## GoogleCloudPlatform/scion — nightly-20261005…nightly-20261006

_79 commits._

### Features
- **feat(web): open agent DM from quick message dialog (#2541)** (e843cf0)
- **feat: reincarnate --broker workspace placement and export identity (phase 2a) (#2509)** (b6b957d)
- **feat: show provisioned-not-started agents clearly (#2507)** (2143f4e)
- **feat(harness): wire the thinking map for claude (#2525)** (8791397)
- **feat(cli): add --force to scion delete (#2406)** (6a9b21b)
- **feat(chart): render the hub's IAP proxy and transport settings; remove acknowledgeHAUnlanded (#2438)** (e988360)
- **feat(web): move Jump to agent into a terminal list footer (#2413)** (5aad8f8)
- **feat: reincarnate --broker dry-run eligibility (phase 1) (#2441)** (f6e8d3d)

### Fixes
- **fix(web): ignore stale chat thread loads after a switch (#2560)** (370ab87)
- **fix(web): agent page header wrap and messaging card overlap (#2559)** (8d00e4a)
- **fix(web): show the project and broker Created / Updated dates (#2558)** (92612d0)
- **fix(cli): attach CLI fixes for hub-mode attach (#2561)** (6755b16)
- **fix(web): keep keys typed while a palette opens as its query (#2556)** (6a60520)
- **main-red fix: config: use an integer sample for integer arrays in the schema env-var test (#2549)** (2016ecb)
- **fix(hub,chat): record 'web' channel affinity in Wave-2 sendAgentRouted (#2467)** (e2e4bac)
- **fix(harness-config): sync propagates local file deletions to the Hub (#2535)** (8c4c97a)
- **fix(broker): refresh per-profile attach capability on heartbeat (#2533)** (28eb4f0)
- **fix(k8s): keep content-hash template names off Kubernetes labels (#2538)** (b07a243)
- **fix(config): configuration bundle — schema drift, env parsing, file-mode load, settings writes (ptone/scion#2870) (#2531)** (ac7c7a1)
- **fix(web): keep long project, broker and skill names inside their card (#2528)** (5a4ef47)
- **web: quiet access boundary test imports and fix chat DM-list flake (#2520)** (a8aa9eb)
- **perf(hub): batch chat DM list store lookups (#2485)** (fe59094)
- **fix(hub): agent lifecycle and broker quota accounting bundle (ptone/scion#2866) (#2508)** (962969a)
- **perf(web-chat): dedupe startup loads and lazy-load space rail threads (#2497)** (b111e16)
- **perf(hub): fewer authz decisions and queries for chat spaces (#2491)** (efa6577)
- **fix(harness-config): exclude backups and temp files from sync and revision (#2412)** (aea72ef)
- **fix(broker): keep the global dir out of provider paths (#2465)** (b97298f)

### Backend
- **Pod recovery P2b (3/5): start claim runner, start-claim reaper, reincarnate claim (#2544)** (4b6ef60)
- **Artifacts P0: scaffolding (experiment, permissions, settings, pkg/artifacts Host seam) (#2567)** (de8d89d)
- **hub: require lifecycle permission to resume an agent on message wake (#2554)** (e2c1648)
- **hub: gate passthrough embedded-broker arm on unscoped platform admin (#2545)** (014c21e)
- **chat: mobile QA fixes for narrow phones and landscape (#2473)** (aa97043)
- **k8s: clone shared-plain git workspaces on NFS from the provision init container (#2494)** (782dda7)
- **runtimebroker: act on an existing agent in the runtime its saved profile selects (#2481)** (30e3cc2)
- **conduit/relay: wait for the peer before closing a stream hop's link (#2553)** (6fcc921)
- **conduit/agent: sciontool conduit dialer and hub port proxy over conduit (#2479)** (4f961a3)
- **hub: consolidate GCP SA verification result handling and admissibility check; fail fast at start (#2542)** (51d67de)
- **cli: explicit --project/-g wins over SCION_PROJECT_ID; -g global targets hub Global project (#2548)** (5962143)
- **hub: specific SA-assign 403 message for an unrecorded delegation edge (#2557)** (ed36b3f)
- **hub: send no GCP metadata mode when an agent has no identity configured (#2480)** (b5adc6c)
- **Chat: keep thread and scroll position across mode switches (#2547)** (5c4ac36)
- **hub: keep delegation edges consistent across agent delete, restore and reincarnate (#2524)** (3c56088)
- **conduit/hub: run the relay in the hub; agent conduit endpoint, settings and startup checks (#2477)** (11317a2)
- **hub: last-owner rule counts only usable owners and checks the post-state (#2514)** (0189409)
- **hub, web: show a restored agent again after delete (restoredAt marker) (#2537)** (a2daad3)
- **hub: guard create dispatch writes and subscriptions against a racing delete (#2536)** (b5338ff)
- **chat: keep the composer and caret on screen with the iOS keyboard open (#2532)** (6a67ba7)
- **Kubernetes runtime: persistent NFS agent home (3/3) (#2534)** (6aecd11)
- **hub: reject tokens for deleted users; authorize the parent group when creating a nested group (#2522)** (fdaa14a)
- **hub: commit agent create as one unit and compensate failed dispatch (#2523)** (4a20451)
- **agent delete: keep a same-name successor's files on a stale-run delete (#2469)** (8a3266e)
- **Pod recovery P2b (2/5): broker starts in flight, hub runtime observations (#2482)** (8dd398d)
- **conduit: relay, router and target libraries (#2471)** (e3ff92e)
- **hub: project members groups cannot be role-binding principals or child groups (#2495)** (aba9645)
- **hub: check the group belongs to the project before slug-rename migration (#2501)** (fe07fb0)
- **runtimebroker: let a Hub cancel remove a queued control-channel request (#2475)** (d525b52)
- **keys: classify HTTP-route failures before a connection as keys_unavailable (#2484)** (2ca84c0)
- **hub: return the broker's typed error from a cross-node dispatch (#2489)** (35bf547)
- **web: drop tray responses for a previous user after a user switch (#2517)** (a79d58c)
- **web: send shell requests once per page load (#2513)** (d3781e8)
- **web: load the agent graph by scope in the compact view (#2510)** (87e8306)
- **sciontool home: leaf, prepare and mark-seeded for a persistent agent home (2/3) (#2488)** (e513f19)
- **hub: do not publish agent.created for an agent deleted during create (#2487)** (b87e761)
- **changelog: daily entry 2026-10-03 (#2429)** (6b8efb6)
- **web: delete failure banner, shared delete helper and stopping states (#2466)** (5ff1ff6)
- **NFS agent home on Kubernetes (1/3): settings, experiment, broker storage choice (#2462)** (49cb989)
- **telemetry: harness telemetry mapping and hermeticity bundle (#2463)** (d7333d8)
- **web: bounded agent lists with paged windows and a capped drain (#2451)** (899ce3f)
- **web: mobile polish for small phones and landscape (#2461)** (746620a)
- **Pod recovery P2b (1/5): start claim store, runtime observations, settings (#2457)** (a044c36)
- **Skill resolution follow-ups: surface resolution failures, cache fixes and skill handling (#2452)** (31d4592)

### Tests
- **test(a2a-bridge): use explicit agent replies as task response (#2563)** (48b5a51)
- **test: test hermeticity and race fixes bundle (ptone/scion#2852) (#2552)** (67d84af)
- **test(runtimebroker): pin runtime in passthrough downgrade test (#2408)** (c0586b8)
- **test(web/e2e): export replaceRoute from chat-file-preview's main.ts stub (#2464)** (60911a5)

### Docs
- **docs: 2026-10-04 changelog updates and weekly release notes Sep 28 - Oct 4 (#2503)** (8a38ee0)
- **docs: GCP identity modes on Kubernetes and asynchronous agent create settings (#2455)** (22ac1c7)

### Chore
- **ci: run pkg/store/entadapter SQLite tests in test-hub-sqlite (#2511)** (2ae6fcb)
- **chore: update LATEST.json for nightly-20261005 (#2460)** (1953548)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/GoogleCloudPlatform/scion?utm_source=github-action)._