diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c5ea042..1c5ecf08 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+A2A message envelope: `POST /a2a/send` now accepts optional `refs` and `blocks` fields. `refs` is a list of up to 8 structured reference objects (kind, title, uri, etc.), and `blocks` is a list of arbitrary objects for rich content. The total serialized message is capped at 64KB. `body` remains required when `blocks` is absent, and is required alongside `blocks` when blocks are present (PR #212).
+
+`GET /version` endpoint with a contract-identifier capabilities list (new `taosmd.capabilities` module). The server publishes what the running build actually supports, because neither a status code nor a version number could answer that question reliably. `GET /health` also gains the same capabilities list. Capabilities are stable contract identifiers with an explicit version suffix (e.g. `collections.v1`), not feature names, so a breaking change becomes `collections.v2` and a client pinned to `v1` sees the capability disappear rather than silently meaning something new. The list is derived at request time by probing the running build (PR #213).
+
+CollectionStore opens `collections.db` via the shared `_db.connect` helper, gaining WAL journal mode and a busy timeout like every other store in the package (PR #215).
+
+Dev and test dependencies moved into a PEP 735 `[dependency-groups] dev` group, so a bare `uv sync` from a clean checkout installs pytest, pytest-asyncio, and the auth extras needed by the test suite with no flags (PR #219).
+
 `GET /version` with a capability list (new `taosmd.capabilities` module). The server now publishes what the running build actually supports, because neither a status code nor a version number could answer that. `taosmd serve` renders the dashboard SPA on unknown non-API paths, so `GET /collections` returns `200 text/html` on a build with no collections code, and an integrator who "verified" a route by checking for a 200 got a confident yes from a server that could not do the thing (this really happened, against the wrong service). Semver does not close the gap either: features land continuously between bumps, and a production box sat a month stale without anyone noticing even though `GET /health` already reported a version. `/version` returns `{"version", "commit", "commit_source", "built_at", "built_at_source", "capabilities"}` and `GET /health` gains the same `capabilities` list alongside its existing `status` and `version` keys, which are unchanged (taOS and the dashboard consume both). Both endpoints are unauthenticated by design, joining `/health` in `_PUBLIC_PATHS`, so monitoring and drift probes keep working on a token-secured box; they expose build identity and capability identifiers only (no paths, no tokens, no configuration). Capabilities are **stable contract identifiers with an explicit version suffix** (`collections.v1`, `grants.v1`, `temporal.v1`, `a2a.v1`, `tasks.v1`, `ingest.v1`, `search.v1`, `graph.v1`, `shelves.v1`), not feature names: a breaking change to a wire contract becomes `collections.v2`, so a client pinned to `collections.v1` sees the capability disappear (a visible break it can act on) rather than `collections` silently meaning something new; additive changes keep the identifier. The list is derived at request time by probing the running build (each identifier is declared next to the module and symbols that implement it, and is advertised only if they resolve), so deleting or renaming an implementation deletes the claim instead of leaving a stale boast, and a divergence test asserts every declared capability's routes exist in the real dispatcher. The commit sha is resolved once at first call and cached, never per request and never by shelling out: `git rev-parse` in a request path can block on a lock or a slow filesystem, so the git plumbing is read directly from the filesystem (`.git/HEAD` -> loose ref or `packed-refs`, including the `gitdir:` indirection used by worktrees and submodules), with an optional packaged `taosmd/_build_info.py` stamp taking precedence for wheel and container builds. Every step degrades to `null` rather than raising, so a pip install with no checkout and no stamp still gets a working endpoint.
 
 Schema migration framework (`taosmd/migrations.py`, `docs/migrations.md`). Every SQLite database the package owns now carries a schema version in its own file via SQLite's native `PRAGMA user_version`, with an ordered list of migration steps per database and a runner that applies only the steps above the stored version, each inside its own transaction, stamping the new version atomically with the change it made. Before this there was no migration mechanism at all: schemas were created with `CREATE TABLE IF NOT EXISTS` and evolved by three hand-rolled `try/except ALTER TABLE` guards. That held only because every change so far was additive. `CREATE TABLE IF NOT EXISTS` does nothing to a database that already exists, so the first column added to an existing table would have reached new installs and no existing one, and every query naming it would have failed at runtime on exactly the stores holding real data. `collections.db` had no upgrade path whatsoever, so that break was one column away from every collections store in the field. The runner is cheap enough to call on every store open (one PRAGMA read when current) and each of `vector-memory.db`, `knowledge-graph.db`, `archive-index.db`, `session-catalog.db`, `claims.db`, and `collections.db` now runs it as part of opening, before its first query.
diff --git a/README.md b/README.md
index fea0124e..a9224e3d 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ The agent will pull the repo, run the install, register itself, append the per-t
 
 ### One-Line Setup (manual)
 
-> **Install:** `pip install taosmd` (add the MCP server with `pip install "taosmd[mcp]"`). For a source/dev install instead, `git clone` then `pip install -e .`. The one-line bootstrap below additionally installs Ollama and downloads the embedding and LLM models; it is newer and still being validated across clean machines, so please report issues.
+> **Install:** `pip install taosmd` (add the MCP server with `pip install "taosmd[mcp]"`). For a source install instead, `git clone` then `pip install -e .`. Warning: `pip install -e .` installs the runtime only and gives you no test runner. The failure is silent, so a reader will otherwise assume their setup worked. See the Dev setup section below for the working commands. The one-line bootstrap below additionally installs Ollama and downloads the embedding and LLM models; it is newer and still being validated across clean machines, so please report issues.
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/jaylfc/taosmd/master/scripts/setup.sh | bash
@@ -80,6 +80,8 @@ This will:
 ```bash
 git clone https://github.com/jaylfc/taosmd.git
 cd taosmd
+
+# Runtime only -- pip install -e . gives you no test runner
 pip install -e .
 
 # 1. Embedding model (required)
@@ -97,6 +99,26 @@ hf download dulimov/Qwen3-4B-rk3588-1.2.1-base \
   --local-dir ~/.rkllama/models/qwen3-4b-chat
 ```
 
+### Dev setup
+
+```bash
+git clone https://github.com/jaylfc/taosmd.git
+cd taosmd
+
+# Install the package plus test dependencies
+uv sync
+
+# Verify the environment
+uv run python -c "import pytest, jwt, cryptography"
+
+# Run the test suite
+uv run pytest
+```
+
+`pip` is not documented as a working dev-setup path here because it is not
+available in this environment and PEP 735 `--group` support could not be
+verified. `uv sync` is the supported short path.
+
 ### Install hygiene (avoid a shadowed install)
 
 Always install taOSmd into a virtual environment, and never with `sudo` into the