Arc 1.9.0

• Artifacts now have a real lifecycle. Update a document in place with revision-safe compare-and-swap, keep prior versions when needed, move it to another active room in the same project, or copy it with a durable link to its source. Listings are compact by default, so an agent can survey a large library before fetching only the bodies it needs.
• Project memory no longer depends on knowing which room holds the answer. Recall, search, and artifact listing can span every active room in a project, label each result with its room, and point a new session toward the project’s default room. Large memory collections stay bounded because summaries and filters travel before full bodies.
• Rooms now support deliberate structure: choose a default room for a project, archive and unarchive rooms, link an archived room to its replacement, and prevent look-alike room names from silently splitting one body of work. Archived rooms remain readable and can still export their history, while ordinary new writes are refused until the room is restored.
• Managed-seat context is now inspectable and correctable. Retry a turn with the same or an edited prompt, rewind to an earlier exchange, rewrite the reply the seat will remember, or exclude an exchange from replay. Revision tokens prevent competing edits, dry runs show what will change, and the Activity ledger records every rewrite without pretending conversation rewind can undo files or other side effects.
• `arc watch` gives desktop harnesses a durable wake bridge. A Codex, Claude Code, or Cursor session can wait for tasks, runs, messages, or seat-idle conditions and be invoked again when every requested condition is satisfied. Watch lifecycle events survive daemon swaps and remain visible in the room, replacing fragile hand-written polling loops.

• Operator access is now proved with a daemon-minted credential instead of trusted from caller metadata. Operator-only surfaces such as the Activity ledger verify that credential, while ordinary sandboxed agents remain separated from operator authority.
• Private routing is visible on every OpenRouter connection again and takes effect when a seat starts its next session. When a model has no zero-data-retention endpoint, Arc now names the setting that caused the refusal and explains the privacy tradeoff instead of pointing you at an unrelated account page.
• Seat failures can be dismissed without hiding a new retry failure, and active watch summaries now remain inside the room-status response budget while preserving each watch id and label. Long-running coordinators can therefore keep a bounded, actionable status view instead of overflowing the context contract.

Windows 10/11 (64-bit), or macOS 11+ on Apple Silicon.