[betterthanclay]

Retain the separate OpenCode HTTP and ACP qualification through 1.19.4. 1.19.5 remains UnverifiedNewer; this PR records the useful identity and dependency evidence and the concrete gaps preventing qualification.

The record explicitly preserves the uncorrelated native-payload/tag relationship, absent observed attestations and Linux x64-only inventory among twelve selected native packages. It records GitLab provider 6.19.0–6.23.1 static analysis and unresolved selected-path effects, and corrects the proper-lockfile addition and signal-exit re-hoist with mutation-sensitive lock-coordinate assertions. Claims, segments, exclusions, operations, hard-delete boundaries and exact live MCP pins are unchanged.

Follow-up lead 5b445586-3c98-47c5-aa88-7950aace016b owns remaining qualification work. No vendor executable, provider session, credential, installation, consumer or release action is included.

Final additive canonical-main integration is complete after Qwen #207; it has no dependency on Queue-blocked #208. OpenCode semantic/evidence bytes remain identical to the source-reviewed stop at 0c87cae.

Independent final-head review 5694738074 passes all five subjects at 60d99ffacf4b163185ce7d0d6e7101005ad091b7. Covering Effigy checks pass, including 205/205 tests and both new ledger targets, clippy, compile, format, docs/routes, retired-concepts and routing. Exact-head CI 40840262643 passes ten jobs; the PR-skipped MSRV tests are not release proof.

[inflatable-tester]

Independent review of PR #529 at 8e2a8f9 (base 72620fa), read against the Queue brief, the repository Validate rule, Contract 029, the version-currentness checkpoint guide and Research 453/464. Scope reviewed: the complete 38-file diff, both frozen fixtures, both new delta ledgers, the claim/segment code paths, and the guide/matrix/architecture truth surfaces.

Independent provenance verification (public static retrieval; no vendor execution, no provider traffic, no installation)

Every pinned value below was recomputed from npm/GitHub for this head and matches the fixtures; I found no wrong digest, count or identity:

• npm opencode-ai latest is 1.19.5; the published version list has no 1.18.36 and no 1.19.6; 1.19.5 is the only stable after 1.19.4.
• npm tarball SHA-256: opencode-ai 1.19.4 2ceca45c7e0bbd50ddd3f4d6d651ed43645647d74279d656e7c7747a4b6a9137, 1.19.5 1f97e49381f8a42a629482eff8be98aa96d62e2e94410a8ec98e738f9c787680; opencode-linux-x64 1.19.4 dca7b06bbb4e4a1ab3681b799cd328057b356d9399e8e47336cf53b7ae658d0d, 1.19.5 2d7cfc303decc6cbbcdb22ff1be258b03ce2b5eae57583545afc8f12c01dd5e0. All 12 per-file npm digests match.
• GitHub v1.19.5: non-prerelease, published 2026-10-28T06:17:49Z, tag commit 810c0eba1a7348036f8bdf61e6632d0c36c6876c, target_commitish dev; linux-x64 asset 588310a336fa3b9df36b3f0225b26f679d453efaad0cf3d66c3651ef3ec1647a, size 79651896. v1.19.4: tag commit 148842ef7cb1bc34192b3fff57d0f9721ab9c801, asset 849bd6b3d959a1d2ef200ed1634a51c79a45ca236aa26665d75debd694805cce.
• Tag archives: 1.19.4 2e553ed005b2df4a7efb9edd26db8fc3caafb1b4dfc3c5c3869192334584d8bb, 1.19.5 7d2ac43b5083a3a4687fe23b79ab153b8d93a6fb186fa07209ed28d4731e5c7a. Canonical trees: 1.19.4 ae0d6884639fda9deb79082e5b27483c9b6a6f45fb8868dadd89714722cbf287 with 6576 files / 6636 entries; 1.19.5 98d156015c7d31198a689d93fbe18bdc9a11c833228473e8334ee36c9973a56b with 6567 files / 60 symlinks / 6627 entries.
• Hop 1.19.4 to 1.19.5: added 4, removed 13, changed 83, identical 6540; path-list digests afe3f85b786e88bbf1d92505f987bdf05d09b9f7add5ce67a7d96ad6c2c6968a, 11a9113311a6949ed859e968a95b19fa93e9c0209147a37e4aa364e5f98d9adc, 4491c152d5e7302a381c25b020e351a15ae651133c37b5647469d76d0bc9f97f all match. The 100 delta paths partition exactly into 34 classified / 15 CI / 1 nix / 27 workspace package versions / 3 release scripts / 20 tests.
• Selected HTTP surface: all 12 mapped stable files byte-identical; packages/sdk/openapi.json byte-identical at d224c1a7506ae981c8d4fc1a8d1f58ac185e27324f94d4daf1b8f84fc2552d26, 162 paths, info.version 1.0.0. All 34 implementation_file_deltas before/after digests match.
• ACP surface: all 18 ACP/MCP behaviour files byte-identical; the only ACP-selected changed file is packages/opencode/package.json (version plus GitLab pin); @agentclientprotocol/sdk stays 0.21.0, protocolVersion 1, bundled Bun 1.4.4.
• Semantic bounding re-derived: the 8 removed src files have no importer or path reference in the 1.19.4 tree; util/rpc.ts is imported only by cli/cmd/tui.ts and cli/tui/worker.ts (both byte-identical); the 23 changed src files are import/exports removal only with bodies unchanged; the PTY bypass change narrows to Effect route context plus ticket query and leaves every non-PTY credential path untouched; no removed export (getReleaseType, isPreview, DEFAULT_CSP, fallbackSanitization, readArrayBuffer, isRepositoryError, isPtyConnectPath) remains referenced in the 1.19.5 tree.
• ACP registry: opencode and opencode-v2 are both 2.2.0 with identical digests; GitHub v2.2.0 is non-prerelease at 2026-10-27T09:04:44Z with tag commit 1097e2668b1e08ad63bdf0b1c4860b9bc01e420c, correctly excluded from both axes.

Findings (author action required)

F1 [medium] artifact-provenance: the shipped-native provenance gap is recorded as an input but never returned as a gap

Files: docs/research/464-opencode-http-acp-1-19-5-identity.md:47-50; crates/swallowtail-adapter-opencode/tests/fixtures/opencode-1.19.5/identity.json (release_artifacts[1].npm.gitHead null, github.release_target_commitish dev, release_target_commitish_kind branch).
Failure: Research 464 states that npm has no gitHead and that the release target is the branch dev, then says source evidence is the tag archive, and proceeds to a compatible-extension decision. It never states the consequence the brief names: the shipped native payload (opencode-linux-x64 bin/opencode, and the GitHub linux-x64 asset it mirrors) cannot be correlated to the v1.19.5 tag tree whose selected files are compared. The byte-identity evidence therefore proves a property of the tag, not of the binary a consumer runs, and the decision does not say which it rests on. I checked the only alternative provenance: npm dist.attestations is absent for both 1.19.5 packages, and the v1.19.5 release publishes no SLSA or attestation asset (36 assets, none is an attestation), so the available provenance really is the recorded tag archive plus digests; that makes an explicit gap statement the correct and only honest close. Related, smaller: only the linux-x64 native payload is inventoried even though the opencode.executable and opencode.server axes themselves carry no platform restriction, so the record should either state that the evidence is platform-scoped to the one observed payload or inventory the other published native identities.
Fix: add an explicit provenance-gap field or paragraph to Research 464 and the fixture (for example native_payload_correlated_to_tag false, with the null-gitHead / branch-target reason and the absence of attestations), scope every byte-identity conclusion to the tag tree, and state the platform scope of the evidence.

F2 [medium] http-behaviour: the changed gitlab-ai-provider dependency is dismissed by the unchanged in-repo wrapper

Files: docs/research/464-opencode-http-acp-1-19-5-identity.md:113-120; crates/swallowtail-adapter-opencode/tests/fixtures/opencode-1.19.5/protocol.json (no dependency-delta entry; classified_unmapped_deltas covers only in-repo files).
Failure: 464 resolves the gitlab-ai-provider 6.19.0 to 6.23.1 move by noting that packages/core/src/plugin/provider/gitlab.ts, provider/provider.ts and provider/transform.ts are byte-identical and that Swallowtail decodes OpenCode catalogue and session envelopes, not the GitLab client. The brief states that exactly this is insufficient. The dependency delta itself is substantive and unrecorded: npm 6.23.1 adds proper-lockfile ^4.1.2 for an opt-in shared direct-access token cache, fixes self-managed Duo Agent Platform plus ws namespace fallback (6.23.1), adds a skipCache provider option (6.22.0), new model mappings (Claude Haiku 5.5, Gemini 4 Argon), an OpenAI Responses tool-strictness default (6.19.1) and an Anthropic refusal-to-content-filter finish-reason mapping (6.20.1); dist/index.js differs by about 1.2k lines between the pins. Whether or not these are inert for the selected routes, the required defaults/auth/cache/retry analysis is absent, so the reachability bound is asserted rather than shown. (The catalogue decoder is permissive, so new model entries do not by themselves break decoding; that is exactly the kind of bound the record should state.)
Fix: record the dependency delta and bound it against the selected handler call paths for both axes, separating catalogue content from provider auth/cache/retry beneath the unchanged wrapper, or record the finite unmet gate and retain the 1.19.4 ceiling for the affected axis.

F3 [low] http-behaviour: the bun.lock classification is factually false and the ledger cannot catch it

Files: crates/swallowtail-adapter-opencode/tests/fixtures/opencode-1.19.5/protocol.json:57; crates/swallowtail-adapter-opencode/tests/opencode_http_1_19_5_delta_ledger.rs:293.
Failure: the classification reads 'Lockfile moves workspace package versions ... and gitlab-ai-provider from 6.19.0 to 6.23.1. No other package coordinate changes.' The real bun.lock delta also adds proper-lockfile ^4.1.2 under gitlab-ai-provider and re-hoists signal-exit (top-level 4.1.0 to 3.0.7, new per-parent 4.1.0 entries for execa, foreground-child and write-file-atomic, proper-lockfile/signal-exit removed). This is the mutation-sensitive per-file classification record, its text is wrong, and the ledger only asserts text length above 40, so the falsity passes CI.
Fix: correct the lockfile classification to name the transitive addition and re-hoist, and add one real assertion over the lockfile delta (for example the added dependency name, or a digest of the lockfile dependency lines) so a wrong classification cannot pass.

Everything else I checked is consistent and needs no change: claim constants and segments (HTTP 1.18.11..=1.18.35 plus 1.19.0..=1.19.5; ACP deprecated 1.18.18..=1.18.30, maintained 1.18.31..=1.18.35 and 1.19.0..=1.19.5), 1.18.36 incompatible and 1.19.6 UnverifiedNewer, historical gaps preserved, MCP live evidence exact 1.18.18 and non-transferring, unflattened axes, no new public operation or authority, prepared hard-delete and detachment bounds unchanged, both new delta ledgers registered as explicit [[test]] targets and included in the maintained selectors, and the docs/matrix/architecture truth updated consistently (81 to 82 releases, 1.14.48..=1.19.5).

Covering checks run once at this head (all through Effigy, none repeated)

• effigy check:current-opencode-http: exit 0 (all-target compile).
• effigy format:package swallowtail-adapter-opencode: exit 0.
• effigy validate:focused swallowtail-adapter-opencode: exit 0; nextest 205 tests across 12 binaries, 205 passed, 0 skipped (200 before this delta plus 5 new: 3 HTTP and 2 ACP ledger tests, both new targets registered in Cargo.toml and executed); clippy passed.
• effigy qa:docs: exit 0 (51 routes, 38 route guides, 50 examples, 17 feature families).
• effigy qa:routes: exit 0 (42 solution rows, 39 features, 740 unavailable cells, 6 pinned producer gaps; 89 operations).
• effigy skill run northstar/retired-concepts: exit 0.
• effigy validate:oxide-routing: exit 0 (233 selectors, 160 switched, 0 cargo escapes) because Effigy selectors changed.

No source was edited; the tracked tree is clean at 8e2a8f9.

Review verdicts

ID	Subject	Verdict	Evidence	Note
artifact-provenance	Node/npm and GitHub stable identity, complete source and shipped file inventories, and artifact-to-source relation	fail	Independently recomputed: npm latest 1.19.5, no 1.18.36/1.19.6, all four npm tarball digests, all 12 npm file digests, v1.19.5/v1.19.4 tag commits and target_commitish, both release-asset digests/sizes, both source archive digests, both canonical trees with file/entry counts, hop 4/13/83/6540 and path-list digests, openapi hash/path count/info.version, and every mapped/implementation file digest. All match. Fail is for the missing gap return: null npm gitHead and branch target_commitish mean the shipped native payload is not correlated to the compared tag, and the record never states that; only the linux-x64 native payload is inventoried for an axis with no platform restriction.	No incorrect pinned value found; the defect is the unstated correlation limit (and platform scope), not the digests.
http-behaviour	Selected HTTP routes, SSE, prompt, cancel, delete, session history, and changed dependency effects	fail	Verified byte-identical selected route declaration/handler files, byte-identical openapi.json (162 paths, info.version 1.0.0), byte-identical selected session files, util/rpc bounded to two byte-identical TUI importers, PTY authorization narrowed and non-PTY credential paths unchanged, 8 removed files unreferenced, 23 changed src files import/export-only. Fail is for the unexamined gitlab-ai-provider 6.19.0 to 6.23.1 dependency delta (required defaults/auth/cache/retry analysis absent) and the false bun.lock classification asserting no other coordinate changes while proper-lockfile is added and signal-exit is re-hoisted.	The selected wire surface itself is confirmed unchanged; the required dependency bound and one per-file classification are missing or wrong.
acp-behaviour	ACP initialize, callbacks, permissions, session and MCP lifecycle through 1.19.5	pass	All 18 ACP/MCP behaviour files (packages/opencode/src/acp/*, cli/cmd/acp.ts, core MCP config, MCP HTTP group/handler, mcp/index.ts) are byte-identical at 1.19.4 and 1.19.5; the only ACP-selected changed file is packages/opencode/package.json (version plus GitLab pin); @agentclientprotocol/sdk stays 0.21.0, protocolVersion 1, bundled Bun 1.4.4; HTTP MCP live honouring stays exact 1.18.18 and does not transfer; axes and registry 2.2.0 remain unflattened/excluded.	The shared GitLab dependency finding F2 also touches the provider layer beneath ACP prompts; the ACP route evidence at this hop is complete.
prepared-boundary	Prepared facade and claim boundary: windows, segments, gaps, hard delete, and authority	pass	OPENCODE_LATEST_QUALIFIED_VERSION and OPENCODE_ACP_LATEST_QUALIFIED_VERSION move to 1.19.5 with segments preserved and extended exactly (1.18.11..=1.18.35 and 1.19.0..=1.19.5; ACP deprecated 1.18.18..=1.18.30 plus 1.18.31..=1.18.35 and 1.19.0..=1.19.5), 1.18.36 stays Incompatible, 1.19.6 UnverifiedNewer, historical gaps unchanged, no new public operation/lifecycle/authority, and prepared hard-delete/detachment/unverified-newer tests were updated coherently and pass.	No consumer-visible narrowing or authority expansion.
covering-checks	Independent covering Effigy validation at the reviewed head	pass	All run once through Effigy at 8e2a8f9: check:current-opencode-http (exit 0), format:package swallowtail-adapter-opencode (exit 0), validate:focused swallowtail-adapter-opencode (exit 0; 205 tests across 12 binaries, 205 passed, 0 skipped, clippy clean; both new ledger targets registered and executed), qa:docs (exit 0), qa:routes (exit 0), skill run northstar/retired-concepts (exit 0), validate:oxide-routing (exit 0; 233 selectors, 160 switched, 0 cargo escapes).	Selection-scope checks were not duplicated; no full qa/ci was run per task.

[inflatable-tester]

Independent delta review — OpenCode 1.19.5 evidence-only stop at fresh-main head

Reviewed exact head 60d99ffacf4b163185ce7d0d6e7101005ad091b7 (Merge canonical main into OpenCode evidence branch, parents 0c87cae41 and 0b548f27b) on branch cursor/opencode-1-19-5-currentness-cb7e, PR 529, planning base 72620fa4837d39cff0056886828f32beae783e93. Worktree clean before and after checks; I edited nothing and pushed nothing.

Scope of this review

This is the brief's authorized final delta review after the owner's serialized fresh-main integration 207; it deliberately does not reopen source/artifact/dependency semantics.

• git diff 0b548f27b..HEAD (PR delta against current main) is exactly 15 files: two opencode-1.19.5 / opencode-acp-1.19.5 fixture sets, the two *_1_19_5_delta_ledger.rs targets, docs/research/464-…, one docs/research/README.md index line, the two [[test]] entries in the crate Cargo.toml, and the two OpenCode selector additions in effigy.toml.
• Every OpenCode semantic file is byte-identical to the independently reviewed 0c87cae: selection.rs 5b74f011…, acp/selection.rs 32fad8e9…, both ledgers (8b57781a…, 61b5722b…), all four HTTP fixture files and all four ACP fixture files, docs/research/464 ce13e360…, Cargo.toml 929fba99…. git diff 0c87cae..HEAD -- crates/swallowtail-adapter-opencode docs/research/464-… is empty.
• The only integration-authored change is the single-line 464 index entry inserted between 465 and 463 with all sibling records retained; CHANGELOG.md, the OpenCode guides, provider-route-matrix.md, the feature-matrix CSV and system-architecture.md are byte-identical to current main (they differ from 0c87cae only through sibling families merged from main). OpenCode rows/cells still read 1.19.0..=1.19.4, 1.18.36 incompatible, later stable visible-unverified.
• Production ceilings remain OPENCODE_LATEST_QUALIFIED_VERSION = "1.19.4" and OPENCODE_ACP_LATEST_QUALIFIED_VERSION = "1.19.4"; 1.19.5 stays AllowUnverified/UnverifiedNewer; segments, historical gaps, hard-delete contract, unflattened axes and HTTP MCP live exact 1.18.18 are unchanged. No public operation, permission, lifecycle, packaging, API or pin changed.

Fresh subject judgements (current-head evidence)

The identity, dependency and lock facts were reproduced independently from public static sources at 0c87cae (npm/GitHub digests and tag trees, canonical tree hashes, hop counts and path digests, openapi hash/162 paths/1.0.0, gitlab-ai-provider tarball and source-map digests with auth/defaults/cache/retry/finish-reason reading, bun.lock coordinate set, 12 native packages, absent gitHead/attestation and branch-valued target). Because every corresponding file is byte-identical here, those judgements carry with byte equality proof, and no semantic reopening or artifact re-download was performed.

1. artifact-provenance — pass. The exact identity/GAP record is present and honest at this head: native_payload_correlated_to_tag:false, attestation_observed:false, Linux-x64-only inventory of the wrapper's 12 native selections, tag-tree-only byte-equality scoping, and the finite owning follow-up 5b445586-3c98-47c5-aa88-7950aace016b. No fabricated correlation and no 1.19.5 qualification. (Supersedes review 5688620338 artifact-provenance fail by id: the unstated correlation limit and platform scope are now explicit.)
2. http-behaviour — pass. Selected route/handler/session files and openapi.json remain byte-identical; util/rpc stays bounded to the two unchanged TUI importers; PTY authorization change remains confined with non-PTY credential paths intact; removed prompt texts unreferenced; the GitLab dependency delta is recorded with named remaining gates rather than dismissed; the lock evidence is corrected to seven mutation-sensitive coordinates. (Supersedes review 5688620338 http-behaviour fail by id: the dependency bound and the false bun.lock classification are repaired.)
3. acp-behaviour — pass. All 18 ACP/MCP behaviour files remain byte-identical; only the OpenCode manifest carries version+pin; ACP SDK 0.21.0, protocolVersion 1, axes unflattened, HTTP MCP live exact 1.18.18, registry 2.2.0 excluded.
4. prepared-boundary — pass. Ceilings stay 1.19.4 with preserved and retained segments, incompatible 1.18.36, unverified-newer 1.19.5, hard delete and live pin intact, and no authority change. The evidence-only outcome is what the repository now states. (Supersedes review 5688620338 prepared-boundary value by id: that review assessed the withdrawn 1.19.5 widening; this head retains 1.19.4.)
5. covering-checks — pass. Run once each at 60d99ffa through Effigy: validate:focused swallowtail-adapter-opencode exit 0 (205 tests across 12 binaries, 205 passed, 0 skipped, clippy -D warnings clean; both new ledgers compiled and executed), check:current-opencode-http exit 0, format:package swallowtail-adapter-opencode exit 0 with tracked tree still clean, qa:docs exit 0, qa:routes exit 0, skill run northstar/retired-concepts exit 0, validate:oxide-routing exit 0 (233 selectors, 160 switched, 0 cargo escapes).

Hosted CI at the exact head

Run 40840262643 for 60d99ffa completed success: Stable format and lint, both Stable nextest shards, Stable process-spawning nextest, Stable examples/metadata/route contracts, Documentation and semantic API, Research number uniqueness, Pinned MSRV floor, Dependency security/licenses/sources, and External Git-source consumer all succeeded. Pinned MSRV floor tests was skipped on the PR by design and therefore, per the brief, is not release proof.

Findings

No blocking findings and no requested changes. Notes only:

• Pinned MSRV floor tests remains PR-skipped; this run is not release proof and no tag/release follows.
• No worker-published value cites an earlier review id (PR body and the single existing review mention none), so the re-review equality check has nothing to compare; the fresh verdicts above supersede review 5688620338 by id on their own evidence.
• PR title/body now describe the retained-1.19.4 evidence-only outcome and the held merge gate; they match repository truth.
• Merge hold remains with the owner; no release, tag, publication or consumer repin authority is implied.

Boundaries observed: no vendor artifact execution, no provider/live/auth/session call, no installation or host/settings mutation, no credentials, no CI weakening, no source edits; static public metadata and immutable prior evidence only, with this round's work in mktemp scratch only.

Review verdicts

ID	Subject	Verdict	Evidence	Note
artifact-provenance	Node/npm and GitHub stable identity, complete source and shipped file inventories, and artifact-to-source relation	pass	At 60d99ff every identity fixture and Research 464 are byte-identical to the independently verified 0c87cae evidence (identity.json d2b85668, README bc72e6cd, 464 ce13e360, dist-inventory 305f4c97/6524bcd0), and the PR delta vs main is exactly that evidence set. The record states native_payload_correlated_to_tag:false, attestation_observed:false, npm gitHead null, branch-valued release target, tag-tree-only byte-equality scope, Linux-x64-only inventory of 12 wrapper native packages, and the owning adaptation lead. No fabricated correlation, no 1.19.5 qualification.	Supersedes review 5688620338 artifact-provenance fail by id: the previously unstated correlation limit and platform scope are now explicit at the same evidence bytes.
http-behaviour	Selected HTTP routes, SSE, prompt, cancel, delete, session history, and changed dependency effects	pass	Selected route/handler and session files plus openapi.json remain byte-identical; util/rpc stays bounded to the two unchanged TUI importers; PTY authorization change remains confined with non-PTY credential paths intact; removed prompt texts unreferenced. The GitLab 6.19.0->6.23.1 delta is recorded from a verified provider-free static reading with auth/defaults/cache/retry/finish-reason facts and named remaining gates, and bun.lock evidence is corrected to seven mutation-sensitive coordinate pairs (fixture e59053e6, ledger 8b57781a) - all byte-identical to the reviewed 0c87cae files.	Supersedes review 5688620338 http-behaviour fail by id: the required dependency bound and the false lock classification are repaired.
acp-behaviour	ACP initialize, callbacks, permissions, session and MCP lifecycle through 1.19.5	pass	ACP fixtures (identity 1953f2a3, protocol 54b88785, dist-inventory 6524bcd0) are byte-identical to the reviewed head: all 18 ACP/MCP behaviour files byte-identical, only packages/opencode/package.json carries version+GitLab pin, @agentclientprotocol/sdk 0.21.0, protocolVersion 1, axes unflattened, HTTP MCP live exact 1.18.18, registry 2.2.0 excluded. No ACP 1.19.5 qualification is claimed.	Fresh judgement unchanged from review 5688620338 acp-behaviour pass; retained as the current-head value.
prepared-boundary	Prepared facade and claim boundary: windows, segments, gaps, hard delete, and authority	pass	OPENCODE_LATEST_QUALIFIED_VERSION and OPENCODE_ACP_LATEST_QUALIFIED_VERSION are 1.19.4 at this head; segments 1.18.11..=1.18.35 / 1.19.0..=1.19.4 and ACP 1.18.18..=1.18.30 / 1.18.31..=1.18.35 / 1.19.0..=1.19.4 preserved, 1.18.36 incompatible, 1.19.5 UnverifiedNewer, hard delete and HTTP MCP live 1.18.18 intact, no public operation or authority change. Shared guides/matrices/architecture/CHANGELOG are byte-identical to current main.	Supersedes review 5688620338 prepared-boundary value by id: that review assessed the withdrawn 1.19.5 widening; this head retains the 1.19.4 evidence-only boundary.
covering-checks	Independent covering Effigy validation at the reviewed head	pass	Run once each at 60d99ff: validate:focused swallowtail-adapter-opencode exit 0 (205 tests/12 binaries, 205 passed, 0 skipped, clippy -D warnings clean; both new ledgers executed), check:current-opencode-http exit 0, format:package exit 0 with tracked tree clean, qa:docs exit 0, qa:routes exit 0, skill run northstar/retired-concepts exit 0, validate:oxide-routing exit 0 (233 selectors, 160 switched, 0 cargo escapes). Hosted CI run 40840262643 at the exact head completed success (10 success, 1 skipped Pinned MSRV floor tests, which is PR-skipped and not release proof).	Fresh-head covering proof; no repeated unchanged artifact downloads or duplicate per-family suites, and no full qa/ci per task.