v1.6.0 — Judged paths, command cwd, and a release-installed quickstart

Five days, 54 commits and twenty-one entries since v1.5.0. The trace contract stays v18; nothing frozen moves. The full section is CHANGELOG.md at this tag.

The report names what it judged, and where the define ran. A --json report carries l0_judged_paths — the paths the built-in atomicity form actually judged — and l0_judged_paths_omitted, the number it did not list (#638). Until now the report said N path(s) judged pre-or-post and nothing named the N, which is the wall the authoring study measured: a subject kept judging the one file it had written off because it never saw which one the count meant. Every report from the point the declared cwd is resolved also names the directory the define's commands ran in — command_cwd / command_cwd_declared in the JSON, a cwd line in the text, and in preflight's next hint (#647). A tool that only works inside its own project needed a cwd the old quickstart template did not show, and the first real adoption run stalled on exactly that twice.

A CI quickstart that installs a released Sideeye instead of building one (#620). docs/ci-quickstart.md now has a lane with no Zig on the runner — asserted, not implied: install-sideeye.sh takes a pinned version, maps the runner to an asset, refuses when the release carries none, and checks the download against the sha256 GitHub publishes. Two lanes run on every push: a correct target gating on exit 0 with the oracle verified, and a planted bug gating on exit 1. The page will pin this release once its assets exist.

The macOS fork stub asks the kernel where the child is, every time it is refused (#629, #632, #651). A child that could not be moved out of the engine's process group used to exit 126 before exec, and the world was reported kill_did_not_land with "Change the define" for a define that was fine. It now runs whenever the kernel reports it leading a group of its own — whichever call put it there — and when it still cannot, the line it writes names what both calls answered. The CI logs since the first fix showed the engine's own parent-side setpgid(pid, pid) had rescued five of six refused children, and that a refused setsid is that rescue having landed.

Smaller changes. child_touched_state_dir's next step follows which of its two walls refused the run, sending one shape to --observe syscalls on Linux (#634). The MCP sideeye_explore_config tool takes observe, so an agent can follow a next_step that names it (#617). README: preflight's exit codes (3 for a define it cannot set up, 1 when --twice finds different bytes) and the macOS oracle, --oracle-fs-usage.

Measurements published in this release, none of which changes the engine. What exhaustive exploration costs from 10 to 1000 crash points — 4.2 s on a one-file state, 30 s on a 20 MB one, and no budget or sampling added (#621). The authoring-cost study's four runs and the count it had been publishing wrongly (#618, #639). Generation g3 of the UNKNOWN-rate page, B2 measured for the first time: 26.3% UNKNOWN over nineteen explored, published beside B and never pooled (#619). Two dogfood runs through the adoption path: lefthook reached a named wall (static linkage), overcommit 0.73.0 a verified FAIL, reproduced and deliberately not filed.

Assets: sideeye-v1.6.0-aarch64-macos.tar.gz, sideeye-v1.6.0-x86_64-linux.tar.gz, sideeye-v1.6.0-aarch64-linux.tar.gz, each carrying the sha256 GitHub computed on upload (docs/cli.md says how to check one). Homebrew: brew upgrade yottayoshida/tap/sideeye once the tap is updated.