Stack manifest: the omniroute row describes the 2026-09-30 builds (held for the trading lane's acknowledgement)

manifests/evidence.json

@@ -42856,8 +42856,8 @@
     },
     {
       "path": "manifests/stack.json",
-      "sha256": "ec451a769bc1fd3c64ff18695a9306d8656d7d6a6441105af2c9f4ffeaa1f1ac",
-      "bytes": 96080
+      "sha256": "d621909e12fb04267c6c2c313ea40387b88e1d37c319aee7d852b4e14aa99e35",
+      "bytes": 98410
     },
     {
       "path": "observability/README.md",

manifests/stack.json

@@ -1895,13 +1895,14 @@
         "https://github.com/diegosouzapw/OmniRoute/blob/v3.8.50/docs/guides/SETUP_GUIDE.md",
         "https://github.com/diegosouzapw/OmniRoute/blob/v3.8.50/src/app/api/compression/preview/route.ts",
         "https://registry.npmjs.org/omniroute/3.8.50",
-        "https://github.com/diegosouzapw/OmniRoute/commit/a58000c7685f4091c7a6fd8ddf3ebce7d2ec67c3",
-        "https://github.com/diegosouzapw/OmniRoute/pull/14904",
+        "https://github.com/diegosouzapw/OmniRoute/commit/2f42a9ac19d1a247ec9ce5473b790843724b3061",
+        "https://github.com/diegosouzapw/OmniRoute/pull/14886",
+        "https://github.com/diegosouzapw/OmniRoute/pull/14812",
         "https://github.com/diegosouzapw/OmniRoute/pull/13788"
       ],
       "source_pin": "5458026c216f77a3da68ea49152dc33470cfe2cb",
-      "freshness": "Official GitHub and npm release 3.8.50 checked September 20, 2026. The published tag commit, npm integrity and runtime build identity remain separate. Isolated Linux install/start/restart/state continuity/plaintext restore/owned stop passed; encrypted native restore is unsupported. Gateway native/provider attempts retained model-prefix and quota failures, not a successful gateway task. Running build, 2026-09-27: the workstation runs a source build, not this pin. Its base is release/v3.8.51 at a58000c7685f4091c7a6fd8ddf3ebce7d2ec67c3. Upstream PRs #14904 and #13788 are cherry-picked onto it, both open and unmerged, with patch-ids equal to upstream's. The BUILD_SHA is dd6e9607e. This manifest has no field for cherry-picks. A version/source_pin pair must also match the landscape freshness snapshot. So the pin stays the published 3.8.50 (npm latest on 2026-09-27) until upstream releases or merges both changes (the #14904 fix and the #13788 feature). Build, service, probes and the recorded keyless loopback posture: docs/decisions/2026-09-27-omniroute-account-pool.md and evidence/artifacts/omniroute-gateway-20260927/.",
-      "command_scope": "Use docs/foundation-stack.md for fresh-prefix guards, explicit DATA_DIR/loopback binding, private management authentication and exact provider scope. The workstation's source build runs from the values-free adoption/templates/systemd/omniroute.service. It is adopted for pooled GPT-6 access by gateway-routed Codex lanes. By the user's decision that gateway runs keyless and passwordless on loopback only (docs/decisions/2026-09-27-omniroute-account-pool.md, decision 5); a multi-user or non-loopback host keeps this recipe's API key and dashboard login. Native Codex stays the max-quality default, and the agent-sdks layer default waits on the preregistered three-arm comparison. Existing native accounts, models, hooks and default routing remain unchanged. Local preview success does not establish semantic fidelity or provider-token savings."
+      "freshness": "Official GitHub and npm release 3.8.50 checked September 20, 2026. The published tag commit, npm integrity and runtime build identity remain separate. Isolated Linux install/start/restart/state continuity/plaintext restore/owned stop passed; encrypted native restore is unsupported. Gateway native/provider attempts retained model-prefix and quota failures, not a successful gateway task. Running builds, 2026-09-30: the workstation runs two source builds, not this pin. Both are based on release/v3.8.51 at 2f42a9ac19d1a247ec9ce5473b790843724b3061 (upstream tagged v3.8.51 afterwards, at 2026-09-30T01:41Z, with the same tree as this commit, and published omniroute@3.8.51 to npm at 02:54Z, so the running builds are the released 3.8.51 tree plus the carries), which contains upstream's merged #14886, the fix that the 2026-09-27 build's #14904 cherry-pick stood in for, and #14812, the serve port-preflight fix that makes the lsof shim redundant. The open upstream PR #13788 is cherry-picked onto both (its two commits' stable patch-ids d6cb98ecd2c4aed3 and cbb7d8fb78ed0dcf equal the upstream commits'), and 20128 also carries a local affinity patch (045aa81f3, patch-id 132ad5e91380a1d2). The BUILD_SHA is ae5539a56 on 20128 and 87c4c488d on 20129. Upstream's check:pack-artifact and check:pack-boot pass on both tarballs (check:pack-boot on the 20129 tarball on its third attempt; the first two failed with causes not established). This manifest has no field for cherry-picks or local patches. A version/source_pin pair must also match the landscape freshness snapshot. npm latest became 3.8.51 on 2026-09-30 (published 02:54Z, after the rebuild), so the condition for moving the pin is met, but the pin stays the previously qualified 3.8.50 until the published 3.8.51 package has its own isolated install and boot check (a separate change to this row); upstream has not carried #13788. The 2026-09-27 build, service, probes and recorded keyless loopback posture: docs/decisions/2026-09-27-omniroute-account-pool.md and evidence/artifacts/omniroute-gateway-20260927/. The rebuild, its non-upstream deltas, the settings and the rollback: docs/decisions/2026-09-30-omniroute-rebuild.md and evidence/artifacts/omniroute-rebuild-20260930/.",
+      "command_scope": "Use docs/foundation-stack.md for fresh-prefix guards, explicit DATA_DIR/loopback binding, private management authentication and exact provider scope. The workstation's source builds run as two units from values-free templates. adoption/templates/systemd/omniroute.service runs 20128, the shared gateway: build ae5539a56, with the local affinity patch, so no OAuth routing combo may be created on 20128 while that patch runs. adoption/templates/systemd/omniroute-fw.service runs 20129, the framework instance: build 87c4c488d, with its own data directory, forwarding to 20128 through a provider node. Both units announce CODEX_CLIENT_VERSION 0.159.1 while the installed Codex is 0.157.1, so the gateway's live catalog lists gpt-6.1-sol. 20129 runs ten of the twelve shipped compression engines at upstream's per-engine settings with the master switch on (upstream ships the master off and every engine disabled; headroom is off in the engines map but still runs where a stored combo names it, omniglyph is off; headerless plan session-dedup, ccr, lite; lossy engines only on a header or combo opt-in; the header allow-lossy selects a peer-owned stored combo); 20128 keeps its master switch off with codex/* excluded. Serve's port preflight counts client sockets on the port, so before restarting 20128, restart hindsight-live and any other client holding a connection to it. The gateway is adopted for pooled GPT-6 access by gateway-routed Codex lanes. By the user's decision 20128 runs keyless and passwordless on loopback only (docs/decisions/2026-09-27-omniroute-account-pool.md, decision 5); 20129 also binds loopback only. A multi-user or non-loopback host keeps this recipe's API key and dashboard login. Native Codex stays the max-quality default, and the agent-sdks layer default waits on the preregistered three-arm comparison. Existing native accounts, models, hooks and default routing remain unchanged. Local preview success does not establish semantic fidelity or provider-token savings."
     },
     {
       "id": "tavily-cli",