v0.2.10

What's Changed

• chore(brain): a checked-in mutations spec for the warehouse producer — 15 hand-measured falsifiers become a generated table by @msywulak in #5282
• feat(brain): the warehouse producer's cadence trigger, under a run lock by @msywulak in #5283
• chore(security): baseline CVE-2026-53615 (util-linux) so the base-image gate reflects reality by @msywulak in #5288
• fix(brain): resolve the snapshot's connection from the entity's group, and give the producer a Run control (#5284, #5287) by @msywulak in #5285
• sec(settings): #5263 → #5262 → #5264, all on the auditSettingsWrite seam by @msywulak in #5292
• fix(db): #5265 → #5269, both in hardDeleteWorkspace (#5289) by @msywulak in #5291
• chore(api): bundle 3 — an unobserved seed Layer and a refusal that outlives its log (#5273, #5112) by @msywulak in #5301
• docs(roadmap): record bundle 3 — #5273 + #5112, and the six lessons the review produced by @msywulak in #5307
• chore(ci): bundle 2 — the scripts/ gate lane, three items in sequence (#5097, #5174, #4738) by @msywulak in #5300
• chore(agents): burn the workflow layer, keep the evidence by @msywulak in #5298
• docs(www): de-link retired commands in two blog posts by @msywulak in #5308
• Three harness fixes: the doc-path guard (#5299), the brand-token bypasses (#5306), the first context extractions (#5302) by @msywulak in #5309
• Close the pre-customer clean-break window; the embeddable widget joins the code surface by @msywulak in #5310
• Two Layer/type-safety issues, and the two that were already done (#5305, #5303) by @msywulak in #5311
• feat(brain): lib/brain/coverage.ts — the Coverage Surface's three-state wire shape (#5214) by @msywulak in #5312
• fix(brain): an enrollment names its connection group, so a duplicated entity name is enrollable (#5286) by @msywulak in #5313

Full Changelog: v0.2.9...v0.2.10