LycaonLLC · wolfiesch · Jul 20, 2026 · Jul 20, 2026 · Jul 20, 2026
diff --git a/README.md b/README.md
@@ -10,9 +10,9 @@ T4 Code is a free, open-source (MIT) desktop app for [Oh My Pi](https://github.c
 
 T4 Code needs an OMP build with desktop appserver support. For v0.1.30, use the public integration build below.
 
-T4 Code v0.1.30 was verified with OMP 17.0.5 built from [`09835b92`](https://github.com/lyc-aon/oh-my-pi/commit/09835b929cd028e7e3f800b3e4203e3d1f37931c), tagged [`t4code-17.0.5-appserver-8`](https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-8). That public integration is based on the official upstream [`v17.0.5`](https://github.com/can1357/oh-my-pi/tree/v17.0.5) tag at [`9fd6e971`](https://github.com/can1357/oh-my-pi/commit/9fd6e97113f5ed3a847e66d346970efdf8afcad9). It recovers safely from a crashed backend whose old process ID still appears alive, while preserving a responsive owner. It also includes privacy-safe project reveal, fast lazy session indexing, cross-session attention and transcript search, the negotiated browser-preview command surface, redacted Codex transport diagnostics, the versioned Agent View lifecycle contract, session-owned cancellation, lock-aware session observation, complete transcript reconciliation, the cooperative `/continue-in-t4` handoff, and deterministic session ordering. Fork CI verifies the exact upstream base, ancestry, release gates, and published binaries. The official upstream v17.0.5 tag has no `appserver` command, so it cannot host T4 Code. The verified runtime is a normal build from the public `lyc-aon/oh-my-pi` source. T4 Code vendors `@oh-my-pi/app-wire` 0.6.2 from integration commit [`04229b1f`](https://github.com/lyc-aon/oh-my-pi/commit/04229b1f46547ac7c0617e55a993496ec9725f46), source tree `8400a3af618e8af11cccf6b20aadcf3a22baf9a1`.
+T4 Code v0.1.30 was verified with OMP 17.0.5 built from [`073506e5`](https://github.com/lyc-aon/oh-my-pi/commit/073506e5ca278d08037beffd9ee78964f659ef12), tagged [`t4code-17.0.5-appserver-9`](https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-9). That public integration is based on the official upstream [`v17.0.5`](https://github.com/can1357/oh-my-pi/tree/v17.0.5) tag at [`9fd6e971`](https://github.com/can1357/oh-my-pi/commit/9fd6e97113f5ed3a847e66d346970efdf8afcad9). It integrates the T4-owned host packages and adds bounded newest-first transcript paging so mobile clients can show the recent conversation before loading older history. It also recovers safely from a crashed backend whose old process ID still appears alive, while preserving a responsive owner. It includes privacy-safe project reveal, fast lazy session indexing, cross-session attention and transcript search, the negotiated browser-preview command surface, redacted Codex transport diagnostics, the versioned Agent View lifecycle contract, session-owned cancellation, lock-aware session observation, complete transcript reconciliation, the cooperative `/continue-in-t4` handoff, and deterministic session ordering. Fork CI verifies the exact upstream base, ancestry, release gates, and published binaries. The official upstream v17.0.5 tag has no `appserver` command, so it cannot host T4 Code. The verified runtime is a normal build from the public `lyc-aon/oh-my-pi` source. T4 Code vendors `@oh-my-pi/app-wire` 0.6.2 from integration commit [`04229b1f`](https://github.com/lyc-aon/oh-my-pi/commit/04229b1f46547ac7c0617e55a993496ec9725f46), source tree `8400a3af618e8af11cccf6b20aadcf3a22baf9a1`.
 
-The development tree now owns the protocol source and generic host service in `@t4-code/host-wire` and `@t4-code/host-service`. The frozen `@oh-my-pi/app-wire` 0.7.0 tarball remains only as a compatibility snapshot for the current OMP bridge. OMP still owns session files, locks, agent execution, and takeover decisions. The verified runtime continues to carry the legacy embedded host copy until a thin bridge release replaces it, so ordinary upstream OMP is not yet compatible.
+The development tree owns the protocol source and generic host service in `@t4-code/host-wire` and `@t4-code/host-service`. The frozen `@oh-my-pi/app-wire` 0.7.0 tarball remains only as compatibility evidence. The verified OMP runtime now launches checksum-pinned T4 host artifacts through thin compatibility exports, while OMP still owns session files, locks, agent execution, and takeover decisions. Ordinary upstream OMP is not yet compatible because it does not ship the appserver launcher or authority adapter.
 
 | Platform | Arch                  | Package                                   |
 | -------- | --------------------- | ----------------------------------------- |

diff --git a/apps/desktop/test/bundled-runtime.test.ts b/apps/desktop/test/bundled-runtime.test.ts
@@ -16,7 +16,7 @@ describe("bundled OMP runtime", () => {
     const sha256 = createHash("sha256").update(bytes).digest("hex");
     await writeFile(join(runtimeRoot, "omp"), bytes);
     await writeFile(join(runtimeRoot, "manifest.json"), JSON.stringify({
-      version: 1, tag: "t4code-17.0.5-appserver-8", platform: "darwin", arch: "arm64",
+      version: 1, tag: "t4code-17.0.5-appserver-9", platform: "darwin", arch: "arm64",
       executable: "omp", size: bytes.length, sha256,
     }));
 
@@ -35,7 +35,7 @@ describe("bundled OMP runtime", () => {
     await mkdir(runtimeRoot, { recursive: true });
     await writeFile(join(runtimeRoot, "omp"), "wrong");
     await writeFile(join(runtimeRoot, "manifest.json"), JSON.stringify({
-      version: 1, tag: "t4code-17.0.5-appserver-8", platform: "darwin", arch: "arm64",
+      version: 1, tag: "t4code-17.0.5-appserver-9", platform: "darwin", arch: "arm64",
       executable: "omp", size: 5, sha256: "0".repeat(64),
     }));
 
@@ -58,7 +58,7 @@ describe("bundled OMP runtime", () => {
     await writeFile(join(runtimeRoot, "omp"), signedBytes);
     await writeFile(join(runtimeRoot, "manifest.json"), JSON.stringify({
       version: 1,
-      tag: "t4code-17.0.5-appserver-8",
+      tag: "t4code-17.0.5-appserver-9",
       platform: "darwin",
       arch: "arm64",
       executable: "omp",

diff --git a/apps/desktop/test/doctor.test.ts b/apps/desktop/test/doctor.test.ts
@@ -41,9 +41,9 @@ describe("T4 setup doctor", () => {
     const source = await readSourceContract();
 
     expect(source.ompVersion).toBe("17.0.5");
-    expect(source.ompTag).toBe("t4code-17.0.5-appserver-8");
+    expect(source.ompTag).toBe("t4code-17.0.5-appserver-9");
     expect(source.ompUrl).toBe(
-      "https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-8",
+      "https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-9",
     );
   });
 

diff --git a/apps/site/src/release.ts b/apps/site/src/release.ts
@@ -6,8 +6,8 @@ export const DOCS_URL = `${SITE_URL}/docs`;
 export const REPO_URL = "https://github.com/LycaonLLC/t4-code";
 export const OMP_URL = "https://github.com/can1357/oh-my-pi";
 export const OMP_RUNTIME_VERSION = "17.0.5";
-export const OMP_RUNTIME_COMMIT = "09835b929cd028e7e3f800b3e4203e3d1f37931c";
-export const OMP_RUNTIME_TAG = "t4code-17.0.5-appserver-8";
+export const OMP_RUNTIME_COMMIT = "073506e5ca278d08037beffd9ee78964f659ef12";
+export const OMP_RUNTIME_TAG = "t4code-17.0.5-appserver-9";
 export const OMP_RUNTIME_URL = `https://github.com/lyc-aon/oh-my-pi/tree/${OMP_RUNTIME_TAG}`;
 export const OMP_UPSTREAM_TAG = "v17.0.5";
 export const OMP_UPSTREAM_COMMIT = "9fd6e97113f5ed3a847e66d346970efdf8afcad9";

diff --git a/apps/site/test/release.test.ts b/apps/site/test/release.test.ts
@@ -61,10 +61,10 @@ describe("release assets", () => {
 
 describe("OMP integration contract", () => {
   it("pins the verified runtime tag, commit, and app-wire package", () => {
-    expect(OMP_RUNTIME_TAG).toBe("t4code-17.0.5-appserver-8");
-    expect(OMP_RUNTIME_COMMIT).toBe("09835b929cd028e7e3f800b3e4203e3d1f37931c");
+    expect(OMP_RUNTIME_TAG).toBe("t4code-17.0.5-appserver-9");
+    expect(OMP_RUNTIME_COMMIT).toBe("073506e5ca278d08037beffd9ee78964f659ef12");
     expect(OMP_RUNTIME_URL).toBe(
-      "https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-8",
+      "https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-9",
     );
     expect(OMP_UPSTREAM_TAG).toBe("v17.0.5");
     expect(OMP_UPSTREAM_COMMIT).toBe("9fd6e97113f5ed3a847e66d346970efdf8afcad9");

diff --git a/compat/omp-app-matrix.json b/compat/omp-app-matrix.json
@@ -21,14 +21,14 @@
     "package": "omp",
     "version": "17.0.5",
     "sourceRepository": "https://github.com/lyc-aon/oh-my-pi",
-    "sourceCommit": "09835b929cd028e7e3f800b3e4203e3d1f37931c",
-    "sourceUrl": "https://github.com/lyc-aon/oh-my-pi/commit/09835b929cd028e7e3f800b3e4203e3d1f37931c",
-    "sourceTag": "t4code-17.0.5-appserver-8",
+    "sourceCommit": "073506e5ca278d08037beffd9ee78964f659ef12",
+    "sourceUrl": "https://github.com/lyc-aon/oh-my-pi/commit/073506e5ca278d08037beffd9ee78964f659ef12",
+    "sourceTag": "t4code-17.0.5-appserver-9",
     "artifacts": {
       "darwin-arm64": {
         "name": "omp-darwin-arm64",
-        "size": 120777424,
-        "sha256": "3ecb5f40be627f7f0f15035822017f8e2c8afaa4a46978f0874a6be8acb3f2fa"
+        "size": 120876496,
+        "sha256": "48138ec0c0329d76d4daa4ddc5ffaf32051c26d8e1ad1898322243d16aac2d5d"
       }
     },
     "upstreamRepository": "https://github.com/can1357/oh-my-pi",
@@ -97,22 +97,24 @@
       "hardened-preview-frame-decoding",
       "complete-preview-command-surface",
       "privacy-safe-local-project-reveal",
-      "stale-appserver-owner-recovery"
+      "stale-appserver-owner-recovery",
+      "t4-owned-host-package-integration",
+      "bounded-transcript-tail-paging"
     ],
     "upstreamTagContainsIntegrationPatches": false
   },
   "verifiedRuntime": {
     "package": "omp",
     "version": "17.0.5",
     "sourceRepository": "https://github.com/lyc-aon/oh-my-pi",
-    "sourceCommit": "09835b929cd028e7e3f800b3e4203e3d1f37931c",
-    "sourceUrl": "https://github.com/lyc-aon/oh-my-pi/commit/09835b929cd028e7e3f800b3e4203e3d1f37931c",
-    "sourceTag": "t4code-17.0.5-appserver-8",
+    "sourceCommit": "073506e5ca278d08037beffd9ee78964f659ef12",
+    "sourceUrl": "https://github.com/lyc-aon/oh-my-pi/commit/073506e5ca278d08037beffd9ee78964f659ef12",
+    "sourceTag": "t4code-17.0.5-appserver-9",
     "artifacts": {
       "darwin-arm64": {
         "name": "omp-darwin-arm64",
-        "size": 120777424,
-        "sha256": "3ecb5f40be627f7f0f15035822017f8e2c8afaa4a46978f0874a6be8acb3f2fa"
+        "size": 120876496,
+        "sha256": "48138ec0c0329d76d4daa4ddc5ffaf32051c26d8e1ad1898322243d16aac2d5d"
       }
     },
     "upstreamRepository": "https://github.com/can1357/oh-my-pi",
@@ -181,7 +183,9 @@
       "hardened-preview-frame-decoding",
       "complete-preview-command-surface",
       "privacy-safe-local-project-reveal",
-      "stale-appserver-owner-recovery"
+      "stale-appserver-owner-recovery",
+      "t4-owned-host-package-integration",
+      "bounded-transcript-tail-paging"
     ],
     "upstreamTagContainsIntegrationPatches": false
   },
@@ -197,7 +201,7 @@
       "packages/host-service"
     ],
     "runtimeAuthority": "omp",
-    "deploymentState": "source-owned-legacy-runtime-bridge",
+    "deploymentState": "source-owned-artifact-runtime-bridge",
     "migrationInputs": {
       "repository": "https://github.com/lyc-aon/oh-my-pi",
       "baseCommit": "09835b929cd028e7e3f800b3e4203e3d1f37931c",

diff --git a/docs/CURRENT_RELEASE_NOTES.md b/docs/CURRENT_RELEASE_NOTES.md
@@ -28,7 +28,7 @@ Session-linked Host Browser Previews continue to open in their dedicated workspa
 
 T4 Code v0.1.30 vendors app-wire 0.6.2 from integration commit [04229b1f](https://github.com/lyc-aon/oh-my-pi/commit/04229b1f46547ac7c0617e55a993496ec9725f46), source tree `8400a3af618e8af11cccf6b20aadcf3a22baf9a1`. The client contract remains `omp-app/1`.
 
-The verified OMP 17.0.5 runtime is built from commit [09835b92](https://github.com/lyc-aon/oh-my-pi/commit/09835b929cd028e7e3f800b3e4203e3d1f37931c) and tagged [t4code-17.0.5-appserver-8](https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-8). It adds stale-owner recovery to the existing appserver capabilities, including privacy-safe local project reveal, lazy session indexing, cross-session attention and transcript search, and the negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.
+The verified OMP 17.0.5 runtime is built from commit [073506e5](https://github.com/lyc-aon/oh-my-pi/commit/073506e5ca278d08037beffd9ee78964f659ef12) and tagged [t4code-17.0.5-appserver-9](https://github.com/lyc-aon/oh-my-pi/tree/t4code-17.0.5-appserver-9). It integrates the T4-owned host packages and adds bounded newest-first transcript paging for fast mobile session opens. It preserves stale-owner recovery, privacy-safe local project reveal, lazy session indexing, cross-session attention and transcript search, and the negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.
 
 The integration is based on the official upstream [v17.0.5 tag](https://github.com/can1357/oh-my-pi/tree/v17.0.5), commit [9fd6e971](https://github.com/can1357/oh-my-pi/commit/9fd6e97113f5ed3a847e66d346970efdf8afcad9). Official upstream OMP v17.0.5 has no `appserver` command and cannot host T4 Code.
 

diff --git a/docs/OMP_BRIDGE.md b/docs/OMP_BRIDGE.md
@@ -34,4 +34,4 @@ The bridge must fail closed when an operation is unavailable or ownership is unc
 
 ## Migration state
 
-The source has moved, but the currently verified OMP integration binary still embeds the legacy host implementation. Until the thin OMP adapter consumes the T4-owned packages, T4 keeps the exact runtime tag and hash in the compatibility matrix. This is a compatibility transition, not a claim that the fork has already disappeared.
+The verified OMP integration now consumes checksum-pinned T4 host artifacts through thin compatibility exports. The duplicated generic host and wire implementation has been removed from the fork; OMP retains the launcher and its private authority adapter. T4 keeps the exact runtime tag, source commit, artifact size, and hash in the compatibility matrix. Ordinary upstream OMP is still not compatible because it does not ship that launcher or adapter.
diff --git a/docs/RELEASE_GATE.md b/docs/RELEASE_GATE.md
@@ -22,19 +22,19 @@ Every release must pass the layers below. Destructive lifecycle checks use a dis
    - Use real CDP touch input at 320 pixels for model-list drag scrolling and selection. Check Send and session-management control reachability at 320, 360, and 390 pixels, including a short 390 x 500 viewport.
    - Open and close the session rail, create a session, reach the Send control, drag-scroll the model list, and select its last available model.
 
-## Legacy bridge continuity proof
+## OMP bridge continuity proof
 
 Run the deterministic compatibility gate from the T4 repository root with Node 24.13.1 and the pinned Lycaon OMP source:
 
 ```sh
 T4_OMP_SOURCE_DIR=/path/to/lycaon-oh-my-pi pnpm test:legacy-bridge-continuity
 ```
 
-The gate intentionally launches the legacy OMP appserver from the pinned authority source, plus a real OMP TUI and multiple production T4 clients. It proves client compatibility across bounded transcript loading, live ownership refusal, concurrent profile isolation, reconnect after an in-flight transport loss, appserver restart recovery, transcript search/read-around, stale-revision rejection, recovered control, and cleanup. It does not claim that `@t4-code/host-service` is deployed; that requires the future thin OMP launcher and authority adapter.
+The gate launches the OMP appserver from the pinned authority source, plus a real OMP TUI and multiple production T4 clients. Its historical command name still says `legacy-bridge`, but the verified runtime now launches checksum-pinned T4 host artifacts through thin compatibility exports. The gate proves client compatibility across bounded transcript loading, live ownership refusal, concurrent profile isolation, reconnect after an in-flight transport loss, appserver restart recovery, transcript search/read-around, stale-revision rejection, recovered control, and cleanup.
 
 CI resolves the exact OMP authority commit from `provenance/omp-host-migration.json`, checks out the exact T4 pull-request head, runs this gate, and attaches the evidence directory to that commit's check run.
 
-Each successful run writes machine-readable evidence under `artifacts/legacy-bridge-continuity/<run>/`: `report.json`, sanitized `wire-events.ndjson`, `failure-matrix.json`, `cleanup-status.json`, and an executable `rollback.sh`. The report names the legacy host implementation, records both source commits and dirty-state fingerprints, and captures bounded snapshot sizes, failure codes, delivered cursor integrity, profile overlap, restart persistence, search/context results, and cleanup state. These artifacts are local and ignored by Git.
+Each successful run writes machine-readable evidence under the historical `artifacts/legacy-bridge-continuity/<run>/` path: `report.json`, sanitized `wire-events.ndjson`, `failure-matrix.json`, `cleanup-status.json`, and an executable `rollback.sh`. The report names the host implementation, records both source commits and dirty-state fingerprints, and captures bounded snapshot sizes, failure codes, delivered cursor integrity, profile overlap, restart persistence, search/context results, and cleanup state. These artifacts are local and ignored by Git.
 
 For a manual failure investigation, rerun with `T4_KEEP_CONTINUITY_SANDBOX=1`. The failed run retains its disposable profile and writes `report.json` plus sanitized `wire-events.ndjson`; successful runs also include `rollback.sh`, which documents the authenticated cleanup request for an explicitly test-mode appserver. Never point the gate or rollback helper at a normal OMP profile.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -34,4 +34,4 @@ The bridge must fail closed when an operation is unavailable or ownership is unc

		## Migration state

		The source has moved, but the currently verified OMP integration binary still embeds the legacy host implementation. Until the thin OMP adapter consumes the T4-owned packages, T4 keeps the exact runtime tag and hash in the compatibility matrix. This is a compatibility transition, not a claim that the fork has already disappeared.
		The verified OMP integration now consumes checksum-pinned T4 host artifacts through thin compatibility exports. The duplicated generic host and wire implementation has been removed from the fork; OMP retains the launcher and its private authority adapter. T4 keeps the exact runtime tag, source commit, artifact size, and hash in the compatibility matrix. Ordinary upstream OMP is still not compatible because it does not ship that launcher or adapter.