The first release in three weeks, and the biggest visual change Vestige has had.

The Cognitive Observatory

A raw-WebGPU living memory field is now the main dashboard graph renderer, with a Field/Classic toggle and click-to-inspect GPU picking. Browsers without a working WebGPU adapter fall back to the Classic Three.js renderer automatically, so nobody gets a dead canvas.

42 bug fixes that had never shipped

Three adversarial audits (#139, #140, #141) fixed 42 backend bugs that were sitting on main unreleased since July 2. Highlights: a migration path that could brick a database mid-upgrade, a suppress/undo pair that was not actually reversible, a UTF-8 boundary panic in the intention parser, and vestige backup failing silently on encrypted databases.

Auto-consolidation is now opt-out, and respects your pins

Thanks to @Vrakoss, who both reported the problem and wrote the fix (#142, #143). Set VESTIGE_AUTO_CONSOLIDATE_MERGE=0 to disable the background merge pass. Protected (pinned) memories are now excluded from it. Being honest about the remaining gap: when the pass is enabled, its merges are still hard deletes with no reversible trail. Use the dedup tool for merges you can undo.

Installs fixed

npm install has been failing on every Intel Mac since v2.2.1, because the release tarball ships INSTALL-INTEL-MAC.md and the installer rejected any archive member outside the three binaries. Fixed.

source_sync was a compiled-out stub on Windows and Intel Mac, so one of the 13 advertised tools silently did nothing there. Both platforms now ship the connectors feature.

Cloud sync is zero-knowledge or nothing

The optional cloud-sync client now requires end-to-end encryption in both directions. It refuses to upload plaintext and refuses to accept a plaintext remote archive. Endpoints must be https. Your passphrase never leaves your machine, and losing it means the data is unrecoverable by design.

The local core remains free forever and is never metered.

Upgrade notes

Migrations V19 and V20 run automatically. If you synced more than one project of the same source system under 2.2.x, their records could clobber each other. V20 clears the connector cursors so your next source_sync does a full re-scan and repairs them, no manual step required.

Black Box tracing is on by default and can be disabled with VESTIGE_TRACE=0. Traces are pruned after 30 days, tunable via VESTIGE_TRACE_RETENTION_DAYS.

If you used cloud sync on 2.2.x without a passphrase, 2.3.0 will refuse the plaintext archive. Set VESTIGE_CLOUD_ENCRYPTION_KEY and re-upload from the machine that still holds your local data.

Release gates

SECURITY.md previously claimed zero vulnerabilities while cargo audit reported five. The dependencies were updated so the claim is now true.

CI had also been red on main since July 18: there was no toolchain pin, so a Rust 1.97 lint change broke a line that had been in the tree since v1.0.0. This release adds rust-toolchain.toml so a future Rust release cannot turn main red with no code change.

Full detail in CHANGELOG.md.