@@ -141,7 +141,7 @@ its lock entry is valid.
 
 - Do not carve hosted code out of backend/web until the purge on 18 Oct 2026. The export window and the purge script run on that code until then.
 - Do not drop SearxNG, sandbox, OpenSandbox, or zero-cache from compose until a new compose is defined.
-- Edit the root `README.md` directly. The draft at `plans/community-local/seo/drafts/README.md` shipped on 18 Sep 2026 and is kept only for history. Anything added to the README replaces something — its length was measured against the eight biggest repos in this category.
+- Edit the root `README.md` directly. The draft at `plans/community-local/seo/drafts/README.md` shipped on 18 Sep 2026 and is kept only for history. Anything added to the README replaces something — its length was measured against the eight biggest repos in this category. Make the same change in every `README.<locale>.md`, section for section; [`06-repo-readme.md`](plans/community-local/seo/06-repo-readme.md#the-readme-since-9-oct-2026) has the rules, where each format-table cell is checked, and how to replace the demo video.
 - Do not commit, push or open a PR unless asked.
 
 ## Security
 
@@ -1,11 +1,14 @@
 <!--
-  Rationale: plans/community-local/seo/06-repo-readme.md. Anything added replaces
-  something (AGENTS.md). Ship the agent copy only with the first release whose
-  installer carries the agent; v2.1.0 does not.
-  The format table is checked against origin/dev c5ff7938a; re-check each cell before a release.
+  Rationale and how to change it: plans/community-local/seo/06-repo-readme.md. Anything
+  added replaces something (AGENTS.md). The agent copy holds from v2.2.0, the first
+  release whose installers carry the agent.
+  The format table is checked against origin/dev c5ff7938a, which v2.2.0 contains; re-check
+  each cell against the release commit before a release.
   The demo video under the header is a GitHub upload, not a file in the repo. To replace it, drag an
   MP4 under 10 MB into any comment box in this repo, copy the user-attachments link and swap the URL.
-  Every README.<locale>.md follows this file section for section; change them together.
+  Every README.<locale>.md follows this file section for section and names the app's UI in
+  the words of surfsense_local/frontend/translations/<locale>.json (Arabic: the English in
+  parentheses); change them together.
   Time-boxed: delete the sunset callout on 18 October 2026, here and in every README.<locale>.md.
 -->
 
 
@@ -4,20 +4,21 @@ What the maintainers are working on, grouped by when. This page names the initia
 
 ## Now
 
-- **Release and CI health.** v2.0.3 was the first release to carry the llama.cpp, sd.cpp and audio.cpp runtimes, built and packaged on all three runners, and [`desktop-tests.yml`](../.github/workflows/desktop-tests.yml) runs the desktop backend, frontend and Electron tests on pull requests. What is left is the CI that proves the runtimes: the release workflow still accepts a prerelease version. See [packaging](architecture/packaging.md) and [updates](architecture/updates.md).
+- **Release and CI health.** v2.0.3 was the first release to carry the llama.cpp, sd.cpp and audio.cpp runtimes, built and packaged on all three runners, and v2.2.0 the first whose installers carry opencode, signed on Windows and notarized on macOS. What is left is CI that catches a break before a release, and the installers' third-party notices ([about](architecture/about.md)). See [packaging](architecture/packaging.md#known-gaps) and [updates](architecture/updates.md).
 - **Egress gaps.** The follow-up fetch for a remote image URL leaves without a consent decision, and some stored grants no longer match what Settings › Network shows. See [egress](architecture/egress.md).
 - **Import from cloud.** The hosted export window closes on 18 Oct 2026. Imports need a progress summary, and a re-run must bring back the chat threads an interrupted import missed. See [import](architecture/import.md).
 - **Scraper API and MCP license mode.** PATs are purged on 18 Oct 2026; after that, license mode is how scraper API and MCP users keep access. See [contract 2](contracts/02-scraper-api-auth.md).
 - **Model catalog.** One catalog for local and remote models, each classified offline from a reviewed, packaged manifest and keyed by model type. See the [proposal](proposals/model-catalog.md).
 - **Hosted wind-down to 18 Oct 2026.** `/sunset` lacks the deletion date, the refund offer and the MCP change; background jobs keep running through the export-only tail; and the purge is still ahead. See [sunset](architecture/sunset.md), the [license portal](architecture/license/portal.md) and the page plan in [`plans/community-local/portal/02-pages.md`](../plans/community-local/portal/02-pages.md).
-- **Plugins.** Redesigned: a plugin is an MCP server the agent, the chat engine and the user call through one Tool Gateway, remote servers hosted by their publishers first, with SurfSense's paid scrapers as the first paid plugin once the scraper API has license mode. The earlier local runner is kept for bundles later. See the [proposal](proposals/plugins/README.md) and ADRs [0051](adr/0051-plugins-are-mcp-servers-behind-one-tool-gateway.md) to [0053](adr/0053-plugins-are-listed-in-a-registry-and-third-party-ones-start-off.md).
-- **Agent.** In progress: a chat thread opened in Agentic mode is the agent's, answered in steps by opencode over the workspace's extracted text, with SurfSense's search and Studio, on any model a technical gate, such as a stated no on tool calls, does not keep out. opencode ships in every installer and dev run, and models are measured against the agent's bar ([model capabilities](architecture/model-capabilities.md)); a model below it will also run fixed workflows with structured output. Outputs first: nothing edits the user's files. See [agent](architecture/agent.md), the [proposal](proposals/agent/README.md) and [ADR 0028](adr/0028-model-written-code-runs-with-approval.md).
+- **Plugins.** Redesigned: a plugin is an MCP server the agent, the chat engine and the user call through one Tool Gateway, remote servers hosted by their publishers first, with SurfSense's paid scrapers as the first paid plugin once the scraper API has license mode. The earlier local runner is kept for bundles later. See the [proposal](proposals/plugins/README.md) and ADRs [0051](adr/0051-plugins-are-mcp-servers-behind-one-tool-gateway.md) to [0054](adr/0054-surfsenses-plugins-run-on-one-plugin-host.md).
+- **Agent.** In progress: a chat opened in Agentic mode is the agent's, answered in steps by opencode over the workspace's extracted text, on any model a technical gate, such as a stated no on tool calls, does not keep out. It makes Word, PDF, PowerPoint and Excel files as scripts SurfSense runs, revises the user's own Word, Excel and PowerPoint files into new copies, Word's as tracked changes, works on PDFs and analyses data; the user's file itself is never written. opencode ships in every installer and dev run, and a list of measured or assumed models sets each chat's default mode ([model capabilities](architecture/model-capabilities.md)); a model below the bar will also run fixed workflows with structured output. The [file agent proposal](proposals/file-agent/README.md) orders what comes next: engines, versions, jobs such as the contract redline, and linked folders. See [agent](architecture/agent.md), the [agent proposal](proposals/agent/README.md) and [ADR 0039](adr/0039-document-scripts-run-without-approval.md).
+- **Docker.** The desktop stack without Electron as one container, replacing the legacy self-host compose. The CORS origins setting, the `VITE_API_BASE` fallback and boot outside `index.ts` are in; the headless entry is next. See the [proposal](proposals/docker/README.md) and [ADR 0035](adr/0035-docker-compose-runs-the-desktop-stack.md).
 
 ## Next
 
-- **Studio.** Four Office formats break the builder rule, podcasts are WAV only, and deleting an artifact through the documents route leaves its files behind. See [Studio](architecture/studio.md).
+- **Studio.** PowerPoint and Excel break the builder rule: their model-written scripts run in the script runner, but nothing confines a script's network or file access, and they keep no spec, so they have no versions or Refine. Podcasts are WAV only. See [Studio](architecture/studio.md).
 - **Local models follow-ups.** What the llama.cpp runtime left open: bugs in fit and fingerprinting, install screen gaps, adding a `.gguf` from disk, and constrained decoding. See [local models](architecture/local-models/runtime.md).
-- **Desktop app gaps.** Small, bounded gaps in documents, freshness and license settings, plus folders, which need a design first. See [documents](architecture/documents.md).
+- **Desktop app gaps.** Small, bounded gaps in documents, freshness and license settings. Library folders shipped in 2.2.0; their Trash and linking a folder on disk are designed in [01](proposals/file-agent/01-sources-and-folders.md) and not built. See [documents](architecture/documents.md).
 - **Chat eval.** Score the chat's answers on every curated chat model: up to 8B on the real files on our own machines, 8B to 32B on Featherless, with 8B in both places as the check. See the [proposal](proposals/chat-eval.md).
 - **Retrieval: a multilingual embedder.** Ranking is done and measured; the remaining gap is that a question in one language does not find its answer in another, which no ranking change reaches. The swap is small and the re-embed migration is the work. See the [proposal](proposals/retrieval.md) and [search](architecture/search.md).
 
 
@@ -23,7 +23,7 @@ The hosted Studio lets the model write code, runs it in a network-denied sandbox
 
 ## Where the code stands
 
-- PPTX and XLSX do not follow the rule. Their prompts ask the model to "write one standalone Python script", and [`worker/studio/office/runner.py`](https://github.com/MODSetter/SurfSense/blob/0847e12f723394ff8343e586c074d6ebb3541fed/surfsense_local/backend/worker/studio/office/runner.py) runs the reply with `exec()` in the worker process, unsandboxed, bounded by a 120-second timeout that cannot hard-kill a runaway thread. The module's `ponytail:` comment names that ceiling, and an out-of-process sandbox runner as the upgrade path. For these two formats the risk is back at arbitrary code with the worker's privileges.
+- PPTX and XLSX do not follow the rule. Their prompts ask the model to "write one standalone Python script", which since [#2184](https://github.com/MODSetter/SurfSense/pull/2184) runs in the out-of-process runner of [ADR 0039](0039-document-scripts-run-without-approval.md), stopped at its time limit, rather than with `exec()` in the worker through [`worker/studio/office/runner.py`](https://github.com/MODSetter/SurfSense/blob/0847e12f723394ff8343e586c074d6ebb3541fed/surfsense_local/backend/worker/studio/office/runner.py), now deleted. For these two formats the risk is still arbitrary code with the user's privileges, in a process of its own that nothing confines ([studio](../architecture/studio.md#known-gaps)).
 - DOCX and PDF follow the rule on small models, which write Markdown for committed builders, and run a strong model's script in the out-of-process runner of [ADR 0039](0039-document-scripts-run-without-approval.md) ([studio](../architecture/studio.md#word-and-pdf)).
 - The other eight formats (summary, mind map, flashcards, quiz, HTML, podcast, image and infographic) execute nothing the model wrote.
 - The HTML viewer renders into `<iframe sandbox="allow-scripts allow-popups">` ([`features/studio/viewers/html-viewer.tsx`](../../surfsense_local/frontend/src/features/studio/viewers/html-viewer.tsx)).
@@ -27,5 +27,5 @@ A command runs with the user's privileges, and a program it starts can open netw
 
 ## Where the code stands
 
-- No agent exists yet.
-- The Office runner's 120-second limit is a `thread.join`, which cannot stop a thread that ignores it ([studio](../architecture/studio.md)).
+- The agent exists, with no shell ([ADR 0039](0039-document-scripts-run-without-approval.md)).
+- Since [#2184](https://github.com/MODSetter/SurfSense/pull/2184) no Studio format runs `exec()` in the worker: every Office script runs in ADR 0039's runner, a process stopped at its time limit ([studio](../architecture/studio.md)).
@@ -30,12 +30,12 @@ The user's sources are untrusted input, and a document can carry instructions ai
 
 ## Where the code stands
 
-The runner and the agent's side are built on `dev_mod` ([the create-and-edit slice](../proposals/file-agent/07-create-and-edit-mvp.md)):
+The runner and the agent's side are built and shipped in 2.2.0 ([the create-and-edit slice](../proposals/file-agent/07-create-and-edit-mvp.md)):
 
 - **The runner.** [`worker/document_script/`](../../surfsense_local/backend/worker/document_script/) runs a script in a process of its own: the frozen worker binary in its `--run-document-script` mode when packaged, [`worker.py`](../../surfsense_local/backend/worker.py) on the backend's Python in development. It gives the script an empty folder, one output path, the images the call names and an environment built from a few system variables, with no key or secret. At 120 seconds, or on a cancel, it kills the script and everything it started: a job object holds them on Windows, a process group elsewhere ([studio](../architecture/studio.md#script-documents)).
 - **Kept with its version.** An agent's Word document or PDF is a script document: its script is the artifact's spec, each edit is a new version, and the next edit reads and changes that script.
 - **No shell.** `bash` is `deny` in [`opencode_config.py`](../../surfsense_local/backend/modules/agent/opencode_config.py), and the agent reaches the runner only through `surfsense_render_document` ([agent](../architecture/agent.md#documents-the-agent-makes)) and `surfsense_analyze_data`, whose scripts read copies of spreadsheet sources ([agent](../architecture/agent.md#analyses)).
 
 - **Studio's Word and PDF.** A strong model's script runs through the runner and is kept as the version's spec; a small model writes Markdown that committed builders render ([studio](../architecture/studio.md#word-and-pdf)).
 
-Not yet: Studio's PowerPoint and Excel still run with `exec()` in [`office/runner.py`](https://github.com/MODSetter/SurfSense/blob/0847e12f723394ff8343e586c074d6ebb3541fed/surfsense_local/backend/worker/studio/office/runner.py), and nothing blocks a script's network access or the processes it starts.
+Since [#2184](https://github.com/MODSetter/SurfSense/pull/2184), Studio's PowerPoint and Excel scripts run through the runner too, and [`office/runner.py`](https://github.com/MODSetter/SurfSense/blob/0847e12f723394ff8343e586c074d6ebb3541fed/surfsense_local/backend/worker/studio/office/runner.py) is deleted. Not yet: nothing blocks a script's network access or the processes it starts.