous one until the next agent launch. (#5225)
• Close-out for MYN-style polyrepo issues: the merged check uses the last-fetched origin/main when a fetch fails, a branch identical to main no longer blocks the review and tests rows, and the post-merge row accepts merged GitLab MRs for issues not tracked on GitHub. (#5225)
• Herdr pane reads return the screen again: on the Herdr terminal backend every pane read came back empty, so readiness waits ran to their timeouts, crash and stall checks could not see the screen, and message submit verification could not confirm delivery. Reads now return the pane’s text, and a message is no longer submitted with Enter while the agent sits at a permission prompt or choice menu. (#5232)
• Skills for this issue loads faster when the dashboard is busy: the skill list now reads skill and pack files in parallel and reuses pack details it has already read. Agent launches read the pack catalog faster too. (#5238)

New

• File explorer in the Stage: the Files button on a project’s home and on an issue tab now opens a live tree of that checkout, colored by git status, with quick open (Ctrl/Cmd+P), content search (Ctrl/Cmd+Shift+F) and a right-click menu to copy paths and stage, unstage or discard changes. The Changed filter replaces the old changed-files list. (#5186)
• Edit files from the explorer: clicking a file in the Files tree now opens it in a Monaco code tab with syntax highlighting. A single click reuses one preview tab; editing it or double-clicking keeps it open. Edits save automatically a second after you stop typing, when you leave the editor, or at once with Ctrl/Cmd+S. If another program changes the file while you have unsaved edits, a banner lets you compare, reload, keep your edits or overwrite, and a Changes toggle shows your edits against the last commit. (#5187)
• File explorer viewers and file transfer: the explorer can now show images, PDFs, audio, fonts, large text files, CSV and TSV tables, zip and tar archives and SQLite databases, and the dashboard server can stream any file or folder from an explorer root and accept file uploads into a workspace. These are the building blocks the explorer’s file tabs, Download menu and file drop use. (#5188)
• Office, notebook and Mermaid previews in the file explorer: Word, Excel and PowerPoint files, OpenDocument text, spreadsheets and presentations, Jupyter notebooks and Mermaid diagrams now open as read-only previews in a file tab. Notebooks show their saved outputs and never run code. A file that cannot be previewed shows its size and a Download button. (#5189)
• File actions in the explorer: create, rename, duplicate, move by drag and delete files and folders in an issue workspace’s file tree. Deleted files go to the Overdeck trash, and Ctrl/Cmd+Z undoes the last action. Drop files from your desktop onto a folder to upload them, or drag rows into a conversation composer to insert their paths. (#5190)

Improved

• Flywheel needs-you items: the Needs you block on the Flywheel page shows one row per item. Issue IDs open the issue, known PRs open on GitHub, and clicking a row scrolls the conversation to the message where the loop first raised that item. (#5198)
• A cleaner phone app: the phone screens get a new header with the Overdeck logo, icons in the tab bar, clearer rows and empty screens, and a faint logo behind the main lists. The logo animates once when the app opens; tap to skip it. In the browser phone view (/m), the gear in the header now sets System, Light or Dark, and the install and notification hints move into one banner you can dismiss. (#5208)

Fixed

• Polyrepo work agents start again: a polyrepo workspace no longer refuses its work agent because of Overdeck’s own synced files (.claude/, .mcp.json, .hume-config) at the workspace root. The root .gitignore now lists them, and the next pan start repairs a workspace created before this fix. Issues already stuck in Planned do not restart by themselves: run pan start <issue> once for each. (#5199)
• Large Codex conversations no longer fill dashboard memory: The dashboard no longer holds very large Codex conversations in memory. Screenshots in tool output show as a short [image: png, 412 KB] note, long tool output is trimmed to its start and end, and a very large conversation opens with its recent history and loads older history from disk as you scroll up. Expanding a trimmed Codex tool row still loads its full text. (#5211)

Fixed

• Send a follow-up at once: the composer now clears as soon as you press Send, and you can send another message while the first is still on its way. Messages still reach the agent in the order you sent them, and a message that fails to send stays in the outbox. (#5184)

Improved

• macOS and bare-host release checks: every release now installs the exact package it publishes on a macOS host with no tmux, Docker or Homebrew, and stops if pan up fails or the idle dashboard spawns too many processes. (#5176)

Fixed

• No systemctl calls on Linux hosts without systemd: the idle dashboard no longer starts a shell for systemctl every few seconds when systemctl is not installed, for example in a container. (#5181)
• Deep-linked issues open fast: opening a link to an issue no longer shows the loading title for about two seconds. The dashboard now asks for the sign-in session and the linked issue before anything else, so they no longer wait behind the many status requests a new tab sends. (#5178)

Fixed

• Idle dashboard process storm on macOS without Docker or tmux: an idle dashboard on a Mac with neither binary installed no longer creates a stream of short-lived processes. (#5168)
• Herdr hosts without tmux: pan up now starts when tmux is missing under the Herdr terminal backend, and the conversation list no longer runs tmux for each conversation on every poll. On macOS without Homebrew, Overdeck no longer tries brew install and prints a download link instead. (#5169)
• macOS no longer runs Linux-only checks: the dashboard no longer calls systemctl to check the supervisor or journalctl to look for kernel OOM kills on macOS. Each failed call there left about ten dead processes. On macOS the dashboard now checks the supervisor over HTTP and reports it in the activity feed when it stops answering for a minute. (#5170)
• Issue headers show the real title right away: the issue drawer, the Command Deck issue view and the phone issue sheet now load the issue’s title on their own instead of waiting for the full issue list, so they no longer show “Issue details” for several seconds, or forever for backlog and canceled issues. While the title loads you see a short placeholder bar; if the tracker cannot be reached you see the issue ID. (#5171)

New

• Atlassian Rovo MCP skill pack: pan skills pack add atlassian installs Atlassian’s Jira and Confluence skills, pinned to a reviewed commit, and with the pack on, Claude Code and Codex agents get the atlassian MCP server at https://mcp.atlassian.com/v2/mcp. Your Jira email and API token sign it in; without them, Claude Code agents reuse your own /mcp sign-in. pan doctor checks the endpoint. (#5165)

Improved

• New installations start in Auto permission mode: a new install launches Claude Code with --permission-mode default and Overdeck’s auto-approve hook instead of bypass; installs that existed before this release keep bypass, written once into ~/.overdeck/config.yaml; pan doctor reports a missing hook, and a launch is refused rather than prompting on every tool call. (#5151)
• Sidebar owner groups honor owner and GitLab: a project’s sidebar group is now its projects.yaml owner, else its GitHub owner, else its GitLab group, else Other, so a GitLab project can show beside its organization’s GitHub projects. (#5161)

Fixed

• A stranded review request is re-requested again: when a review was requested but never dispatched, and the review had no run state yet, the background patrol’s recovery did nothing, so the review stayed stuck until someone requested it again. The patrol now re-requests it through the same guarded review route that pan review request uses, 15 minutes after the request. (#4623)
• Polyrepo CI test verdicts are read for the member repo’s head: in a polyrepo project with verification.tests: ci, the verification gate looked up the CI test result under the wrapper repo’s HEAD, which no PR points at, so a red CI test job never failed the test gate and verification passed on typecheck and lint alone. It now reads the verdict for the primary member repo’s head, both at the start of the run and after an agent commit moves it. Standalone projects are unchanged. (#4624)
• A check that fails later on the same commit now reaches the agent: when lint failed first and a test shard failed a minute later on the same pull request head, the agent heard only about lint. The CI failure relay now sends a new feedback file that names each check that failed after the earlier feedback. Repeated reports for a check already delivered still send nothing. (#4625)

New

• Jira as an issue tracker: a project with tracker: jira now works like a GitHub, Linear or Rally project. Jira Cloud and Jira Data Center are both supported. Jira issues show on the board, in the Command Deck and in search; pan start, pan done, pan close and pan reopen take a Jira key; and Overdeck moves the issue through your Jira workflow and links the pull request to it. Add the Jira token, email and site under Settings → Tracker Keys or in ~/.overdeck.env, and pan doctor checks them. The code can still live on GitHub or GitLab. See Jira Integration. (#5160)

Fixed

• A dashboard restart no longer re-runs passed verification: when the dashboard restarted between a passed verification and the review dispatch, the full gate suite (25 to 45 minutes) could run again for the same commit. It now dispatches the review that was owed. (#5150)

New

• GitHub organizations: Overdeck now picks the acting identity per repository: the GitHub App’s bot where the App is installed, and your gh account everywhere else. Before, a machine with the App used the bot’s token on every repository, including ones the App could not reach. The sidebar groups projects by owner, the Command Deck header shows the owner and the acting login, Settings has a GitHub Identities section, and pan doctor prints one row per owner with the fix when an identity cannot push. See GitHub organizations and identities. (#5159)
• Memory extraction on subscription-only hosts: a claude-cli provider lets a host with a Claude subscription and no API key extract memory observations. (#5148)
• One-paste connector setup: Integrations gives one block of text to paste for Grok Bot, Grok Build, Hermes and OpenClaw, with pairing status guidance, and Grok Bot is on the connector. (#5140)
• Connect a bot: each bot has its own copy button, pending requests are listed under Bots, and a notice confirms when a bot is connected. (#5136)
• One-click activation: the overdeck.ai activate link is now a single Authorize click on a page that names the bot and the machine. (#5132)
• Resume conversations after a terminal-backend restart: when the terminal backend restarts (a crash, an out-of-memory stop, a service restart), Needs you shows one row, <N> conversations stopped when the terminal backend restarted, with a Resume all button. Overdeck never resumes them by itself. Resume all starts them one at a time, waits while memory or CPU pressure is high, and skips conversations that are paused, held, or stopped on purpose. See Conversations. (#5134)
• Resume a conversation from a shell or an agent: pan conversations resume <name> and the resume_conversation MCP tool resume a stopped conversation, as the dashboard’s Resume button does. (#5134)

Improved

• New default models: on built-in defaults, work, test, ship and worker agents and three review lanes now run on Claude Opus 5.5 instead of Sonnet 5.5 (the mid workhorse), which roughly doubles what those agents cost; the Anthropic cost-saver preset keeps Sonnet 5.5 for 30% of work. The cheap workhorse, conversation titles, compaction and memory extraction now use Claude Haiku 5.5 instead of Haiku 4.5 ($0.10/$0.50 per MTok against $1/$5), which needs Claude Code 2.1.293 or newer. Installs that set these models in config keep them. (#5124)
• GPT-6.1 Terra on the Claude Code harness: gpt-6.1-terra now runs on the Claude Code harness through CLIProxy as well as on the Codex harness, with the same 272K context pin as the other GPT-6 models. CLIProxy 7.3.16 picked it up from its remote model catalog; no CLIProxy upgrade is needed. (PAN-4634)
• God View shows only real data: simulated ages, rates and effects are gone, mislabeled orbs are fixed, and the field guide matches what the canvas draws. (#5138)

Fixed

• Reopen and discussion sync use the right repository: reopening an issue and syncing its discussions now run against the issue’s own repository. Before, they could read another project’s repository. (#5159)
• Terminal tab for Codex and OpenCode conversations on Herdr: the tab no longer says the conversation is not running when it is. (#5142)
• Restart hold set after approval: a hold placed after a restart was approved now stops that restart. (#5143)
• Out-of-memory kill no longer stops every pane: when the kernel kills one pane process for memory, the Herdr server and the other conversations keep running. (#5126)
• Long failed message no longer hides the timeline: the failed-message box scrolls, so the timeline and the Retry and Discard buttons stay visible. (#5128)
• Runaway text-to-speech takes: pan-tts retries a Qwen3-TTS take that runs far too long, and trims it if the retry runs away too. (#5129)
• pan review request no longer races PR adoption: when a PR opened outside a pipeline workspace is still being adopted into one, pan review request now answers that adoption is in progress and starts nothing. Before, it could start a second verification on the half-built workspace, which made adoption refuse with workspace-head-mismatch and showed a false Needs you. (#4995)
• A dashboard restart no longer re-runs passed verification: if the dashboard restarts after verification passed but before review started, review now starts on the next boot without running the gates again, as long as the head has not moved. A request that a restart interrupted while a dependency install had a tracked file modified also resumes, and Overdeck checks that the tree is clean only when it dispatches review. Before, both cases ran every gate again (25 to 45 minutes) on a head that had already passed. (#4622)

New

• Grok Build harness: run agents and conversations on xAI’s Grok Build CLI (grok) with the grok harness. Overdeck reuses your Grok Build sign-in, keeps sessions persistent over ACP, reports cost, and lists the Grok models in pickers once grok is installed and signed in. pan doctor checks it. See Harnesses. (#5119)
• Recent notifications: Settings → Anywhere → Phone notifications lists the last 50 notifications Overdeck sent, where each went, and whether the question is still waiting, was answered from Overdeck, or was answered or withdrawn elsewhere. (#5115)
• Coding-agent CLIs stay up to date: Overdeck now updates npm-installed Claude Code, Codex CLI and OpenCode in the background once a day, and updates Claude Code before a launch that needs a newer version, so a new model no longer stops at “needs Claude Code X or newer”. Running sessions keep their version. Turn it off in Settings, Coding Agents, or with harnesses.auto_update: false. See Harnesses. (#5114)

Improved

• Can’t reach rows in Needs you: when this machine cannot read a linked machine’s Needs you, the desktop and the phone show Can't reach <machine>; it may have items waiting. until a fetch succeeds. (#5115)
• Close an item and its acceptance criteria in one call: pan task done <issue> <item> <item>.ac1 <item>.ac2 ... and the task_done tool’s itemIds take many ids at once. They record every id with one commit, or none of them and name each one that lacks its Item: line, so a plan with 85 acceptance criteria no longer costs 85 commits and pushes. (#5121)

Fixed

• No more false “stopped responding” push after a PR merges. The merged work agent is recorded as stopped when its terminal closes, and the crash watcher never counts a paused agent as crashed. (#5113)

New

• Delete your account from the phone app: Settings → Delete account deletes your overdeck.ai account from inside the Overdeck app. Type DELETE to confirm; the phone then signs out. If the request fails, the app stays signed in and offers Delete on the web. (#5109)
• Muse Ember: Meta’s muse-ember-1.0 is in the Muse Code model picker, the Settings catalog and the cost tables ($0.10/M input, $0.004/M cached input, $0.50/M output, 1M context). A request over 200K input tokens is billed at $0.30 / $0.012 / $1.50, and cost tracking applies that rate per request. (#5110)
• Muse Wonder Full: muse-wonder-full-1.0 is in the Muse Code model picker as a subscription-only model, billed through the Power ($50/mo) or Maximum ($200/mo) Muse Code plan rather than per token. (#5110)

New

• Claude Fable 5.2: Anthropic’s claude-fable-5-2 is in the model pickers, the Settings catalog and the cost tables ($8/M input, $40/M output, $0.20/M cache reads, 1M context). It is cheaper than Fable 5.1, which stays selectable. Fable 5.2 needs Claude Code 2.1.321 or newer: use the dashboard’s Upgrade Claude Code button or run npm install -g @anthropic-ai/claude-code@latest. No default model changes. (#5105)
• Connect a bot in one paste: Settings → Anywhere → Bots → Connect a bot copies one setup message for your bot. The bot does the setup itself and shows you an approval link, and you approve it on your own machine. (#5080)
• Per-project MCP servers and credentials: a project can give its agents its own MCP servers and the credentials they need. (#5077)
• Low-disk alerts: when free disk drops below 5 GiB, and again below 2 GiB, Overdeck adds a Needs you item and sends a phone push. (#5099)

Improved

• Gauntlet lanes respect the disk floor: pan lane start refuses to launch when the disk is low, and superseded lanes are reaped. (#5098)
• Telemetry you can act on: the dashboard and the phone app report failed requests, crashes and phone link drops to PostHog (anonymous, only when telemetry is on); usage of MCP protocol revisions, clients and surfaces is recorded; and CI runs, test homes and throwaway VMs no longer count as new installs. See Telemetry. (#5101, #5085, #5086)
• dbt projects: gate environments get placeholders, feature names are identifier-safe, and each workspace gets its own dev target. (#5073)
• Skill packs: the docs are current, with a pack authoring guide and a config reference. (#5075)

Fixed

• No more false “agent stopped responding” push after every planning finalize. (#5081)
• Account sign-in retries the device-code request once after a network error and shows the real cause when it fails. (#5076)
• pan close works for GitHub-tracked projects with a custom issue prefix. (#5059)
• pan is on PATH for operator shells and spawned work agents, so pan doctor can run. (#5063)
• The conversation view follows Claude Code’s backgrounded sessions instead of drifting from the terminal. (#5060)

New

• Overdeck MCP for agents and bots: every managed agent now gets Overdeck’s own tools over MCP, so it can check off its plan, signal done, hand off, delegate to a worker or lane, start an issue, schedule a message, read and add memory, link and watch pull requests, ask you for a secret, and ask you to link a machine, without shelling out to pan. Claude Code, Codex and the ACP harnesses get the server injected automatically; harnesses without MCP get a short CLI instructions block instead. Agent tokens are minted per agent and revoked when it ends, and approvals for every harness collect in one fleet-wide pending list. See Overdeck MCP and pan mcp. (#4968, #4967, #4978, #4983, #4982, #4997, #4975, #4984, #4985, #4974, #4989, #4981, #4991, #4992, #4977)
• Connect your own bots: Settings → Anywhere → Connect a bot links Hermes, OpenClaw, Grok Build or a Grok bot (through the xAI API) to your fleet. A bot signs in with OAuth 2.1 and you approve it on an approval card, or it reaches your machines through pan mcp connector and the overdeck.ai directory. An opt-in public /mcp endpoint over Tailscale Funnel is available for bots that run elsewhere. Plugin source for each bot is in integrations/. See Bots. (#4979, #4986, #4990, #4988, #4980, #5014, #4966, #5030, #5035, #5032, #4996, #4965, #5040, #5052)
• Native phone apps for iOS and Android: an Overdeck app for iPhone and Android pairs with your machine by QR code (Settings → Anywhere → Set up the phone app) and talks to it over the same end-to-end encrypted channel as linked machines. It shows Needs you and your conversations grouped by project, answers questions, starts new conversations, and follows System, Light or Dark appearance. Push notifications are sealed to each phone, so Apple, Google and overdeck.ai cannot read them, and you can pause them or choose which kinds you get. On iPhone a Live Activity shows your counts. The apps are in TestFlight and Play internal testing now. See Phone app. (#4923, #4883, #4891, #4894, #4902, #4898, #4899, #4900, #4877, #4962, #5051, #4964, #5044, #5031, #5047, #5050)
• Shared Sessions: share a live conversation with someone else. pan share (or the share action in the dashboard) opens a share link; pan join or the hosted web join page lets others watch the conversation and its terminal read-only, draft prompts, or take control when you hand it to them. Peers connect over WebRTC with a TURN fallback, and the host reconnects and viewers restore on their own. See Shared Sessions and pan share. (#4880, #4889, #4895, #4912, #4913, #4919, #4911, #4915, #4916, #4972)
• Account in the dashboard: Settings → Anywhere has an Account card with PKCE sign-in, and account.overdeck.ai has an account page for your plan, relay allowance and machines. (#5010, #4969)
• Restart hold: pan restart hold --reason "…" stops every pan reload and dashboard restart, from any conversation, until pan restart release or its --until time. Use it during a live test that a restart would interrupt. (#5056)
• SageOx and Deft: try SageOx in a project without committing it, with an Overdeck-built ox and Codex support; and a per-issue Deft Directive with its state in the dashboard and a Run on Deft switch. (#4893, #4879)

Improved

• The merge train explains itself: when it skips a PR it now says why (checks pending at a given commit, a failed PR listing, a conflict) in the pending list and the logs, instead of skipping silently. The PR listing it reads is lighter and logs its failures, and per-PR auto-merge no longer races UAT batch generations. (#5039, #5053, #4976)
• Fewer stuck reviews and merges: a review approval that hits a temporary GitHub error is saved and retried instead of lost; the review-convergence check judges only the rounds since the last approval; the merge step no longer rebases away a conflict the branch already resolved; and a reviewer’s verdicts are ranked by review order, not by timestamp. (#5037, #4994, #5038, #4707, #4701)
• Fewer merge conflicts between parallel PRs: the codebase notes’ last-verified line holds only a date, and the phone app’s acceptance log merges both sides automatically. (#5025, #5055)
• Disk-aware starts: concurrent workspace starts reserve disk space up front, so several starts at once can no longer run the disk out. Agent scratch files live under ~/.overdeck/tmp with a 14-day cleanup, so a reboot no longer deletes them. (#4973, #5009)
• pan tell accepts a conversation’s bare name, and pan lane start --machine auto says why it picked this machine. (#5004, #5024)
• Telemetry: PostHog now covers the phone apps and Anywhere desktop events. (#5027)

Fixed

• You can type to an idle work agent again: the composer no longer locks when a Herdr agent finishes its turn and waits at its prompt. (#5026)
• Phone link stability: the phone app no longer drops and re-creates its connection on mobile networks, and links to a paired machine after a long machine uptime. (#5049, #5034)
• Overdeck Anywhere: pan worker run to a Fly machine no longer times out opening the secure channel; the Command Deck shows reports for remote gauntlet lanes; five display bugs and the 1600x900 layout are fixed; a Mac set up with pan connect can reach LAN machines; and pan connect on macOS no longer prints a Linux-only warning. (#5008, #5017, #5023, #4921, #4901, #4987)
• Conversations: a Codex conversation receives its first message reliably, and Pull here keeps a Codex conversation’s title. (#4907, #4910)
• Pipeline and dashboard: the closed-issue reaper no longer exhausts the GitHub App quota; the idle-stack reaper no longer stops containers of live agents on Herdr hosts; pan reload no longer ships a stale held build; workspace creation in a polyrepo without a root package.json works; tiered crews named in by_kind can be removed; and Settings model selects no longer cut off model names. (#5002, #4698, #4892, #4963, #4679, #4678)
• Add a Fly machine points to the right config file when remote.enabled is missing. (#4914)

Improved

• Overdeck Anywhere is easier to find: a Machines entry in the sidebar shows how many linked machines are online, the command palette has Anywhere actions (link a machine, add an SSH or Fly machine, set up a phone, set up Tailscale and more), and the Get set up card on Home has a Reach this machine from anywhere row. (#4874)
• CodeRabbit findings reach the work agent: when CodeRabbit posts a review with inline comments on a pipeline PR, Overdeck sends the findings to the issue’s work agent. The agent fixes the ones it agrees with and replies on the PR thread with its reason for each one it rejects. Nothing waits for CodeRabbit when it posts nothing. (#4870)
• Working directory on another machine: when you choose another machine in the New conversation dialog, the Working directory field now says that the other machine sets it, instead of showing this machine’s directory. (#4873)

Fixed

• Phone app opens conversations on linked machines: tapping a conversation that lives on another linked machine now opens it, instead of failing to load. (#4875)

New

• Overdeck Anywhere: each of your machines runs its own Overdeck, and the machines now link to each other, so you can see, control and move conversations and work between them from any one dashboard. Everything that runs on your own machines is free and open source. The hosted overdeck.ai services are optional, invite-only for now, and their source is in services/ under the Functional Source License. See Overdeck Anywhere and Linked machines.
  • Linked machines: run pan pair on one machine and pan machines link <url> on the other, and the two dashboards talk server to server over an end-to-end encrypted channel. Your browser still talks only to the machine it opened. A link learns every route to the other machine (LAN, Tailscale, direct, relay or SSH), uses one that answers, and reports the other machine’s health. Link both ways is the default. (#4715)
  • overdeck.ai sign-in and directory: pan account login signs a machine in to account.overdeck.ai with GitHub’s device flow, and pan account status and pan account logout complete the group. A signed-in machine registers in the connect.overdeck.ai directory, which lists your machines in Settings → Anywhere → Directory (or pan machines directory). Link two of them without a pairing code by two-screen approval: both screens show the same six-digit code, and you approve only if the codes match. The free account includes 3 machines. (#4691, #4726)
  • Direct and relay routes: when no LAN or Tailscale route answers, linked machines open a peer-to-peer WebRTC path through the directory and show it as direct. When no direct path exists, the relay add-on carries the same encrypted channel through a TURN relay, with a 50 GB monthly allowance per account, and the status card shows Using relay. The relay tries TURN over TLS and TCP first, so it can connect when UDP is blocked. (#4726, #4868)
  • SSH machines: Settings → Anywhere → Add an SSH machine (or pan machines add-ssh) starts pan up on an SSH host, or adopts one already running, and links it. Removing a machine that Overdeck started stops its server; a server you started yourself keeps running. (#4720, #4866)
  • pan connect: npx @overdeck/core connect on a fresh server installs a lasting runtime, runs Overdeck as a systemd user service (or a launch agent on macOS) that survives logout and reboot, and prints the link to use on your main machine. Update all and pan update update that runtime. (#4718, #4824)
  • Fly VMs as machines: pan machines add-fly starts a Fly.io VM that runs Overdeck, links it, and can start a conversation there; unlinking destroys the VM. Choose Fly (new VM) in the Machine field or pass --machine fly, and set remote.auto_fly to let Auto create one. pan start <id> --remote now runs the work agent as a linked conversation on the VM’s server. pan machines add-fly --harness codex runs Codex on the VM and keeps its ChatGPT sign-in in sync. You pay Fly directly. Fixes found while testing Fly machines are included. (#4742, #4818, #4850, #4749, #4797, #4807, #4812, #4815)
  • Conversations across machines: one conversation list shows the conversations on every linked machine. Open and control a conversation on another machine, message it with pan tell @<label>/<conv>, or choose Pull here (pan conv pull) to move it to this machine with its uncommitted changes; the old copy then refuses new turns. Open preview and pan machines forward reach a dev server on the other machine. Open in editor opens the owner’s checkout in VS Code over Remote-SSH, through a Tailscale route or an SSH machine. (#4731, #4867)
  • Work across machines: the Machine field, --machine <label> and --machine auto choose where a conversation, worker or issue runs. Auto avoids a machine whose CPU is saturated, and --needs docker picks a machine that has Docker. pan worker run --machine delegates to another machine, and Needs you, usage and Compare settings cover the whole fleet. pan lane start --machine runs gauntlet lanes on any linked machine, nested under the orchestrating conversation at home. (#4744, #4758)
  • Fleet versions and Update all: Settings → Anywhere → Fleet versions (or pan machines versions) lists the Overdeck and harness CLI versions on every machine. Update all (pan machines update) updates them and waits for running turns to finish first. (#4719)
  • Phone app and push notifications: the dashboard installs on a phone as a web app at /m, reached over Tailscale Serve. It shows Needs you, your conversations and a read-only pipeline board, and answers an agent’s question in three taps. Settings → Anywhere → Set up a phone pairs it. Your machine sends Needs-you notifications itself with Web Push, encrypted so the push service cannot read them, with an optional ntfy topic. (#4693, #4784, #4688)
  • Set up Tailscale: Settings → Anywhere → Set up Tailscale (or pan tailscale setup) installs Tailscale, signs in, serves the dashboard over HTTPS with token sign-in required, and finds other Overdeck machines on your tailnet. pan tailscale status shows the current state. (#4706)
  • Webhook triggers: pan triggers (or Settings → Anywhere → Triggers) creates a secret URL that messages a conversation or starts a new one when GitHub, Stripe, CI or a chat bot posts to it. GitHub and Stripe signatures are checked. Events reach the machine through Tailscale Funnel, or the directory’s webhook inbox holds them for 24 hours while the machine is offline. (#4700, #4726)
  • MCP server: pan mcp serve (stdio) and the /mcp endpoint let an MCP client list and read conversations, send messages, start conversations and workers, and answer waiting questions, limited to what its token’s scopes allow. Copy MCP URL in Settings → Anywhere mints a scoped token and copies the URL. (#4699)
  • Desktop app without a local server: the desktop app can open a chosen machine’s dashboard instead of starting its own server, and its menu and tray switch between machines. (#4665)
  • Pipeline transcripts in the Session Vault: finished pipeline agents’ transcripts are saved to the Session Vault automatically, so your other machines can open them. (#4664)
  • Known limitations: three parts of Anywhere were not verified end to end before release. The Set up Tailscale step has not been run on a real machine. Running npx @overdeck/core connect as a systemd service on a fresh VPS has not been tested on a real VPS (#4863). The relay’s TURN-over-TCP fallback for networks that block UDP is covered by tests but has not yet connected on a live Fly VM. The release acceptance run is in docs/ANYWHERE-RELEASE-CHECKLIST.md. (#4864)
• Deft pipeline per issue: pan skills deft use <ISSUE> runs one issue on Deft Directive’s own pipeline. Overdeck installs Directive into that issue’s worktree and hides every installed file from git, so the PR never carries it. The work agent gets Deft’s build, pre-PR and review-cycle skills, and Overdeck runs no review, test or verification agents for that issue. The merge gate waives approval at head for a Deft issue, refuses a PR that carries install files or a stale Deft state archive, and auto-merge holds an issue whose Deft policy requires a human merge. pan skills deft save|show|back <ISSUE> commits the state archive, shows the install and merge-guard verdict, and switches the issue back to Overdeck’s pipeline. (#4857)
• gstack skill pack: pan skills pack add gstack adds gstack from the eltmon/gstack fork. Overdeck renders its skills and runtime under ~/.overdeck/packs/gstack/ and never writes ~/.claude or ~/.gstack. The consent preview lists the render command, every script the mounted skills can run and the skills left unmounted. Turn the pack on at global, project or issue level. pan skills pack browser gstack builds gstack’s browser, design and PDF runtime after a second consent, so skills such as qa, browse and make-pdf can mount. pan skills pack remove gstack removes every mount it made. (#4735, #4745)
• pstack skill pack: pan skills pack add pstack registers poteto’s pstack from the eltmon/plugins fork (Cursor’s Claude Code build, 58 skills, 7 opt-in). Turn it on with pan skills set --pack pstack on [--project <key>|--issue <id>] and invoke skills as /pstack:<name>. Known packs no longer need a url in pan skills pack add. (#4728)
• Color themes, including VS Code themes: Settings → Appearance has separate light and dark color themes, with built-in themes. Import VS Code theme reads a theme .json file or a .vsix extension package and previews it before you save. The theme also colors terminals and code blocks. Duplicate and edit copies a theme into an editor with color pickers and a live preview. (#4689, #4806, #4809)
• Scheduled conversations: a schedule sends a stored prompt to a conversation on a recurring timetable, for example every evening at 21:00. Manage schedules with pan conv schedule add|list|pause|resume|rm, or choose Schedule… from a conversation’s row or tab menu. A row with an active schedule shows a next-run badge, and a delivered run moves the conversation back to Inbox. (#4668, #4800)
• Send a message when rate limits reset: when a conversation has hit its usage limit, choose Send when limits reset in the composer, or run pan tell --when-limit-resets, and Overdeck delivers the message once the limit resets. Queued messages show in the timeline with Edit and Cancel, and pan conv pending <conv> lists them. (#4686)
• Settle and snooze conversations: the conversation list is now split into Needs you, Inbox, Snoozed and Settled. Settle a conversation to mark it done for now without stopping it, or snooze it until a chosen time. Every action has Undo, and a bulk bar acts on several rows at once. Conversations settle themselves after 3 days with no activity; change or turn this off in Settings → Conversations or with pan conv auto-settle-idle-days <days> (0 turns it off). (#4709, #4793)
• Cite selected text: select text in an agent’s reply, or in a markdown preview in the editor pane, click Cite, add a comment, and the quote goes out with your next prompt. (#4667, #4795)
• pan diagnose: collects a redacted diagnostic bundle and, after you confirm, starts Claude Code or Codex in it to find and fix the problem. It works when the dashboard, the supervisor or Herdr is down. pan doctor --json is new as well. (#4676)
• Open file links in a browser: right-clicking a file link offers Open in browser and an item for each browser installed on this machine. (#4765)
• New models: Kimi K3.1 Pro and K3.1 Pro Highspeed on the Claude Code, Kimi Code CLI and ACP routes; Highspeed needs a Kimi Code Allegretto (Pro) plan or higher. Also added as opt-in models: OpenAI gpt-6-rosalind (limited to OpenAI’s trusted-access program) and gpt-6-astra-law on the Codex route, gemini-3.6-flash, glm-5.3-flash and glm-5.3-flashx, Mistral Large 4, xAI grok-4.7 and grok-4.3, MiniMax-M3.1-Flash and the MiMo V2.6 series. (#4816, #4855, #4856, #4858)

Improved

• Model catalog refresh: prices for OpenAI, Gemini, Qwen and GLM models now match the providers’ published rates, and model ids the providers retired (older MiMo, Groq, Cerebras, Gemini and Qwen ids) are replaced with live ones. claude-sonnet-4-5 is no longer offered for new selections; existing selections still migrate to claude-sonnet-4-6. kimi-code/kimi-for-coding now points at K2.8 Preview. (#4855, #4856, #4858)
• Auto-settle on merge replaces auto-archive on merge: when a conversation’s linked PR merges or closes, the conversation is now settled instead of archived, so it stays one click away. The pan conv auto-archive-on-merge command is gone; use pan conv auto-settle-on-merge [on|off], the Settings → Conversations switch, or the per-conversation override in the row and tab menus. (#4787)
• Fly remote workspaces: automatic reap, the host heartbeat and credential refresh for pan start --remote agents run again, and Overdeck no longer copies your SSH keys to the VM. When flyctl’s stored token goes stale, Overdeck refreshes it and retries once, and pan doctor has a Fly token row. (#4713, #4796, #4848)
• Dialogs: dialogs now sit on a shared modal that rises above the page, and the New conversation dialog is laid out in clear sections. The decision dialog renders the question as markdown with its context in a separate block, traps focus, and supports Esc, Cmd/Ctrl+Enter and number keys. (#4770, #4766)
• Skills page: skills are grouped by origin (Core, Overdeck, Personal, Project) under collapsible headers that show how many are on, packs use the same groups, and search opens only the groups that hold a match. (a443ff0)
• Issue links in conversations open the issue drawer: clicking an issue link in a transcript opens the issue’s drawer instead of a new browser tab, including for issues the dashboard has not loaded, such as closed ones. (#4716, #4721)
• Stop and archive show progress on the row: a conversation being stopped or archived dims, shows Stopping… or Archiving…, and cannot be acted on twice. (#4684)
• Flywheel NEEDS YOU banner: clicking it reopens the pending question, or jumps to the tick that raised it. (#4764)
• pan review request reports refusals: when Overdeck cannot adopt a PR into a pipeline workspace (for example, its branch is checked out in another worktree), the command now refuses at once with the reason instead of answering “queued”. A refusal found later is posted as a PR comment. (#4790)
• Faster dashboard snapshots: per-issue cost totals are now kept up to date as costs are recorded, so the dashboard no longer re-adds every cost event (about 1.5 s on a large history) every 15 seconds. (#4729)
• Docs and internal work: a dedicated Skill packs page and a pan skills CLI reference; CI flake fixes, test infrastructure, and follow-ups to code review findings. (#4768, #4703, #4704, #4725, #4736, #4761, #4771, #4808, #4692, #4798)

Fixed

• Traefik no longer listens on your network: the Traefik template published ports 80, 443 and 8080 on every interface, so a client on your LAN could reach the dashboard through Traefik and, with a forged Host header, get a dashboard session. Traefik now binds to 127.0.0.1, and pan install, pan sync, pan up and pan dev migrate an existing compose file. The dashboard also rejects a forwarded non-local client. To publish on every interface on purpose, set bind = "all" under [traefik] in ~/.overdeck/config.toml; pan doctor warns when Traefik is published on every interface. (#4662, #4695)
• The dashboard loads after a restart: requests that arrived while the dashboard was still starting were never answered, which could fill the browser’s connection limit and leave the dashboard unreachable until the tab closed. They now wait for startup, or get a 503 if it takes too long. (#4637, #4695)
• Herdr terminals connect when started through npx: a dashboard started with npx could not find herdr in ~/.local/bin, so every terminal view looped on “Connection lost”. (#4631)
• pan pair and other CLI calls work after an npx launch: agent panes could hold a stale internal token and get rejected. The token file is now read first, and a mismatch is explained in the 401 message. (#4687)
• Merge train rebases siblings after every merge: approved PRs in a merge train were never rebased after a merge, because no merge door ran the train reconcile. Every merge now does. (#4802)
• A push after approval gets a new review: a PR whose approval went stale after a push sat “approved and green” without merging. The auto-merge scheduler now re-requests review for the new head once, and logs why it skipped a PR. (#4783)
• Verification checks the PR head: verification merged main into the workspace as it stood, so a PR that received commits from elsewhere (a handoff worktree, a merge-train rebase, a GitHub suggestion) was verified on the wrong tree and never reached review. The workspace now moves to the PR head first. (#4814)
• Adopted PRs can be reviewed: a PR adopted from outside a pipeline workspace has no xBRIEF, and verification always failed it on incomplete plan items. The plan checklist is now skipped for adopted workspaces. (#4794)
• Operator-started strike PRs merge: the strike merge door required an approval at head that strike PRs never get. An operator-started strike now merges once every other gate passes. (#4780)
• What to UAT lists each member’s criteria: the merge train’s checklist read plans from main, where unmerged features have none. It now reads them from the feature branches. (#4804)
• Close-out no longer reports a missing PR on a failed read: a transient error reading the PR was reported as “no pull request found”. Close-out now retries once and reports the read failure. (#4854)
• Flywheel strike rows: strike workspaces showed as separate PAN-<n>-STRIKE issues with “tracker unknown”. They now fold onto their issue’s row with a strike badge. (#4763)
• Simple issue page actions work: every simple-mode action failed with “Invalid CSRF token”, and the page offered Start work while the work agent was already running. (#4712)
• Workspace stacks use one Docker network each: each workspace stack used two Docker subnets, because the init-perms service had no network and Compose added an empty default network. (#4711)
• Fly remote setup: the default image registry.fly.io/pan-workspace:latest did not exist; the default now comes from your Fly app. A failed pan start --remote setup now deletes the VM it created, and --remote finds an issue’s existing plan instead of planning it again. (#4781, #4789, #4788)
• pan project add proposes a valid issue prefix: it could propose a prefix with digits, which issue ids cannot use. Prefixes are now letters only. (#4865)
• Command palette search: the palette showed “No results” while a newer search was still loading. (990c96d)
• Order-book chips in tree rows: the chip no longer covers the issue id. (312f4f2)

New

• GPT-6.1 Terra: OpenAI’s gpt-6.1-terra is in the OpenAI provider, the model pickers and the cost tables ($1/M input, $0.05/M cached input, $5/M output, 1.05M context, 128K output), with the 272K Codex context limit applied. It is opt-in; defaults are unchanged. Under ChatGPT sign-in it needs Codex CLI 0.159.0 or newer, and Overdeck refuses the launch on older versions with the upgrade command. It runs on the Codex harness; the Claude Code route through CLIProxy does not serve it yet (PAN-4634). (#4633)

New

• Open containing folder: right-click a file chip in a conversation and choose Open containing folder to open the file’s folder with the file selected. macOS uses open -R, Windows uses explorer /select,, and Linux asks the file manager to select the file over D-Bus (Nautilus, Dolphin, Nemo, Caja and Thunar support this). On Linux, when no file manager answers, the parent folder opens instead. The item appears on markdown and non-markdown chips.

Improved

• CI failure feedback names the failing test: when a PR’s CI test job fails, the feedback sent to the work agent now comes from the failing check runs, so it can name the failing shard while the rest of the workflow is still running. It includes an excerpt of the job log from the first Vitest FAIL line to the test summary. Aggregate jobs that only repeat a shard’s failure are left out. When no job log becomes available within about two minutes, the feedback still lists each failing check with its log command and URL. (PAN-4534, #4613)
• Conversation search banner sets up the OpenAI key in one click: the banner shown when conversation search has no OpenAI key now has a short title, an explanation, and an Add OpenAI key button. The button opens Settings → Providers with the OpenAI row expanded and its key field focused. The banner used to point at a Settings section that does not exist.

New

• Opt-in Semgrep install (phase 1): set security.semgrep.enabled: true in ~/.overdeck/config.yaml and pan sync or pan install installs a pinned Semgrep 1.180.0 once per machine, through uv (or pipx), into ~/.overdeck/tools/semgrep/. pan doctor then reports whether it is installed at the pinned version and whether semgrep.dev is reachable; with the feature off it prints nothing. Your own Semgrep install is never touched, and a repo-committed .pan.yaml cannot turn the feature on. This release only installs and checks Semgrep; scans in verification and review come later. See Semgrep. (PAN-4585, #4611)
• Dagger Cloud and other commit-status CI count as the test job: the CI test gate (verification.tests: ci) used to recognize only GitHub check runs, so a project whose CI reports through commit statuses never had a passing test job and could not merge. Dagger Cloud test checks are now recognized from their commit status, in the merge gate, the default-branch test baseline and the Command Deck checks state. When one fails, the agent’s feedback names the check path, links to dagger.cloud and gives the command to rerun just that check. Set verification.tests: ci for a Dagger Cloud project; auto-detection names dagger.toml in its reason but does not switch modes on its own. (PAN-4589, #4604)

Improved

• Two quality gates can run at once: the machine-wide CPU admission queue for verification gates and local Vitest runs had one slot, so PRs could wait an hour or more on an idle machine. The new resources.quality_gate_slots setting (default 2, from 1 to 16, read from ~/.overdeck/config.yaml only) allows that many at once. A gate still starts only while CPU is unpressured, and running gates are never preempted. A queued worker could also wait forever when another poller deleted its half-written ticket; tickets are now written atomically and a waiter recreates a missing ticket without losing its place. (PAN-4546, #4617)
• Verification stops as soon as the result is decided: a verification run used to finish every local gate (often 25 minutes or more, holding the CPU admission slot) before failing on a head whose CI test job had already failed. It now checks before each gate and stops early when CI is already red for that head, the PR has merged, or the agent has pushed a newer commit. A run stopped by a newer commit restarts on the new head. (PAN-4531, #4608)
• Verification survives a dashboard restart: a verification worker kept running across a dashboard restart, but its result was never used, so no reviewer was dispatched and the next review request re-ran every gate. The dashboard now re-attaches to running workers at startup and dispatches review when they finish, and a review request on the same head uses an unclaimed finished result instead of starting over. Workers started before this release are not re-attached on the first restart after you upgrade. (PAN-4532, #4602)
• PRs opened outside a pipeline workspace enter the pipeline: a feature/<issue> PR pushed from a plain git worktree (for example a pan handoff --cwd conversation) was never verified or reviewed, and nobody was told. Overdeck now creates the issue’s workspace at the PR head and starts review. When it cannot (the branch is checked out in another worktree, the local branch has diverged, or the project is polyrepo), Command Deck shows the PR under Needs you with the fix, and pan show prints it. Adoption never pushes, forces or deletes anything. Also, pan workspace create now checks out an existing remote feature branch instead of cutting a new one from main. (PAN-4605, #4620)
• Main-branch CI status looks past commits with no CI run: when a repository skips CI for some pushes to main (for example .pan/ bookkeeping commits), the Command Deck CI chip, the default-branch test baseline and the close-out check now use the newest run that finished green or red, instead of reporting unknown or giving up on a commit that has no run. (PAN-4618, #4621)
• The editor pane opens markdown anywhere in your home directory: a .md file outside every registered project used to fail with “Path is outside the allowed project roots”. Markdown files under your home directory now open read-only, with a note, and editing and saving stay limited to registered projects and OVERDECK_HOME. (PAN-4583, #4587)
• Archiving a conversation shows progress: after you confirm Archive, the row, the tab menu and the conversation header show it is archiving and the action cannot run twice. A toast confirms success, and a failure shows the server’s error and leaves the conversation in place. All three entry points behave the same way. (PAN-4584, #4588)

Fixed

• Merge-train batches assemble again: no UAT batch had assembled since 2026-09-20, because three old failed assemblies kept the reconciler’s failure cutoff closed for good. Only failures from the last 6 hours now count, so batches assemble again once the cause is fixed. The Flywheel UAT card also gives each ready feature its own Merge button while no tested batch exists, names a failed assembly with a Retry batch assembly button, and no longer says a batch “assembles automatically” when none will. (PAN-4598, #4603)
• Approved PRs stay on Awaiting Merge: an approved, green, mergeable PR that was not opted into auto-merge showed as ready for only 5 minutes after some other merge, then disappeared from Awaiting Merge and lost the issue view’s Merge to main. The approval is now refreshed in the background, so the PR stays listed until it merges, its head moves or a check goes red. (PAN-4597, #4607)
• Auto-merge no longer strands approved, green PRs: when the merge gate refused a scheduled auto-merge at the last moment, before any merge ran, the row was recorded as a failed merge. A failed row is never retried at the same head, so the PR waited for a manual merge or a new commit. A refusal is now recorded as blocked and auto-merge tries again once the gate passes. The gate also stopped reporting “not approved at PR HEAD” when GitHub had not yet worked out whether the PR is mergeable: it now gives that reason instead, and re-reads mergeability once, 3 seconds later, before deciding. Rows that already ended as failed are not changed. (PAN-4540, #4612)
• A re-review checks the new head: a review request after a fix push could join a verification worker still running on the previous commit and fail the new commit with the old commit’s CI result, costing an attempt. A worker is now joined only for the same head (or its own sync merge with the target branch); otherwise it is stopped and a fresh one starts on the new head. (PAN-4527, #4599)
• Herdr conversation terminals are no longer blank: every agent in a Herdr workspace split the same tab, so after a few conversations a new one got a one-row terminal and the Terminal tab showed nothing. Each agent now opens in its own tab, sized to that tab. The first dashboard viewer controls the terminal and later viewers are read-only. Idle shell panes left behind by a Herdr restore are cleaned up automatically. (PAN-4582, #4600)
• pan show --health no longer calls working Herdr agents stuck: the CLI health check could not see the agent’s transcript activity, so on Herdr every agent older than 30 minutes showed as STUCK. It now reads the transcript heartbeat like the dashboard does. (PAN-4595, #4601)
• Held handoffs show what they are waiting for: a pan handoff --hold conversation whose session ended before its kickoff was sent showed “This conversation has no saved history”. It now shows “Held handoff — kickoff not sent” with the focus, working directory and handoff doc, and a Start button that sends the kickoff. Held handoffs also appear in Needs you. (PAN-4596, #4606)

Documentation

• What verification runs and why it is slow: the Pipeline Gates guide now lists each step of a verification run in order, explains the CPU admission queue and why logged gate times include queue wait, and advises which local gates to keep when CI already runs the same checks. Projects configuration documents every quality_gates key. (PAN-4609, #4615)

New

• Curated memory in the repository: short, reviewable facts (working agreements, corrections, non-obvious project facts) now live in <planHome>/.overdeck/memory/<id>.md and are committed with the code, so they reach every machine with a normal git pull. Every managed session gets an index of them at launch, whichever harness it runs, and the Context page preview shows the same sections. Use pan memory add, edit, show, list and retire to manage them; pan memory search lists matching facts before observations. A fact that contains a secret or a home-directory path is refused, and pan done refuses to finish with an uncommitted fact. See Project memory. (#4579)
• Operator memory syncs across machines: facts about you (--user) live in ~/.overdeck/context/memory/, and pan memory sync --setup <git-url> turns that folder into a clone of a private repository you own. After setup, pan memory sync, pan sync, the dashboard (every 15 minutes) and each --user write keep it in sync. When two machines change the same fact, your copy is kept as <id>-conflict-<machine> for review and is not injected. Facts that are true on one machine only go in the new machine store (--machine), which never syncs. (#4581)
• Fresh-start handoffs: pan handoff --fresh and the dashboard’s Fresh start option start a clean conversation with no transcript, summary or parent link. Optional focus text becomes the first message. (#4569)
• Gemini 4 Argon: gemini-4-argon, generally available from Google since 2026-10-13, is in the model pickers, the model catalog and cost tracking. It has a 1,048,576-token window and low, medium and high thinking. Cost tracking uses Google’s introductory rates through 2026-11-30: $2.00 input, $0.10 cached input and $10.00 output per MTok.

Improved

• Long conversations open faster: opening a conversation loads the most recent window of history instead of the whole transcript, and older messages load as you scroll up or jump to them. Large tool results show a preview with their size and load in full on demand. Exports still contain the complete transcript. (#4574)
• Smoother dashboard under heavy activity: the dashboard re-renders less while many agents stream events, and reconnecting after a long gap catches up from a snapshot instead of replaying every missed event on the main thread. (#4573, #4571)

Fixed

• Copy works again in the terminal view: dragging to select text in a Herdr pane selected nothing, so Copy never appeared and Ctrl+C had nothing to copy. Plain drags select again; Shift is forced only while the app in the pane captures the mouse.
• Multi-line paste arrives as one paste: a Herdr terminal attach lost the pane’s bracketed-paste mode, so pasted newlines reached the agent as separate Enter presses. The mode is now restored on attach, and keyboard and context-menu paste send one bracketed block. (#4580)
• A merge no longer fails on a duplicate PR: when the lookup for a branch’s open PR failed briefly, the merge tried to open a second PR and stopped with “Failed to create PR”. It now reuses the existing PR.
• Herdr shows Claude Code agents as agents: Claude Code launchers now run as their own foreground job, so Herdr detects the agent in the pane and reports its status.

New

• Muse Wonder: muse-wonder-1.0, Meta’s frontier model released on 2026-10-12, is in the model pickers, the model catalog and cost tracking. It runs on the Muse Code harness like Muse Spark, with a 1M-token context, and costs $4.00 input, $0.20 cached input and $20.00 output per MTok. Enable Meta (Muse) in Settings → Providers to choose it. Muse Wonder Full is not supported yet: Meta offers it only on the Muse Code Power Usage and Maximum Usage plans and has not published its model ID.

New

• Claude Haiku 5.5: claude-haiku-5-5, released by Anthropic on 2026-10-07, is in the model pickers, the model catalog and cost tracking. It has a 1M-token context, 128K output and adaptive thinking (default effort medium). Cost tracking applies its tiered pricing: $0.10 / $0.50 per MTok in/out for prompts up to 100K tokens, and five times that above 100K. Launching it needs Claude Code 2.1.293 or newer; Overdeck refuses the launch on an older CLI and says so. The built-in cheap and background defaults still use Haiku 4.5.

Fixed

• The configured Claude model is the one that launches: the Command Deck status review and the planner relaunch that delivers a dashboard message passed the short opus and haiku aliases to Claude Code for Opus 4.8, 4.7, 4.6 and Haiku 4.5. Current Claude Code resolves those aliases to Opus 5.5 and Haiku 5.5, so those two paths could run a newer model than configured. Every model now launches by its full ID. Regular agent launches (work, plan, review, Flywheel) always passed the full ID and were not affected.
• Default expensive model is Opus 5.5: the built-in default for the expensive workhorse (plan, review, strike, sequencer, knowledge) and the Flywheel moves from claude-opus-4-8 to claude-opus-5-5, matching the eval-backed Anthropic defaults preset. Opus 5.5 is also cheaper ($4 / $20 per MTok against $5 / $25). Installs that set these models explicitly keep their setting; installs on the built-in defaults now run Opus 5.5 for these roles.
• Sonnet 5.5 cache reads cost $0.10 per MTok, matching Anthropic’s 2026-10-07 price cut.
• Starting the Flywheel again works: pan flywheel start --fresh and the Flywheel page’s Start failed with “FOREIGN KEY constraint failed” once the previous Flywheel conversation had a handed-off successor. The old conversation is now kept under a retired name and archived instead of deleted.
• Workspaces rail: a project’s main checkout no longer appears as an anonymous “main” row in the sidebar’s Workspaces list (it only appeared for some projects). Each project’s Home has a Main checkout button next to Terminal and Web that opens it, creating its workspace the first time. Favorite a main checkout to keep it in the rail, where it shows under the project’s name; Cmd-K lists every main checkout by project name.

Fixed

• Projects find their GitHub tracker themselves: a project registered without tracker, github_repo or issue_prefix used to show “No tracker configured … set tracker: or issue_prefix: in projects.yaml” and an empty Issues panel. When the project’s origin remote is on GitHub, the dashboard (at startup), pan sync and project setup now write github_repo: owner/repo into ~/.overdeck/projects.yaml and log what they set. Projects with no GitHub origin still show the message, which now names github_repo: or tracker: instead of issue_prefix:.
• First message to a new conversation is no longer refused: a Claude Code conversation started in a directory Claude Code had never trusted stopped at the “Do you trust the files in this folder?” dialog, and Herdr refused the first message with agent_blocked. Conversation launches are now pre-trusted like issue agents, and ~/.claude.json is created if it does not exist yet. When an agent is waiting at a dialog for any other reason, the delivery error now quotes the dialog and tells you to answer it in the Terminal tab.
• The Codex authentication banner clears after codex login: signing in with codex login in your own terminal refreshed ~/.codex/auth.json, but the banner kept showing “expired” from CLIProxy’s stale copy until the dashboard restarted. The status check now re-copies the newer credentials first. An access token that has lapsed but still has a refresh token no longer counts as expired, because Codex and CLIProxy refresh it on next use, so it no longer blocks Codex spawns either. The banner now names which copy (~/.codex or the CLIProxy copy) is bad.

New

• Scoped API tokens: pan token create <name> --scopes <list> creates a bearer token (odk_…) that a program such as an event sidecar or a notifier can use instead of a full device session. The scopes are read:events, read:state, read:conversations, tell, operate and admin; a request outside them gets 403 with insufficient_scope. The token is printed once, works over HTTP, the event stream and WebSocket upgrades, and can never create a session, a pairing credential or another token. pan token list shows tokens and pan token revoke <id> closes a token’s live connections at once. See Remote access. (#4441)
• Access tokens in Settings: Settings → Access Tokens lists tokens with their scopes and times, creates one and shows it once with a Copy button, and revokes one after a confirmation. A browser signed in as a paired device can see the list but cannot create or revoke. The same section has Require a token to sign in, which turns on dashboard.require_token_mint at once, with no restart. (#4450)
• Pair a device from the dashboard: Settings → Anywhere has Pair a device, which makes a pairing link and QR code for an address you pick, and can add a new address to the trusted origins with no restart (stored in ~/.overdeck/trusted-origins.json). Only a browser on the machine itself can make links or add addresses. The section lists paired devices with Revoke, and an Anywhere status card, also on the Health page, shows this machine’s label, the addresses it is reachable at, the number of paired devices and the Session Vault state, with a fix for each problem. (#4449)
• Session Vault in the dashboard: with the dashboard running, conversations started from it are saved to the vault 30 seconds after they go quiet and synced every 5 minutes, with no hook. Settings → Session Vault shows the backend, the last sync, any blocked lines with the pan vault allow-secret command, the machines that have synced, and the transcripts waiting for deletion, which you can review and delete there (#4444). The same section now sets up a new vault (a dialog shows the recovery phrase, and any generated passphrase, once), joins an existing vault with the passphrase or the recovery phrase, unlocks a machine whose key is missing or was rotated, and has Sync now. Only the Claude Code Stop hook still needs pan vault setup --hooks (#4461).
• Conversations from your other machines: Claude Code and Codex conversations saved to the vault by another machine appear in the conversation list marked “from <machine>”. They are read-only copies; the composer shows the pan vault resume <id> command instead of an input. (#4448)
• Continue here: a read-only copy has a Continue here button that adopts the conversation on this machine and opens it. It shows where it will continue and the code snapshot it will apply, asks how to proceed when the directory’s branch, commit or dirty state differs, offers to clone and register the project when no registered project matches, and puts the code snapshot in a new workspace when the checkout has uncommitted changes. If another machine continued it first, it says so and changes nothing. (#4454)
• Continue on another device: a conversation’s ⋮ menu (in its header or on its row) has Continue on another device. Open on another screen shows a link to the conversation, a Copy button and a QR code, offers only trusted addresses other devices can reach, and in a browser on this machine can add a one-time pairing credential so an unpaired device pairs and opens the conversation in one step. Hand off to another machine saves the conversation and its code snapshot to the vault right away and says which version to continue; a running conversation then shows Keep working here and Stop this session. A line that looks like a credential blocks the save and the dialog names the pan vault allow-secret command. On the receiving machine, Check for new conversations in a vault row’s menu syncs at once. Hand-off works for Claude Code and Codex conversations. (#4472)
• Model presets: Settings → Model Routing has Apply Anthropic defaults, Apply Anthropic cost-saver (pilot) and Apply OpenAI defaults, and the CLI has pan models preset list|show|apply|undo. A preset sets the workhorse slots, roles, review lanes, existing tiers, default conversation model and background models to one provider’s lineup in one step. Before applying you see every setting that will change, before and after, and the ones the preset leaves alone. Only those settings are written into ~/.overdeck/config.yaml; comments and other lines keep their text. The whole preset is blocked when the provider has no credentials or its harness CLI is not installed. Undo restores the values the last apply replaced, except settings you changed since. The Anthropic presets cite the 2026-09-29 eval run; the OpenAI preset is research-backed and not yet eval-tested in Overdeck. A newer preset version is shown for review and never applied automatically. See Model presets. (#4412)
• Operator decisions: a work agent that cannot continue without your decision runs pan ask <issue> "<question>" --option <a> --option <b> (2 to 4 options, optional --context). The issue moves to Needs you with the question and its options, and God View marks it on the shelf. Answering from the dashboard, or any message delivered to that agent from the dashboard or pan tell, closes the question; pan ask <issue> --withdraw withdraws it. Work agents are told to use it for blocking questions. (#4387)
• Effort for conversations: the Home composer and the Command Deck sidebar have an effort picker next to the model picker, with the levels the model supports. pan handoff and pan fork take --effort <level>; without it the new conversation inherits its source’s effort, clamped to the new model, and switch-model keeps the effort the same way (#4489). Changing the level in a running Claude Code conversation or agent sends /effort and keeps the new level only after Claude Code confirms it in the transcript; a session that is mid-turn or waiting on a permission prompt is refused. The picker now shows the effective level and where it came from, such as High · default or Low · set, instead of “Effort unverified”, and terminal when someone ran /effort in the native CLI. Claude Code also saves low through xhigh as the default for your own new claude sessions of that model in ~/.claude/settings.json (#4495).
• New conversation with options: the + in the Command Deck header is now a split button. The + still creates a conversation at once; the caret beside it, and a command palette action, open New conversation with options…, which sets the project, a working directory inside it, model, harness, effort (with the default’s source shown), context, skills, a linked issue and an optional first message for that one conversation. Skill choices there are stored on the conversation and apply at every launch, resume, restart and fork, ahead of issue, project and global settings (#4491). The Skills field shows each skill’s description, filters by name or description, and groups skills into collapsible sections (Project skills, Overdeck, Personal, and one per pack) with on counts (#4537).
• Compare any two refs: the diff panel has a Compare… view that diffs any two branches, tags or commits of the conversation’s repository, with no remote or pull request needed. Choose A..B for every difference or A…B for the head’s changes since the two diverged. The selection is kept in the URL, so a popped-out comparison can be bookmarked. An ignore whitespace toggle in the panel header hides re-indented and re-spaced lines in every view and is remembered per browser. (#4505)
• Conversation bookmarks: click the icon beside a user or assistant message to bookmark it; click it again to rename or remove the bookmark. The Bookmarks header button lists them, and clicking one scrolls to that message and outlines it. Bookmarks survive reloads and new messages, are never written into the agent’s transcript, and are not copied by a handoff or fork. A conversation holds up to 500. (#4521)
• Handoff options: pan handoff --skill <name> and --pack <id> turn skills or a cached skill pack on for the new conversation only. pan handoff --hold creates and launches the new conversation without sending the kickoff; its dashboard composer shows the kickoff text, which you can edit and send, or you can run pan handoff start <conv>. A held kickoff is sent once. (#4502)
• Blocker wake: pan task block <issue> <item> --on <ref>... records which issues or PRs must merge first (an issue ID, #N, owner/repo#N or a PR URL). Within about two minutes of the last of them merging, the dashboard sends the issue’s work agent one BLOCKERS MERGED message telling it to sync with main and unblock the item, or raises Needs you once if the agent cannot be reached. Set OVERDECK_DISABLE_BLOCKER_WAKE=1 to turn it off. (#4452)
• Deft Directive profile: add the deft pack with pan skills pack add deft https://github.com/eltmon/directive --ref <ref> and turn it on to mount seven read-only Deft skills that need no Deft engine. Each carries a notice telling the agent not to run Deft’s CLIs, install packages or change git hooks, and outside a Directive project Claude Code launches also deny those commands. In a project that already uses Deft Directive, pan skills deft status|enable|disable --project <key> shows who owns each concern and stores managed mode, where Overdeck owns worktrees, review and merge; turning the pack off at the issue or project level hides the project’s Deft pointer skills and writes Deft’s own .deft-directive-disable flag in issue worktrees, which Deft engines from v0.92.0 honor. Overdeck never runs a Deft CLI or writes a tracked file in your project. See Skills. (#4428)
• SageOx pack (off by default): the sageox pack records Claude Code sessions with SageOx, using an ox you build from the eltmon/ox fork. That build writes nothing into your repository, adds no attribution to commits or PRs, and stays offline unless Overdeck allows the network. With uploads off, the default, nothing leaves the machine; pan skills pack sageox upload on --project <key> uploads redacted session transcripts to the SageOx cloud ledger, and pan skills pack sageox status shows each project’s state. If ox or the repository’s .sageox/ is missing, the launch continues without SageOx and prints a warning. Codex launches never get it. pan doctor has a SageOx row while the pack is registered. See Skills. (#4430)

Improved

• Effort across agent launches: an agent keeps its effort across resume, restart, crash recovery, session rotation, crash respawn and model handoff, clamped to the relaunch’s model; a later roles.<role>.effort change reaches new spawns only (#4488). The review parent, test dispatch, Flywheel and remote Fly work agents launch at their roles.<role>.effort, and pan worker run and pan spawn take --effort <level> (#4536). pan plan --effort accepts all five levels, the Plan dialog offers them and defaults to high, and the planning prompt no longer calls xhigh or max low effort (#4518). Tier slots launch at their crew’s effort unless you pass --effort, and Settings has an Effort select per tiered-execution crew and per review sub-role (#4520). Kimi K3 accepts all five levels (Medium launches as High, Extra High as Max), Pi and Muse send xhigh for max, and a launch with no resolved effort now fails instead of falling back to the harness’s own default (#4533). Each new sessions.json entry and cost-ledger row records its effort, pan cost effort [--issue <id>] [--json] groups spend by effort, and the Agents page, pan status and pan show show an agent’s effort and its source (#4526).
• Find a conversation by its title: Cmd+K conversation results are one row per conversation, labelled by its title, with the best-matching excerpt and a hit count. Title matches rank first, then matches in message text, then matches only in paths, code or tool output. Archived conversations are included and marked, and title matching works even when conversation search indexing is off. (#4375)
• PR badges on issue rows: an issue’s row in the Command Deck project tree and in the sidebar Workspaces rail shows its PR number, colored by state and review, with × for failing checks, within seconds of pan done opening the PR. Operator conversations working inside the issue’s workspace get the PR link too, and in a project’s main checkout a conversation is linked by branch only while its terminal is running. (#4463)
• Conversation targets for agent commands: pan tell, pan pause, pan unpause, pan untroubled and pan kill accept conv/2972, conv:2972 or a dashboard conversation URL as well as an issue or agent ID. A bare number that matches both an issue agent and a conversation is refused with every candidate listed. (#4468)
• One-click Linear sign-in: the Linear authentication banner has one Connect Linear button. It opens the authorization link, asking a blocked agent for a fresh one when the last link expired, checks access when you return to the dashboard tab (or with Check now), and resumes every blocked agent. Blocked-agent rows link to their conversation or issue. Pasting the callback URL is now a fallback, open by default only when the dashboard is not on a loopback address. (#4469)
• Continued-on markers: after a conversation continues on another machine, its row and composer on the first machine read “Continued on <machine>” with a link to the other copy. Turns typed there afterwards are saved as a separate fork, and the composer names the fork’s id. (#4462)
• Jev settings in the dashboard: Settings → Background AI sets the Jev route (OpenCode Zen or TypeSafe direct), model and timeout, saving as you edit with no restart, and refuses to turn a Jev toggle on while no model is set. Under each toggle it shows calls in the last 24 hours, the last call time and the last error, from a usage log in ~/.overdeck/jev/usage/ that never records the API key, the text sent or the answer. (#4524)
• Silent reviewers are recovered: a reviewer that was dispatched but wrote nothing for roles.review.stallMinutes (default 15) is stopped and dispatched again once per run; if it is still silent, the issue goes to Needs you. pan show lists these as review.stalled and review.stall-escalated. (#4440)
• Click an image thumbnail in the composer, or under a sent message, to view the image full size. (#4496)
• Idle dashboard terminals stay connected behind proxies with idle timeouts of 30 seconds or more, because the terminal WebSocket now exchanges a heartbeat every 20 seconds. Programmatic clients opt in with ?heartbeat=1. (#4458)

Changed

• TLDR removed: the TLDR Read hook, its index daemon, the pan admin tldr and pan status --tldr commands, the Health and Metrics TLDR panel, the Settings toggle and the pan-tldr/pan-admin-tldr skills are gone. A 14-day audit of 2,071 agent transcripts found 282 reads the hook replaced with an outline. Within the next 8 tool calls, 74.5% re-read the file with offset/limit, 13.8% read it through Bash, 3.9% re-read it in full, and only 7.8% worked from the outline, so each denial cost an extra model turn instead of saving tokens. New workspaces no longer install a ~1.5 GB Python venv or start a daemon, and creating a workspace now refuses to run with under 10 GiB free. pan sync and pan install unregister the two hooks from ~/.claude/settings.json (and from workspace-local .claude/settings.json copies) before deleting their scripts, and the dashboard stops leftover daemons when it starts. Leftover .venv and .tldr/ directories are not deleted; pan sync tells you when some exist. An agents.tldr key in config.yaml is ignored and dropped on the next Settings save. Restart agents started before the upgrade so their sessions stop loading the old hooks. (#4431)
• The diff panel’s vs main view, for conversations and agents, now compares committed changes against the project’s configured default branch, so a project on master or trunk gets a correct view, and All turns and vs main list the changed files. A popped-out vs main link from before the upgrade shows this new comparison. (#4504)
• The sidebar’s context checkboxes are gone; choose a conversation’s context in New conversation with options… instead. (#4491)
• The mattpocock skill pack’s default source is now the fork eltmon/skills, pinned at v1.2.3, so upstream changes arrive when the fork is synced and you re-pin with pan skills pack update mattpocock --ref <tag>. Adding the pack still turns nothing on, and setup-matt-pocock-skills stays opt-in. (#4427)
• The GitHub issue poller backs off while nothing changes: each unchanged poll doubles the interval from 30 seconds up to 5 minutes. A changed poll, the Refresh button, a cache clear, loading the issue list or a GitHub issues webhook returns it to 30 seconds. Subscribe your GitHub App to Issues events, or an issue edited on GitHub can take up to 5 minutes to appear. /api/cache-status reports the reason for the current interval. (#4516)
• An agent’s AskUserQuestion call that is empty, a placeholder or a status update is rejected before it reaches you, so only real decisions open a dialog. Work agents are told they may end their turn to wait for background work. (#4519)

Fixed

• Permission prompts with long commands: a Claude Code permission prompt taller than the conversation’s terminal can now be answered from the dashboard; it used to show in Needs you with no buttons. Needs you shows the command and the next step, and Open terminal opens the conversation’s terminal. (#4471)
• Conflict repair reaches more PRs: an approved PR that turns conflicting is repaired without waiting for CI, which GitHub never runs on a conflicting PR (#4452), and a PR approved at an older commit is repaired too and re-reviewed at its new head (#4470). The merge gate is unchanged: the repaired head still needs green CI and an approval at that head.
• CI test failures reach the work agent: a red CI test job now sends its failure to the issue’s work agent, including when GitHub’s check event lists no pull request; before, the relay never fired and the PR sat. A CI failure message the agent does not accept raises Needs you. (#4442)
• Test-removal waiver is back: pan review waive-test-removal <id> --reason "…", or the waiver control under a failed test-skip gate in the dashboard’s Test/Lint panel, lets you approve a deliberate test removal for the current head. Nothing could grant one since pan verify waive-test-removal was removed. The waiver is stored untracked in the workspace, so granting it changes no file in git, and the command refuses agents, including the Flywheel. Run pan review request <id> afterwards. (#4443)
• God View: after a dashboard restart, busy issues no longer show as frozen “1h idle” (#4538). The shelf and Doldrums labels no longer overprint, the shelf shows at most 8 orbs, merged issues waiting only for close-out leave through MERGE instead of sticking on the shelf, and the PLAN, REVIEW and TEST counts include only live agents (#4539).
• A review whose kickoff text contained a split emoji was rejected by Herdr, so the reviewer never started and was dispatched again forever. Overdeck now sends well-formed text, and a kickoff the backend rejects goes to Needs you. (#4517)
• A composer message to Claude Code on Herdr sometimes sat in the input box without being submitted. Overdeck now waits for the paste to show, presses Enter, and presses it once more if the message is still there and no menu or prompt is on screen. (#4494)
• After /clear in a conversation, the old row and the new one shared one terminal session, so listing revived the old row and stop or resume acted on both. The newest conversation now owns the session: stop and resume on the old row act on it, deleting or archiving the old row stops nothing, and prompts can no longer be answered from the old row. (#4490)
• Idle Claude Code conversations no longer jump to the top of Chats as “active just now” every hour; a row’s last activity is now its last message, not the transcript file’s modified time. (#4525)
• Conversation timeline rows no longer overlap when you scroll back through a long conversation, resize the window or toggle tool calls. (#4500)
• pan close no longer refuses an issue that landed and deployed. A verification run cut short by the merge is recorded as skipped instead of left running, and shown muted in the dashboard; the verification check passes when the work landed and main verification passed; and the deploy check retries the dashboard health probe 3 times before reporting it unreachable. (#4545)

New

• GPT-6.1 Sol: OpenAI’s gpt-6.1-sol is in the model pickers, the Settings catalog and the cost tables ($2/M input, $0.10/M cached input, $10/M output, 1.05M context, 128K output). It is selectable only; no default or tier mapping changed. On the Codex harness with a ChatGPT login it needs Codex CLI 0.159.0 or newer, because older Codex gets a 400 from OpenAI for this model. Overdeck refuses the launch below that version and names the upgrade command (npm install -g @openai/codex). (#4423)
• Session Vault: pan vault saves your agents’ conversations, encrypted on your machine, into a private git repository you own, and lets another machine continue them. pan vault setup <git-url> creates the vault and prints a 24-word recovery phrase once; pan vault join <git-url> adds another machine. pan vault save, sync, list, show and status manage what is saved, and pan vault resume <id> takes a conversation over on this machine (or <id>@<version> to fork at an earlier version). Before resuming, it compares the directory’s branch, commit and dirty state with the saved state and asks how to proceed. Claude Code and Codex resume natively; other harnesses get a markdown digest to paste into a new session. A line that looks like a credential blocks the save and is named by line number and pattern, never by value. pan vault exclude keeps paths, git origins or single conversations off the vault, and setup --hooks adds a Claude Code Stop hook that saves after every turn. Overdeck provides no backend, never sees the contents, and pan vault commands send no telemetry. Losing every device and the recovery phrase loses the vault. See Session Vault. (#4385)
• Session Vault on Windows: continuing a Linux conversation under WSL2 is verified end to end, including the uncommitted-code snapshot with its line endings, file modes and symlinks. Native Windows is not supported yet: it needs the Herdr terminal backend, which does not run there, and a few vault and dashboard steps still fail. The Session Vault docs list what works today. (#4421)
• Vault passphrase unlock: a new machine can join the vault with a passphrase instead of the 24 words. Setup offers a generated six-word passphrase or your own (16 characters or more), and pan vault passphrase set|remove changes it later. The vault key is stored wrapped under the passphrase, so anyone who can read your vault repository can try to guess it offline; each guess is deliberately slow, which protects a generated passphrase but not a weak one. The recovery phrase still works, and removing the passphrase never locks you out. (#4388)
• Uncommitted code travels with the conversation: each vault save also takes an encrypted snapshot of the working tree (tracked and untracked files, plus local commits you have not pushed; files matched by .gitignore are left out). pan vault resume fetches origin, checks out the saved commit and applies the changes unstaged. Use --worktree <dir> to apply into a new worktree or --no-code to skip the code. The snapshot is stored only in your vault, never pushed to your git host, so it works while the first machine is off. The target checkout must be clean. Snapshots over 50 MB are skipped, and code that looks like it contains a credential is not uploaded until you allow it with pan vault allow-secret <id> --file <path>. (#4389)
• Vault key rotation: after losing a device, pan vault rotate-key re-encrypts the vault under a new key and prints a new recovery phrase. Other machines stop syncing until they re-join with the new phrase or passphrase, and keep their own conversations when they do. Rotation protects only what you save afterwards: the lost machine can still read everything saved before it. Upgrade Overdeck on every machine before rotating, because older versions cannot read conversations saved before a rotation, and revoke the lost machine’s git credentials too. (#4414)
• Opt-in transcript eviction: with "evict": true in the vault config, pan vault evict lists the local transcripts that are fully saved and verified by reading them back, with a fingerprint of that list, and deletes nothing. pan vault evict --confirm <fingerprint> deletes exactly those files, skips anything that changed since the review, and refuses a list that no longer matches. pan vault restore <id> rebuilds an evicted transcript byte for byte. Eviction is off by default and never runs on its own. (#4385)
• Pair another device with a dashboard: pan pair --url <address> prints a one-time link that lets a laptop, tablet or second desktop open this machine’s dashboard with its own revocable session. The link works once, expires after 10 minutes, and carries its credential in the URL fragment so it never reaches a server or proxy log. pan devices list and pan devices revoke <id> manage paired devices; revoking one closes its open connections at once. Each machine still owns its own projects, agents and conversations. See Remote access. (#4417)
• Claude Code version check and upgrade: Overdeck knows the oldest Claude Code each model needs (Claude Fable 5.1 needs 2.1.255, Claude Sonnet 5.5 needs 2.1.284) and refuses a launch on an older Claude Code before creating a terminal session, naming the installed and required versions and the upgrade command. The dashboard shows a banner while any configured model’s minimum is unmet. For a user-writable npm, native or Homebrew install it offers an Upgrade Claude Code button; for a root-owned npm prefix, an unrecognized install or Windows it shows a command to copy, since Overdeck never runs sudo. Running agents keep their current Claude Code. pan doctor reports the version, install method, per-model minimums and any other claude binaries on your PATH. (#4378)
• Codex version floor for GPT-6: with a ChatGPT login, gpt-6-sol and gpt-6-luna need Codex CLI 0.156.1 or newer, and OpenAI returns a 400 below it. Overdeck now refuses such a launch up front on every start path, names the required version and never substitutes another model. API-key auth has no floor. pan install does not manage the Codex CLI; upgrade it with npm install -g @openai/codex. pan doctor shows one Codex model floor row per model. (#4386)
• External skill packs: add a third-party git repository of skills, such as mattpocock/skills, with pan skills pack add <id> <url> --ref <tag>. Overdeck shows a preview, pins the commit you approve, and mounts the pack through the harness’s own plugin system, so pack skills never land in your shared skill folders. Packs and single pack skills are off until you turn them on, at global, project or issue level (pan skills set --pack <id> on, or the Skills page, project settings and issue view). pan skills pack update re-previews before moving the pin. Packs apply to Overdeck-managed Claude Code and Codex launches only, not to other harnesses or remote launches. Only skill folders are mounted: a pack’s hooks, MCP servers, commands and scripts are listed as Not applied and never reach the agent. The dashboard can turn packs on and off but cannot add them. See Skills. (#4353)
• Jev judgment client (optional, off by default): Overdeck can ask TypeSafe AI’s Jev model small typed questions, through OpenCode Zen or directly through TypeSafe. It needs a jev: block with an explicit model and a TypeSafe or OpenCode Zen key (Settings, Background AI), and each feature has its own toggle, all off. Low-cost mode, which is on by default, turns them all off. With Jev unconfigured nothing is sent and nothing changes. What each toggle sends to TypeSafe: the turn-end assessment sends an idle plan agent’s or conversation’s role and the last 6,000 characters of its last message; the acceptance-criteria review sends the id and title of each acceptance criterion at plan finalize; the memory relevance toggle is not called by anything yet and sends nothing. The API key and request bodies are never logged, and each request is costed in the ledger. See Jev. (#4380)
• Jev readings in Needs you and plan finalize: with the turn-end toggle on, an idle Claude Code or Codex plan agent or conversation that stopped without asking through a tool can read Asked you a question, Reported done or Blocked on its Needs-you row instead of the generic label. A reading is shown only at 0.7 confidence or higher, is advisory, and triggers no action; measured precision for the question label is 0.78, below the 0.9 bar for calling it ready. With the acceptance-criteria toggle on, pan plan finalize prints warnings about criteria that are not observable or combine several checks, and never changes its exit code. (#4397, #4394)
• Conflict repair for approved PRs: an approved PR with green checks that turns conflicting with main no longer sits until someone notices. Once a minute the dashboard finds such PRs and sends the issue’s work agent one repair instruction per head: sync with main, resolve, run the gates, push and request review. If the conflict is still there 45 minutes later, or the agent cannot be reached, the issue goes to Needs you once. A repaired PR whose approval no longer stands at its new head is re-reviewed, and review is requested once if the agent has not done so within 15 minutes. Set OVERDECK_DISABLE_CONFLICT_REPAIR=1 to turn it off. (#4411)
• Independent plan critic: planning for an issue labeled architecture, substrate-improvement or security, or finalized with pan plan finalize --critic, gets a read-only critique from a model of a different family before it can complete. Each blocking finding needs an answer in the PRD; after two rounds finalize proceeds and lists anything unresolved. Set the critic with roles.plan.sub.critic.model. It has no default, so a flagged plan cannot finalize until you set one. (#4382)
• CPU pressure awareness: on Linux, Overdeck reads CPU pressure stall information and holds back new gauntlet lanes (HTTP 429 cpu-saturated, override with pan lane start --force) while the CPU is saturated. A dashboard agent start shows a warning you can confirm, and holding Flywheel-started agents is opt-in with resources.governor_cpu_hold_dispatch. Conversations, pan start and dashboard Start are never blocked on CPU. The dashboard gets a larger CPU share, verification runs a smaller one, and batch agents and lanes run at a lower priority, all configurable under resources.*. Runaway processes, such as a tool call that outlived its agent, are reported in the activity feed with the command to stop them; Overdeck never kills them. Where pressure data is unavailable, as on macOS, load per core is the fallback. (#4322)

Improved

• Guardrails for parallel agents, adapted from Deft: pan task claim refuses a task that another live agent holds or whose file scope overlaps one, treating an unclear scope as overlapping; --steal overrides it and says what it overrode (#4357). The agent git shim refuses commit, push, merge and cherry-pick in a feature worktree that is on the wrong branch or a detached HEAD (#4351). Forks, handoffs and read-write workers refuse a project’s primary checkout as their working directory; an operator can pass --allow-primary to pan fork or pan handoff (#4354).
• An ended work agent that handed its issue to review now reads Handed to review instead of Ended unexpectedly, and a planning session reads Plan finalized when the issue’s plan is. (#4401)

Changed

• The dashboard requires a credential from other machines: every /api and /events request that does not come from this machine now needs a dashboard session, a paired device session or the internal token, or it gets a 401. Every WebSocket connection (terminals, RPC, voice) requires one too, and a browser whose session cannot be created shows an Unauthorized banner with Retry. A LAN device that opened the dashboard without signing in must now pair with pan pair. If a local reverse proxy (Tailscale Serve, cloudflared, Traefik) forwards outside traffic, turn on dashboard.require_token_mint, and add non-default addresses to OVERDECK_TRUSTED_ORIGINS. (#4417, #4317)
• Operator-only labels: only you can add or remove the auto-merge, hold-for-uat and released labels. Work agents, conversations and the Flywheel have their gh refuse those label writes and are told to ask you. (#4379)
• Planning files are committed, not left in the primary checkout: per-issue continue files and spec status changes are written in the issue’s workspace instead of the project’s primary checkout, and pan done commits pending .pan/continues/ and .pan/specs/ changes before it rebases. Close-out no longer writes the spec; its status comes from the merged PR. pan scope commits and pushes on main only when the issue has no workspace. (#4377)
• A finalized plan can no longer be changed by the work agent. Finalize stamps a Plan-Finalized trailer on the spec’s commit, and a new required plan-integrity verification check fails a branch that adds, removes or edits plan items or acceptance criteria after that; status fields are still allowed to change. Work agents record progress with pan task done in the continue file. (#4355)
• pan spawn runs every worker that can change files in its own item worktree by default. --shared puts a worker in the issue workspace instead, and only the foreman or an operator can use it. (#4376)
• The /okf skill now comes from a pinned release of eltmon/okf. pan sync installs that version and replaces local edits in copied installs, but leaves a copy you symlinked to your own checkout alone. pan doctor warns when an installed copy’s version differs. (#4415)

Fixed

• Prompt-time memory injection works again: it almost never injected a memory, because query expansion failed, most often for lack of an Anthropic API key, and the fallback search then required every word of the prompt to match. Injection now searches for any of the prompt’s content words, so it finds matches even when expansion fails. A missing or rejected key is reported as provider-auth-failed in pan memory doctor with its cause, and pan doctor has a Memory extraction row. The anthropic extraction provider needs ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN in both the dashboard’s and the agents’ environment; a Claude subscription login does not authenticate it. (#4416)
• Work that never started is visible: when the automatic work start after planning failed, for example because the workspace’s Docker stack would not rebuild, the issue sat with no work agent and no sign of it. That start is now deferred and retried like a guardrail refusal, and the Command Deck and Needs you show Work start retrying, or Work agent not started with the error and a Start work action. (#4413)

New

• Claude Sonnet 5.5: Anthropic’s claude-sonnet-5-5 is in the model pickers, the Settings catalog and the cost tables ($2/M input, $10/M output, 1M context), and it is now the default for the Sonnet tier: workhorses.mid, new conversations, status reviews, fork summaries, the tiered-execution supervisor, the test and merge specialists and the provider fallback. A model you chose yourself is unchanged. Claude Code launches now pass the full Sonnet model ID instead of the sonnet alias, so an agent configured for Sonnet 5 keeps running Sonnet 5. Sonnet 5.5 needs Claude Code 2.1.284 or newer; run npm install -g @anthropic-ai/claude-code@latest first. Overdeck no longer sends temperature to models that reject it, so memory extraction and the speech summarizer work with Sonnet 5 and newer. (#4336)
• Local GPU models (experimental): run Claude Code agents on a model served by a local Ollama (0.14 or newer) with ollama:<tag> model IDs. Model traffic stays on the machine, no provider API key is needed, and the run is costed at $0. Overdeck checks Ollama and the model before launch, pan up starts Ollama only when a configured model uses it, pan install offers setup (skip it with --skip-ollama), and pan doctor reports the server, version, downloaded models and loaded context size. No local model has completed a work-agent task yet; see Local models. (#4271)
• Prime Agent harness: Prime Intellect’s Prime Agent (0.8.x) can run work agents and conversations. Set harness: prime-agent on a role or pick it for a provider under Settings, Providers. Dashboard messages, pan tell, stop, resume, transcripts and cost work as they do for other harnesses, and pan doctor checks the binary, version and auth. Anthropic models need API-key auth with Prime Agent; subscription auth is blocked. (#4251)
• Steer a running Claude Code turn: press Ctrl+Enter (Cmd+Enter on macOS) in the composer, or choose Steer in its delivery selector, to interrupt the current turn and send your message at once instead of queueing it. pan tell --steer <id> "<message>" does the same from a shell. Pi keeps its existing steer. Codex, ACP, OpenCode, Kimi Code, Muse Code and Prime Agent do not steer yet and refuse a steer instead of queueing it silently. (#4314)
• Turn skills on and off: each skill has an on/off state at global, project and issue level, and the narrowest level wins. Set it from the Skills page, project settings, the issue view or pan skills set <skill> on|off|inherit, and list states with pan skills list. Claude Code and Codex launches apply it. The 11 core pipeline skills always stay on. (#4326)
• Ended sessions show their outcome: an ended agent session reads Merged, Review approved, Changes requested, Tests passed, Tests failed, Plan finalized, Stopped by operator or Stopped by close-out instead of a bare “Session ended”. Only Ended unexpectedly is highlighted, and it appears only on positive evidence. (#4318)
• Answer permission prompts from the dashboard: a Claude Code permission prompt, including one raised by a subagent, opens a dialog in the conversation, appears in Needs you with how long it has waited, and sends a desktop notification that repeats after 5 and 30 minutes. Messages you send while a prompt is open are held and go out when it clears. (#4284)
• Gauntlet lanes: pan lane start|list|wait|report|stop|reap launches and manages builder, critic, verifier, play and orchestrator conversations from any harness. Lanes nest under the conversation that launched them in the Command Deck and on the Agents page, critics pair with their builder and show their verdict, and pan lane show prints a builder’s critic chain. (#4238)
• Type and go from Home: both Simple and Advanced Home have a composer that starts a conversation, a discussion or a terminal command, in a project or with no project. An unscoped conversation can be moved into a project later, and the sidebar always shows the No-project entry. (#4287)
• Add Project dialog: suggests unregistered local repositories to add in one click, snaps a subfolder to its repository root, and imports a folder of repositories as separate projects or as one multi-repo project. The New Workspace title is now a Smart field that recognizes issue references and branch names. (#4289)
• Get set up checklist: Home shows what still needs attention on a new install (Claude and GitHub logins, the terminal backend, memory). pan install and pan doctor now warn instead of failing on optional tools such as Docker, ast-grep, and tmux when Herdr is the backend. (#4286)
• Close-out settings: Settings, Close-out controls whether close-out removes the workspace and deletes the feature branch, shows how much disk closed issues’ workspaces still use, and offers Clean up now for closed, merged workspaces with no uncommitted changes. (#4288)
• Reasoning effort per role, tier and project: set effort on a role, sub-role, tier or project, and Overdeck resolves it through one precedence chain for every launch, clamping a level the model does not support. See Reasoning effort. (#4261)
• The Flywheel page shows issue titles, live agents, headline stats, UAT batches and a Report tab, flags unknown tracker issues and work with no agent, and offers Start fresh for an orphaned session. pan flywheel status prints the same detail. (#4215)
• The pan-consolidate-conversations skill makes the current conversation the owner of a project’s open work: it digests the other open conversations’ pending commitments, archives them and reports a ledger. (6cbb757)

Improved

• Awareness feed: All shows transitions (conversations started, ended or failed) inside a 24 hour window instead of re-dating every working conversation on each poll. A gauntlet run is one card with its lanes on expand, an issue’s activity collapses into one card with a step count, and Project scope keeps the project’s conversations and run cards. The empty Git, Files and Comments tabs are gone. (#4316)
• Faster conversation open: polling aggregates run on their own worker lane, so opening a conversation no longer waits behind them, and an open no longer loads the transcript twice or re-parses it on the main thread. Diffs are polled only while the session is alive and cached for an unchanged transcript. (#4321)
• Degraded mode instead of outage screens: when the dashboard loses its server, pages stay visible and usable under one banner (delayed, unreachable or restarting). Server-backed actions stay visible but disabled with the reason, and composer messages sent meanwhile are held and sent on reconnect. (#4285)
• The issue right-click menu lists only the actions available in the issue’s current state. Three restart entries became one Restart agent dialog, and Plan is one dialog with a start-after-planning checkbox that now actually starts work. (#4220)
• The Agents page Live view shows the current tool and its description on each row, counts subagent activity before calling an agent quiet, starts the preview’s subagent rail collapsed, and puts a conversation that ended on a provider error into Needs you. (#4231)
• Conversation titles and About summaries describe everything still in context, using the latest compaction summary, instead of only the most recent request. (#4252)
• A universal rule tells every agent to use literal paths, never variables, as rm targets. (0b5162d)
• The grilling, codebase-design, domain-modeling and improve-codebase-architecture skills, adapted from mattpocock/skills, now ship with their MIT license notice. (cf9773c)

Changed

• close_out.remove_workspace now defaults to true, so close-out removes a merged issue’s workspace unless your cloister.toml sets the key. Deleting the feature branch stays off by default. (#4288)
• The dashboard keeps synced skills and rules current by itself: after a pan reload or a merge that changes them, it runs pan sync --if-changed. The Setup changed banner now appears only when that sync fails or is turned off, and says what changed. Turn it off with context.auto_sync: false. (#4272)
• A new dashboard profile opens in Simple mode; profiles with dashboard history stay in Advanced. (#4287)
• Memory governor reserves and the spawn guardrail’s memory thresholds now scale with installed RAM, and on macOS the governor uses memory pressure and the same available-memory figure as the header, so small Macs no longer stay in permanent shedding. Reserves you set are normalized against RAM. (#4274)
• Anonymous telemetry, when enabled, also sends an hourly bucketed GitHub API usage sample, a throttled notice when GitHub rate-limits a call, and a daily heartbeat with bucketed project and agent counts. Settings, Telemetry has a new opt-in, off by default, that groups your installs by a pseudonymous hash; GitHub logins, emails and raw IDs are never sent. See Telemetry. (#4277)

Fixed

• Dashboard freezes: the dashboard could stop responding with its main thread stuck, and the watchdog restarted it many times a day. The cause was the native file watcher used for conversation transcripts. Overdeck now polls transcripts every 15 seconds instead. (93468d6)
• GitHub rate limits: Overdeck’s own polling could use the whole hourly GraphQL budget. The quota sampler now reads GitHub’s real GraphQL counter, close-out stops re-asking about unmerged branches every minute, PR listings are smaller, skip projects without a remote and are cached for idle repositories, and a pause ends when GitHub’s window resets. Every GitHub call is metered by caller: the app bar shows a quota pill with the top callers, a banner states GitHub’s used-of-limit while calls are paused, and pan doctor github-quota shows the local view. (#4319, #4277)
• Herdr agents show their live status: on the Herdr backend the dashboard served every agent as stopped, so God View, the Command Deck and agent counts missed working agents. Panes are now matched to agents by agent key. (#4323)
• Close-out is no longer blocked by exited agents: pan close and Close Out check whether an agent recorded as running is actually alive. An exited agent no longer blocks; a live agent or an inconclusive check still does. (#4325)
• No more false “Not found in transcript”: long or queued composer messages that Claude Code wraps as pasted content are matched and shown without the <pasted_content> tags. (#4335)
• The Herdr Terminal tab decodes UTF-8, so characters such as ●, ·, box-drawing lines and emoji no longer render as mojibake. (#4315)
• Messages to a Claude Code conversation reach the main agent: the composer and pan tell switch Claude Code’s input back to the main agent before sending and refuse if they cannot. A message that lands in a subagent is labeled Delivered to subagent, and one that never lands moves to the outbox with Resend and Copy instead of waiting forever. (#4276, #4262)
• A composer send that was not delivered shows Not delivered with a resend action instead of Sent. (#4284)
• The Command Deck model and effort pickers are no longer clipped and no longer shift the conversation column. (#4273)
• A dead agent is reported once per launch and marked stopped, instead of re-emitting dead and running events every minute. (#4313)
• Review verdicts and merges no longer fail when a PR lookup is rate-limited: transient forge failures are retried, a deferred verdict is replayed, and the open PR on a branch wins over a closed one. (#4270)
• Review is dispatched when the dashboard restarts during verification. (#4232)
• A deferred work-agent hand-off survives a dashboard restart, and pan plan finalize, pan plan done and pan show say when a hand-off is held because dispatch is frozen. (#4227)
• The pan start plan-freshness check no longer refuses plans that create new files; it flags only files deleted after the plan was written. (#4226)
• A work model chosen during planning is used by the automatic start that follows. (#4237)
• Tiered execution tiers accept workhorse:<slot> references, Settings shows when a tier overrides roles.work, and pan admin config tiers prints each tier’s effective model. (#4192)
• Agents started by an operator through a planning hand-off are no longer treated as Flywheel agents by the emergency brake and memory shedding. (#4239)
• Plan-artifact pushes no longer leave the local main branch unable to follow origin; conflicting untracked .pan/ files are set aside with a backup and a warning. (#4230)

Fixed

• npx @overdeck/core works again. Since 0.60.0 the package listed the test library @effect/vitest as a runtime dependency, which pulled vitest’s optional peer packages into every install. After @vitest/browser-playwright 5.0.2 was published, npm crashed while resolving them with Cannot read properties of null (reading 'edgesOut'), so a fresh npx @overdeck/core or npm install -g @overdeck/core failed before Overdeck started. The dependency is removed, and the build now refuses to publish a test framework as a runtime dependency. If you still see the error, clear the stale npx cache with rm -rf ~/.npm/_npx and run the command again.

New

• GPT-6 Sol and GPT-6 Luna: OpenAI’s new gpt-6-sol and gpt-6-luna are in the OpenAI provider, the model pickers and the cost tables, with the Codex 272K context limit applied. Defaults and routing are unchanged; pick them per role. (#4234)
• The Agents page opens on a Live view: running and in-pipeline agents are grouped into Needs you, Live and Waiting, each with one reason, in resizable panes with a collapsible preview and a new set of agent state colors. (#4216)
• Start a bare conversation from the Command Deck with the “No context” checkbox: no Overdeck-injected context and a faster spawn. (#4187)
• Pull requests are linked to conversations by branch, so a conversation shows the PR it produced. (#4067)
• Subagents take direct input from their own composer and show a live working indicator. (#3788)
• A project row shows the progress of a pan reload deploy while it builds and restarts. (#4094)
• Conversations and pan handoff run through the terminal backend, so they live in Herdr panes like every other agent. (#4104)

Improved

• Merge train restored: approved, green, mergeable PRs that opted into auto-merge are scheduled and merged on the merge-train tick again, and pan merge cancel uses the merge-train routes. (#4066, #4111)
• Faster CLI startup: pan loads each command’s code only when that command runs, so pan --version drops from about 560 ms to 180 ms. (#4205)
• The Command Deck issue tree shows a real state badge instead of “Allocated”, one status signal per row, and each resource once as an icon cluster. (#4218)
• Board routes no longer wait on gh pr list or per-agent derivation, so the parked and auto-merge views load quickly. (#4091)
• An issue that was closed out renders as shipped, with its history, instead of as never started. (#4078)
• The status-bar emergency stop shows what it stopped. (#4125)
• The conversation feed shows ACP agents’ thinking, prompt failures and stalled turns as their own rows. (#4142, #4141, #4152)
• Skills, CLI docs and agent-facing messages name only pan verbs that exist after the Cut. (#4143, #4158)
• pan doctor flags a stale pan sync source checkout, and pan sync prunes git hooks that were deleted upstream. (#4148, #4161)
• Dependency security updates: an in-range refresh with security overrides clears most bun audit advisories, the desktop build moves to electron-builder 26 to clear a critical tar advisory, and the pinned CLIProxyAPI moves to v7.3.16. (#4202, #4214, #4159)
• Internal cleanup: the remaining hardcoded model fallbacks are gone (an unset model now resolves through role routing), and dead sub-roles, stores and pan inspect leftovers are removed. (#4164, #4170, #4080)

Fixed

• Planning hand-off guardrails: a planning auto-handoff acknowledges advisory guardrails, and a hand-off the guardrails refuse is retried instead of dropped. (#4135, #4177)
• A “troubled” agent can be cleared again: pan untroubled <id> is back, and pan start --force also clears the gate. (#4228)
• Herdr agents show up everywhere: pan status, the agent output API, god view liveness, skills and attach hints now read the Herdr backend, and Herdr issue workspaces are found again after a restore. (#4103, #4089, #4093, #4072, #4099)
• Stopping an agent or reaping an idle one closes its Herdr panes, and finished review and one-shot role runs are reaped on Herdr. (#4076, #4162, #4175)
• Only Overdeck’s own agent panes count toward the work-agent limit. (#4207)
• Review synthesis is re-dispatched when every lane reported but the parent died, and pausing an issue also holds its review convoy. (#4153, #4150)
• The Request review menu’s Full, Quick and None choice applies to the run it starts. (#4120)
• Repeated identical UAT failures escalate once instead of looping. (#4063)
• An idle agent resumes after “Connection lost mid-response”. (#4178)
• An unfinished workspace setup resumes instead of starting the agent inside it, and every Claude Code launch is pre-trusted before it starts. (#4176, #4163, #4144)
• Workspace teardown removes its Docker Compose networks, and orphaned workspace networks are swept. (#4181)
• pan reload carries the running dashboard’s boot gates. (#4179)
• The “Reconnecting” banner clears after a restart, and the sidebar refetches projects and conversations on reconnect. (#4075, #4082)
• Conversation search skips deleted transcripts, recovers from watcher errors, and opens hits from unregistered and subagent conversations. (#4157, #4194, #4087)
• A transient pipeline-membership failure is retried instead of latching an error banner. (#4092, #4190)
• Keystrokes typed on /projects/new before the backend settles are kept. (#4147)
• Merged strikes clean up their pane, worktree and branch. (#4070)
• Every GitHub App API request has a timeout. (#4060)
• JSONL transcripts outside vendor cleanup roots are preserved. (#3817)

New

• Agents directory at /agents: a tree of local, remote and project agents with a list and a conversation, issue and PR context pane. Agents launched by other tools appear there too. (#4022, #4038)
• pan worker run | wait | report | list: delegate work to a registered, issue-linked worker agent that reports back. (#4027)
• Attach the native Codex or OpenCode terminal UI to a running conversation. (#4028, #4025)
• The Flywheel page is back, derived from live data instead of a stored run record. (#3999)

Improved

• One merge gate. Every merge path (the merge-ready set, the dashboard Merge button, auto-merge, the merge train and the per-project queue) asks the same question. A CI-mode project needs its CI test job to succeed on the PR head, and a failed UAT verdict for the current head blocks merge until a later pass. (#4040)
• Review and UAT verdict markers in PR comments count only from the repository’s owners, members and collaborators, or from Overdeck’s own identity. (#4040)
• pan handoff, the memory governor, pan start --fresh and stuck-agent force kill stop agents through the terminal backend, closing their Herdr panes. (#4048)
• Approving a merge after origin/main moved returns a clear 409 with both SHAs and recovery steps. (#4041)
• Internal cleanup: the Effect façade layer was cut back to plain Promise and synchronous functions. Some @overdeck/core exports were removed or renamed; the full list is in CHANGELOG.md. (#4006, #4057)

Fixed

• A failed UAT is relayed to the work agent again. (#4033)
• The stuck pause holds, and repeated verdict feedback is sent once. (#4039)
• Background subagents keep running until they finish. (#4054)
• The question dialog resets its answer for each new question. (#4058)
• Conversation lifecycle events are attributed to the right launch and row. (#4005)
• Planning, resume and recovery relaunches close the review gaps left by the Herdr move. (#4018)
• Flywheel’s in-flight list excludes merged and closed issues. (#4004)
• Plan homes with a legacy .pan/ gitignore rule are repaired. (#3998)
• Desktop builds ship again. (#3997)

The Cut

• Herdr is the default terminal backend. pan install, pan sync, pan up and pan doctor install and check Herdr for you. tmux is still supported through terminal.backend: tmux. See Terminal backend. (#3995)
• Planning artifacts live in your repo. Drafts, specs, continues, orders and the backlog sequence are committed under .pan/ in the project (or its plan home), not in a separate state worktree. pan admin migrate-plan-home <project> copies open issues’ artifacts across.
• Merge readiness comes from the PR. It is PR approvals, green checks and forge mergeability. Review verdicts are PR reviews, posted by the GitHub App.
• Retired commands. pan approve becomes gh pr review --approve or the dashboard Merge button, pan review pending becomes gh pr list, and pan inspect, pan reset-to-planned, pan unstick, pan review resync/reset and pan copy-config are gone because there is no stored state left for them to act on.
• Simpler background supervisor. The patrol loop is now four routines: nudge stuck work, nudge on API errors, reconcile liveness, and reap closed issues.

New

• Each issue keeps an append-only pipeline journal that pan show prints, and the work agent is told when verification passes instead of polling. (a4fb7a4)
• Tests run once per push on CI, plus the touched tests locally, instead of the full suite on the host. (#3993)
• Claude Opus 5.5 support across launch, routing, model pickers and cost reporting. (#3985)
• A Conversations scope in the Ctrl-K command palette. (#3933)
• The pan-open-threads skill collects your unfinished threads across conversations into one checkable page. (d35b93e)

Improved

• Dashboard menus and popovers share one style, keyboard navigation, positioning and focus handling. (#3945)
• The backlog page is one ordered list without the Now, Next, Later and Someday bands, and it loads in a fraction of the time. (7110e02, #3978)
• Transcripts stay findable: each session records its transcript path when it starts, and closing an issue keeps agent state and transcripts. (#3976, #3951, #3979)
• Strikes open a PR for you to merge. (#3987)

Fixed

• Stopping an agent closes its Herdr pane. (#3989)
• OpenCode conversations show their saved history, start and resume on Herdr, and recover from stalled permission prompts. (#3986, #3991, #3970)
• Merge-train batches assemble again, fail loudly, and stop after three consecutive failures. (#3972)
• The command palette shows a search error instead of “No results” when the request fails. (#3980)
• A handed-off agent can resume its saved session. (e35d03e)