[pavelhov]

Summary

Promotes the reviewed output-allowance fix and version 0.1.27 to the stable branch for the official updater release. Existing installations automatically use known model capacity for ordinary requests. The request policy provides the caller-cap opt-out.

The default can increase usage or reduce an oversized requested total to the known capacity. Capacity selection is scoped to the provider destination, and context compaction has separate maintenance budgets.

Feature review and CI passed in PR #97.

Validation

• Local full parallel qualification passed with the required failed-file rerun after updating four legacy caller-cap characterizations. The rerun passed all 50 tests and includes JSON/SSE completion coverage for the new default.
• Typecheck, privacy scan, GUI lint, and docs build passed. GUI lint reported one existing Combos hook warning.
• The promoted runtime tree matches the qualified feature revision.
• Real Sparkle replacement and relaunch qualification passed all six isolated stopped/native/owned cases across ARM64 and x86_64. Every case verified semantic recovery and fixture cleanup. Both fixture versions use the same production code with differing build metadata, and canonical archive integrity is verified separately.
• Required Ubuntu CI and integrated Windows verification passed. GitHub canceled both hosted macOS attempts during runner provisioning because of capacity constraints. Equivalent local macOS checks passed, including the full Bun suite, 888 GUI tests, Swift core/UI tests, CLI smoke, and the app build. This promotion uses the completed local macOS qualification under the maintainer release policy.

Security review

The reviewed change binds output capacity to known provider destinations and keeps private route provenance request-local. Strict configuration validation rejects private runtime fields on disk.

Release signing uses the existing external Ed25519 key and pinned Sparkle 2.9.6 tools. All 21 published historical feeds authenticated under that key. Official assets will be universal, built from the clean promoted commit, and verified after draft download and through the published discovery URL. The release is an ad-hoc, unnotarized preview.