0.59.0

Train stages

• The integrator carries a train through merge, deploy, and UAT. An app’s integration.stages in apps.json names the stages a train goes through after its cars are merged, and integration.targets says whether a deploy target is auto (the integrator deploys it on the boss’s quoted words) or strict (the default: the boss is asked for each target). A car held before merge leaves the train; a skipped target is the boss’s question. Prompts only: prompts/integrator.md, prompts/apps-config.md, prompts/planning.md, and the spec docs/specs/2026-11-05-train-stages.md.

An unattended box shared by several devs

Design: the shared-box spec.

• The box’s link.log says who sent what to which run (G6). One tower-in line per inbound tower or tower-reply (sender device, team, ask id, message id) and one tower-run line when an ally run takes the message (the run id). Never the text.
• A question or a notice of a shared box goes to the controller that dispatched the unit, and the team’s admins (G3). Before, every dev at dispatch saw, and could answer, every other dev’s worker’s question. The box now sends a question and a run’s notice only to the controller whose ally run or opened main it came from and to the roster’s admins; a unit nobody dispatched (the tower’s own run) is the admins’ alone. An answer from anyone else is refused by the box (dialog-answer-not-recipient in link.log), not just hidden. The signed policy gains no field. unit-status is unchanged.
• A device that leaves the team, or loses dispatch, no longer leaves its work running on the box (G4). An ally run claimed at dispatch ends (gracefully, with the reason in the notice) when its device falls below it, as it already did when the device left the team. A main such a run opened at dispatch is asked to quit as boss_close_main asks it, every 15 seconds until it does: a main that is busy is asked again, and the admins are told once that it still runs and once that it ended. A main opened below dispatch with the boss’s Allow is left alone. Nothing is ended while the link holder cannot read the roster, or on a single look. Not in this release: an admin’s remote stop of one unit.
• Review fixes (security review of G6/G3/G4). The admin of one team is no longer told, and cannot answer, another team’s dispatcher’s question. A revoked device’s main is forgotten only after two sweeps that find it gone and with its pane absent from Herdr; a main still there is reported to the admins instead of dropped without a word. A refused policy file stops the revocation at once (it used to be able to end runs in the 2 to 4 seconds before the holder stopped), and a team the policy dropped has its controllers’ mains ended. A revoke notice or an unanswered-question notice that no admin could be told is sent again later, and a question nobody can be told of stays open with one dialog-unrouted line in link.log. A failed tower open is told to each dev whose message failed. Left as residual in the spec: mains older than 7 days or past the route table’s cap, and a missing policy file.