[luoph]

Update roundreddot/better-paseo from d648d0aaa66f9fffd15a0d670b41121df95cd4e6 to f42dd6fbb1860da2f2edc92f7c1620789ef45267.

• On iPad, Filters opens in a toolbar dropdown, and pulling down on a lane refreshes the board. Folding a lane keeps the other lanes at their open width, so cards stay put during the animation.
• The iPad sidebar can narrow to 240pt, and its resize handle takes less of the panel. The sort row in the view menu shows a disclosure arrow.
• When automatic titles are on, a title is generated once as the task starts, from the first 2000 characters of the first message. A title set by hand is kept. The setting is labeled "Generate title when the task starts".
• On the phone board, tapping the selected lane tab scrolls that lane to the top. The button that jumps to the loaded end is larger and sits higher.
• Settings previews include the sidebar count row. In the phone board preview, the lane tabs scroll sideways at full size.

OVERVIEW.md, the manifest description, package metadata, and listing media URLs are unchanged.

Validation:

• Registry tests: 189 passed.
• Offline validation: 435 records are well-formed.
• Online changed-record validation: the updated record matches its pinned artifact.

Source changes

[paseo-bot]

Better Paseo is approved, @luoph and @RRD-dev. I reviewed the update and retained your existing overview, description and media. Nothing is needed from you.

For the next release, clarify in OVERVIEW.md that automatic titles start with the first message’s turn, use its first 2,000 characters and do not replay starts missed while the plugin is offline. This helps users understand when provider requests occur. Listing-page guidance.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head 61783e7aea6aa618870ef48f436fe6db3f776c6f. Read the PR and all discussion, original submissions #706 and #705, and accepted registry history. Existing attribution retained.
• Independently fetched both Git artifacts from https://github.com/RoundRedDot/better-paseo.git: old d648d0aaa66f9fffd15a0d670b41121df95cd4e6, new f42dd6fbb1860da2f2edc92f7c1620789ef45267. Both commits exist; no tag is recorded. Inspected all 890 old and 891 new archive members before confined extraction, regular files/directories only, without hooks or submodules. Archive SHA-256: old 52426c09fc105924a71838283b6fd027965c889651571add522b0a404b6322a2, new 593e70ae7f1b11340ab6d432aef4f38d876105e93f0f27cdc9b3b32eb995eb97 (local evidence, not upstream signatures).
• Read the production delta, complete title-generation service and affected UI paths. With the existing opt-in setting enabled, the turn-start hook checks the canonical first-prompt turn ID and provisional title before starting one helper. Automatic input is the first message’s first 2,000 characters; manual generation retains its bounded conversation excerpts. Helper labels/directory prevent recursive title jobs. Title changes during generation prevent saving over a manual edit. Settings remain off by default; an existing enabled setting now applies at turn start. Helpers use ordinary configured provider permissions, as disclosed in the overview; the no-tools instruction is not a sandbox. No actual provider invocation was performed.
• Tablet refresh calls the existing task refresh capability; filtering, lane widths, phone scrolling and settings previews change presentation. No new independent network destination, credential-file access, subprocess or runtime software installer was found in the production delta. Existing helper workspace creation/archival and agent renaming remain purposeful. Unchanged filesystem, timeline, CLI and host-library behavior was not exhaustively re-audited.
• Manifest/package/lock and preparation scripts are unchanged. npm ci --omit=dev uses the shipped lockfile; all 396 locked dependency entries have npm registry HTTPS resolutions and SHA-512 integrity, and root dependency ranges match the manifest. The sole production install hook is esbuild 0.28.2: independently downloaded its locked tarball and verified SHA-512, then read install.js. It resolves the locked platform binary, checks its version, and if missing uses an exact-version npm/direct-download fallback with pinned binary SHA-256 verification. Development-only fsevents is omitted. The subsequent client build reads reviewed local inputs, generates the local client bundle and server chunk, and evaluates bundled code from those inputs at runtime. No plugin/dependency installation, build, import, test or execution was performed during review.
• English author overview, description, icon and 14 listing-media URLs retained; no translations or registry fallback required. Viewed existing board and iPad listing images, which show the interface with sample data. Trusted current-main validation passes on the submitted record unchanged: 435 well-formed records and one matching pinned artifact. All 189 registry tests and the reviewed head’s Validate workflow pass. Registry content edits by this review: none.
• Limits: static artifact review, no live UI, device, provider or installation QA. Author-reported UI changes were traced in source, not exercised. No blocking safety finding, remaining author requirement or factory-policy incompatibility identified.