Added

Continue anywhere (Pro): hnl resume <session-id> [--harness omp|claude-code|codex|pi] picks up one of your sessions from any of your machines. It fetches the session's checkpoint (goal, next step, todos, done, decisions, files touched), its handoff note and newest prompts (GET /v1/continue/:id, your own sessions only), finds the repository here (a folder you chose before, the session's own folder, or a clone with the same remote under ~/Workspace, ~/code, ~/src and the like; otherwise it asks once, or takes --cwd, and remembers), and starts the harness there with that context: omp and Claude Code through HarnessLink's context hook, Codex and pi as the first prompt. --print prints the context instead. The dashboard's History panel and Session page have Continue on… with a harness picker and the command to copy; nothing runs from the dashboard. On Free both answer with the upgrade prompt (403 feature_gated).
Spend control (Pro): Usage → Budgets sets a daily and a monthly budget in USD with alerts at 50, 80 and 100% (any of them), sent once per threshold per UTC day or month by email and to your linked Telegram chat; a budget only alerts, it never blocks. Team members also see their organisation's per-person USD limits there and get the same alerts before the gateway refuses calls at 100%. "Cheaper models this month" shows, for each model you spent on, "Using <model> for these calls would have cost $X less": the same token counts priced from the list-price table, only for a cheaper model in the same family you already use (or one you listed under Model equivalents) that your organisation's model rules allow, and nothing when no such model or price exists. The month's gateway saving shows there and on a new Overview Budget card. GET /v1/spend, PUT/DELETE /v1/spend/budgets/:window, PUT /v1/spend/equivalents; 403 feature_gated below Pro (Free sees one upgrade prompt on Usage, nothing on Overview). Budgets, alerts sent and equivalents are in Download my data (spend.json).
Tenant data spreads over several D1 databases (ADR-61). A directory (control table tenant_directory) maps every organisation to one tenant database (TENANT_DB, TENANT_DB_2, …); every tenant read and write resolves it, new organisations land on the least full database listed in TENANT_PLACEMENT, and existing ones stay on the original. cloud/scripts/tenant-move.ts moves an organisation between databases — freeze, copy, verify counts and checksums, flip, delete the source — resumable and abortable; while a move holds an organisation its requests answer 503 tenant_moving (retryable). The owner console's Overview shows each tenant database's size against D1's 10 GB cap and warns from 70% (GET /v1/admin/databases). The runbook is docs/CLOUD_SETUP.md, "Tenant databases".
Locked history moves to R2 cold storage (ADR-61). On a plan with a history window, whole months older than the window — prompts, session index rows and their sync-journal entries — move hourly from D1 to gzip-compressed JSONL in the transcript bucket, indexed per part. An upgrade brings them back (straight after a Stripe or owner plan change, and on every hourly run); Download my data includes them; deleting the account deletes them; parts entirely past 365 days expire with their transcripts. The locked counts on History and Sessions include them when no filter applies. cloud/scripts/tenant-load-test.ts measures the dashboard and sync queries of a seeded heavy tenant before and after.

Added

Flag notifications