diff --git a/README.md b/README.md
index 21da87712..d17fd77c6 100644
--- a/README.md
+++ b/README.md
@@ -187,7 +187,7 @@ The public source fixture removes personal path literals and independently recou
 
 ## Start here
 
-0. Clone the catalog and check out the attested release tag: `git clone https://github.com/seathatflowsinourveins/native-agent-stack.git && cd native-agent-stack`, then `git checkout "$(python3 -c "import json;print(json.load(open('adoption/manifest.json'))['source']['release_tag'])")"` — the `adoption/manifest.json` `source.release_tag` field (`v2026.09.22.1` or a later tag, at `source.release_commit`, published with SLSA build provenance by `.github/workflows/publish-catalog.yml`). Do **not** check out `source.baseline_commit`: that field predates `adoption/` and `tools/adoption/` entirely and is never a checkout target (Codex cross-family review finding, `codex-review-72`; `codex-review-64` is the separate promotion-gate cross-family review finding); `scripts/adoption_status.py` uses it only as the comparison point for its `baseline_matches`/`baseline_differs` `git` result. See [`adoption/bootstrap.md`](adoption/bootstrap.md) step 0 for the full detail, including `gh attestation verify` for a downloaded release archive.
+0. Clone the catalog and check out the attested release tag: `git clone https://github.com/seathatflowsinourveins/native-agent-stack.git && cd native-agent-stack`, then `git checkout "$(python3 -c "import json;print(json.load(open('adoption/manifest.json'))['source']['release_tag'])")"` — the `adoption/manifest.json` `source.release_tag` field (`v2026.09.23` or a later tag, at `source.release_commit`, published with SLSA build provenance by `.github/workflows/publish-catalog.yml`). Do **not** check out `source.baseline_commit`: that field predates `adoption/` and `tools/adoption/` entirely and is never a checkout target (Codex cross-family review finding, `codex-review-72`; `codex-review-64` is the separate promotion-gate cross-family review finding); `scripts/adoption_status.py` uses it only as the comparison point for its `baseline_matches`/`baseline_differs` `git` result. See [`adoption/bootstrap.md`](adoption/bootstrap.md) step 0 for the full detail, including `gh attestation verify` for a downloaded release archive.
 1. Start with [new-machine adoption](adoption/README.md), the [continuation manifest](adoption/manifest.json) and [future update protocol](adoption/update.md). The SDK now has a native uv hash lock and fresh-prefix acceptance; historical results remain scoped to their original host.
 2. Follow the [native installation and workflows](recipes/README.md). Choose the profile appropriate to your project; use your own native client login and project paths.
 3. Adopt the inactive [examples](examples/) deliberately. They contain no credentials, blanket trust settings or active machine-specific configuration.
diff --git a/adoption/bootstrap.md b/adoption/bootstrap.md
index 83abf52d2..40fb79a77 100644
--- a/adoption/bootstrap.md
+++ b/adoption/bootstrap.md
@@ -13,7 +13,7 @@ cd native-agent-stack
 git checkout "$(python3 -c "import json;print(json.load(open('adoption/manifest.json'))['source']['release_tag'])")"
 ```
 This checks out `adoption/manifest.json` `source.release_tag`
-(`v2026.09.22.1`, or a later tag) at `source.release_commit`
+(`v2026.09.23`, or a later tag) at `source.release_commit`
 (`bdd04ca50eb781f8366c955f481479b7a7f57cbd`), published with SLSA build
 provenance by `.github/workflows/publish-catalog.yml`. Do **not** check out
 `source.baseline_commit`: that field records the parent publication
diff --git a/adoption/manifest.json b/adoption/manifest.json
index 316d920a1..4b3164ba0 100644
--- a/adoption/manifest.json
+++ b/adoption/manifest.json
@@ -6,8 +6,8 @@
     "repository": "https://github.com/seathatflowsinourveins/native-agent-stack",
     "baseline_commit": "8f1da51757e925d319e2a50f080b02742e7e7168",
     "baseline_meaning": "Parent accepted publication before this adoption addition; local revision is always git rev-parse HEAD. This commit predates adoption/ and tools/adoption/ entirely and must never be the checkout target for a new machine (see release_tag/release_commit below, and adoption/bootstrap.md step 0; Codex cross-family review finding, codex-review-72).",
-    "release_tag": "v2026.09.22.1",
-    "release_commit": "bdd04ca50eb781f8366c955f481479b7a7f57cbd",
+    "release_tag": "v2026.09.23",
+    "release_commit": "4970ba0f9c961f5bfaf765544d14e5527601028d",
     "release_meaning": "The attested release tag adoption/bootstrap.md step 0 checks out on a new machine (or a later tag): published with SLSA build provenance by .github/workflows/publish-catalog.yml, and contains both adoption/ and tools/adoption/ (unlike baseline_commit above)."
   },
   "supported_platforms": [
diff --git a/adoption/platforms/linux-wsl2.md b/adoption/platforms/linux-wsl2.md
index a526c89ef..e1beed1b1 100644
--- a/adoption/platforms/linux-wsl2.md
+++ b/adoption/platforms/linux-wsl2.md
@@ -14,7 +14,7 @@ git checkout "$(python3 -c "import json;print(json.load(open('adoption/manifest.
 ```
 
 That checkout target is `adoption/manifest.json` `source.release_tag`
-(`v2026.09.22.1` or a later tag, at `source.release_commit`, published with
+(`v2026.09.23` or a later tag, at `source.release_commit`, published with
 SLSA build provenance by `.github/workflows/publish-catalog.yml`). Do
 **not** check out `source.baseline_commit`: that field predates `adoption/`
 and `tools/adoption/` entirely and is never a checkout target (Codex
diff --git a/manifests/evidence.json b/manifests/evidence.json
index 3ac08a11d..cf9464f84 100644
--- a/manifests/evidence.json
+++ b/manifests/evidence.json
@@ -3103,8 +3103,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "0f5f1f53b515cea04adab0d6f2b7aa56864e831634720fbe7ada47adc3200238",
-      "bytes": 21875
+      "sha256": "32aa91b40225b9663a9ecdff2a434036c547accde3b15c7b1783a1d63dc70711",
+      "bytes": 21873
     },
     {
       "path": "SECURITY.md",
@@ -3128,8 +3128,8 @@
     },
     {
       "path": "adoption/bootstrap.md",
-      "sha256": "9720a7c6b8886ff2129f27eef3dca2240d58ad9f51af101caa5f14e83d3b2748",
-      "bytes": 8343
+      "sha256": "f111297e0e34fff084cb0399fd04c9183f841d835d848c241a5357f46dc939a5",
+      "bytes": 8341
     },
     {
       "path": "adoption/host-receipt.schema.json",
@@ -3153,8 +3153,8 @@
     },
     {
       "path": "adoption/manifest.json",
-      "sha256": "cfdcffc32b5c512a24b6836aee64093da1a21bce0cf52bed5ca8ed101255456c",
-      "bytes": 18192
+      "sha256": "f15170e3376a66bc98425489ac6b2c2b1bc0213b9692ccba810849e0bfa908e6",
+      "bytes": 18190
     },
     {
       "path": "adoption/paired/README.md",
@@ -3198,8 +3198,8 @@
     },
     {
       "path": "adoption/platforms/linux-wsl2.md",
-      "sha256": "807a025fa6a46ce5e78fddedc6f4664f5291558fd7a231bcbe8240169a22835b",
-      "bytes": 4881
+      "sha256": "502d5172b3a91d871c8372258579bb1fc6e992c084bcec98db76aefbdcc3ea95",
+      "bytes": 4879
     },
     {
       "path": "adoption/platforms/macos-arm64.md",