Empryo ships with two engines now. The classic one, and a lean one that stops handing the model 37 tool schemas it did not ask for. On the bench the lean engine cut cost 29% on Haiku 4.5 and 34% on Opus 5 with no drop in how many tasks passed. It is off by default, and off is byte-identical to the old behaviour, which a test proves on the actual bytes going over the wire. Flip it from the footer badge. Also in this release: the terminal transcript rebuilt as one renderer instead of two, and a way for the model to explore your repo in a single deposit instead of thirty tool calls.

• One flag, two engines. agentFeatures.forgeV2 picks the lean context engine. Turn it on from /agent-features in the terminal, Router then Behaviors on the desktop, or the merged config in headless. With it off, the request Empryo sends is byte-for-byte what 3.5 sent. I did not want to guess about that, so forge-v2-optin.test.ts compares tool names, descriptions, schemas and provider options on the wire.
• The engine badge is a switch. V1 or V2 sits in the footer and beside the prompt on both surfaces. Click it, the next turn uses the other engine. No config file, no restart.
• Occasional tools arrive when asked for. Memory, skills, the dispatch family, plan and ask_user move to the deferred tail. Repo intelligence stays resident, because a model that cannot see your code map is a model that greps blindly.
• Price decides depth. Cheap tiers get the graph on demand instead of a map up front. Expensive tiers keep the map, since that is where reading it pays for itself. A tools panel shows you which tools your current model is actually carrying.
• Root causing that repros first. On lean tiers the engine sweeps for every site a symptom touches instead of patching the first one it finds, and it wants a reproduction before it believes a fix.

• Thirty tool calls become one answer. The model writes a JavaScript function body against a read-only view of your workspace, with read, grep, files and outline served from the graph cache. Only what the script returns enters the conversation. A walk that used to cost twenty greps and fifteen reads of transcript now costs one deposit.
• It cannot touch anything. Read-only by design, paths jailed to the workspace, 20 second timeout, output capped by the same governor as every other result. Edits stay in the audited edit tools where they belong.
• Capable tiers only. Weak models write orchestration code that fails silently, so they never see it.

• One renderer for a live turn and a finished one. The transcript used to be drawn twice, by two code paths that drifted. Now a run is one row, sealed by the shared block policy, and prose rows never fold or wear a tick they did not earn.
• Steering reads as a tree. Thoughts, notes and grouped rows hang off their header instead of floating in a flat list. ^O expands exactly what it advertises.
• Denied tools settle. A tool you refuse stops spinning forever and reports that it stopped.
• Every well is the same well. Confirm, question, plan, tool-stop and new-tab share one frame. Pickers open even when they are empty and tell you why they are empty.
• A question stands where the input stands. When the agent asks you something, the prompt appears in the lane you were already typing in, not off to one side of it. Boot cards stand in that same lane, and the composer's chips and stop hint ride the frame instead of drifting away from it.
• The bottom dock speaks one language. Every band in it reads the same way, and a folded band still says what is happening rather than going quiet when you collapse it.
• The lane's top line tells you which workspace you are in. Useful the moment you have more than one tab open on more than one repo.
• A reference pane owns the keyboard while it is open. Arrow keys and Enter go to the pane you are looking at, and nothing else steals them.
• Spacing, weight, depth, motion, colour and icons live in one file. Which means the next panel I add looks like the last one without me remembering to make it so.

empryo.com/immunity draws QA coverage from live numbers, including the gaps. It opens on the bug that started it: an installer that verified a signature and then ran the file regardless.

• The proxy is called Subscriptions everywhere a user can see it, because that is what it does for you.
• Custom providers take raw request parameters. extraBody merges straight into the request for the backends whose one weird flag no client option covers. It is trust-gated, so an untrusted checkout cannot use it to rewrite where your requests go. There is a field for it in the desktop provider dialog that validates before it saves, and you can park a provider without deleting it.
• Arabic and Hebrew render right to left, per block, in chat and in the composer. Thanks to whoever filed #164.
• `find_model` lets the agent look up a model by fuzzy name across the catalog, and dispatch takes a per-task model, so a subtask can run somewhere cheaper than the turn that spawned it.
• `/retry` sets how hard a failing turn tries. Attempts and backoff, from the terminal palette or the desktop Reliability card. These numbers lived in a config file and nowhere else.
• Empryo asks before it trusts a repo on first launch, on both surfaces, and a first launch no longer stops to ask about an optional download.

• A permanent provider error ends the turn. It used to fall back into the turn loop and re-send the identical request with no counter and no backoff. Measured: 60 requests in 30 seconds against a 400, 115 against a 401, billed to you until you pressed Ctrl-X. This is the worst bug in this list and it had been there a while.
• An image a model cannot read no longer kills the conversation. The picture stayed in the history, so every later turn resent it and failed on the same bytes, including after a restart. Empryo now drops it from what the model sees, sends the turn again, and says so. Your thumbnail stays in the transcript.
• A desktop crash loop that wrote 174,000 files is gone, along with an updater that did not update. The right-click menu works again on macOS; on Windows it still does not, and the patrol says so rather than letting me claim otherwise.
• Sessions stop losing turns. Torn log tails, unreadable stores, ambiguous id prefixes and truncated folds on restore all now fail with a message that names the condition instead of a JavaScript engine's opinion.
• Scripted installs land instead of aborting partway.
• One denominator behind every context gauge, so the number in the status bar and the number in the panel stop disagreeing.
• `navigate` resolves `Class.method`, and the code map never answers "no matches" from an index it has not finished building.
• The model selector picks the top match when you type and press Enter, rather than whatever was selected before you started typing.
• Headless failures reach stderr in every output mode, and headless exits cleanly instead of hanging on a worker.
• Empryo waits for the code graph before the first headless request, so the first turn is not the one that runs blind.
• `/clear` clears the marionette map too. Clearing a conversation used to leave the compiled map behind, so the next turn started from a picture of a session you had just thrown away.
• The untrusted-repo warning stopped shouting on the wrong surface. It is a headless note now, and opt-in, instead of a banner in front of a terminal that already asks you about trust.

• AI SDK 7.0.64.
• Claude models through a gateway now ride the Anthropic wire rather than a chat-completions translation, which is what makes tool search and prompt caching work there.
• A request-size guard measures the serialized body, not just tokens, because a proxy with a 1 MiB limit does not care how you counted.
• Compat lanes tolerate spec-loose chunks from backends that improvise on the OpenAI format.
• The immune system got stricter about itself. A stale or missing desktop build now reports as a gap instead of a pass, a crashed interpreter is re-measured rather than filed as a defect, and the Windows transport stopped re-handshaking on every single command. A patrol that flatters itself is worth nothing, and these are the checks that stop it.