#1113 — main publication and selected Hub135 activation (child #1117)

Source PR2683/main 47816a61095f196cf726f194f482739bc09f6a82; final head d51a9304860b754603039c756e7aa4b16bd595c1; tested PR merge6abe88a5a89fd1b23c4182537273436dd188e65d has the same tree. Dedicated activity CI38345127850:SQLite130/PostgreSQL121/runtime and pair52 PASS,11 assertion witnesses RED. Existing caller38345128139/sender38345127849/pair38345128183 and ten required checks PASS. A PG fixture scalar/array error and23-byte tool metadata overflow were corrected without weakening production guards, assertions or byte ceiling85500. Mutation-pin unchecked4 remains the original baseline4.

Hub135 formal 38345772164 and Node139 formal 38345774136:build, all FOUR gates, aggregate and preview publication/registry readback SUCCESS, from source main47816a61095f196cf726f194f482739bc09f6a82. Node139 public bytes were verified before dispatching the exact-pair CLI173. The first CLI run38346683979 built that same source but failed Gate4 (stale bilingual preview172 claims); publication SKIPPED. It is preserved as failure evidence, not a pass.

CLI documentation PR2685/main 064ed34c9eba20f852a32dbe42b98389c3c2ce63 updates only bilingual version claims/release notes. Its bootstrap source is byte-identical to the checked172 CLI source; the docs identify source continuity as an inference, since the173 install gate uses an explicit password. Final CLI formal38347806170 rebuilds from that documentation main:all FOUR gates SUCCESS and npm publish step SUCCESS, but registry verification timed out900seconds:CLI173 remains NOT VERIFIED/PENDING visibility. The formal run is FAILURE and must not be called all-green. Hub/Node retain their original publication source and are not republished. All three PACKAGE source trees equal source47816a61; full repository release SHAs are separately recorded.

Verified Hub/Node public tarballs equal their own exact-main gated artifacts byte-for-byte; CLI below is only its gated artifact, NOT PUBLIC verification:
Hub:0.9.0-preview.135 / 1248605 bytes / SHA256 4bf1d5bb25065cf7dbd52b6834a0b1563c7a6575c20b0a1346d92674ad20c29a / sha512-bKYKkD9jh7zNEtCyQUKC6jvZeD7HTvKHv4gsEsqFDZ2Y39JhFKkfM0dsqB5fnU69mbVqsU+bUGCNbg/96ZLjAg==
Node:2.5.0-preview.139 / 593735 bytes / SHA256 bed365ae4cdf509fd7094496de6149a70ce395f2cfe4d4e22b136b479d93f946 / sha512-Un7JUCtub8iG7DoiJpriJ4gFHKk7Bw4SwOcamsjTf4TnByMgGlKx+r3zdc0DxsT4p1WgG7/F4lh9O2kbLJcaog==
CLI GATED ONLY / registry still404:2.3.0-preview.173 / 2128643 bytes / SHA256 5e3a8464afbe06cada0039adce494e2564af73b266a0bfc555db30ce203b4029 / sha512-YllZd4/6SOLSw6boHKYIOusRUft2Q6t3sheDE1mgkbmBRyh47jywSk3SxJ8p/OEbyjED0YYksBX+Ek35ERdyHw==
Preview tags135/139/172 at the visibility check; CLI173 is not yet installable. Stable latest30/58/76 unchanged. Do not republish staged173. Recheck version/tarball/preview and compare bytes/SRI with this gated artifact when it appears; source/root package trees are already verified.

Deployment PR2684/main 6109c69773069eb0adc8035326ebc887a6d3b7cb; profile Docker38346163166 and ten required checks PASS. Managed manifest/lock pins the exact135 SRI; every transitive dependency entry stays unchanged. Installed Hub347 files match public package. Private owner-only consistent VACUUM INTO backup $HOME/.commhub/backups/activity1113-p135-0q44836w, 745426944 bytes, integrity ok. Read-only, network-none Docker schema/migration preflight PASS with preserved snapshot counts {"sessions": 331, "tasks": 81616, "nodes": 302, "networks": 7, "requirements": 1117, "api_tokens": 641, "user_inbox": 2705}; Bun1.4.0 driver on an offline copy, no live DB/credentials/HTTP entrypoint mounted. Data changes after the snapshot; counts are not a permanent live invariant.

Confirmed 2026-10-13T04:29:38.150364+00:00:selected commhub-hub PID607441->650734, restart92->93, secured135, actual entrypoint $HOME/.commhub/runtime-v118-preview135/node_modules/@sleep2agi/commhub-server/bin/commhub.ts. Profile equals deployment main, original base and environment-file metadata unchanged; no --update-env. Rollback:$HOME/.commhub/runtime-v117-preview134. Business node runtime/thread/model/provider/login settings were not changed.

Bounded natural observation 2026-10-13T05:12:07.861608+00:00:same PID/restart, 116 fresh heartbeat sessions since activation, SSE133, events [{"event_type": "task.ack", "to_status": "acked", "n": 4}, {"event_type": "task.expired", "to_status": "expired", "n": 3}, {"event_type": "task.expiry_notice", "to_status": "expired", "n": 2}, {"event_type": "task.failed", "to_status": "cancelled", "n": 1}, {"event_type": "task.failed", "to_status": "failed", "n": 1}, {"event_type": "task.orphan_suspected", "to_status": "acked", "n": 1}, {"event_type": "task.replied", "to_status": "replied", "n": 72}, {"event_type": "task.send.delivered", "to_status": "delivered", "n": 62}, {"event_type": "task.started", "to_status": "running", "n": 50}, {"event_type": "task.warning.delivered_stale_30s", "to_status": "delivered", "n": 56}, {"event_type": "task.warning.delivered_stale_60s", "to_status": "delivered", "n": 45}], selected new vault-key/panic/segfault markers0. Earlier5min baseline {"heartbeats5min": 110, "events": [{"event_type": "task.failed", "n": 1}, {"event_type": "task.replied", "n": 11}, {"event_type": "task.send.delivered", "n": 6}, {"event_type": "task.started", "n": 4}, {"event_type": "task.warning.delivered_stale_30s", "n": 6}, {"event_type": "task.warning.delivered_stale_60s", "n": 6}]}. Warning/failed/expired events are retained rather than called zero; windows differ. This does not establish whole-fleet ACK/model execution or complete DR.

Legacy rollout observation:original scheduler task consumed03:50:53Z, expired04:51:01Z by hub-scheduler stuck timeout since consumed_at; last_activity_atNULL under Node121. The native turn continued. This is the compatibility fallback, not a verified failure of the139 producer. The original expired task/run will remain terminal and receive only the bound late-reply evidence. A read-only aggregate observed0 accepted task activity rows before client adoption.

CLIENT CANARY STILL OPEN:communication node PID384817 remains Node121 under parent controller PID384770/CLI153 (directory label154 is not the package version). CWD remains $HOME/comm-niu. No current-turn restart, thread fork/reset, provider/model/login or credentials change. The new producer is PUBLIC, while CLI173 is staged/unverified; no original production Node139 activity pulse has been claimed. Parent #1113/#1105 remain doing2/3. Next:reconcile the selected controller's Git-authoritative normal173/139 upgrade entry while keeping identity/CWD/environment/original vendor thread; after an authorized normal idle start, validate real owned-turn consumption/activity and scheduler idle/total behavior. Legacy121 retains the fallback budget. Public package availability and Hub activation do not prove client adoption.

Recovery authority:deploy/hub/README.md and versioned base/profile/managed lock. Startup/PM2, ports/proxy, environment source, upgrade verification, rollback and private data boundaries remain recorded. Original-value secrets and production data need private backups/security authority. Complete key recovery remains NOT_COVERED.

Late npm verification2026-10-13T06:03:47–48Z:Hub136 and CLI173 version metadata, preview tags and complete registry tarballs are now public. Both match their original exact-main gated and GitHub artifacts byte-for-byte, SHA1/SHA256/SRI verified; stable latest30/76 unchanged. Hub136 SHA25647449d1e6163e4ec7595d3124676ad655845ead7e22d0184777c2dade3dd7e81; CLI173 SHA2565e3a8464afbe06cada0039adce494e2564af73b266a0bfc555db30ce203b4029. Original CLI run38347806170 remains FAILURE due its earlier900-second timeout; this is later read-only verification, not a rewritten verdict or repeated npm publish. Npm distribution gap#1123 can close and#1117 publication can close after this Git fact lands. Keep the existing GitHub managed lock and Hub136 activation; original production Node139 activity canary remains OPEN.
