Promote v0.40.2 to production

.docker/caddy/Caddyfile

@@ -1,6 +1,7 @@
 # Local development edge that mirrors the production Caddy routing in
-# deploy/caddy/Caddyfile: a single origin serves the web app, and the
-# reserved /_roomote-api/* prefix is stripped and proxied to the API.
+# deploy/caddy/Caddyfile: a single origin serves the web app, public webhook
+# paths go directly to the API, and the reserved /_roomote-api/* prefix is
+# stripped and proxied to the API.
 #
 # `pnpm dev` points the ngrok web tunnel at this listener instead of the
 # web app, and derives TRPC_URL as <public-url>/_roomote-api — the same
@@ -29,6 +30,20 @@
 		}
 	}
 
+	# Webhook URLs are public integration contracts. Send them directly to the
+	# API so a missing or stale web-app proxy route cannot acknowledge an event
+	# with the Next.js HTML fallback without actually processing it.
+	@api_webhooks {
+		path /api/webhooks /api/webhooks/*
+	}
+
+	handle @api_webhooks {
+		reverse_proxy host.docker.internal:13001 {
+			lb_try_duration 10s
+			lb_try_interval 250ms
+		}
+	}
+
 	@api {
 		path /_roomote-api /_roomote-api/*
 	}

.docker/gbrain/entrypoint.sh

@@ -379,9 +379,85 @@ echo "[gbrain-entrypoint] starting gbrain serve on :$PORT (full surface)"
 gbrain serve --http --port "$PORT" --bind "${GBRAIN_BIND:-0.0.0.0}" --surface full &
 SERVER_PID=$!
 
+# The brain repo's git mirror (gbrain's durability hardening: a post-commit
+# auto-push plus a repo-scoped credential helper) is set up by
+# `gbrain sources harden`, which reads the PAT from GBRAIN_GITHUB_PAT. It
+# writes the credential file under $HOME/.gbrain. Run by hand in an ssh
+# session that meant /root, which the next deploy rebuilt, and every commit
+# since sat local-only (observed: 9.7k unpushed commits, three days of
+# silent "LOCAL-ONLY, NEEDS ATTENTION" in the push log). Re-run it on every
+# boot, under the volume-anchored HOME above, so the credential survives
+# redeploys and a freshly provisioned brain is hardened as soon as the PAT
+# is set. Idempotent by design, DB-backed (needs the server's registry, so
+# it runs after startup), and never fatal.
+if [ -n "${GBRAIN_GITHUB_PAT:-}" ]; then
+  (
+    sleep 30
+    echo "[gbrain-entrypoint] hardening the brain repo mirror (GBRAIN_GITHUB_PAT is set)"
+    gbrain sources harden --all --no-cron 2>&1 \
+      | sed 's/^/[gbrain-entrypoint] mirror: /' || true
+  ) &
+  HARDEN_PID=$!
+else
+  HARDEN_PID=""
+fi
+
+# Hot-memory facts that gbrain's own put_page backstop extracts land in the
+# database without a markdown fence (row_num NULL). The nightly extract_facts
+# phase refuses to run while such rows exist for live entity pages, reading
+# them as an interrupted v0.32.2 upgrade, so on any brain that is written to
+# every day the phase jams permanently and consolidation starves. gbrain's
+# sanctioned drain is re-running the v0.32.2 fence backfill, which is
+# idempotent (only row_num IS NULL rows, de-duplicated against the page's
+# existing fence), so run it at boot and once a day ahead of Roomote's
+# 07:00 UTC maintenance cycle. Targeted with --migration on purpose: a
+# brain created on a recent gbrain still lists every older data
+# orchestrator as pending, and a bare apply-migrations would run them all.
+# Never fatal: a failed drain leaves the phase skipped, which is today's
+# behavior, and the log says why.
+FENCE_BACKFILL_UTC_SECONDS=$((6 * 3600 + 30 * 60))
+# The backfill refuses to write into a dirty working tree (it expects a human
+# to review the diff), but in a hosted brain nothing reviews: gbrain commits
+# its own write-through page writes, while the pages its maintenance phases
+# touch sit uncommitted until something commits them. Commit the tree on
+# both sides of the drain so it can run tonight and again tomorrow. The
+# identity matches gbrain's bootstrap commits; an unchanged tree is a no-op.
+commit_brain_tree() {
+  git -C "$BRAIN_DIR" add -A 2>/dev/null \
+    && git -C "$BRAIN_DIR" -c user.name=gbrain-bootstrap \
+      -c user.email=bootstrap@localhost commit -q -m "$1" 2>/dev/null \
+    || true
+}
+fence_backfill() {
+  echo "[gbrain-entrypoint] fencing unfenced facts (v0.32.2 backfill)"
+  commit_brain_tree "roomote: commit maintenance-written pages before fence backfill"
+  # Facts whose entity page does not exist can never be fenced, so the run
+  # reports "partial" every time, and three partials wedge the ledger. The
+  # retry marker clears that each night; on its own it only writes the marker.
+  gbrain apply-migrations --force-retry 0.32.2 --non-interactive >/dev/null 2>&1 || true
+  gbrain apply-migrations --migration 0.32.2 --non-interactive 2>&1 \
+    | sed 's/^/[gbrain-entrypoint] fence-backfill: /' || true
+  commit_brain_tree "roomote: fence backfill (v0.32.2)"
+}
+(
+  # Let the server and worker settle before the first drain.
+  sleep 60
+  fence_backfill
+  while :; do
+    now="$(date -u +%s)"
+    delay=$((FENCE_BACKFILL_UTC_SECONDS - now % 86400))
+    if [ "$delay" -le 0 ]; then
+      delay=$((delay + 86400))
+    fi
+    sleep "$delay"
+    fence_backfill
+  done
+) &
+FENCE_PID=$!
+
 TERMINATING=0
 stop_processes() {
-  kill -TERM "$SERVER_PID" "$WORKER_PID" 2>/dev/null || true
+  kill -TERM "$SERVER_PID" "$WORKER_PID" "$FENCE_PID" ${HARDEN_PID:+"$HARDEN_PID"} 2>/dev/null || true
 }
 trap 'TERMINATING=1; stop_processes' TERM INT
 

.gitignore

@@ -84,3 +84,6 @@ artifacts/ci-e2e/
 
 # Scheduled-task runner lock (machine-local runtime state)
 .agents/scheduled_tasks.lock
+
+# Editor swap files
+*.swp

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 This file tracks product releases for Roomote (single monorepo version). Automated release entries are prepended by `pnpm run version`.
 
+## 0.40.2 (2026-08-22)
+
+This patch improves Fast coordination, Slack task visibility, pull request review reliability, task feedback, and Brain preview operations.
+
+### Highlights
+
+- Configure a separate model and reasoning level for Fast orchestration.
+- Follow Fast-delegated Slack work through native streaming task cards and richer pull request updates.
+- Keep pull request review notifications and closeout work moving safely through GitHub API limits.
+- See renamed tasks immediately, get clearer billing pause guidance, and avoid empty Dependabot reports.
+
+### Patch changes
+
+- Explain when billing has paused new task launches and direct users to check billing across the web app and chat integrations.
+- Improve the Brain preview with truthful source and corpus status, full-corpus browsing, correct page metadata, more reliable Slack and GitHub ingestion, resilient nightly synthesis and fact extraction, and durable mirror credentials across redeploys.
+- Keep scheduled Dependabot triage quiet when a successful scan finds no open alerts or follow-up work.
+- Make Fast workflows easier to follow with native streaming Slack task cards, relayed coding progress, task-specific pull request updates, automated review feedback, terminal pull request status, actionable follow-up suggestions, and stronger recovery from long turns and transient provider failures.
+- Keep pull request review notifications and closeout work reliable under GitHub API limits by caching unchanged reads, deferring quota-limited work, and ignoring unrelated external bot activity.
+- Let deployment admins choose a separate model and reasoning level for Fast orchestration while keeping the coding model as the default fallback.
+- Refresh task lists and search results immediately after a task is renamed so the new title appears without reloading the page.
+
 ## 0.40.1 (2026-08-20)
 
 This patch improves Slack and self-hosted administration, fixes task and Discord delivery issues, and smooths PostgreSQL upgrades.

apps/api/src/handlers/discord/fast-agent.ts

@@ -92,6 +92,7 @@ export async function processDiscordFastAgentMessage(input: {
       userId: input.senderUserId,
       apiBaseUrl: Env.TRPC_URL ?? Env.R_APP_URL,
       conversation,
+      signal: releaseFastAgentLock.signal,
       senderDisplayName:
         input.interaction?.interaction.member?.nick ??
         input.sender.global_name ??