The Workspace pane now maps the Swift symbols of a folder you choose, right in the app. The Wiki pane now drafts a page on a topic you name, and nothing is written until you approve it.

Unreadable conversation checkpoints are now preserved, with a visible error and a retry option. Chats wait for recovery before accepting a new message, and failed saves no longer report that your conversation was saved.

Model safety now fails closed. Coil bundles signed catalog v2 as its offline baseline, prevents an older network catalog from rolling it back, preserves blocked and withdrawn model decisions across relaunch, and recovers interrupted loads without silently retrying or switching models. Verified installs are rehashed against their exact signed identity before activation, while memory admission labels estimates honestly and refuses oversized loads. Route previews and model state stay bound to eligible, verified selections.

Model management gets serious integrity guarantees: every downloaded model is now verified file-by-file against a signed manifest before it can load, installs are resumable and atomic, the model chooser shows exact download size and free-disk requirements, and memory admission prevents oversized loads. The old unsigned live model list is replaced by a cryptographically signed catalog - entirely off unless you turn it on.

New: optional Bring Your Own Key. Use your own OpenAI, Anthropic, Gemini, or OpenRouter API key so Coil can answer from the cloud on Macs that can't hold a local model — including a new first-run path that skips the model download entirely. Off by default; your key lives only in the macOS Keychain and nothing is ever sent to Silo Systems.

Coil now picks a worker model that matches your Mac. Macs with less than 32 GB of memory get a 27B-class model that fits in about 8.5 GB, instead of the smaller 9B model used before, so answers improve without slowing your machine down. Macs with 32 GB or more continue on the 27B model at higher precision. Every default was loaded and run before shipping. You can also switch on an optional live model list in Settings. When it is on, Coil refreshes the catalog of available models from Hugging Face about once a day, so new models appear without waiting for an app update. It is off unless you turn it on, and the app works fully offline without it. The model picker now includes more choices for larger Macs, warns when a model will not fit your hardware, and shows longer usable context on the newest models. Everything still runs entirely on your Mac.

Coil's worker models move to the Qwen3.8 generation. The default worker on 32 GB and larger Macs is now Qwen3.8-27B (4-bit), with a 256K-token context window and mixed-precision, speculative-decoding, and 8-bit variants in the catalog for bigger machines. 16 GB Macs keep the lighter 9B default. Context budgeting now uses the model's true memory shape, preventing out-of-memory stalls in long sessions. All models still run entirely on your Mac.

Audit history is now easier to review and carry out of Coil. Filter local audit entries by operation and date, then export exactly the selected scope as a deterministic Markdown report with useful before-and-after context. Empty and no-match states are explicit, and exporting never changes memory data. Everything remains on this Mac.

Coil's memory now recalls in context, not in fragments. Memories are linked into a persisted similarity graph, grouped into communities, and recalled as a connected, budget-packed subgraph, so a recalled note arrives with the notes it belongs with. The memory constellation renders those stored links directly and tints them by community. The command line gains graph-aware memory search and a memory ingest verb for bringing local notes in. This release also fixes several things you could run into: - A chat turn could leave the composer locked for ten minutes when a generation failed or no model was connected. Coil now tells you what went wrong straight away. - The pause button did not always show whether auto-reply was actually paused. - Opening the Workspace pane could quit the app on projects with same-line overloads. - Long tool output is no longer discarded when it is trimmed mid-character. - Forgetting a memory now clears its links, so the constellation matches what you kept. - Buttons that are unavailable now look unavailable. Everything stays fully on device: no accounts, no cloud inference, no telemetry.

Work inside one folder with Coil's new reviewed workspace tools. Choose an inspect-only, review-changes, or ask-every-tool policy; inspect exact file previews protected by full-content hashes; approve Read, Write, Edit, read-only bounded shell, and graph runs; cancel in-flight commands; and export a content-safe local JSON trace receipt. This update also adds clear completion, truncation, cancellation, denial, and error states while preserving Coil's fully on-device privacy model.

Work inside one folder with Coil's new reviewed workspace tools. Choose an inspect-only, review-changes, or ask-every-tool policy; inspect exact file previews protected by full-content hashes; approve Read, Write, Edit, read-only bounded shell, and graph runs; cancel in-flight commands; and export a content-safe local JSON trace receipt. This update also adds clear completion, truncation, cancellation, denial, and error states while preserving Coil's fully on-device privacy model.

Reliability and workflow improvements. • Boot-failure recovery — if the engine fails to start, Coil now explains what happened and offers a one-click Retry • Fixed a reliability issue where a stalled long generation could hang the composer • Copy any turn to the clipboard with one click • One-click transcript export for the whole conversation 100% on-device. No cloud. No account.

Memory consolidation — Coil now distills conversations into typed, deduplicated facts you can inspect, edit, and undo. • Automatic consolidation off the reply hot path (idle flush) • Audit trail with undo for every store / update / merge / delete • Memory pane shows atoms by kind plus persona • CLI: coil memory consolidate / audit / undo 100% on-device. No cloud. No account.