v0.1.1 — held twice, fixed everything, receipts included

Every finding from two external adversarial reviews — a three-pass cross-model council on v0.1.0 and a pre-release red team on the v0.1.1 candidate (GPT-5.1, Gemini 2.5 Pro, DeepSeek R1, attacking the live scripts by executing them) — fixed and regression-proofed. The red team held the release unanimously; we adopted the stricter verdict, answered all fifteen findings with fixes rather than wording, and shipped only after the HOLD authors' own conditions were met.

Reliability

• fsync'd write-ahead intent/effect logs: the power-loss double-send becomes a designed, loud halt — and the chaos harness now stages the lost-flush state to prove it
• Safety verdicts earned by on-disk state, never by a string: forged halts fail the harness
• Lease + heartbeat run lock (claim-with-a-lease, applied to the manager itself): same-run concurrency refuses, crashed runs self-recover in ~30s, recycled pids can't wedge a run, no manual lock deletion ever
• Wired idempotencyKey (runId:step) in every worker stub; step-name validation; capped corruption backups

Tooling

• Linter immune to comments, strings, and multi-line template literals, with setInterval and hoisted clock/random detection; 12-case line-pinned regression corpus with mutation-tested teeth; single-file mode
• Content-integrity-pinned KnoSky grounding (baked sha512, refuse-on-mismatch); strict GRAPHSMITH_OFFLINE parsing
• CI on Linux + Windows × Node 18/22 runs the full proof battery on every push; npm publish is gated behind it — this release is the gate's first green

Receipts
All three review reports — council, red team, and verification pass, dissents preserved — are published in docs/reviews/. Three deliberate boundaries (log rotation, cross-file data-flow lint, air-gapped supply-chain verification) are disclosed in the README with their revisit triggers.

Same medicine the skill prescribes.