The Studio shell. Runtime-mode dispatch from the welcome screen, a project rail that mirrors the session rail with permission tags and drift badges, a four-workspace center with an explicit close dialog, and one status strip carrying the MCP host status word. All three renderer registries now have a window teardown owner; nothing had been disposing them.

A terminal that behaves like an IDE terminal. Copy, paste, the context menu and OSC 52 run through a narrow typed IPC surface owned by the main process, so the session's permission handlers stay deny-all and the web clipboard API is never used. An image-only clipboard forwards the raw keystroke to the program in the pty so it attaches the image itself; a copied file pastes as a quoted path; a drop inserts up to 32 shell-quoted paths without pressing Enter. Links activate with the platform modifier and open through a Vex-branded consent dialog whose policy stays in main: one-use proposal, expiry bound to the asking window, URL re-checked at the answer.

Explorer, watcher and viewer. A file explorer over a per-platform watcher backend chosen explicitly (windows, inotify, fs-events) instead of a hidden watchman probe on every subscribe. A deleted directory is reported as its highest missing ancestor whatever the platform's event stream delivers.

The pty host never outlives VEX. A pty host from a killed main process used to survive with a shell sitting inside a deleted project folder, which is what made a Windows project delete fail with nothing but "Operation was aborted". The host now carries explicit parent identity, polls parent liveness, kills terminal trees on Windows, and a startup reaper collects orphans from older runs. A blocked delete names the holder instead of telling you to close unknown programs, and "Close it and retry" kills only re-validated holders of our own.

Errors leave evidence. The first error boundaries in the app: a root boundary and per-workspace boundaries with Retry, with window errors and workspace-restore rejections reported through the existing telemetry channel. Main always writes a sanitized local log line before any consent-gated forward. A blank window on project open now leaves a recovery surface rather than a bare background color.

Legible in both themes. Opaque terminal text backgrounds per theme, xterm minimum contrast raised to 4.5, six new outline glyphs through the icon gate for the Settings register, and a permission badge that says FULL ACCESS in words instead of relying on a generic mark. Contrast is pinned by tests against the real painted background in both themes, and the note is honest that dim text on white measures 3.49:1, which is as far as xterm can go at 50 percent opacity.

One limit stated plainly. A Studio terminal is your own shell: it inherits your user environment the way any terminal does, with VEX's own configuration variables and Electron's process variables stripped before the shell starts (the same deny-list model VS Code uses). Provider and wallet keys live in the VEX vault, not in environment variables, so a terminal does not receive them; what you export in your own shell profile is yours to manage.

Orders with a lifecycle, not a fire-and-forget. Order previews, execution intents, submit lifecycle, provider outcomes and pre-submit revalidation each own durable state. Stop loss, take profit, OCO and trigger-limit orders are part of the surface.

Leverage and the agent's capital share are your settings. Settings -> Lighter -> Trading setup lists every active perpetual market with its live leverage and the market's maximum; you choose a value, read what it does to your margin and your liquidation price, and confirm. VEX signs Lighter's own leverage change locally, submits it once and proves the outcome from the exchange's transaction record, with an open position or without one, cross or isolated. The same card holds the share of the account's collateral the agent may commit. VEX enforces that share before any order the agent prepares is signed, pricing a buy at its approved worst case and counting the exchange fee and the Vex fee; reduce-only orders and spot sells are exempt, and a refusal states the ceiling and the amount that broke it. The agent reads both values as tradingLimits from lighter_rhc_onboarding_status (or the Lighter Core twin) and is told where you change them; no tool can change either. Both paths were exercised on a live Robinhood Chain account before this shipped.

Consent is checked after the nonce and before the bytes. Consent expiry is asserted after nonce acquisition, immediately before signing and again before submission; an expired proposal produces a typed unsubmitted outcome that keeps its signing evidence rather than a silent failure. Vault lock, shutdown and project-scope refusal reach the executor as real cancellation sources.

Deposits and withdrawals carry evidence. Deposit preflight, fee preflight, transaction identity and deposit evidence are recorded before money moves; withdrawals have their own lifecycle, manual claim path and predicted execution timestamp.

The integrator fee is disclosed before you authorize it. 10 bps on perpetuals and 25 bps on spot, maker and taker, with the current versus target tier economics, the reversibility and cooldown, and the authorization duration stated in words on the card. The deposit consent sentence names the network fee without inventing a numerical ceiling it cannot promise.

Honest tool hints. Read-only and destructive hints on every Lighter tool reflect what the handler actually does, wire codes are table-tested against the pinned SDK constants, and Studio admission reasons are typed rather than derived from a string prefix.

A launchpads namespace. Launch images live in one locker shared by both launchpads, published content-addressed with the cid re-derived locally from the fetched bytes before any URL is trusted. The in-app surface takes an image id; the Studio surface takes a path read through a no-follow reader rooted at the project's own root, and the forbidden field on each surface is refused by name.

pools.fun, from suite detection to holder rewards. The V1/V2/V3 contract suite table with typed detection outcomes, a 15-point launch verifier, a simulate-only mode and a suite-aware settlement decoder. Holder rewards claim and distribute read the distributor and its mode from the deployer's own event, quote earnings at one pinned block, and cross-check claim calldata byte for byte against the provider's prepare endpoint. No Vex fee on rewards.

Virtuals bonding-curve trades. Quote and execute against BondingV5 through FRouterV3 on Base and Robinhood Chain, with the implementation address pinned per proxy and re-read before signing, curve arithmetic transcribed from the contracts in integer math, and the on-chain anti-sniper window refused by name unless you accept it explicitly. Graduated agents, Solana and Ethereum get typed hand-offs instead of a wrong answer. The Vex fee is 25 bps, folded under the swap and taken only after the trade succeeds.

Reads at full depth. Virtuals server-side screening with about 45 filters and 26 sorts, a trade tape, creator fees with the measured reason a creator cannot claim through VEX, and candles for every lifecycle stage: graduated pools from GeckoTerminal, bonding agents from the trade tape on Base and Solana, and from the pair's own on-chain Swap logs on Robinhood Chain.

Activity says which family it belongs to. New AgentScan roles for creator fee claims, holder reward claims, reward distribution and launch cancellation; the Vex fee folds under its parent on both feeds with pending and failed attempts visible as "attempt pending" or "attempt failed" rather than disappearing. Attestation verdicts are written only by the server's own read back.

The tool surface grew to 185 protocol tools. Retrieval is measured per namespace, and where a number moved the wrong way it is recorded as measured rather than smoothed over.

Quote-bound swap execution. The route summary you were shown is persisted verbatim with a digest and claimed exactly once; the approval envelope carries the snapshot id, that digest, the approved floor and an expiry. The minimum output derives from the approved amount, and the final signed transaction is revalidated immediately before the signature on every signing lane. A resume that cannot claim the exact row you saw refuses by name: already claimed, superseded, expired, digest mismatch, unbound approval.

Wrap and unwrap, without a round trip. Exact 1:1 native to wrapped-native conversion on a live-verified per-chain registry of eight chains, with locally derived calldata, its own durable intent, and no fee by construction. Unwrapping WETH previously required bridging to another chain and back.

Balances the model does not have to divide. Every balance row carries an exact human string beside the atomic amount, decimals are never guessed, and a missing price is a null value with an explicit unavailable flag rather than a zero. Both balance surfaces report inventory completeness and valuation completeness as two separate axes.

Spending is gated on what the chain says. Quotes read the chain and add insufficient balance, insufficient gas reserve and unreadable balance to the eligibility union, with unreadable failing closed and never being reported as insufficient. The route snapshot seals the transaction set and the per-gas price ceilings; a changed leg set, an exceeded or unreadable fee market, or a plan disagreeing with the approval card each refuse before anything signs.

The Vex fee is the quote's own statement. The approved fee is bound to the signature rather than recomputed at execution time, and the fee gate on the bridge path fails closed with typed divergence reasons instead of a silent comparison.

A named venue when KyberSwap is unavailable. KyberSwap is geo-blocked in some countries and its edge answers before any KyberSwap body is produced. That refusal now names the same-chain fallback, the direct Uniswap venue, and the agent's guidance says when to switch: region or edge block, missing chain or pair coverage, a failed or implausible quote, or your explicit request.

A provider approve step is bound to the plan. A bridge provider's approve step cannot appear between approval and signing without being part of the plan you approved, and the attribution referrer is sent only when an API key is actually configured.

v4 pools on seven chains. The native Uniswap venue prices and executes Uniswap v4 alongside V2 and V3 on Robinhood Chain, Ethereum, Base, Arbitrum, Optimism, Polygon and BNB Chain, through UniversalRouter and transaction-based Permit2 allowances. Routes are single hop and versions are never mixed in one call.

Discovery says what it can and cannot see. For a requested pair the venue probes hookless pool keys at four canonical fee and tick-spacing combinations and validates each candidate against the PositionManager's own key and hash binding before quoting it. Hooked pools are found through DexScreener only, so an unindexed hooked pool or a nonstandard key can still be missed, and that is stated rather than reported as no liquidity.

KyberSwap stays the default router. The direct Uniswap venue is the named fallback, and it is the preferred venue on Robinhood Chain. Nothing about the region-blocked fallback path changes.

A native amount is never overstated. Where a v4 native input can only be bounded from the wallet's isolated-block balance change, it is recorded as a lower bound and labelled as one; a hooked native output that no log can prove stays null on a confirmed swap instead of borrowing the pool's estimate. The Vex fee uses at most the lesser of the requested input and that bound, and missing evidence withholds the fee rather than guessing it.

15 percent of gas-price headroom, measured. Fee sampling on Robinhood Chain and Base showed intervals moving up to 5.2 percent in about three minutes. The approved per-gas ceiling now carries 1500 bps of headroom over the observed estimate, established before approval and sealed in the digest, so a tiny drift between quote and execute no longer refuses a swap. An old quote receives no new headroom at execute time, and a larger rise still requires a fresh quote and a fresh approval. This is a small-sample margin, not a promise about future congestion.

Execute got faster. The execute path refreshes the route it already holds instead of rediscovering it, with redundant preparation reads removed and the RPC budget shared across the quote and execute clients.

Refusals report the shortfall. A slippage refusal states the measured shortfall rather than refusing flatly, the USD price reference is read independently instead of taken from the aggregator's lagging field, an exhausted set of RPC endpoints is a typed refusal, and a nonce lease keeps a refused leg from blocking the next transaction. Receipt waits are bounded.

Snapshots publish every cycle. A bridge in flight used to withhold the whole snapshot line, which is how a wallet with $200 could read $50 with a $150 hole. In-flight money is now a named component of the snapshot: kind, role, amount with symbol, an optional USD estimate, its age and a standing of in transit or unresolved. Unresolved money is listed and counted, never added to the total.

A cached total says it is cached. Per wallet and per chain read status is durable, with the stale-since time and the reason shown beside the total in Portfolio, and a manual refresh that can answer "partial". A failed read defers a group for at most three cycles and then publishes it marked partial. Any P&L comparison touching a partial snapshot is null rather than invented.

Solana balances update again. The bundled read endpoint answers 403 for balance and both token-account programs; the default is repaired to an endpoint measured answering 200, user overrides keep precedence, and a failure is classified with the endpoint host rather than a bare "Error". If you run your own Blockscout, a per-chain base URL override now sits in Settings beside the RPC overrides.

Every provider refusal has a name. The bridge fill verifier tries every RPC the app trusts and names an endpoint's refusal instead of failing anonymously, and provider RPC egress is DNS-pinned with a deadline per bridge leg.

Quieter logs that keep their facts. Engine events are emitted once rather than twice, repeated informational lines collapse to a bounded reminder with a suppressed count, and the log scrubber uses an explicit sensitive-key list plus value-shape matching, so counters survive instead of being redacted.

A turn is no longer called dead at ten minutes. The turn wall clock moves from 10 to 30 minutes, and a successfully continued full-autonomy turn reports that it is waiting for its wake instead of reporting a false terminal state.

A loop is caught and named. Tool-call signatures are result-aware, a repeat gets a corrective cue at the first strike and an honest stop at the second, rather than the same call running seven times.

Crash-orphaned missions come back. A recurring reclaim picks up missions left running by a crash under an exact running-only compare-and-set, claiming the run before cancelling its wake so the deadlock reproduced live cannot recur, with a fail-closed money-state gate on retry.

One activity projection. Running or sleeping with the next wake time, pushed to both the composer strip and the desk tape, with steering unblocked, one owner for the stop affordance, typed operator-interrupt dispositions and cause-specific copy for every named pause.

Superboard key. Settings gains a Superboard section where you generate one share token, see it once and copy it. VEX mints it locally and sends only its SHA-256 to AgentScan, so the ingest write credential is never used as proof of ownership. Generate is once; there is no rotation.

Empty model streams fail over. A stream from OpenRouter that returns nothing within a bounded prefix fails over instead of leaving the turn hanging.

Dependency and packaging hygiene. Sentry Electron 7.18, electron-log 5.4.4, an Electron fuses refresh, a production dependency audit gate with overrides, and electron-updater's js-yaml pinned to 4.3.2 for GHSA-2883-xcg3-v3hh.

Startup ordering. Studio comes up when the database does, readiness commits after the drain, every registration path waits for the database, and teardown never publishes readiness.

Agents get a protocol map. An agent connecting through Studio receives an inline map of the protocols available to it, and the instruction and consent text was corrected to match what the surface actually does.