@@ -130,7 +130,7 @@ M0→M4 is where you stop wanting to switch editors. These milestones are what m
 **M5 — Close the loop & earn hands-off trust.**
 - **● Diagnostics-driven auto-verify loop** *(M)* — ✅ **DONE.** After edits land and the model goes to finish, Atom++ verifies its own work before handing back: pulls `vscode.languages.getDiagnostics` for the files it touched this run (NEW errors only — diffed against a pre-run baseline keyed by severity+message, so pre-existing/unrelated problems and line-shifts don't trigger a chase) and, if a verify command is configured, runs it through the live-terminal plumbing; failures are injected back as a synthetic turn so the agent self-corrects, bounded by `atompp.ai.verify.maxRounds` (re-entries) **and** `maxSteps`, abort-safe, shown as a live ⛨ verify card. A command that can't even run (missing npm script / not found / exit 127) is classified as a config problem — it warns the user and never loops the agent on it. New `verify.js` (pure, unit-tested: 24 + 8 + 13 cases) + settings `atompp.ai.verify.{enabled,command,maxRounds,includeWarnings}`. *The capability every 2026 source calls the defining trait of autonomous agents — turns the agent from "writes code" into "ships working code."*
 - **Background command execution** *(M)* — ✅ **first slice shipped.** `run_command` now takes `background:true`: the command still goes through the Approve card but returns immediately (`Started in the background as id …`) so the agent keeps working while the live terminal card keeps streaming and Stop stays available. A new `read_command_output {id, lines}` tool lets the agent poll a background process's recent output + status (`[running on :3000] …`), with port/readiness sniffed from the logs (`verify.js` `sniffPort`/`looksReady`, unit-tested) and a "no new output since last read" delta. Background runs ignore `commandTimeout`; a `bgRuns` registry (extension.js) is reaped on New Chat + extension unload so servers don't orphan their ports. *Deferred to slice 2:* the auto-background safety net (a foreground command still running after ~12s auto-detaches so a forgetful model never hangs), a port badge on the card, the `atompp.ai.agent.background.*` settings, and a max-concurrent cap. *This pairs with the auto-verify loop: start server → test against it → fix → repeat.*
-- **● Workspace checkpoints / restore timeline** *(M)* — snapshot touched files per agent step, with one-click "Restore to here." *Cursor's checkpoints are explicitly "what makes people comfortable letting the agent make sweeping changes"; `reviewSession.js` already snapshots from disk, so this is mostly promoting it to a per-step stack.*
+- **● Workspace checkpoints / restore timeline** *(M)* — ✅ **DONE.** Each agent turn that changes files is a checkpoint; a subtle always-visible **↩ Restore checkpoint · N files** chip under each user message rolls the workspace back to **before that turn ran**, undoing that turn *and every later one* (created files deleted, modified files rewritten to their exact pre-turn disk content, transcript truncated, stale Keep/Undo cards cleared). Snapshot-on-first-touch reuses reviewSession's single from-disk read (the checkpoint + per-file-review layers can't diverge); restore reuses `undoFile`'s write-back via a shared `restoreOne`; **earliest-pre-image-wins** across the restored suffix (unit-tested); refuses while the agent is running; `trimAgentMemory`-proof (truncation resolved by message *identity*, not a stale index). In-memory per session. *Plus a composer **↑/↓ history recall** (shell/Cursor-style, multiline-safe).* *This is Cursor's "what makes people comfortable letting the agent make sweeping changes" — and it completes M5's close-the-loop trilogy with the auto-verify loop + background execution.*
 - **Prompt transparency + editable system prompts** *(S)* — view and override the real `SYSTEM` prompts and see the exact context sent. *A stated PLAN pillar (§4, from Void), still unbuilt; a privacy/trust wedge against closed tools.*
 - **Real token + cost accounting** *(S)* — ✅ *context-usage shipped, Claude-Code-style*: `providers.js` captures real Anthropic `usage` (input/output + cache tokens); the footer now shows a **donut ring** that fills + recolors by pressure (accent → amber → red), and **clicking it opens a breakdown popover** (segmented bar + Messages / System prompt / Tools / Free-space rows with tokens + %), live-updating as the agent runs. *Remaining:* running $ spend + replace `lmProvider`'s length/4 estimate. *Cost opacity is the #1 criticism of BOTH Cursor and Windsurf — a no-backend editor showing exact per-message usage flips their biggest weakness into ours.*
 - **Ship-grade polish** *(S)* — ✅ *richer chat markdown shipped* (lists/tables/headings/links + diff coloring + codicons). *Remaining:* debug logging OFF by default; finish M3's Settings UI / theme studio / VS Code settings import.