v3.5.1

# Engram 3.5.1

Frozen core source: [`41f12547`](https://github.com/Gentleman-Programming/engram/commit/41f1254796d49233d7bcb11741093bc09eb386ff). Changes since the last published core release, **v3.4.0**: **75 merged pull requests**.

This fix-forward release was published through [Release run 39466387308](https://github.com/Gentleman-Programming/engram/actions/runs/39466387308). The existing **v3.5.0** tag remains unchanged after its release attempt failed the module-tidy guard; no core v3.5.0 GitHub Release was published.

## Highlights

- Atomic memory consolidation with plan/confirmation, ownership checks and structured provenance; batch relation judgments and atomic session finalization.
- Compact search, paginated observation history and Go-owned HTTP/agent workflow contracts.
- Explicit prompt sharing for Git sync: prompts are excluded from Git chunks by default.
- Local project aliases and routing previews, optional capture provenance, and explicit HOME project-selection safeguards.
- Session-owned Pi server lifecycle and bundled-store upgrade recovery; reduced compaction/bootstrap context churn.
- Fixes for sync session recreation with local children, Claude resume/compaction registration and OpenCode global-session authority.
- Windows SQLite temporary-storage stabilization; bounded enrolled-journal repair transactions; project deletion tombstones and improved diagnostics.
- Dashboard refresh and bounded dashboard read-model memory use.
- Reconciled module checksums to fix the core release tidy guard (#1957): go.sum only, 6 additions and 35 deletions; go.mod and all 95 selected module versions unchanged. Closes #1955.

## Upgrade and compatibility

The authorized release pair is **Engram 3.5.1 + the existing gentle-engram 0.5.0**. The core source above is distinct from Pi 0.5.0's source, `fe897f66e964c58284bdc83e6e5447f9ba8364c0`; no Pi republishing is planned. Core and Pi version streams are independent. The companion publication guard checks registry name/version, the installer pin, startupPolicy and sessionOwned metadata; it does not require equal core/Pi SemVer or Git SHAs. That guard alone does not prove runtime compatibility.

Setup upgrades the known managed 0.4.2 predecessor while preserving unrelated settings and MCP configuration (#1924). Pi 0.5.0 is already published on npm's `candidate` channel and as a Pi GitHub Release; `latest` promotion remains separate and pending. The isolated Windows amd64 runtime and managed-settings upgrade smoke passed for both staging and the actual published core 3.5.1/Pi 0.5.0 pair. npm `latest` promotion remains a separate pending operation. Back up your data and configuration before upgrading. This release does not claim full Go/Pi semantic parity or validation of every downstream Shell bundle upgrade.

## Verification and limits

- Actual source-fix evidence: checksum tidy RED/GREEN, module verification, unchanged selected-module comparison and independent bounded review PASS. Normal PR #1957 CI and merge-queue CI passed. The final merged core source above has parent `fe897f66e964c58284bdc83e6e5447f9ba8364c0` and tree `6752db1a3f1185d24459b6aedb6ac60ad184601b`, matching the reviewed checksum-fix tree. Issue #1955 is closed.
- Exact merged-source main CI **39461390767 passed** for core source `41f1254796d49233d7bcb11741093bc09eb386ff`; the observer exited 0. This is source-CI evidence, not validation of a new release artifact.
- Core 3.5.1 staging **39462750335 / attempt 1** succeeded for the frozen source. Artifact **12283567571** matched its API archive digest; all **14 payload files** and six clean-source VCS buildinfo records were verified. The locally packed Pi 0.5.0 tarball is byte-identical to the already-published package. The staged pair's isolated Windows amd64 runtime/managed-settings upgrade smoke passed all 11 checks. **Core 3.5.1 publication and actual public-asset/runtime verification succeeded within the scope below.**
- Historical evidence only: the old staged core **3.5.0** and companion **0.5.0**, both from `fe897f66`, passed an isolated Windows x64 genuine Pi 1.3.0 search/save/search smoke, authentication, managed-settings migration and owned-process shutdown checks. Pi 0.5.0 publication succeeded; its published tarball matched the staged bytes and its provenance identity was inspected (cryptographic signature-chain verification was not claimed). These results remain valid for those identities, not for new core 3.5.1 artifacts.
- Actual public assets: all seven downloaded files matched GitHub API names, sizes and SHA256 digests; the six archives also matched `checksums.txt`. All six executables report Go 1.25.10, the expected OS/architecture and source revision `41f12547`. Public binaries differ from staging and report `vcs.modified=true` / `+dirty`; no post-build tracked-clean proof or signed-attestation equivalence is claimed.
- Actual public-pair runtime evidence: the downloaded Windows amd64 binary (SHA256 `cfd90c4572428c68c702b24e990c1cd3912f977dc8bc59d678d9337520bdbc2e`) and the verified public Pi 0.5.0 bytes passed all 11 checks in genuine Pi 1.3.0. Native empty search → save → search, HTTP 401/200 authentication, managed 0.4.2→0.5.0 settings migration preserving unrelated settings/MCP, and owner/child shutdown passed. The independent probe ran once and exited 0; all children and the loopback model server closed. Pi lifecycle stderr traces are expected. Coverage is Windows amd64 with synthetic private fixtures, not real-user upgrades, every platform installation or every downstream Shell bundle upgrade.
- Homebrew formula metadata was checked at version 3.5.1: all four Darwin/Linux URLs and archive hashes match this release. No Homebrew installation was performed.
- Windows binaries are not Authenticode-signed; Smart App Control and Defender reports remain separate open investigations (#1703, #1912).

## Contributors

Thank you @dnlrsls, @danielgap, @MataM15, @josegarvinvictoria, @pablon, @Alan-TheGentleman, @NotMxx, @akushonkamen, @LucasOliveira-dev2026 for the contributions included in this release range. Individual PR credits and first-time contributors are listed below.

## What's Changed
* fix(store): isolate manual saves from foreign session owners by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1797
* fix(hooks): make session confirmation timeout configurable by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1798
* feat(review): add data-preserving sync guidance by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1800
* fix(doctor): explain unsupported observation-source repairs by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1799
* fix(store): classify rescued session ownership atomically by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1801
* feat(sync): bound dead deferred rows with conflicts prune by @danielgap in https://github.com/Gentleman-Programming/engram/pull/1783
* feat(store): add atomic ConsolidateObservations with plan/confirm (#242 slice 1 of 3) by @danielgap in https://github.com/Gentleman-Programming/engram/pull/1782
* feat(store): schedule reviews for five knowledge types by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1803
* fix(plugin): bind resumed Claude sessions to their live continuation by @MataM15 in https://github.com/Gentleman-Programming/engram/pull/1765
* fix(sync): exclude prompts from Git chunks unless explicitly shared by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1806
* feat(ci): add inactive linked-issue validation evaluator by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1812
* feat(pi): add canonical topic workflow to the memory protocol by @josegarvinvictoria in https://github.com/Gentleman-Programming/engram/pull/1653
* feat(cli): add explicit prompt sharing for Git sync by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1813
* feat(store): preserve structured consolidation provenance (slice 2) by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1818
* feat(ci): add inactive bounded issue-check publisher by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1819
* feat(ci): bootstrap trusted issue approval refresh by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1823
* feat(store): bind consolidation to expected source owner by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1824
* docs: unify memory protocol across all agent surfaces by @pablon in https://github.com/Gentleman-Programming/engram/pull/1787
* feat(mcp): expose confirmed atomic memory consolidation by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1825
* fix(pi): preserve fake CLI invocation logs on Windows by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1829
* feat(store): older history integration tracker (draft, no merge) by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1815
* feat(ci): add trusted native issue-policy PR jobs by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1838
* refactor(cli): extract doctor sync repair orchestration by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1837
* test(store): cover consolidation provenance sequences by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1836
* test(cloud): measure mutation pause lookup amplification by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1842
* feat(ci): add guarded native metadata rerun helper by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1843
* feat(mcp): add batch judgments and atomic session finalization by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1840
* test(cloudstore): characterize dashboard cache read behavior by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1848
* test(cloudstore): measure dashboard rebuild SQL and history cost by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1849
* feat(ci): prepare inactive issue approval refresh dispatcher by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1850
* fix(store): adopt the coupled SQLite libc EINTR sleep fix by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1853
* fix: recover bundled stores across core upgrades and stop session-owned servers with Pi by @Alan-TheGentleman in https://github.com/Gentleman-Programming/engram/pull/1854
* feat(contract): add Go-owned agent contract foundation by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1847
* test(scripts): cover operational performance ratchet modes by @NotMxx in https://github.com/Gentleman-Programming/engram/pull/1784
* feat(ci): wire issue approval events to guarded native refresh by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1855
* fix(ci): bind native refresh to the original PR event by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1861
* fix(pi): preserve owned startup fixture checks on Windows by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1862
* feat(search): expose compact search through HTTP and Pi by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1863
* ci(governance): enforce root-cause-first contribution lifecycle by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1295
* feat(history): expose paginated observation history through HTTP and Pi by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1869
* test(ci): cover duplicate runs and late legacy publication by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1867
* feat(release): add rejection-only candidate checker by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1874
* refactor(agent): share compound workflow validation across transports by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1871
* feat(release): validate local Pi package tarballs by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1882
* feat(http): integrate Go-owned agent workflows on main by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1883
* fix(pi): integrate Go-owned agent profile on main by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1884
* test(pi): integrate real HTTP workflow coverage on main by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1886
* feat(capture): preserve optional project provenance by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1885
* fix(ci): validate trusted qualified issue references by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1887
* feat(server): integrate current HTTP runtime endpoint on main by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1889
* feat(projects): add local aliases and routing preview by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1890
* feat(runtime-contract): generate current Go-owned HTTP projection by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1893
* fix(sync): isolate inbox retention and read-only state by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1898
* feat(pi): package Go runtime comparison assets by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1904
* fix(doctor): skip blank MCP registration configs by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1915
* docs(contributing): map existing focused verification commands by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1916
* fix(store): bound enrolled journal repair transactions by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1917
* fix(store): record project tombstone on delete project --hard by @akushonkamen in https://github.com/Gentleman-Programming/engram/pull/1895
* test(store): make project tombstone timestamp coverage deterministic by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1918
* fix(doctor): warn on inert foreign sync targets by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1919
* feat(project): prepare opt-in HOME project selection guard by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1922
* fix(project): require explicit HOME selection at capture boundaries by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1925
* fix(cloudstore): bound dashboard read-model build memory by @Alan-TheGentleman in https://github.com/Gentleman-Programming/engram/pull/1931
* feat(cloud): re-theme the dashboard with the gentlemanprogramming.com styles by @Alan-TheGentleman in https://github.com/Gentleman-Programming/engram/pull/1933
* feat(release): guard companion publication order by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1936
* feat(release): stage unsigned candidates without publication by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1939
* fix(claude): avoid redundant bootstrap context retrieval by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1945
* fix(pi): keep compaction recovery out of the system prompt by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1946
* fix(pi): isolate native contract fixtures from delegated roles by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1950
* fix(opencode): validate global session location authority by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1952
* fix(sync): preserve local data across chunk session recreation by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1951
* fix(claude): register a resumable session after compaction by @LucasOliveira-dev2026 in https://github.com/Gentleman-Programming/engram/pull/1935
* fix(cli): stabilize SQLite temporary storage on Windows by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1953

* feat(release): prepare compatible session-owned candidate pair by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1924
* fix(build): reconcile module checksums for core release by @dnlrsls in https://github.com/Gentleman-Programming/engram/pull/1957

## New Contributors
* @MataM15 made their first contribution in https://github.com/Gentleman-Programming/engram/pull/1765
* @pablon made their first contribution in https://github.com/Gentleman-Programming/engram/pull/1787
* @NotMxx made their first contribution in https://github.com/Gentleman-Programming/engram/pull/1784
* @akushonkamen made their first contribution in https://github.com/Gentleman-Programming/engram/pull/1895
* @LucasOliveira-dev2026 made their first contribution in https://github.com/Gentleman-Programming/engram/pull/1935

**Full Changelog**: https://github.com/Gentleman-Programming/engram/compare/v3.4.0...v3.5.1