v0.19.0

Deferred-work remediation release. All fixes driven through the delegate MCP lifecycle (Codex GPT-5.6 Sol) and independently verified; CI green on macOS/Linux/Windows.

Security

• Fixer private Git object store: the shared object database is no longer a fixer-writable sandbox root; fixer writes go to a per-run private object directory, and trusted promotion imports exactly the promoted commit's objects (bounded pack-objects), verifying shared-store reachability without alternates before publishing the anchor.
• Copy-on-write dependency clone: aux verification worktrees no longer receive a writable node_modules symlink/junction into the primary checkout (APFS clonefile / Linux reflink; no CoW → fail-closed skipped-cow-unsupported). Windows and non-reflink Linux no longer inherit dependencies into aux worktrees.
• Checkout-lock ABA guard: release deletes the lock file only when it still records the releasing holder's pid + process token.

Fixed

• Run manifests record real reproducibility provenance (committed instruction-file hashes + installed verifier bytes) or fail closed; the silent pending/empty defaults are gone.
• Candidate freezing rejects truncated Git output instead of publishing an incomplete review patch.
• verifyRunManifest treats archived protocolVersion as provenance with same-major compatibility, keeping existing archives reviewable across protocol upgrades.

Changed

• .opencode lane mirrors carry the full operating contract (foreground-only, bounded stall relaunch, worktree isolation, Git-state prohibitions, action-first preamble, failure-classification vocabulary); stall handling normalized to at most one relaunch, two invocations total.
• Lane-contract tests are negation-proof, and the failure-precedence e2e test pins an explicit eleven-classification literal.

See CHANGELOG.md for details.