Changelog

The resident Agent can now checkout an installed ordinary App, edit its source and submit the candidate through the existing physically confirmed update path.

• Add app.checkout and app.submit lifecycle Tools without adding a second transport or activation path.
• Keep editable source under apps/<id>/checkout while excluding App data, temporary files and credentials.
• Return bounded install/update outcomes from .system/app-events/<id>.json so an Agent can inspect the previous result before retrying.
• Keep the running release unchanged until validation, on-device review and physical confirmation complete.

The Pi Agent System App gained denser viewport-aware Chat and Files surfaces plus bounded file deletion through an Action.

• Adapt compact Chat, Files, Apps and Settings layouts while keeping product policy in JavaScript.
• Route workspace.delete and the Files UI through the same Pi Agent deleteFile Action.
• Protect system roots and keep file mutation inside the System App data.fs capability.
• Clarify the firmware-seeded System App release lifecycle separately from ordinary App releases.

The S3 host reduced avoidable scanout pressure while the Agent and wireless provider path are active.

• Tune the S3 runtime and display path around the shared framebuffer completion contract.
• Reduce model-turn display contention without moving UI policy into board firmware.
• Harden OpenAI-compatible and Anthropic response handling used by embedded wireless providers.
• Keep long-running display stability and memory-pressure work as separate physical acceptance.

PocketPi added the Waveshare ESP32-S3-Touch-LCD-4.3 as a second supported target while preserving one App source and one AgentOS stack.

• Add firmware/esp32-s3 and extract shared ESP-IDF AgentOS, storage, Wi-Fi and transport mechanisms into firmware/esp32-common.
• Pass host logical viewports into every View Guest and expose width, height, orientation, scale and layout extents through View.viewport.
• Render the S3 480×800 logical surface into its rotated 800×480 RGB panel and map GT911 touch through the same transform.
• Make Pi Agent, Exa and Robinhood choose portrait stacks or landscape columns without board-specific App forks.

Installed ordinary Apps can update through the same staging, review and physical-confirmation path used for first install.

• Preserve App SQLite data and native credentials across code-only and schema updates.
• Add forward migrations/N.sql, candidate rehearsal, one live migration transaction and atomic source activation.
• Refresh Tools, schedules, Action runtime and View runtime after activation.
• Complete an approved interrupted update during boot; release history and rollback remain out of scope.

Ordinary Apps moved to raw JavaScript and SQL while preserving App = Data + Actions + View.

• Add the minimal raw View SDK and source App runtime.
• Migrate Exa and Robinhood to source-loaded Actions, SQLite Projections and fixed Views.
• Add retained View reconciliation so native nodes are reused and only changed props or text are emitted.
• Validate source-App install and Exa/Robinhood interaction on physical ESP32-P4 hardware.

The runtime established one PocketJS substrate, one JavaScript System Framework and the App = Data + Actions + View contract.

• Keep one resident Pi Agent System Guest plus independent three-entry View and Action Guest LRUs.
• Make Actions actor-neutral so Agent Tools, UI events and schedules share one behavior boundary.
• Move product policy into JavaScript while native code retains hardware, isolation, security and lifecycle mechanisms.
• Rename the ordinary package descriptor to app.json and remove compatibility artifacts.

Ordinary Apps gained destructive uninstall and UART ingress through the same AppSupervisor path as HTTP.

• Remove an uninstalled App's Tool routes, schedules, Guests, SQLite/data, credentials, native sessions and release.
• Protect the resident Pi Agent System App from uninstall.
• Persist standalone wireless model configuration in native NVS and remove the implicit UART model fallback.
• Exercise UART install, uninstall, restart absence and clean reinstall on the physical ESP32-P4.

Firmware stopped embedding ordinary Apps; each App became one independently installable .pocketapp.

• Keep only the resident Pi Agent System App in Firmware.
• Add one native Installer contract and a review/installing/success/failure UI.
• Use local HTTP only as package ingress; lifecycle state remains owned by Installer.
• Allocate App QuickJS heaps and large ESP32 worker stacks from PSRAM through the host-selected allocator.

The project adopted its complete embedded-device runtime boundary instead of maintaining a separate desktop product composition.

• Make Pi Agent the resident System App that owns /workspace.
• Define ordinary Apps through public Tools, private Data Actions and schedules, App-local SQLite and fixed PocketJS Views.
• Share AgentOS and PocketJS product contracts between ESP32-P4 and its macOS development simulator.
• Keep credentials, TLS, transport, hardware, lifecycle and timeout enforcement in native hosts.