diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 0913d7921..1c1f3a777 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-	".": "0.3.0"
+	".": "0.3.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d16dc2609..70e451c9a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,223 @@
 # Changelog
 
+## [0.3.1](https://github.com/RigelBuild/compass/compare/v0.3.0...v0.3.1) (2026-10-09)
+
+
+### Features
+
+* **agent-image:** ship jj and jj-vine in the agent image (RIG-4723) ([#1800](https://github.com/RigelBuild/compass/issues/1800)) ([47e37c7](https://github.com/RigelBuild/compass/commit/47e37c7899c81e10eecd94e97c7ba53cffcdd524))
+* **agent:** port portable operating guidance and survival kernel (RIG-3903) ([#1491](https://github.com/RigelBuild/compass/issues/1491)) ([9ec4eb5](https://github.com/RigelBuild/compass/commit/9ec4eb54a1a057cd0d3b0529bd0be9ccfc10c042))
+* **agent:** range-encode ControlAck applied_above (RIG-1466) ([#1813](https://github.com/RigelBuild/compass/issues/1813)) ([403f672](https://github.com/RigelBuild/compass/commit/403f67211cb4b01f12493963ca76d2c1aea970e7))
+* **agent:** Reload continues the session transcript under the new config (RIG-4418) ([#1704](https://github.com/RigelBuild/compass/issues/1704)) ([5af811b](https://github.com/RigelBuild/compass/commit/5af811ba883ff0e2f5193cc03fc362a398f5b488))
+* **api:** expose issue search RPC (RIG-4278) ([#1540](https://github.com/RigelBuild/compass/issues/1540)) ([2b8034c](https://github.com/RigelBuild/compass/commit/2b8034ccfd5bbfea4c4a6bdcdeaf6150a0aa718d))
+* **appconfig:** add the no-config signal, URL normalizer, and app.toml writer ([#1740](https://github.com/RigelBuild/compass/issues/1740)) ([092d7c6](https://github.com/RigelBuild/compass/commit/092d7c6bf13b30d76a28b08c14c082779e491555))
+* **auth:** mint and verify per-agent gateway tokens (RIG-2864) ([#1752](https://github.com/RigelBuild/compass/issues/1752)) ([aa3b206](https://github.com/RigelBuild/compass/commit/aa3b206e9da453d6c82037668ffaadd3982813f5))
+* **comms:** agent tools name channel groups by leaf or slash path ([#1705](https://github.com/RigelBuild/compass/issues/1705)) ([b071662](https://github.com/RigelBuild/compass/commit/b071662c6a8b8457cfc7a1737b8643e695b23827))
+* **comms:** carry the author handle on every wire Message (RIG-2880) ([#1340](https://github.com/RigelBuild/compass/issues/1340)) ([5bd98f8](https://github.com/RigelBuild/compass/commit/5bd98f89bdded51b2ee6162fa4d2f221ad00eb07))
+* **comms:** carry the channel id on SearchMessages hits (RIG-4295) ([#1612](https://github.com/RigelBuild/compass/issues/1612)) ([e260f49](https://github.com/RigelBuild/compass/commit/e260f49c16ec0ad10809da95e18342b19402dad5))
+* **comms:** publish message_posted on the event fabric (RIG-3107) ([#1333](https://github.com/RigelBuild/compass/issues/1333)) ([896506d](https://github.com/RigelBuild/compass/commit/896506d71718b76810210caf65f5886aa6ee4a59))
+* **comms:** require a taxonomy role on CreateAgent (RIG-3097) ([#1733](https://github.com/RigelBuild/compass/issues/1733)) ([10f50c3](https://github.com/RigelBuild/compass/commit/10f50c375ca18c71b18c7131f41dc5c2b5939db3))
+* **compass-agent:** add channel, group, and membership comms tools (RIG-2726) ([#1809](https://github.com/RigelBuild/compass/issues/1809)) ([51d2290](https://github.com/RigelBuild/compass/commit/51d22902ec90e940e22fc44d0b3fe78242161a44))
+* **compass-agent:** record publish flush shape and batch size (RIG-3694) ([#1245](https://github.com/RigelBuild/compass/issues/1245)) ([67304fd](https://github.com/RigelBuild/compass/commit/67304fde79ab67071f66adaab0960b54d37c3ba0))
+* **dashboards:** ship Grafana dashboard JSON for agent obs signals (RIG-2826) ([#670](https://github.com/RigelBuild/compass/issues/670)) ([7d17aba](https://github.com/RigelBuild/compass/commit/7d17aba3e90a7bc7f905c0296f89e2a775dc824c))
+* **delivery:** consume message_posted from the event fabric (RIG-3107) ([#1345](https://github.com/RigelBuild/compass/issues/1345)) ([fc3dbc5](https://github.com/RigelBuild/compass/commit/fc3dbc54f0e6a74d69d21ddc68f7d74d888ee7ec))
+* **delivery:** route owner-qualified mentions within the channel (RIG-4364) ([#1751](https://github.com/RigelBuild/compass/issues/1751)) ([e691058](https://github.com/RigelBuild/compass/commit/e691058ac8de45bdcd8fbd3f5b3f2fa2b3f24a42))
+* **design-ledger:** derive Compass record status from main (RIG-3662) ([#1284](https://github.com/RigelBuild/compass/issues/1284)) ([c10b267](https://github.com/RigelBuild/compass/commit/c10b26718d6b96015bfb0759aada37214f4b6137))
+* **devenv:** assert the operator CLI artifact after build (RIG-3412) ([#1329](https://github.com/RigelBuild/compass/issues/1329)) ([3b81120](https://github.com/RigelBuild/compass/commit/3b811208bd16e3724bedd6fd5a18ddf3f3d114f0))
+* **docs:** reconcile design ledger IDs (RIG-3634) ([#1313](https://github.com/RigelBuild/compass/issues/1313)) ([2a6b7bf](https://github.com/RigelBuild/compass/commit/2a6b7bff67b63416a9d8d8eac7fcb3f11e9dfa14))
+* **fabric:** let a subscriber callback fail so the event is redelivered (RIG-4030) ([#1355](https://github.com/RigelBuild/compass/issues/1355)) ([8732432](https://github.com/RigelBuild/compass/commit/87324322118b9cdf5a243089d416688870737059))
+* **fabric:** park events the server drops at MaxDeliver (RIG-4036) ([#1400](https://github.com/RigelBuild/compass/issues/1400)) ([473b409](https://github.com/RigelBuild/compass/commit/473b409f766744e289ea84b98d73a29d1251553f))
+* **fabric:** propagate trace context, add OnReconnect, pin serial callbacks (RIG-3107) ([#1337](https://github.com/RigelBuild/compass/issues/1337)) ([0776d3f](https://github.com/RigelBuild/compass/commit/0776d3f1ca71759176fbbaf3832c93806a1cfc90))
+* **fabric:** report each durable consumer backlog as an OTel gauge (RIG-4299) ([#1585](https://github.com/RigelBuild/compass/issues/1585)) ([f890817](https://github.com/RigelBuild/compass/commit/f89081712f33c4fcd7727cb5b5a01a8c43a9ee8b))
+* **forge:** read PR review threads and required checks from GitHub GraphQL (RIG-1728) ([#1354](https://github.com/RigelBuild/compass/issues/1354)) ([9daf76e](https://github.com/RigelBuild/compass/commit/9daf76ee93289ea488dbe9a25cf1d9496f8f1aa1))
+* **gateway-image:** lane scaffold and pure core (RIG-4340) ([#1587](https://github.com/RigelBuild/compass/issues/1587)) ([bb0ae15](https://github.com/RigelBuild/compass/commit/bb0ae1520f5abad1ff638e2b5c3f555d5b051294))
+* **guest-image:** derive the guest rootfs from the pinned agent OCI image ([#1252](https://github.com/RigelBuild/compass/issues/1252)) ([d8ccbb3](https://github.com/RigelBuild/compass/commit/d8ccbb3bac6818fb27b5f72f5fb85a11c532cccd))
+* **guest-image:** pin the agent OCI image the guest rootfs derives from (RIG-3786) ([#1215](https://github.com/RigelBuild/compass/issues/1215)) ([cc9e600](https://github.com/RigelBuild/compass/commit/cc9e600956bd46740dd84cc883043cb2ce90875f))
+* **guest-image:** publish the guest triple as a non-runnable OCI artifact ([#1268](https://github.com/RigelBuild/compass/issues/1268)) ([99f867f](https://github.com/RigelBuild/compass/commit/99f867f1e342de32c464cca3e22f230a0d2d1094))
+* **linearagent:** end Linear "Thinking" on the Manager's first reply (RIG-4163) ([#1469](https://github.com/RigelBuild/compass/issues/1469)) ([b98800c](https://github.com/RigelBuild/compass/commit/b98800cb71c75cd1a1af2d951b645d188c8dc43f))
+* **linear:** link sessions through a click-time /l/session redirect (RIG-2794) ([#1717](https://github.com/RigelBuild/compass/issues/1717)) ([dbb0751](https://github.com/RigelBuild/compass/commit/dbb075196955aec145044f7a67794c374b554feb))
+* **linear:** record the issue identifier on the agent-session association (RIG-4043) ([#1709](https://github.com/RigelBuild/compass/issues/1709)) ([526324a](https://github.com/RigelBuild/compass/commit/526324a1ba2f7f047e83d8abb028e7b2b35fd172))
+* **proto:** add the channel attach edge, membership mode, and ReparentChannel (RIG-4185) ([#1590](https://github.com/RigelBuild/compass/issues/1590)) ([8232d08](https://github.com/RigelBuild/compass/commit/8232d08c1be86e4d560c0712b041a769d21f6e1b))
+* **proto:** add the GatewayCredentials service for the LLM gateway (RIG-2863) ([#1611](https://github.com/RigelBuild/compass/issues/1611)) ([9fee8fd](https://github.com/RigelBuild/compass/commit/9fee8fd0f1459c4dde75aa127d1a023f5521d2f5))
+* **release:** digest-re-tag the runner image to vX.Y.Z on release (RIG-3758) ([#1341](https://github.com/RigelBuild/compass/issues/1341)) ([c7e6189](https://github.com/RigelBuild/compass/commit/c7e61895b792b89095bcd37dda09878e816bed3a))
+* **release:** digest-re-tag the runner image to vX.Y.Z on release (RIG-3758) ([#1397](https://github.com/RigelBuild/compass/issues/1397)) ([53bb2ab](https://github.com/RigelBuild/compass/commit/53bb2abf520703e735f261dfde224d81cd2fee25))
+* **renovate:** fail rollup on a half-relocked devenv lock ([#1936](https://github.com/RigelBuild/compass/issues/1936)) ([89788ea](https://github.com/RigelBuild/compass/commit/89788ea9f0a6b794d31eaec7f337b0f3ee2079fe))
+* **renovate:** manage the Go analysis battery pins (RIG-3306) ([#1742](https://github.com/RigelBuild/compass/issues/1742)) ([0a000af](https://github.com/RigelBuild/compass/commit/0a000af6cb35c38e5554f506d5818446cfa4c83b))
+* **renovate:** refresh the UI node_modules FOD pin on bun and flake bumps ([#1647](https://github.com/RigelBuild/compass/issues/1647)) ([bc3da6f](https://github.com/RigelBuild/compass/commit/bc3da6f19671fe626201ae165fa6cf3a5cc42911))
+* **runner:** bind a resume lifetime on the Runner after accept (RIG-4297) ([#1707](https://github.com/RigelBuild/compass/issues/1707)) ([c421fb1](https://github.com/RigelBuild/compass/commit/c421fb1e946f44dfe18e76783be92727554d222d))
+* **runner:** mint server session IDs (RIG-3696) ([#1283](https://github.com/RigelBuild/compass/issues/1283)) ([640a019](https://github.com/RigelBuild/compass/commit/640a019890b92294ed5957146d0fbcbb7a8b9a5f))
+* **runtime:** label and list apple-container agent containers by Runner (RIG-4080) ([#1405](https://github.com/RigelBuild/compass/issues/1405)) ([02f9714](https://github.com/RigelBuild/compass/commit/02f97140e3f70b57cef93426926b3804913dfad4))
+* **search:** add message search provider (RIG-4280) ([#1555](https://github.com/RigelBuild/compass/issues/1555)) ([8abd1e6](https://github.com/RigelBuild/compass/commit/8abd1e62e5b2c810735f2395653aa7145c3ac0e0))
+* **server:** add forge scope storage (RIG-4434) ([#1654](https://github.com/RigelBuild/compass/issues/1654)) ([e09539d](https://github.com/RigelBuild/compass/commit/e09539ddb171173eefe17c52289e97ce167f1044))
+* **server:** archive the transcript tail when a session ends without Stop (RIG-4135) ([#1464](https://github.com/RigelBuild/compass/issues/1464)) ([00510f4](https://github.com/RigelBuild/compass/commit/00510f4f0120b75165644c1321cf5931e9c7f3cb))
+* **server:** assemble the Linear agent session responder (RIG-2717) ([#1360](https://github.com/RigelBuild/compass/issues/1360)) ([2015710](https://github.com/RigelBuild/compass/commit/2015710a99de58de82f3ad75a8de371df74d7e41))
+* **server:** configure forge scope enforcement and boot grants (RIG-4434) ([#1656](https://github.com/RigelBuild/compass/issues/1656)) ([9bbb94e](https://github.com/RigelBuild/compass/commit/9bbb94ec54530a802d3308ecffc29ec3d0af1464))
+* **server:** gate forge writes on account scope grants (RIG-4434) ([#1655](https://github.com/RigelBuild/compass/issues/1655)) ([4637391](https://github.com/RigelBuild/compass/commit/4637391cf899bb7d43004be994817816146e7fe8))
+* **server:** owner-qualify agent author handles (RIG-4026) ([#1720](https://github.com/RigelBuild/compass/issues/1720)) ([1e42084](https://github.com/RigelBuild/compass/commit/1e42084689a2e84aebda9dad49742c7f6d386a64))
+* **server:** per-account first-run tour state (RIG-4505) ([#1687](https://github.com/RigelBuild/compass/issues/1687)) ([2c16dd0](https://github.com/RigelBuild/compass/commit/2c16dd0a61f1658eff882942bcc0bfa0a17ae290))
+* **server:** report build git rev via GetServerInfo (RIG-2039) ([#1760](https://github.com/RigelBuild/compass/issues/1760)) ([470dde8](https://github.com/RigelBuild/compass/commit/470dde8c5768eb3db0a61a5d7dc75228aec248df))
+* **sql-migration-gate:** fail CI when a PR edits a migration on the base branch (RIG-3338) ([#1624](https://github.com/RigelBuild/compass/issues/1624)) ([8f94503](https://github.com/RigelBuild/compass/commit/8f9450337941791110d89703284232bff0973995))
+* **stack:** add the microVM guest configuration seam (RIG-3789) ([#1281](https://github.com/RigelBuild/compass/issues/1281)) ([c2e91f4](https://github.com/RigelBuild/compass/commit/c2e91f405799f0002c1529616f25c56b8339c5dd))
+* **stack:** configurable host ports for bundled NATS and collector ([#1690](https://github.com/RigelBuild/compass/issues/1690)) ([b36c78f](https://github.com/RigelBuild/compass/commit/b36c78f91acaee369ff97b4ee658a401f1db4758))
+* **stack:** materialize digest-pinned guest artifacts (RIG-3789) ([#1282](https://github.com/RigelBuild/compass/issues/1282)) ([64dd436](https://github.com/RigelBuild/compass/commit/64dd4363a7d443e8a22faa172344df15c72b8ae2))
+* **stack:** supervise the LLM gateway as a container child (RIG-2862) ([#1382](https://github.com/RigelBuild/compass/issues/1382)) ([3f07cba](https://github.com/RigelBuild/compass/commit/3f07cbae7033e78a7c485a852cce1c975479a6d2))
+* **store:** add issue search query (RIG-4277) ([#1539](https://github.com/RigelBuild/compass/issues/1539)) ([c5249a1](https://github.com/RigelBuild/compass/commit/c5249a15bd0e230aabf5472d99b473c53ca60e5e))
+* **store:** index issue search text (RIG-4276) ([#1538](https://github.com/RigelBuild/compass/issues/1538)) ([194254a](https://github.com/RigelBuild/compass/commit/194254ac486f39a63a380dff2e207d1fcdd35f62))
+* **store:** let an agent see every agent of its own owner (RIG-4147) ([#1462](https://github.com/RigelBuild/compass/issues/1462)) ([25d91b7](https://github.com/RigelBuild/compass/commit/25d91b71a8af062826d7c5c478ff42b95c694c5c))
+* **store:** refuse to serve an applied migration edited after it ran (RIG-3338) ([#1623](https://github.com/RigelBuild/compass/issues/1623)) ([0f28925](https://github.com/RigelBuild/compass/commit/0f289252ee1c1310a08557afed665526680f0430))
+* **store:** unique sibling channel-group names with a repairing migration (RIG-3030) ([#1595](https://github.com/RigelBuild/compass/issues/1595)) ([45b71ef](https://github.com/RigelBuild/compass/commit/45b71efa12b09d6400bfef0bbe668d4ea2b3572a))
+* **tools:** add dl-claim CLI for Compass design-ledger ids (RIG-3634) ([#1418](https://github.com/RigelBuild/compass/issues/1418)) ([396c02d](https://github.com/RigelBuild/compass/commit/396c02d2344705345a10fdcb79766312ce23bc54))
+* **tools:** add the font-coverage gate (RIG-3603) ([#1208](https://github.com/RigelBuild/compass/issues/1208)) ([a51dd4d](https://github.com/RigelBuild/compass/commit/a51dd4d38b133acc346ddc33123c2b5503a98d2e))
+* **ui:** add the top-bar search shell (RIG-4279) ([#1544](https://github.com/RigelBuild/compass/issues/1544)) ([bf164d1](https://github.com/RigelBuild/compass/commit/bf164d1f3052fcf9370a70a2295d976b828c4ca5))
+* **ui:** ask for the bearer at runtime in browser mode (RIG-4164) ([#1470](https://github.com/RigelBuild/compass/issues/1470)) ([0d18263](https://github.com/RigelBuild/compass/commit/0d182638b01002f6044bc50cfb1de014b62a6bbd))
+* **ui:** drop the New folder button and rename folder-* to tree-* (RIG-4191) ([#1490](https://github.com/RigelBuild/compass/issues/1490)) ([b9670ab](https://github.com/RigelBuild/compass/commit/b9670ab86a8f6c58c6967808cbef52947e205ad3))
+* **ui:** export RespondToAsk generated types (RIG-1330) ([#1298](https://github.com/RigelBuild/compass/issues/1298)) ([5e5f054](https://github.com/RigelBuild/compass/commit/5e5f0545e63d0798f117a826ef9e09990b41e341))
+* **ui:** first-run setup screen and server connect form ([#1757](https://github.com/RigelBuild/compass/issues/1757)) ([1f70448](https://github.com/RigelBuild/compass/commit/1f70448920af04e7f32dded0a87e77a9077e071c))
+* **ui:** let a deployment bake the door URL into compass-ui (RIG-4169) ([#1492](https://github.com/RigelBuild/compass/issues/1492)) ([9805b5c](https://github.com/RigelBuild/compass/commit/9805b5ca8168af35e3c782ec26ef184460dacaf5))
+* **ui:** lift the channel attach fields in the live adapter (RIG-4192) ([#1596](https://github.com/RigelBuild/compass/issues/1596)) ([fed476a](https://github.com/RigelBuild/compass/commit/fed476a82f624eaa7c53565c2b84b253d7c3fa0a))
+* **ui:** New tab always opens a new tab (RIG-4676) ([#1798](https://github.com/RigelBuild/compass/issues/1798)) ([3069ccb](https://github.com/RigelBuild/compass/commit/3069ccb8135eb0e009572be42a75c276a3c8b0cf))
+* **ui:** read-only model registry view in Settings (RIG-3124) ([#1332](https://github.com/RigelBuild/compass/issues/1332)) ([a282952](https://github.com/RigelBuild/compass/commit/a28295288b44ed384154a3edf10c7d7c2a11c2cc))
+* **ui:** render channels in the one sidebar agent tree (RIG-4191) ([#1552](https://github.com/RigelBuild/compass/issues/1552)) ([d3a4499](https://github.com/RigelBuild/compass/commit/d3a4499cbea36610076a138a9482ccfe998532e5))
+* **ui:** search all issues and PRs from the palette and top bar (RIG-4281) ([#1613](https://github.com/RigelBuild/compass/issues/1613)) ([14537fb](https://github.com/RigelBuild/compass/commit/14537fb9ee7931c4e78388012f73810761793db5))
+* **ui:** stack the agent log panel in narrow panes (RIG-4682) ([#1787](https://github.com/RigelBuild/compass/issues/1787)) ([f3ee331](https://github.com/RigelBuild/compass/commit/f3ee3319e9e66d4558cbc511ffd5e3297d191bc1))
+* **ui:** two-pane split with a resizable splitter (RIG-4446) ([#1780](https://github.com/RigelBuild/compass/issues/1780)) ([9fa2751](https://github.com/RigelBuild/compass/commit/9fa2751d6ad3f36a38ef5fd92a2a8f5b620a7e31))
+* **ui:** view tab strip with keep-alive and open-in-tab links (RIG-4444) ([#1755](https://github.com/RigelBuild/compass/issues/1755)) ([04278b6](https://github.com/RigelBuild/compass/commit/04278b6f89b85f8766e6723ce18aa9cbac8399a2))
+* **ui:** W leader chords and palette commands for tabs and panes (RIG-4445) ([#1770](https://github.com/RigelBuild/compass/issues/1770)) ([2afaa08](https://github.com/RigelBuild/compass/commit/2afaa085f7c05f7cb69f7696b0c41be1a3d7d4b3))
+* **ui:** window layout model, hash sync and session persistence (RIG-4443) ([#1743](https://github.com/RigelBuild/compass/issues/1743)) ([26f50c3](https://github.com/RigelBuild/compass/commit/26f50c391e2b9095e58ab8df6edf9bc952dda760))
+* **usage:** add the GetUsageSeries read RPC over token-usage rollups (RIG-2865) ([#1370](https://github.com/RigelBuild/compass/issues/1370)) ([3cf8027](https://github.com/RigelBuild/compass/commit/3cf80272cd060e5136a4e9bd9c35ac5cae5d54e2))
+* **usage:** add the Plane-A token-usage store (RIG-2872) ([#1365](https://github.com/RigelBuild/compass/issues/1365)) ([2c2c3e5](https://github.com/RigelBuild/compass/commit/2c2c3e585c870fcc7c02f081fad07488800ebed8))
+* **usage:** derive compute-usage rollups and prune the raw compute log (RIG-2872) ([#1513](https://github.com/RigelBuild/compass/issues/1513)) ([c144385](https://github.com/RigelBuild/compass/commit/c144385dd5ed16bf354e97824a7c7efc6702fb9a))
+* **usage:** record compute-usage intervals with the session binding (RIG-2872) ([#1509](https://github.com/RigelBuild/compass/issues/1509)) ([d0cffd2](https://github.com/RigelBuild/compass/commit/d0cffd2828b1534ac0f1d97df88c60eb556942e7))
+
+
+### Bug Fixes
+
+* **agent-image:** bundle legacy Pi module registry (RIG-4070) ([#1378](https://github.com/RigelBuild/compass/issues/1378)) ([f1ab32d](https://github.com/RigelBuild/compass/commit/f1ab32d3f5acd7a7630a5bd1c9d00f41bcb17dab))
+* **auth:** scope bearer callers to their token's tenant (RIG-4066) ([#1375](https://github.com/RigelBuild/compass/issues/1375)) ([dc0a9f4](https://github.com/RigelBuild/compass/commit/dc0a9f4f0b7fc7521f6a598a4af9cee6524c5b19))
+* **build:** ship the pinned secretspec CLI with compass-server (RIG-4583) ([#1758](https://github.com/RigelBuild/compass/issues/1758)) ([1024cd5](https://github.com/RigelBuild/compass/commit/1024cd522fe2f712ab9406e05ca2b07b18a12823))
+* **ci:** run design-ledger touch-coupling on PRs, fail if unwired (RIG-3924) ([#1799](https://github.com/RigelBuild/compass/issues/1799)) ([e9aea23](https://github.com/RigelBuild/compass/commit/e9aea2340481c629ba9f118e858c811c5b9e5d5d))
+* **ci:** save the e2e Go cache only from main push/schedule (RIG-4384) ([#1629](https://github.com/RigelBuild/compass/issues/1629)) ([ce258fd](https://github.com/RigelBuild/compass/commit/ce258fd05b7cb14ecfbe50c7b6aa20d093074236))
+* **comms:** refuse a member's owner-only post with PermissionDenied (RIG-4116) ([#1424](https://github.com/RigelBuild/compass/issues/1424)) ([ba2938d](https://github.com/RigelBuild/compass/commit/ba2938d4f254983b75c7fcd803e40cf4d2a8e241))
+* **comms:** resolve update_members channel by name for agent tools (RIG-3030) ([#1588](https://github.com/RigelBuild/compass/issues/1588)) ([8c851ed](https://github.com/RigelBuild/compass/commit/8c851ed235812025df6125794974075de0476007))
+* **comms:** trim a departing member's final ChannelChanged to the channel id (RIG-1325) ([#1745](https://github.com/RigelBuild/compass/issues/1745)) ([50b3224](https://github.com/RigelBuild/compass/commit/50b3224c6d41fad32e42dea38f835c8c53bbad55))
+* **compass-agent:** keep benign horizontal whitespace in marker rendering (RIG-1544) ([#1262](https://github.com/RigelBuild/compass/issues/1262)) ([fdd4f8f](https://github.com/RigelBuild/compass/commit/fdd4f8f8ff451b48a84b686f8013a3e0d061c087))
+* **compass-agent:** mark a full forge_list_issues page as possibly having more (RIG-4121) ([#1511](https://github.com/RigelBuild/compass/issues/1511)) ([acf0a86](https://github.com/RigelBuild/compass/commit/acf0a8613759d74dec1651a83669777933fd7d83))
+* **compass-agent:** render GitHub App [bot] logins in forge_account (RIG-4120) ([#1427](https://github.com/RigelBuild/compass/issues/1427)) ([ea515f5](https://github.com/RigelBuild/compass/commit/ea515f5880f697d75b7d468c2d98c7bd4ba1e80a))
+* **compass-agent:** run tests against a scratch omp agent dir (RIG-4110) ([#1512](https://github.com/RigelBuild/compass/issues/1512)) ([5369eb1](https://github.com/RigelBuild/compass/commit/5369eb17f04783f899f7830fa07a47d6ee4dc6d8))
+* **delivery:** fire a hold that lost the race to its settle; skip held in start sweeps (RIG-4031) ([#1351](https://github.com/RigelBuild/compass/issues/1351)) ([8a58d24](https://github.com/RigelBuild/compass/commit/8a58d24cc76c61b47c406f307e5adae6cb5bce74))
+* **delivery:** wake owed agents when a Runner attaches (RIG-4166) ([#1465](https://github.com/RigelBuild/compass/issues/1465)) ([066e46c](https://github.com/RigelBuild/compass/commit/066e46c8a9a3d1f954750a8dc10d342c43c75b1f))
+* **design-ledger-gate:** exempt Trunk merge-queue PRs from touch-coupling (RIG-4821) ([#1922](https://github.com/RigelBuild/compass/issues/1922)) ([b698561](https://github.com/RigelBuild/compass/commit/b698561b3f80d0e5ad4e18ec4e1904ac1533ff11))
+* **devenv-cli:** reject multi-output nix builds; test repo charset (RIG-3047) ([#1517](https://github.com/RigelBuild/compass/issues/1517)) ([13a204c](https://github.com/RigelBuild/compass/commit/13a204cdc4fd8e1dc8099d8d0413d588143d5034))
+* **devenv:** correct the runner-token comment to the real failure (RIG-3935) ([#1321](https://github.com/RigelBuild/compass/issues/1321)) ([8eb37ab](https://github.com/RigelBuild/compass/commit/8eb37abdf8381b8cfde5fa4853679283db6ce446))
+* **devenv:** default GOLANGCI_LINT_CACHE to the per-clone lint cache (RIG-1465) ([#1792](https://github.com/RigelBuild/compass/issues/1792)) ([56feb99](https://github.com/RigelBuild/compass/commit/56feb9905e096cef6febed7b7a09acdcadd67d36))
+* **devenv:** fail the dogfood builds instead of exec'ing a stale binary (RIG-3935) ([#1318](https://github.com/RigelBuild/compass/issues/1318)) ([263cebd](https://github.com/RigelBuild/compass/commit/263cebdc4a439af6bdf7521c7f0e8305b57f343a))
+* **devenv:** guard XDG_RUNTIME_DIR before dogfood:clean removes anything (RIG-3366) ([#1317](https://github.com/RigelBuild/compass/issues/1317)) ([4353932](https://github.com/RigelBuild/compass/commit/4353932875e7cda8570b0a11e8c6d75225fd3412))
+* **devenv:** name both halves of the masked token-read failure (RIG-3935) ([#1322](https://github.com/RigelBuild/compass/issues/1322)) ([998397c](https://github.com/RigelBuild/compass/commit/998397cb3b73b35288c422b66c27db04b78721b2))
+* **devenv:** refuse a NUL or UTF-16 version.txt before stamping (RIG-3439) ([#1789](https://github.com/RigelBuild/compass/issues/1789)) ([5b23d08](https://github.com/RigelBuild/compass/commit/5b23d08ac974f62e874fc656e6c7f854132ff1e0))
+* **devenv:** surface a failed runner-token read instead of enrolling empty (RIG-3935) ([#1320](https://github.com/RigelBuild/compass/issues/1320)) ([12e4007](https://github.com/RigelBuild/compass/commit/12e40078a63064deba557e57f2a90fc6a6ed81fd))
+* **dl-claim:** give a runnable status check and the returned ids (RIG-3634) ([#1419](https://github.com/RigelBuild/compass/issues/1419)) ([0879f01](https://github.com/RigelBuild/compass/commit/0879f0179e9f54fe62359d92c93c89cf0999fb2b))
+* **dl-reconcile:** classify ledger lines once for both counters (RIG-3634) ([#1325](https://github.com/RigelBuild/compass/issues/1325)) ([1ba92c8](https://github.com/RigelBuild/compass/commit/1ba92c866ac68674f56cf86a5a1c21252285a9a0))
+* **dl-reconcile:** classify ledger lines once for both counters (RIG-3634) ([#1327](https://github.com/RigelBuild/compass/issues/1327)) ([401bbb7](https://github.com/RigelBuild/compass/commit/401bbb710638c1ab57fe948a654e77942e66ef44))
+* **dl-reconcile:** reject unrendered ledger rows (RIG-3941) ([#1489](https://github.com/RigelBuild/compass/issues/1489)) ([fc2c80d](https://github.com/RigelBuild/compass/commit/fc2c80d97b3a8b3a04301fa5c08420ade5384d99))
+* **e2e:** carry the shared stand-up failure text into every leg (RIG-4613) ([#1759](https://github.com/RigelBuild/compass/issues/1759)) ([e388948](https://github.com/RigelBuild/compass/commit/e3889482a94683b0cab6574712391a22845edc94))
+* **fabric:** park an event once when a late Term races the advisory (RIG-4494) ([#1683](https://github.com/RigelBuild/compass/issues/1683)) ([6e9a113](https://github.com/RigelBuild/compass/commit/6e9a113b2966af061142b2f1f4f1956cc2f53101))
+* **fabric:** reap abandoned durable consumers after 2x MaxAge (RIG-3448) ([#1807](https://github.com/RigelBuild/compass/issues/1807)) ([1ddda30](https://github.com/RigelBuild/compass/commit/1ddda30e6685fddf6c15cb2c1e2abf5081c1492e))
+* **font-gate:** enforce fail-closed font coverage parsing (RIG-3742) ([#1294](https://github.com/RigelBuild/compass/issues/1294)) ([b1ddf48](https://github.com/RigelBuild/compass/commit/b1ddf48d63decdf3bfffddb19f6f4297c484e497))
+* **forge:** apply list_issues limit so an agent gets a bounded page (RIG-4121) ([#1426](https://github.com/RigelBuild/compass/issues/1426)) ([d2a48e1](https://github.com/RigelBuild/compass/commit/d2a48e18bf1d3d7bfef1a82eab5664e4ac2dad32))
+* **forge:** leave a PR's checks unset when no roll-up was fetched ([#1680](https://github.com/RigelBuild/compass/issues/1680)) ([ca5a14e](https://github.com/RigelBuild/compass/commit/ca5a14e7b0cb8e831738c65ea8b0e06deb239e2e))
+* **go:** serialize concurrent golangci-lint runs (RIG-4813) ([#1889](https://github.com/RigelBuild/compass/issues/1889)) ([419f3ad](https://github.com/RigelBuild/compass/commit/419f3ada001eed2d39feae6a59a1adb5d8ed1763))
+* **guest-image:** allowlist layer entry types and fixture-test the unpack (RIG-3850) ([#1334](https://github.com/RigelBuild/compass/issues/1334)) ([e2df925](https://github.com/RigelBuild/compass/commit/e2df9254cc6e7315745819102e2608fb2238b381))
+* **guest-image:** stop the e8/e9 fixture checks racing tar against grep -q (RIG-3850) ([#1398](https://github.com/RigelBuild/compass/issues/1398)) ([3d9db31](https://github.com/RigelBuild/compass/commit/3d9db31ca2dc588e5e7004bf7344c8534bbc8f8b))
+* **hooks:** bound the pre-push moon ci concurrency to 4 ([#1682](https://github.com/RigelBuild/compass/issues/1682)) ([4fae441](https://github.com/RigelBuild/compass/commit/4fae441cbf55cdc1f20cca668c3060206ea3696d))
+* **ingest:** skip check_suite events whose head sha has no pull request at debug level (RIG-4205) ([#1507](https://github.com/RigelBuild/compass/issues/1507)) ([895c7be](https://github.com/RigelBuild/compass/commit/895c7be301ec2f3490aee259982be91f94e95f2a))
+* **linearagent:** key session posts on the Linear-Delivery id (RIG-2717) ([#1361](https://github.com/RigelBuild/compass/issues/1361)) ([07705d0](https://github.com/RigelBuild/compass/commit/07705d0bec29e44e9a9be7b397c9012968843770))
+* **linearagent:** read prompted follow-up text from agentActivity.content.body (RIG-4161) ([#1461](https://github.com/RigelBuild/compass/issues/1461)) ([c1590b2](https://github.com/RigelBuild/compass/commit/c1590b2cbb946259df3ccba131b11e142ce76ff9))
+* **linearagent:** route Linear comment events by issue identifier when number is absent (RIG-4205) ([#1502](https://github.com/RigelBuild/compass/issues/1502)) ([ab1e45b](https://github.com/RigelBuild/compass/commit/ab1e45bdb2fdadd725d82fe9189ea75f788d3ebe))
+* **linearagent:** skip Linear emits for a replayed delivery (RIG-4133) ([#1781](https://github.com/RigelBuild/compass/issues/1781)) ([5c58c64](https://github.com/RigelBuild/compass/commit/5c58c644a7d49bf4f78fb52f338447d28345d1f6))
+* **macos-bundle:** bound the pre-create hdiutil calls (RIG-3939) ([#1484](https://github.com/RigelBuild/compass/issues/1484)) ([fbc9c56](https://github.com/RigelBuild/compass/commit/fbc9c56bfd296e37157a6773d14a41ab84aaea48))
+* **macos-bundle:** inject the pre-create flush so tests never run a real sync (RIG-4476) ([#1671](https://github.com/RigelBuild/compass/issues/1671)) ([7d7f1a9](https://github.com/RigelBuild/compass/commit/7d7f1a92152c980fa160ed6579895a2ded5aa5e0))
+* **macos-bundle:** name what holds the staging tree when hdiutil create fails (RIG-3939) ([#1326](https://github.com/RigelBuild/compass/issues/1326)) ([991625d](https://github.com/RigelBuild/compass/commit/991625dd5dff676688ad337acd9fa889cf1d8604))
+* **macos-bundle:** retry hdiutil create when the image is busy (RIG-3939) ([#1483](https://github.com/RigelBuild/compass/issues/1483)) ([5137d11](https://github.com/RigelBuild/compass/commit/5137d1184d7e346616f905e2ec71af88513b024a))
+* make main green again (RIG-4878) ([#1990](https://github.com/RigelBuild/compass/issues/1990)) ([ea5c036](https://github.com/RigelBuild/compass/commit/ea5c03617cfc4dadf76d32c1efbf16e24eaf50a8))
+* **microvm:** treat a cancelled launch ctx as an expected teardown wait (RIG-4124) ([#1431](https://github.com/RigelBuild/compass/issues/1431)) ([8537af8](https://github.com/RigelBuild/compass/commit/8537af8ae770167211c261945fe52e390249b997))
+* **release:** let rootlesskit create user namespaces on ubuntu-24.04 (RIG-4129) ([#1439](https://github.com/RigelBuild/compass/issues/1439)) ([d783fc1](https://github.com/RigelBuild/compass/commit/d783fc142db13b223ff5ea182b56f4c8edf9b374))
+* **release:** republish guest and runner images on devenv.lock changes ([#1689](https://github.com/RigelBuild/compass/issues/1689)) ([9a39795](https://github.com/RigelBuild/compass/commit/9a39795bee9562bb03b34ee014a0dae1b42e4938))
+* **release:** tag runner image only after digest check; rename-aware closure diff (RIG-4025) ([#1344](https://github.com/RigelBuild/compass/issues/1344)) ([92e4a29](https://github.com/RigelBuild/compass/commit/92e4a2972ac97263099375a24665656206dd5128))
+* **repo:** exempt release CHANGELOG from MD050 (RIG-1746) ([#1650](https://github.com/RigelBuild/compass/issues/1650)) ([f89fa83](https://github.com/RigelBuild/compass/commit/f89fa83fd246414498e22e712507110e4bb63864))
+* **runner,server:** report ERRORED after in-flight frames and reject spawn on an errored agent (RIG-4097) ([#1634](https://github.com/RigelBuild/compass/issues/1634)) ([5dd4cc0](https://github.com/RigelBuild/compass/commit/5dd4cc07a21efb16320114e0e678bf2cc99d95b8))
+* **runner:** bound ControlAck size before decode (RIG-4777) ([#1849](https://github.com/RigelBuild/compass/issues/1849)) ([31f37bd](https://github.com/RigelBuild/compass/commit/31f37bd2cae068bd459d7b6ea6e83d136a5f7a2f))
+* **runner:** consume server-minted session IDs (RIG-3696) ([#1304](https://github.com/RigelBuild/compass/issues/1304)) ([e9fcfdf](https://github.com/RigelBuild/compass/commit/e9fcfdf033359259960346619017539fa491f39b))
+* **runner:** handle a container removed outside Compass on podman (RIG-4401) ([#1639](https://github.com/RigelBuild/compass/issues/1639)) ([0100ae8](https://github.com/RigelBuild/compass/commit/0100ae84f39badfc3b8852c90fe5ea4cc0c61dcc))
+* **runnerhub:** cap inbound RunnerService messages (RIG-3586) ([#1676](https://github.com/RigelBuild/compass/issues/1676)) ([f1c3291](https://github.com/RigelBuild/compass/commit/f1c3291df5c5c1e5bb59e5d4f4d656ee786929ba))
+* **runnerhub:** fail enrollment when the durable reap fails (RIG-3691) ([#1700](https://github.com/RigelBuild/compass/issues/1700)) ([c7a9a5f](https://github.com/RigelBuild/compass/commit/c7a9a5ffc3447c8a26a54cb9969f2a03c8a19b99))
+* **runnerhub:** keep the container binding after Start so a resume can fetch secrets (RIG-4122) ([#1458](https://github.com/RigelBuild/compass/issues/1458)) ([e01f820](https://github.com/RigelBuild/compass/commit/e01f820435085ee514644570000544b31744e845))
+* **runnerhub:** reap a Runner's session bindings in every tenant on enroll (RIG-4296) ([#1606](https://github.com/RigelBuild/compass/issues/1606)) ([2059ba7](https://github.com/RigelBuild/compass/commit/2059ba78c0d259569ef73faebf2f0363a4235b0f))
+* **runnerhub:** reap a Runner's session bindings on every enroll (RIG-4223) ([#1515](https://github.com/RigelBuild/compass/issues/1515)) ([17e3f8f](https://github.com/RigelBuild/compass/commit/17e3f8f300ec680beaa3a6abaacc2f29d0d229a3))
+* **runnerhub:** reject FetchSecrets from a Runner that does not own the session (RIG-4102) ([#1404](https://github.com/RigelBuild/compass/issues/1404)) ([ae03a60](https://github.com/RigelBuild/compass/commit/ae03a6098be57374ccee5a3cfeeb6e9010540d90))
+* **runnerhub:** reject Runner calls for a session another Runner owns (RIG-4083) ([#1399](https://github.com/RigelBuild/compass/issues/1399)) ([a7e6b28](https://github.com/RigelBuild/compass/commit/a7e6b2858bf89ff6c7b0cc7fb6862d14dea2f6ad))
+* **runnerhub:** report a token-store fault as Unavailable, not Unauthenticated (RIG-4529) ([#1711](https://github.com/RigelBuild/compass/issues/1711)) ([056c388](https://github.com/RigelBuild/compass/commit/056c38810ebfa03b8bf24106d544da25f0632b65))
+* **runnerhub:** rotate a runner token file registered to another subject (RIG-3343) ([#1548](https://github.com/RigelBuild/compass/issues/1548)) ([2040628](https://github.com/RigelBuild/compass/commit/2040628c9d1da5a3da52af1ac36febf7c2bd550c))
+* **runnerhub:** scope Runner-originated binding calls to the session's tenant (RIG-4146) ([#1463](https://github.com/RigelBuild/compass/issues/1463)) ([e25b064](https://github.com/RigelBuild/compass/commit/e25b0640b033e6e34da676321794cf084b45e88b))
+* **runnerhub:** scope the faulted-reap read-through refusal per Runner (RIG-3691) ([#1681](https://github.com/RigelBuild/compass/issues/1681)) ([7e8faf5](https://github.com/RigelBuild/compass/commit/7e8faf50816d6c3f550ccb02a884c0efeed2a052))
+* **runnerhub:** serialize enroll reaps with session promotion ([#1756](https://github.com/RigelBuild/compass/issues/1756)) ([77a78f5](https://github.com/RigelBuild/compass/commit/77a78f530274c3561fd3b978a82e1ddac77c0908))
+* **runnerhub:** treat a Runner-reported ERRORED as the lost-session edge (RIG-4221) ([#1570](https://github.com/RigelBuild/compass/issues/1570)) ([541031f](https://github.com/RigelBuild/compass/commit/541031fa1a7da8a66688f9f7ae6e5cfddb38d372))
+* **runner:** keep a live container's socket when re-Provision fails (RIG-4075) ([#1385](https://github.com/RigelBuild/compass/issues/1385)) ([19a0444](https://github.com/RigelBuild/compass/commit/19a044450c76f568f7d8443eea91da19c1725247))
+* **runner:** re-Provision replaces a registered workload that is not running (RIG-4199) ([#1609](https://github.com/RigelBuild/compass/issues/1609)) ([5ebcb61](https://github.com/RigelBuild/compass/commit/5ebcb611256542736bcef20f4cf1c2b1e842d6dd))
+* **runner:** read the stream outcome when the bootstrap Send hits EOF (RIG-4359) ([#1605](https://github.com/RigelBuild/compass/issues/1605)) ([69c7a19](https://github.com/RigelBuild/compass/commit/69c7a1959e786b93725896530e5b62e0880ccda0))
+* **runner:** reject re-Provision onto a launched container name (RIG-4090) ([#1422](https://github.com/RigelBuild/compass/issues/1422)) ([dc0ad13](https://github.com/RigelBuild/compass/commit/dc0ad13744747d0bd60c727cc9f87f9a9d90eec7))
+* **runner:** report agent exit while a descendant holds the stdio pipes (RIG-4100) ([#1510](https://github.com/RigelBuild/compass/issues/1510)) ([81c9e67](https://github.com/RigelBuild/compass/commit/81c9e67e3ccdd6ed14775046001865e60cf8cf2b))
+* **runner:** report unexpected agent exits with stderr tail (RIG-4068) ([#1371](https://github.com/RigelBuild/compass/issues/1371)) ([2980408](https://github.com/RigelBuild/compass/commit/298040822eebd80d9f8019fee9805097069551df))
+* **runner:** retry enrollment with bounded backoff (RIG-3691) ([#1699](https://github.com/RigelBuild/compass/issues/1699)) ([3058dcb](https://github.com/RigelBuild/compass/commit/3058dcb7b1809b08aceeebc6e31aa18360088bb9))
+* **runner:** run the startup preflight under the signal ctx (RIG-3218) ([#1790](https://github.com/RigelBuild/compass/issues/1790)) ([ba07785](https://github.com/RigelBuild/compass/commit/ba07785e967100eb47161543c744768e150be2c9))
+* **runner:** serve AgentGateway.Board by relaying to the Server (RIG-4074) ([#1374](https://github.com/RigelBuild/compass/issues/1374)) ([a47ddde](https://github.com/RigelBuild/compass/commit/a47dddee77bedf1ad3acadd9d6ee076909ca6293))
+* **runner:** sweep detached exec sessions when an agent stops (RIG-4708) ([#1805](https://github.com/RigelBuild/compass/issues/1805)) ([4be37e2](https://github.com/RigelBuild/compass/commit/4be37e293d773084623df80228ca784f4ca48109))
+* **runner:** sweep stale agent containers on startup (RIG-4065) ([#1373](https://github.com/RigelBuild/compass/issues/1373)) ([9e4bb4e](https://github.com/RigelBuild/compass/commit/9e4bb4e4803cf9f91d360891244c9647111b22ea))
+* **runtime:** kill the in-container process group when a CLI exec client dies (RIG-4181) ([#1791](https://github.com/RigelBuild/compass/issues/1791)) ([9b77e93](https://github.com/RigelBuild/compass/commit/9b77e93b82fbb321030ae50136826cad695d2548))
+* **server:** close doors when the shutdown drain overruns (RIG-1252) ([#1785](https://github.com/RigelBuild/compass/issues/1785)) ([231a8be](https://github.com/RigelBuild/compass/commit/231a8be7a55c1ca0643384c0a67aa0220916ac85))
+* **server:** forge_list_issues with no state lists open issues (RIG-4160) ([#1459](https://github.com/RigelBuild/compass/issues/1459)) ([995750b](https://github.com/RigelBuild/compass/commit/995750b2c6c1de40a63f2309f1b0348a8ef08d7b))
+* **server:** match the whole socket identity before cleanup removes it (RIG-4696) ([#1786](https://github.com/RigelBuild/compass/issues/1786)) ([72ad0c1](https://github.com/RigelBuild/compass/commit/72ad0c17c9b8e734de6cfd3d13535163b369b180))
+* **server:** re-provision a lost container when waking an agent (RIG-4131) ([#1442](https://github.com/RigelBuild/compass/issues/1442)) ([f1d47bf](https://github.com/RigelBuild/compass/commit/f1d47bfb6f82e8db9bbc2dd9eb0876c4aa8da8ae))
+* **server:** register the Linear write coordinate with host linear.app (RIG-4038) ([#1356](https://github.com/RigelBuild/compass/issues/1356)) ([c733d49](https://github.com/RigelBuild/compass/commit/c733d4978c4449415015e7d42f456debb40d7ee3))
+* **server:** reject forge coordinates registered with an empty host (RIG-3870) ([#1667](https://github.com/RigelBuild/compass/issues/1667)) ([e9e698f](https://github.com/RigelBuild/compass/commit/e9e698f802a702c1bd67b07280ea1fb8aa73200b))
+* **server:** resolve admin-door agent and account handles (RIG-2880) ([#1339](https://github.com/RigelBuild/compass/issues/1339)) ([f5f361a](https://github.com/RigelBuild/compass/commit/f5f361a6cf9533cfbb2039301ee210bca73b93f2))
+* **server:** resolve the despawn target by agent handle (RIG-2880) ([#1338](https://github.com/RigelBuild/compass/issues/1338)) ([09f9966](https://github.com/RigelBuild/compass/commit/09f9966078a0ea4732a5a9b340fa432597f89b79))
+* **server:** run a delivery-loop wake under the agent's tenant (RIG-4167) ([#1466](https://github.com/RigelBuild/compass/issues/1466)) ([52681dc](https://github.com/RigelBuild/compass/commit/52681dcd28b9d06bcab7dea106120cab71108485))
+* **server:** wake an agent whose session the runner no longer knows (RIG-4145) ([#1455](https://github.com/RigelBuild/compass/issues/1455)) ([02013f5](https://github.com/RigelBuild/compass/commit/02013f59009bb6b23580ef8b5845e561a7cb190e))
+* **server:** wake checks liveness from the hub cache only (RIG-4223) ([#1516](https://github.com/RigelBuild/compass/issues/1516)) ([8300131](https://github.com/RigelBuild/compass/commit/83001319324dd6b7a300bf623476ff94f0f7b2f6))
+* **server:** warn when the admin-token state dir is shared ([#1801](https://github.com/RigelBuild/compass/issues/1801)) ([cd1c445](https://github.com/RigelBuild/compass/commit/cd1c445feeb86878238f455f7158a1127e943a38))
+* **stack:** answer the registry bearer challenge when materialising the guest (RIG-3789) ([#1604](https://github.com/RigelBuild/compass/issues/1604)) ([ddece0a](https://github.com/RigelBuild/compass/commit/ddece0a2327e64b9966d48c42e8915400765ec2d))
+* **stack:** authenticate cached guest image reuse (RIG-3906) ([#1401](https://github.com/RigelBuild/compass/issues/1401)) ([49d1d47](https://github.com/RigelBuild/compass/commit/49d1d4734ae6ea955e0d60f5398f814287c2a1f3))
+* **stack:** bound container teardown by ctx and never block Phase A (RIG-4571) ([#1748](https://github.com/RigelBuild/compass/issues/1748)) ([3a26d4b](https://github.com/RigelBuild/compass/commit/3a26d4b7d5e578a597b54c13c446067be6921b6a))
+* **stack:** confirm cross-process teardown by group exit, not socket alone (RIG-3937) ([#1657](https://github.com/RigelBuild/compass/issues/1657)) ([94067d9](https://github.com/RigelBuild/compass/commit/94067d9041ff125b36fe8c6c6ef7c2e2e30c28a3))
+* **stack:** default the microVM runner run root to the runtime dir (RIG-4514) ([#1693](https://github.com/RigelBuild/compass/issues/1693)) ([f3beee1](https://github.com/RigelBuild/compass/commit/f3beee1d6909589762cb6a30b444f2dc829190dd))
+* **store:** a nested channel group takes its parent visibility (RIG-4750) ([#1940](https://github.com/RigelBuild/compass/issues/1940)) ([dc9dc82](https://github.com/RigelBuild/compass/commit/dc9dc82984704eb6e7ad36965522f1e30f8499aa))
+* **store:** backfill session rows stamped with an empty tenant (RIG-4167) ([#1471](https://github.com/RigelBuild/compass/issues/1471)) ([ea782ab](https://github.com/RigelBuild/compass/commit/ea782abf3a08c03e66b0c72313a59232c363e02c))
+* **store:** enforce the owner-qualifier grammar in handle resolution (RIG-2880) ([#1342](https://github.com/RigelBuild/compass/issues/1342)) ([1edb14e](https://github.com/RigelBuild/compass/commit/1edb14edcf788ac62bdae26fc564d109c47c9532))
+* **store:** name the supervisor routing channel routing (RIG-4037) ([#1443](https://github.com/RigelBuild/compass/issues/1443)) ([65b2114](https://github.com/RigelBuild/compass/commit/65b2114b7d2124b1d480aa4c893e54a6167133b9))
+* **store:** refuse a reserved group as a channel-group parent (RIG-4358) ([#1610](https://github.com/RigelBuild/compass/issues/1610)) ([1aad54b](https://github.com/RigelBuild/compass/commit/1aad54bbe833e3e774a367de0faa2183a8dd6594))
+* **store:** refuse reserved top-level group names in CreateChannelGroup (RIG-4045) ([#1364](https://github.com/RigelBuild/compass/issues/1364)) ([020867f](https://github.com/RigelBuild/compass/commit/020867f8e0d15bda4447e52d57409d43c4755b66))
+* **store:** reserve the __linear__ group name at top level (RIG-4045) ([#1521](https://github.com/RigelBuild/compass/issues/1521)) ([36cdb36](https://github.com/RigelBuild/compass/commit/36cdb36b29153f1f82a536c2995c19823f95a0d6))
+* **store:** scope MessageAskIDs to the author's edit authz (RIG-1552) ([#1753](https://github.com/RigelBuild/compass/issues/1753)) ([6f32ae5](https://github.com/RigelBuild/compass/commit/6f32ae519cd63cd1e53187321999fc55be349a64))
+* **toolchain:** derive golangci-lint Go builder arg from nixpkgs (RIG-4180) ([#1474](https://github.com/RigelBuild/compass/issues/1474)) ([91f9e90](https://github.com/RigelBuild/compass/commit/91f9e901274f05bb531cf3a6e635601351b7c998))
+* **toolchain:** evaluate version-guard without copying the working tree (RIG-4094) ([#1392](https://github.com/RigelBuild/compass/issues/1392)) ([a7e4046](https://github.com/RigelBuild/compass/commit/a7e40464fd7dd4382888cc001c24ba4037d9dff2))
+* **tools:** parse UI source with the TypeScript compiler in the font gate (RIG-3855) ([#1274](https://github.com/RigelBuild/compass/issues/1274)) ([d320592](https://github.com/RigelBuild/compass/commit/d320592677c790a47d65d6801d3b390df195c9c7))
+* **ui:** add topbar search accessibility (RIG-4282) ([#1556](https://github.com/RigelBuild/compass/issues/1556)) ([4a718ab](https://github.com/RigelBuild/compass/commit/4a718ab5c9590a432ae2f3d6a2135c5cda0899a5))
+* **ui:** chrome cleanup: drop ADE and usage bar, Session Log naming, pane edges, row re-measure (RIG-4771) ([#1811](https://github.com/RigelBuild/compass/issues/1811)) ([a6742db](https://github.com/RigelBuild/compass/commit/a6742db20df029b975f22fa7fbe9d697290a3423))
+* **ui:** keep the Bridge Issues/PRs toggle in place (RIG-4773) ([#1812](https://github.com/RigelBuild/compass/issues/1812)) ([088b5a2](https://github.com/RigelBuild/compass/commit/088b5a27d04f94d85fcd4706e50c12aeb79204c3))
+* **ui:** live Session Log tails SubscribeAgentSession for the open agent (RIG-4772) ([#1814](https://github.com/RigelBuild/compass/issues/1814)) ([173c723](https://github.com/RigelBuild/compass/commit/173c723a7f4e0ee62a107d1c41cb4361b6b4dfe9))
+* **ui:** reset top-level markdown margins and zero .r-tab padding (RIG-4087) ([#1381](https://github.com/RigelBuild/compass/issues/1381)) ([3e4e7b7](https://github.com/RigelBuild/compass/commit/3e4e7b7832b7819a67e31c6dff3a4086b9a4303f))
+* **ui:** retire group_dm channel branches (RIG-3785) ([#1314](https://github.com/RigelBuild/compass/issues/1314)) ([50ec6e3](https://github.com/RigelBuild/compass/commit/50ec6e307de463d174caf750dc9ac92eecc79aff))
+* **ui:** scope the pinned e2e fontconfig to the Playwright browser (RIG-4210) ([#1608](https://github.com/RigelBuild/compass/issues/1608)) ([ca7c412](https://github.com/RigelBuild/compass/commit/ca7c4126d854446759278cd743ef3bd052e2057e))
+* **ui:** use avatarInitial for channel thread summaries (RIG-3765) ([#1305](https://github.com/RigelBuild/compass/issues/1305)) ([e5fd855](https://github.com/RigelBuild/compass/commit/e5fd855555d97d2afb6477bd6f0eb4e56861e942))
+* **vfs:** bound lock waits by ctx, reap by rename, reclaim orphan locks (RIG-3310) ([#1493](https://github.com/RigelBuild/compass/issues/1493)) ([fd09de8](https://github.com/RigelBuild/compass/commit/fd09de840ed542a61393f0b93fe75106d8d32ec6))
+
+
+### Performance Improvements
+
+* **forge:** stop listing issue pages at the requested limit (RIG-4123) ([#1666](https://github.com/RigelBuild/compass/issues/1666)) ([5b7e6e4](https://github.com/RigelBuild/compass/commit/5b7e6e4ceb80b21236723511a1db06cc08766d4d))
+* **store:** resolve AccountsByHandles with one query per namespace (RIG-2880) ([#1346](https://github.com/RigelBuild/compass/issues/1346)) ([ea77193](https://github.com/RigelBuild/compass/commit/ea77193692392adc347f8df15f5a618e078c638a))
+* **store:** walk a PutAgentConfig bundle once for both profile lints (RIG-3220) ([#1797](https://github.com/RigelBuild/compass/issues/1797)) ([fdf6220](https://github.com/RigelBuild/compass/commit/fdf62209242cdc04676d198f8fe116cf32ed9611))
+
 ## [0.3.0](https://github.com/RigelBuild/compass/compare/v0.2.1...v0.3.0) (2026-09-16)
 
 
diff --git a/version.txt b/version.txt
index 0d91a54c7..9e11b32fc 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-0.3.0
+0.3.1