tamashi095 · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026
diff --git a/...se-the-same-sdk-engine-and-delegate-browser-session-measurements-and-control.md b/...se-the-same-sdk-engine-and-delegate-browser-session-measurements-and-control.md
@@ -247,3 +247,44 @@ Durable independent report: `/tmp/miso-796-audit/verify-adapter95-published-verd
 registry archive: `/tmp/miso-796-audit/misofm-engine-web-adapter-0.5.7-registry.tgz`.
 All source, package and published-adoption gates are PASS. Root synchronizes
 this evidence upstream and the matching GitHub issue before verified closure.
+
+## Exact SDK dependency correction release
+
+Reopened after app#210's required real-browser proof established engine#801:
+published SDK 0.2.5 live spectrum repeatedly gaps despite valid uninterrupted
+audio. Previous adapter 0.5.7 source/provenance PASS remains valid for its bytes.
+The bounded next slice changes only the exact SDK dependency to the verified
+engine#794 correction release and adapter patch metadata/lock/necessary existing
+guards. Candidate versions are SDK 0.2.6 and adapter 0.5.8; re-audit availability
+before freezing. No adapter backend, ownership, cache, PCM or Wasm changes.
+
+Luna XHIGH implements metadata; separate fresh Astra MEDIUM verifies. Root
+checkpoints, integrates latest main, runs existing package/type/test and packed
+fresh-consumer gates with exactly one SDK resolution, then required browser CI
+and the existing OIDC release. Verify registry archive/integrity/provenance and
+provide exact identities to app#210. Existing packed browser scenario must retain
+same-engine measurements and corrected live spectrum. No republishing existing
+versions, dependency overrides or deployment on local-only identities. Record
+new source/run/archive identities separately, sync GitHub, close after verification.
+
+## Adapter 0.5.8 candidate PASS
+
+Checkpoint `d0f7db8` changes only the eight dependency/version/provenance guard
+paths: adapter 0.5.8 adopts published SDK 0.2.6 from source
+`cdf629d6bfd0224b3532dd0abd04b9581240da56`, SDK archive SHA256
+`8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb`.
+No adapter runtime/backend/Wasm changes. Luna's terminal evidence reports full
+check 380/380 tests, 247 package files, packed Chromium spectrum/response proof
+and publish dry-run PASS; those implementation gate runs have no saved log files.
+
+Fresh Astra MEDIUM independently reviewed the diff and rebuilt the same archive,
+then passed normal fresh tarball installation, strict public types/imports and
+exactly one registry SDK 0.2.6. Actual SDK archive/source provenance matches the
+pins. Candidate adapter SHA256
+`ad740867c1c80d2594d96364d646a135490e1f9a03c73fec5b9601346507d948`;
+SHA1 `d8546f99d955d9687d934b0119a2d8a8b3374805`;
+integrity `sha512-rWOffhfIjwquuIpnI3S3jBYdxeZYD5MqG33Y9VpRGGBaKLRsN9Gf3ci1i2peveCYuvf3HE0VH77WOitq2qHRJQ==`.
+Independent report `/tmp/miso-adapter058-verifier/candidate-verdict.md` clearly
+separates independent results from implementation-reported terminal gates.
+Required CI, immutable publication and published archive/signature/attestation
+verification remain pending; no completion claimed for corrected adapter bytes.
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
@@ -23,12 +23,12 @@ concurrency:
 
 env:
   PACKAGE_NAME: "@misofm/engine-web-adapter"
-  PACKAGE_VERSION: "0.5.7"
+  PACKAGE_VERSION: "0.5.8"
   NPM_CONFIG_REGISTRY: "https://registry.npmjs.org"
 
 jobs:
   publish:
-    name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.7
+    name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.8
     runs-on: ubuntu-24.04
     steps:
       - name: Refuse a non-main or mismatched dispatch
@@ -63,7 +63,7 @@ jobs:
           [[ "$(node -p "require('./package.json').version")" == "$PACKAGE_VERSION" ]]
           [[ "$(node -p "require('./package-lock.json').name")" == "$PACKAGE_NAME" ]]
           [[ "$(node -p "require('./package-lock.json').version")" == "$PACKAGE_VERSION" ]]
-          [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.2.5" ]]
+          [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.2.6" ]]
           [[ "$(node -p "require('./package.json').repository.url")" == "git+https://github.com/misofm/engine-web-adapter.git" ]]
 
       - name: Install dependencies
@@ -138,7 +138,7 @@ jobs:
             [[ "$attempt" == 60 ]] && { echo "registry did not converge" >&2; exit 1; }
             sleep 5
           done
-          [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.2.5" ]]
+          [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.2.6" ]]
           consumer=$(mktemp -d)
           trap 'rm -rf -- "$consumer"' EXIT
           cd "$consumer"

diff --git a/NOTICE b/NOTICE
@@ -1,10 +1,10 @@
 @misofm/engine-web-adapter
 Copyright 2026 Miso
 
-This product depends on @misofm/engine@0.2.5. The reviewed integration archive
+This product depends on @misofm/engine@0.2.6. The reviewed integration archive
 was packed from misofm/engine commit
-1646a6a1bd0011cc2b5480283bf498b27be460e5 with SHA256
-c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d.
+cdf629d6bfd0224b3532dd0abd04b9581240da56 with SHA256
+8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb.
 This records reviewed source/archive identity, not registry publication.
 
 The transport SHA-256 implementation and verified-store/session-gate invariants

diff --git a/README.md b/README.md
@@ -1,7 +1,7 @@
 # @misofm/engine-web-adapter
 
 Headless, framework-neutral browser session hosting for
-`@misofm/engine@0.2.5`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC
+`@misofm/engine@0.2.6`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC
 through bounded HTTP ranges and a one-stem universal `@misofm/codec@0.1.1`
 Wasm Worker, verifies
 canonical PCM into OPFS, then feeds the Engine through bounded shared-memory
@@ -10,15 +10,15 @@ rings. URL, authentication, and request mapping remain caller-owned.
 ## Install
 
 ```sh
-npm install @misofm/engine-web-adapter@0.5.7 @misofm/engine@0.2.5
+npm install @misofm/engine-web-adapter@0.5.8 @misofm/engine@0.2.6
 ```
 
-The package is ESM-only and remains pinned to exactly Engine `0.2.5` and
+The package is ESM-only and remains pinned to exactly Engine `0.2.6` and
 `@misofm/codec` `0.1.1`. The codec currently supports Node `>=22.23.2 <23`
 and Bun `>=1.4.2 <1.5`; browser consumers use the bundled public codec asset.
-The integration uses the published Engine 0.2.5 archive
-from commit `1646a6a1bd0011cc2b5480283bf498b27be460e5`, SHA256
-`c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d`.
+The integration uses the published Engine 0.2.6 archive
+from commit `cdf629d6bfd0224b3532dd0abd04b9581240da56`, SHA256
+`8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb`.
 This release adds indexed full-response stem acquisition: active FLAC chunks are
 decoded once into verified sparse PCM, and timeline gaps are generated as zeroes
 when the Engine reads them. The existing native-FLAC path remains available.

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@misofm/engine-web-adapter",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Bounded FLAC browser session adapter for @misofm/engine using @misofm/codec",
   "license": "Apache-2.0",
   "repository": {
@@ -62,7 +62,7 @@
   },
   "dependencies": {
     "@misofm/codec": "0.1.1",
-    "@misofm/engine": "0.2.5",
+    "@misofm/engine": "0.2.6",
     "effect": "4.0.0-rc.112",
     "hash-wasm": "4.12.0"
   },

diff --git a/scripts/check-package.mjs b/scripts/check-package.mjs
@@ -6,10 +6,10 @@ import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
 
 const packageJson = JSON.parse(await readFile("package.json", "utf8"));
-assert.equal(packageJson.version, "0.5.7");
+assert.equal(packageJson.version, "0.5.8");
 assert.deepEqual(packageJson.dependencies, {
   "@misofm/codec": "0.1.1",
-  "@misofm/engine": "0.2.5",
+  "@misofm/engine": "0.2.6",
   effect: "4.0.0-rc.112",
   "hash-wasm": "4.12.0",
 });

diff --git a/src/provenance.ts b/src/provenance.ts
@@ -1,9 +1,9 @@
 export const ADAPTER_PROVENANCE = Object.freeze({
   engine: Object.freeze({
-    package: "@misofm/engine@0.2.5",
+    package: "@misofm/engine@0.2.6",
     repository: "misofm/engine",
-    archiveSha256: "c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d",
-    commit: "1646a6a1bd0011cc2b5480283bf498b27be460e5",
+    archiveSha256: "8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb",
+    commit: "cdf629d6bfd0224b3532dd0abd04b9581240da56",
   }),
   safeBaselines: Object.freeze({
     stemStore: "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c",

diff --git a/tests/foundation.test.ts b/tests/foundation.test.ts
@@ -18,11 +18,11 @@ test("foundation is pinned to the exact public Engine release", async () => {
   assert.equal(ADAPTER_PROVENANCE.engine.package, `@misofm/engine@${packageJson.dependencies["@misofm/engine"]}`);
   assert.equal(
     ADAPTER_PROVENANCE.engine.commit,
-    "1646a6a1bd0011cc2b5480283bf498b27be460e5",
+    "cdf629d6bfd0224b3532dd0abd04b9581240da56",
   );
   assert.equal(
     ADAPTER_PROVENANCE.engine.archiveSha256,
-    "c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d",
+    "8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb",
   );
   assert.equal(ADAPTER_PROVENANCE.safeBaselines.stemStore, "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c");
 });