Cerevisor 3.2.1

3.2.1 is a hardening release on the 3.2.0 tree. No new feature, no new screen, nothing new leaving your machine: thirty-eight tickets addressed from things 3.2.0 shipped slightly wrong or left rough. The one you will feel first: a Check-by-hand answer can now be changed. The rest is a run’s own history telling the truth about sizes, secrets, action classes and timeouts, reviews behaving the way the guides already described them, and a Continue that refuses honestly instead of starting a run that does nothing.

1. Check by hand: change your answer

3.2.0 made a Check-by-hand answer permanent: one press, no way back, and a second press was simply refused. Now a settled row carries a Change my answer button. Pressing it offers the two answers again; picking the other one records your change, and the row reads You said: It happened (changed from: It did not happen). Nothing is erased: the change is written as a second decision of your own, and the run’s history holds both, in order, with the later one standing. Pressing it and choosing the answer you already gave is refused with That is already your answer. rather than filling the history with a change that changed nothing. A plain second press on a settled row is still refused, and now names the button that does work: You have already answered this one. To change it, press “Change my answer”.

On your phone you can still give the first answer, but you cannot change one: that would need a message the Companion connection does not have in this version, and it says so: To change an answer, use the run window on your computer.

Two more things about this list are fixed. A run the app was killed during used to answer This run is still finishing — try again in a moment. forever, which was exactly the kind of run most likely to hold a call nobody could account for. Cerevisor now closes out a run that is not live, has no ending, and whose last recorded moment is more than fifteen minutes old (using the same close-out it already runs at startup) and then lets you answer it. A run quieter than that bound keeps the old sentence, because it may genuinely still be finishing. And the search for the run’s own history is now bound to the workflow you are looking at instead of walking every workflow you have ever run.

2. The Overview says when a run was continued

A run started with Continue this run looked, in its Overview, exactly like a run started from scratch. It now opens with This run continues an earlier run. and the same plain sentences the pre-run summary showed you before you confirmed: what was kept, what runs fresh, what picks up its own session. An exported run carries those lines too, right under the counts. A run launched the ordinary way says nothing extra.

3. Reviews: the default has a setting, a reviewer reaches no connected server, only its reviewer’s word counts

Five things about reviews were true in the code and not true in practice.

• The workflow-wide review default now has a row in Settings. In 3.2.0 the chat builder could set it and nothing could unset it, so a workflow whose default was Always with no reviewer on the canvas blocked Run with no way back. The workflow section of Settings now carries Needs review before it counts (default for this workflow) with the three choices, under a line saying a card’s own setting wins over it. The message that blocks Run names Settings, so the block says where to go.
• A reviewer reaches no connected server. A reviewer is meant to be read-only, but it still inherited whatever connected servers the workflow assigned, so a card that may not write a file could reach a server that writes anything. A card that reviews another now resolves to no servers at all, whatever it or the workflow was given. Separately, the pre-run summary, live chat and a reviewer’s own sub-agents now list the narrowed tools a reviewer actually gets instead of the wider set, so what you confirm is what runs.
• Only the reviewer’s word counts. The standing verdict on an agent’s work now comes only from the card the run actually paired to it as its reviewer. Any other author’s review-shaped note stays on the board and is never taken as the verdict: a producer cannot certify itself, and a bystander cannot overwrite a real review.
• Turning review off and on again reuses the reviewer card it made before, instead of leaving the old one behind on the canvas as an ordinary agent and inserting a second. A reviewer card no longer draws the “this agent is connected to nothing” warning, and a card pasted from elsewhere always lands with review switched off rather than arriving switched on with no reviewer behind it.
• A reviewer is told when nothing was produced. A producer that writes its file and returns no closing text used to hand the reviewer an empty page to judge. The reviewer is now told, in one sentence, that there was nothing to read and asked to say so in its review. And when a sent-back producer’s work is passed to a downstream agent as a list of files, the reviewer’s own sentence is lifted off the top first. It used to be read as a file path that does not exist.

One review rule was simply not working: the third signal for Only when the agent is unsure (the agent’s work was rejected by a check and it had to be asked again) required a state no run ever reaches, so it never fired. It now reads the run’s own retry record, and the documentation says what the code does rather than what the plan hoped.

4. A run that already finished cannot be continued

Pressing Continue this run on a run whose agents had all finished started a run that did nothing and then reported success. It is now refused before anything starts: Everything in this run already finished — there is nothing to continue.

If the check Cerevisor makes to work out what continuing would do cannot be made at all, a Continue now stops instead of going ahead: Cerevisor could not work out what continuing this run would do, so it did not start it. Try again. An ordinary launch is unchanged: it still carries on if that check fails, because an ordinary launch has nothing to work out. And on a Continue that resumes a Cursor cloud agent, Cerevisor no longer waits forever for Cursor to answer: pressing Stop ends the wait, and a resume that never answers inside the run’s own inactivity window is stopped and says so in plain words rather than hanging.

5. What the record gets right now

A run’s history is Cerevisor’s account of what happened, so several small wrongnesses in it were worth a release of their own.

• Sizes are in bytes. The size recorded for a fetched page counted characters, not bytes, so anything non-English read small.
• Secrets in a web address are removed from all of it. 3.2.0 replaced secret-looking query values and left the rest. Now a secret-shaped path segment is replaced too, a fragment is dropped entirely (it never reaches a server, so nothing is lost from the account), a user name and password written into the address are cleared, and the query keeps its original order instead of being shuffled. All of that happens before the address is written down, so it holds even for a request Cerevisor then refuses to make.
• A consequential tool call is recorded as consequential. The second, audited copy of each call carried no action class, so it read routine whatever the call actually was.
• The first uncertain call is recorded as the first. A call Cerevisor could not account for was filed as though it had already been retried to the limit.
• A connected server that stops answering is recognised by type, not by its sentence. The timeout used to be identified by matching the words of an error message, which quietly breaks the moment the wording changes.
• Another program’s temporary files are no longer blamed on an agent. Cerevisor was watching the operating system’s own temp folder, so anything else on your machine writing there during a run was reported in that run’s trail as a write outside the workflow folder by your agent. That folder is no longer watched, which also means a genuine write there by an agent is no longer reported.
• Pause All reported the id of whichever run happened to be last instead of nothing, an unused value that read as if one run owned the pause.
• Two robustness fixes with no visible behaviour: an agent named after a built-in object property no longer breaks a status lookup in the run window, and a run whose history was cut off by a crash now has its summary rebuilt from what was written, under test.

Some of this changes what is recorded, not only what is shown, so a 3.2.1 recording differs from a 3.2.0 one of the same work: the retry count on a first uncertain call reads 1 rather than the retry cap; the audited copy of a consequential call now carries its real class (the primary record of that call still reads routine, an open ticket); the size of a fetched page is now in bytes; and a recorded address may be re-spelled by the redaction pass as well as shortened. Three more changes are worth knowing. A run recorded by 3.2.0 that never got as far as its first written moment is now closed out with an empty summary instead of being re-examined at every launch, so your phone answers such a run with an empty Overview rather than with nothing at all. Cerevisor closed before this run finished can now appear on a run closed while the app is open, because answering a long-dead run by hand is what closes it. And reviews recorded before 3.2.1 carry no record of which card reviewed which, so re-opening an older run shows its review notes on the board without a standing verdict on the tile.

6. Housekeeping

• The tests no longer write your real Cerevisor folder. The end-to-end suite kept chat transcripts under your home directory rather than the throwaway one it is given. Nothing of yours was read or sent anywhere, but a test run could leave files in ~/.cerevisor; it no longer can.
• The phone’s board drops an id it cannot send. An unusually shaped note id used to break the connection to your phone instead of being trimmed or dropped; it is now checked the way the two sibling messages already check theirs. A refused mark now refreshes the list on both the phone and the run window instead of leaving a stale row.
• npm run check:mobile builds what it checks, a cost is never shown as a negative number, and several explanatory comments in Cerevisor’s shared copy file now sit on the members they describe.
• Everything user-facing that changed in this release lives in that one shared copy file, so the run window, the export and the phone say the same words.

Known limits

• Your phone cannot change a Check-by-hand answer. It can give the first answer; changing one is done in the run window on your computer, and the phone says so.
• Turning review back on reuses the reviewer card, but the line drawn between a producer and its reviewer is not durable. The connection made when a reviewer is inserted is removed again by the canvas’s own automatic wiring the next time you edit the workflow. The review itself still happens (the pairing is carried by the cards, not by the drawn line), but the line may disappear.
• A further twenty-eight tickets were deliberately deferred rather than fixed here, each because it would need a new connection between the app’s halves, a new shape in the record, a new setting or a design decision, among them a stable identity for each recorded step (which is why a run whose history is genuinely unreadable still cannot be checked by hand), a per-run identity on security records, the final address after a redirect, and the question of whether a continued run should re-run the pre-run capability check. They are listed one by one, with the reason each waits, in the design note at docs/superpowers/specs/2026-09-11-cerevisor-3-2-1-hardening-design.md § 2.3.
• Everything listed under 3.1.0’s, 3.1.1’s and 3.2.0’s known limits still applies, except the ones below.

What this closes from 3.2.0’s known limits

These bullets in the 3.2.0 release note are no longer true of this version. That note is left as the record of what 3.2.0 shipped; this is where they are answered.

• “A Check-by-hand answer cannot be changed. One answer per step, from any surface.”: it can be changed in the run window now (§ 1). It still cannot be changed from the phone.
• “A run whose history was torn by a crash cannot be checked by hand at all.”: narrower than it was: a run that was merely left without an ending is now closed out and can be answered (§ 1). A run whose written history is genuinely unreadable still cannot be, and says so.
• “The Overview does not yet show a note saying a run was continued.”: it does (§ 2).
• “A workflow-wide review default of Always, on a workflow with no reviewers, blocks Run until reviewers are added, and there is no Settings screen to reset it from.”: there is one now (§ 3).
• “Turning review off and on again inserts a new reviewer card; the old one stays on the canvas as an ordinary agent until deleted.”: it reuses the card it made (§ 3).
• The pre-run summary no longer overstates a reviewer’s tools, and a reviewer no longer reaches a connected server (§ 3).

What this was verified on

The whole automated suite, the type gates, the desktop-channel contract check, the mobile checks, the coverage gate and a production build were run on this Windows development machine for each of the four code workstreams and again on the merged tree: the files that only time out under full-suite load re-run green on their own. The Ubuntu leg of CI ran green on every workstream for its build and skills jobs; its end-to-end job is red with exactly the set already red on main. Locally the known red set shrank by one: the end-to-end test that was failing because the suite wrote your real Cerevisor folder now passes.

Nothing here has been exercised by hand in the running app, on any installer, or on any phone. Changing an answer, the continuation lines on a real continued run and the new Settings row are written down as unverified rows for a person to run, in docs/plans/2026-09-07-cerevisor-3-1-m2-real-app-checklist.md (K13–K15), and that same checklist’s earlier rows, K1–K12, remain UNVERIFIED too; no row on it has a recorded result. Nothing in this release claims otherwise.

Platforms

Available for Windows, macOS (Intel and Apple silicon) and Linux (AppImage and Debian package), all built from the same tagged tree by the release workflow.

Updating

Existing installations receive the update through Cerevisor’s built-in updater, and the installers are available from cerevisor.com/download and the private GitHub release. Your workflows, run history and settings carry forward untouched; no file format changed.