SiliconState · SiliconState · Aug 7, 2026 · Aug 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Changed
 
-- Rebuilt the public README around a concise product overview, real Dext frontend captures, direct quick start, plain safety boundaries, and links to focused references instead of duplicating the technical documentation. Follow-up review replaced the overbroad “project-aware memory” shorthand with explicit project-scoped autosave/resume and user-authored recall/Seat semantics, changed paste-ready auth examples to keep credentials out of shell arguments, and made incomplete CLI login guidance point to Dext's `/login` paste path for API keys or manual OAuth callbacks. Added lightweight Linux/macOS and Windows installers that require exact release tags and safe regular-file destinations, select a matching release, verify `SHA256SUMS`, validate the candidate's reported version before replacing an existing binary, install per-user, and use a documented exact-revision locked source fallback until the first tagged release; Windows uses `File.Replace` when supported and a rollback-preserving rename fallback only for explicit unsupported-operation failures, retaining a recoverable backup if rollback fails. Fixed the public `irm | iex` path under Windows PowerShell 5.1 by replacing nullable modern-.NET architecture metadata with native Windows environment detection, including 32-bit PowerShell on 64-bit Windows. Attestation-required mode fails closed instead of using an unattested source build. CI now executes offline Unix and Windows installer harnesses covering success, no-clobber failures, strict tags/destinations, source pinning/fallback disablement, malformed API state, version mismatch, and Windows replacement rollback/recovery; both Windows PowerShell 5.1 and PowerShell 7 parse and execute the complete harness plus an in-memory install matching `irm | iex`. Release tags must be annotated and point to a commit contained in `origin/main`; Pages deployment has a bounded 15-minute action deadline within a 20-minute job. The verified remaining GitHub governance-setting gaps are recorded in R-008.
+- Rebuilt the public README around a concise product overview, real Dext frontend captures, direct quick start, plain safety boundaries, and links to focused references instead of duplicating the technical documentation. Follow-up review replaced the overbroad “project-aware memory” shorthand with explicit project-scoped autosave/resume and user-authored recall/Seat semantics, changed paste-ready auth examples to keep credentials out of shell arguments, and made incomplete CLI login guidance point to Dext's `/login` paste path for API keys or manual OAuth callbacks. Added lightweight Linux/macOS and Windows installers that require exact release tags and safe regular-file destinations, select a matching release, verify `SHA256SUMS`, validate the candidate's reported version before replacing an existing binary, install per-user, and use a documented exact-revision locked source fallback when no tagged release is available; Windows uses `File.Replace` when supported and a rollback-preserving rename fallback only for explicit unsupported-operation failures, retaining a recoverable backup if rollback fails. Fixed the public `irm | iex` path under Windows PowerShell 5.1 by replacing nullable modern-.NET architecture metadata with native Windows environment detection, including 32-bit PowerShell on 64-bit Windows. Attestation-required mode fails closed instead of using an unattested source build. CI now executes offline Unix and Windows installer harnesses covering success, no-clobber failures, strict tags/destinations, source pinning/fallback disablement, malformed API state, version mismatch, and Windows replacement rollback/recovery; both Windows PowerShell 5.1 and PowerShell 7 parse and execute the complete harness plus an in-memory install matching `irm | iex`. Release tags must be annotated and point to a commit contained in `origin/main`; Pages deployment has a bounded 15-minute action deadline within a 20-minute job. For the `v0.1.0` publication, Windows joined Ubuntu/macOS as a required `main` check, `v*` tags gained update/deletion protection, immutable releases and private vulnerability reporting were enabled, and vulnerability alerts plus Dependabot security updates were activated; R-008 now tracks only the residual trusted-maintainer boundary for initial tag creation.
 
 - Pack Runtime Protocol v1 now fails closed across the full lifecycle: recursive schemas accept only the implemented keyword subset; native-name and host approval-operation collisions use the full occupied catalog during activation and resume; executable bytes are hashed, displayed at approval, and rechecked before every call; prompt-level `Always` approval is scoped to that exact runtime identity; changing approval or sandbox policy revokes the active executable runtime and queued callbacks; current-run approval/sandbox policy remains authoritative during resume and saved grants are discarded before restoration; restoration preflights exact canonical pack-directory/source identity, manifest/hash/state accounting, project trust, and executable approval before mutating the live agent; activation/idle/read events enforce read-only confinement inside the executor; protocol-sized stdout is preserved and content/effects/queued prompts reject unsafe terminal controls; malformed timeout overrides fail closed; stdin delivery and root execution share the configured deadline, and output drain after process-tree cleanup has a separate one-second cap; state/effects/continuation accounting applies atomically; and pending continuations persist, cancel/refund on interrupt, and remain bounded. Runtime calls also persist state/results without read-tool debounce, surfaced lifecycle errors are privacy-redacted, `/allow`/`/allowed` recognize active dynamic tools, and any runtime-bearing session uses format v5 so pre-runtime binaries reject rather than silently discard executable-runtime state.
 

diff --git a/README.md b/README.md
@@ -37,7 +37,7 @@ Windows PowerShell 5.1 or PowerShell 7:
 irm https://raw.githubusercontent.com/SiliconState/Dext/main/scripts/install.ps1 | iex
 ```
 
-The Windows installer uses native Windows environment values for architecture detection so the same in-memory script works under Windows PowerShell 5.1 and PowerShell 7. The installers select the matching release archive, require an exact `vX.Y.Z` tag, verify its SHA-256 checksum, and validate that it starts and reports the selected version before replacement. Dext has not published its first tagged release yet, so the current installers resolve and pin the current `main` commit before running a locked Cargo build; that fallback requires [Rust](https://rustup.rs). Set `DEXT_SOURCE_FALLBACK=0` to require a release instead. Set `DEXT_REQUIRE_ATTESTATION=1` to additionally require [GitHub CLI](https://cli.github.com/) verification of release provenance; because source builds have no release attestation, that setting also disables source fallback.
+The Windows installer uses native Windows environment values for architecture detection so the same in-memory script works under Windows PowerShell 5.1 and PowerShell 7. The installers select the matching release archive, require an exact `vX.Y.Z` tag, verify its SHA-256 checksum, and validate that it starts and reports the selected version before replacement. Dext `v0.1.0` is published, so the default installers download prebuilt archives and do not require Rust. If no tagged release is available, the documented fallback resolves and pins the current `main` commit before running a locked Cargo build; that fallback requires [Rust](https://rustup.rs). Set `DEXT_SOURCE_FALLBACK=0` to refuse source fallback. Set `DEXT_REQUIRE_ATTESTATION=1` to additionally require [GitHub CLI](https://cli.github.com/) verification of release provenance; because source builds have no release attestation, that setting also disables source fallback.
 
 Prefer to review before running? Download [`install.sh`](scripts/install.sh) or [`install.ps1`](scripts/install.ps1), inspect it, then execute it locally. Release provenance and manual verification are documented in [`docs/RELEASING.md`](docs/RELEASING.md).
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -68,7 +68,7 @@ cargo test --release --locked
 cargo test --release --locked --test tui_smoke -- --nocapture
 ```
 
-Also scan untracked and ignored files before deciding what to preserve locally vs. delete. Dependency licenses are checked against `deny.toml`; release publication generates `dext.cdx.json` and includes it in checksum and provenance verification. The public installers are reviewable repository scripts: they install per-user, require exact `vX.Y.Z` release tags, verify the selected archive against `SHA256SUMS`, extract only the expected root binary, require the candidate to start and report the selected release version before replacement, and can require `gh attestation verify` with `DEXT_REQUIRE_ATTESTATION=1`. The Windows installer derives native architecture from Windows environment values rather than nullable modern-.NET runtime metadata; CI and release builders execute the complete harness and an in-memory `Invoke-Expression` install under both Windows PowerShell 5.1 and PowerShell 7. Windows uses `File.Replace` when supported and a rollback-preserving same-directory rename fallback only when replacement is unsupported before mutation; a failed rollback retains the previous binary under the recovery path reported in the error. Before the first tagged release, the installers' documented source fallback resolves one current `main` commit and passes that exact revision plus `--locked` to Cargo; attestation-required mode refuses this unattested fallback. Offline Unix and Windows installer tests cover successful replacement, checksum rejection without clobbering an existing binary, exact-revision source fallback, malformed release/ref responses, strict tag parsing, version mismatch, fallback disablement, and the attestation requirement; Windows also forces unsupported replacement, rollback, and backup-retention paths. The release workflow rejects a tag commit not contained in `origin/main`. Owner tag creation, immutable asset handling, manual checksum/SBOM verification, and GitHub build-provenance verification are documented in [`docs/RELEASING.md`](docs/RELEASING.md). Terminal dependency and renderer changes must also satisfy [`docs/TUI.md`](docs/TUI.md), including its PTY gate and live-terminal acceptance. Published release assets should be used only after both `SHA256SUMS` and `gh attestation verify <asset> --repo SiliconState/Dext` succeed.
+Also scan untracked and ignored files before deciding what to preserve locally vs. delete. Dependency licenses are checked against `deny.toml`; release publication generates `dext.cdx.json` and includes it in checksum and provenance verification. The public installers are reviewable repository scripts: they install per-user, require exact `vX.Y.Z` release tags, verify the selected archive against `SHA256SUMS`, extract only the expected root binary, require the candidate to start and report the selected release version before replacement, and can require `gh attestation verify` with `DEXT_REQUIRE_ATTESTATION=1`. The Windows installer derives native architecture from Windows environment values rather than nullable modern-.NET runtime metadata; CI and release builders execute the complete harness and an in-memory `Invoke-Expression` install under both Windows PowerShell 5.1 and PowerShell 7. Windows uses `File.Replace` when supported and a rollback-preserving same-directory rename fallback only when replacement is unsupported before mutation; a failed rollback retains the previous binary under the recovery path reported in the error. The published `v0.1.0` archives are the default installer path and do not require Rust. If no tagged release is available, the documented source fallback resolves one current `main` commit and passes that exact revision plus `--locked` to Cargo; attestation-required mode refuses this unattested fallback. Offline Unix and Windows installer tests cover successful replacement, checksum rejection without clobbering an existing binary, exact-revision source fallback, malformed release/ref responses, strict tag parsing, version mismatch, fallback disablement, and the attestation requirement; Windows also forces unsupported replacement, rollback, and backup-retention paths. The release workflow rejects a tag commit not contained in `origin/main`. Owner tag creation, immutable asset handling, manual checksum/SBOM verification, and GitHub build-provenance verification are documented in [`docs/RELEASING.md`](docs/RELEASING.md). Terminal dependency and renderer changes must also satisfy [`docs/TUI.md`](docs/TUI.md), including its PTY gate and live-terminal acceptance. Published release assets should be used only after both `SHA256SUMS` and `gh attestation verify <asset> --repo SiliconState/Dext` succeed.
 
 ## Runtime safety notes
 

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -257,7 +257,7 @@ Compaction preserves recent tool evidence and summarizes older conversation when
 
 ## Verification surface
 
-Expected release assets also include a CycloneDX JSON SBOM. The release workflow includes the SBOM in `SHA256SUMS`, provenance attestation, verification, and publication alongside the four platform archives. The first successful tag run remains explicitly tracked in [`RELEASING.md`](RELEASING.md) until this path has end-to-end evidence.
+Expected release assets also include a CycloneDX JSON SBOM. The release workflow includes the SBOM in `SHA256SUMS`, provenance attestation, verification, and publication alongside the four platform archives. This path completed end to end for `v0.1.0`; [`RELEASING.md`](RELEASING.md) records the workflow and verification evidence.
 
 Expected checks before releasing Dext changes:
 

diff --git a/docs/RELEASING.md b/docs/RELEASING.md
@@ -1,6 +1,6 @@
 # Releasing Dext
 
-Releases are owner-triggered by an annotated version tag. The workflow does not publish from branches or manual dispatch, rejects tag commits outside `origin/main`, and treats published tags/assets as immutable by policy; repository tag protection and immutable-release settings remain owner controls tracked in [`R-008`](RISK_REGISTER.md).
+Releases are owner-triggered by an annotated version tag. The workflow does not publish from branches or manual dispatch and rejects tag commits outside `origin/main`. Active `v*` rules prevent updates and deletion, published releases are immutable, and initial tag creation remains a trusted maintainer action guarded by workflow validation.
 
 ## Dry review
 
@@ -32,18 +32,18 @@ Releases are owner-triggered by an annotated version tag. The workflow does not
    If an agent must orchestrate the gate, start a separate trusted Dext process with `dext --sandbox-profile danger-full-access --approval always` and use it only in a controlled checkout. Changing `DEXT_SANDBOX_PROFILE` inside an already-confined shell does not remove the parent process's kernel sandbox. Do not weaken `workspace-write` or grant shared temp, PTY, or Cargo-home access merely to make self-hosted tests pass.
 
 4. Confirm branch CI is green on Linux, macOS, and Windows; do not rely only on the currently configured required checks. Windows CI includes the native Job Object descendant-lifecycle test and parses/executes the complete installer harness under both inbox Windows PowerShell 5.1 and PowerShell 7. Each engine evaluates `install.ps1` from in-memory text through `Invoke-Expression`, matching the public `irm | iex` path, and checks native architecture detection without nullable modern-.NET metadata. Linux and macOS execute the Unix installer harness. These offline tests cover successful replacement, checksum failure without clobbering the existing binary, exact-revision source fallback, malformed release/ref responses, strict tag parsing, unsafe destination refusal, version mismatch, fallback disablement, and attestation-required refusal of source fallback. Windows additionally forces unsupported `File.Replace`, successful fallback, rollback, and retained-backup recovery paths. Linux compiles Criterion benchmarks. Confirm the scheduled security workflow passes both vulnerability auditing and the dependency-license policy. If terminal dependencies or `src/tui.rs` changed, apply the renderer contract and live-terminal checks in [`TUI.md`](TUI.md). Review `.github/workflows/release.yml`, especially its full action commit pins, quality gate, four-target matrix, annotated-tag/origin-`main` ancestry checks, and publish-job permissions.
-5. Before the first public release, resolve the GitHub-setting gaps recorded in [`R-008`](RISK_REGISTER.md): require Windows CI alongside Ubuntu/macOS, protect `v*` tags, enable immutable releases, private vulnerability reporting, vulnerability alerts, and Dependabot security updates. Confirm the tag and release do not already exist. Treat release artifacts as immutable even before the setting is enabled: never move a published tag or replace bytes under an existing tag/checksum.
+5. Before every public release, recheck the owner-controlled GitHub settings: require Windows CI alongside Ubuntu/macOS, protect `v*` tags from update and deletion, and keep immutable releases, private vulnerability reporting, vulnerability alerts, and Dependabot security updates enabled. Confirm the tag and release do not already exist. Initial release-tag creation remains a trusted maintainer action because this personal repository does not currently enforce a creation-only rule with an owner bypass; the workflow must still reject lightweight tags, commits outside `origin/main`, and tag/package version mismatches.
 
 ## First-release evidence
 
-The publication workflow has not yet completed a version tag. Before treating it as proven, record the first successful tag run here:
+The publication path first completed for [`v0.1.0`](https://github.com/SiliconState/Dext/releases/tag/v0.1.0) in [release run `31139795179`](https://github.com/SiliconState/Dext/actions/runs/31139795179) from commit `9a48eb9a8f7065a2dd71041527e0b276a7444876`:
 
-- [ ] Annotated-tag, `origin/main` ancestry, and package-version validation passed.
-- [ ] Four platform archives and `dext.cdx.json` were published and listed in `SHA256SUMS`.
-- [ ] Provenance verification passed for every checksummed asset.
-- [ ] Packaged binaries passed the workflow smoke checks.
+- [x] Annotated-tag, `origin/main` ancestry, and package-version validation passed.
+- [x] Four platform archives and `dext.cdx.json` were published and listed in `SHA256SUMS`.
+- [x] Provenance verification passed for every checksummed asset in the workflow and an independent post-publication download.
+- [x] Packaged binaries passed the workflow smoke checks.
 
-After the first successful release, replace these unchecked items with the tag and workflow URL. The README/usage installers will then consume the published archives automatically; until that point their default `latest` path deliberately falls back to a locked source build from one resolved `main` revision. Attestation-required mode refuses that fallback because a local source build has no release attestation.
+The README/usage installers now consume the published archives automatically, so normal installation does not require Rust. Their exact-revision locked source fallback remains available only when no tagged release exists. Attestation-required mode refuses that fallback because a local source build has no release attestation.
 
 ## Publish