release(v1.9.4): mempalace 3.10.0 with a pinned palace root, pi-atelier v0.10.3, pi held at 0.85.1

Three pins move or are deliberately held; the CHANGELOG's Unreleased section
becomes the v1.9.4 entry in this same commit, because since ee6cb9e the tag
build runs check-doc-drift.sh check 9 and every would-bake value must be named
above the last published heading.

mempalace 3.9.0 -> 3.10.0 (Dockerfile.base). Deferred at v1.9.3 for two
"Upgrade notes" items; both re-measured against the 3.10.0 wheel:

  - New installs resolve ~/.config/mempalace. The order is $MEMPALACE_CONFIG_DIR,
    then ~/.mempalace IF it holds config.json / people_map.json /
    palace/chroma.sqlite3, then XDG. An EMPTY ~/.mempalace fails that test, and
    an empty ~/.mempalace is what a freshly mounted devbox-palace volume (or
    entrypoint.sh's mkdir on a volume-less container) looks like at first boot.
    Measured with a fresh $HOME and `uvx mempalace==3.10.0 init`: config.json
    landed in ~/.config/mempalace, ~/.mempalace stayed empty, and
    entrypoint-user.sh's `[ ! -d ~/.mempalace/palace ]` would fire every start.
    Same run with MEMPALACE_CONFIG_DIR set: everything in ~/.mempalace.
    => ENV MEMPALACE_CONFIG_DIR=/home/${USER_NAME}/.mempalace, placed in the
    non-root-user section where USER_NAME is in scope, and entrypoint-user.sh
    reads PALACE_DIR from the same variable (old path as fallback). Existing
    volumes were safe either way; this is for first boots. MEMPALACE_PALACE_PATH
    is still honoured (config.py:927), so smoke-test.sh's stage test holds.
  - event_list defaults newest-first without a cursor. Server-side: the
    extension talks to synlig over MEMPALACE_REMOTE_URL, so it lands when the
    hub upgrades. mempalace-toolkit 2167a1b (floating main) makes every
    cursor-less call say order:"desc" so the mailbox reads the same window on
    either server version.

Corrected a stale sequencing comment while there: synlig serves the palace as
a `uv tool` under systemd (mempalace-serve.service; measured 2026-09-22:
mempalace 3.9.0, python 3.12.13, chromadb 1.5.9, no palace container), not via
docker-compose.mempalace.yml as the comment had said for two releases.

pi-atelier v0.10.1 -> v0.10.3 (Dockerfile.variant). Fixes only (both tags
released 2026-09-22); package.json at v0.10.3 still has zero runtime deps and no
build script, peerDeps still >=0.84.0. Annotated tags: the CHANGELOG names the
peeled SHA ed3837b, which is what resolve-versions bakes and check 9 compares.

pi HELD at 0.85.1 while 0.86.1 / 0.87.0 exist. 0.87.0 removed the
shouldStopAfterTurn agent option; pi-observational-memory 3.1.4 still uses it
and AgentContext.systemPrompt in observer/reflector/dropper (measured: 1 hit
per worker in src/agents on both the baked 3.1.3 tree and upstream master;
finishTurn 0). peerDeps are `*`, so it would break at runtime, not install.
Upstream #82, fix PR #83 open and unmerged. Bump pi and pi-obsmem together
once #83 ships. The other extensions are clean against the 0.86/0.87 lists.

Verified locally the way CI does: check-doc-drift.sh rc=0 with check 9
reporting all four moved components as named above the v1.9.3 heading;
lint-shell.sh rc=0; hadolint 2.15.1 (CI's pin, with .hadolint.yaml) rc=0 on
both Dockerfiles; PyPI 3.10.0 present, not yanked. Two claims caught by
re-measurement before commit and corrected in the text: a pi issue number
that does not exist on the 0.87.0 changelog line, and "8 shouldStopAfterTurn
hits" that was 3 (one per worker) in src/.

Still open before the tag: run the feeder from the built image against the
3.9.0 hub (dry-run first); recreate acceptance must show ~/.mempalace/palace
still passing and no ~/.config/mempalace appearing. After acceptance: upgrade
synlig's tool to 3.10.0.

CHANGELOG.md

@@ -11,7 +11,139 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## Unreleased
+## v1.9.4 — 2026-09-22
+
+### Dependency audit (2026-09-22)
+
+Every component checked against upstream by direct command, not assumed. "Baked"
+is v1.9.3's published labels or, for the floating `*_VERSION=latest` tools, the
+binaries in a running v1.9.3 container. The 13 GitHub-`latest` tools were
+resolved through the same `/releases/latest` redirect the Dockerfile follows.
+
+| Component | Baked in v1.9.3 | Upstream now | Action |
+|---|---|---|---|
+| **pi** | `0.85.1` (pinned) | **`0.87.0`** (0.86.0, 0.86.1, 0.87.0 since) | **held — blocked by pi-observational-memory, see below** |
+| **pi-atelier** | `v0.10.1` (`734258b`) | **`v0.10.3`** (`ed3837b`, released 2026-09-22) | **bumped** |
+| **mempalace** | `3.9.0` (pinned) | **`3.10.0`** (changelog dated 2026-09-15) | **bumped, with one adaptation** |
+| **mempalace-toolkit** | `817b3a8` | **`2167a1b`** | floating `main`; the commit is this release's own (below) |
+| **pi-observational-memory** | `cba0334` (3.1.3) | **`e7d77dc`** (3.1.4) | adopted implicitly via `master` (below) |
+| pi-toolkit | `9c87ee8` | `9c87ee8` | none |
+| pi-extensions | `25c1265` | `25c1265` | none |
+| pi-fork | `e69725c` | `e69725c` | none |
+| pi-studio (studio variant) | `e04fc7a` | `e04fc7a` highest semver tag | none |
+| skillset (mempalace fallback snapshot) | `e9e45f7` | skillset at `1c5f960`; `check-doc-drift.sh` rc=0 (snapshot still byte-identical) | none |
+| gitea-mcp, agent-browser, node | `1.7.0`, `0.38.1`, `v24.21.0` | identical | none |
+| 13 floating `*_VERSION=latest` tools | — | all 13 identical to the running v1.9.3 binaries | none |
+
+### mempalace 3.9.0 → 3.10.0, and why one `ENV` line comes with it
+
+v1.9.3 deferred 3.10.0 for two "Upgrade notes" items. Both were re-measured
+against the 3.10.0 wheel rather than the changelog; one needed an adaptation, the
+other turned out to be the other side's problem.
+
+**"New installs keep config and palace under `~/.config/mempalace`."** The
+resolution order (`config.py`, `_default_config_dir`) is `$MEMPALACE_CONFIG_DIR`,
+then `~/.mempalace` *if* it holds `config.json`, `people_map.json` or
+`palace/chroma.sqlite3`, then XDG. An **empty** `~/.mempalace` fails that test —
+and an empty `~/.mempalace` is exactly what a freshly mounted `devbox-palace`
+volume looks like at first boot (and what `entrypoint.sh`'s `mkdir` leaves on a
+volume-less container). Measured with a fresh `$HOME` and `uvx mempalace==3.10.0`:
+`mempalace init` wrote `config.json` to `~/.config/mempalace`, `~/.mempalace`
+stayed empty, and `entrypoint-user.sh`'s first-run test `[ ! -d ~/.mempalace/palace ]`
+would have stayed true on every start. Same run with `MEMPALACE_CONFIG_DIR` set:
+everything landed in `~/.mempalace`.
+
+So `Dockerfile.base` now sets `ENV MEMPALACE_CONFIG_DIR=/home/${USER_NAME}/.mempalace`
+(in the non-root-user section, where `USER_NAME` is in scope), and
+`entrypoint-user.sh` reads `PALACE_DIR` from the same variable with the old path
+as fallback — the first-run test and mempalace's own resolution can no longer
+disagree. Existing volumes were safe either way (`config.json` is a legacy
+marker; this container's volume holds one); the `ENV` is for first boots.
+`palace_path` still defaults to `<config_dir>/palace` and `MEMPALACE_PALACE_PATH`
+is still honoured (`config.py:927`), so `smoke-test.sh`'s stage-path test keeps
+its meaning, and `recreate-sanity-check.sh`'s hard-coded `~/.mempalace/palace/chroma.sqlite3`
+stays correct.
+
+**"MCP event listing returns the newest events first when no cursor is given."**
+This is **server-side**. The pi extension talks to the fleet hub over
+`MEMPALACE_REMOTE_URL`, so `mempalace_event_list`'s default flips when *synlig*
+upgrades, not when this image does. `mempalace-toolkit` `2167a1b` (this release)
+makes every cursor-less `event_list` call in the extension say `order: "desc"`
+explicitly — three of five did not — so the mailbox's `deriveOwed` and
+`deriveClosed` read the same newest-N window against either server version. Its
+selection was already order-independent (`isStrictlyAfter`); what the fix changes
+is *which* events are in the window: on a 3.9.0 hub the cursor-less calls were
+returning the **oldest** N, the latent truncation `deriveOwed` had already fixed
+for two of its calls in toolkit `e2b060a` (2026-09-09).
+
+Also in the upgrade notes, neither reaching this image: `mempalace rules` dropped
+`--agent` (zero callers in pi-devbox, mempalace-toolkit, skillset, myconfigs);
+`get_collection()` refuses unknown collection names (library callers only). MCP
+tool-schema review — the regression class this pin exists for: no tool removed or
+renamed; additive fields on search results (`filed_at` / `content_date`
+provenance), `limit`/`offset` on `kg_timeline`, `last_modified` on drawers.
+
+**Server state, measured over ssh on 2026-09-22:** synlig serves mempalace
+**3.9.0** as a `uv tool` under `systemd` (`mempalace-serve.service`, python
+3.12.13, chromadb 1.5.9) — *not* via `docker-compose.mempalace.yml`, which the
+`Dockerfile.base` sequencing comment had claimed for two releases (corrected in
+this commit). Client and server are level today; this image reintroduces skew
+until synlig runs `uv tool upgrade mempalace` and restarts the unit. That is the
+step that lights up the server-side changes above. Skew-relevant meanwhile: 3.10.0
+CLI writes follow the daemon write-routing policy (`direct`/`prefer`/`require`),
+so the feeder (`mempalace-pi-session`, 3.10.0 client) against the 3.9.0 hub is
+the one path to exercise on the built image before tagging — see *Still open*.
+
+### pi-atelier v0.10.1 → v0.10.3 (`734258b` → `ed3837b`)
+
+Fixes only per the release notes for v0.10.2 and v0.10.3 (both 2026-09-22):
+sidebar text/borders preserved beside inline images (#53), transcript images
+hidden while capturing overlays are open, Workspace Pulse skips redundant
+HEAD/diff when nothing tracked changed (#61), sidebar height from row counts
+(#59), git/usage scans suspended while disabled, Display Revert + Undo ordering.
+Checked before bumping: `package.json` at v0.10.3 still declares zero runtime
+dependencies and no build script (the no-`npm install` reasoning in
+`Dockerfile.variant` holds), `peerDependencies` still `>=0.84.0` (spans the
+pinned pi 0.85.1), 13 commits all under `src/ tests/ docs/ scripts/` plus
+metadata, no entry-point move. Both tags are annotated: the SHA above is the
+peeled commit, which is what `resolve-versions` bakes and what check 9 compares.
+
+### pi held at 0.85.1 (0.86.1 and 0.87.0 exist)
+
+Not an oversight. pi 0.87.0 *"Removed the inherited `shouldStopAfterTurn` agent
+option. Use `finishTurn` and return `{ action: "end" }` instead"*, and 0.86.0
+moved provider stream inputs to `TranscriptContext` with the system prompt read
+from `context.messages`. pi-observational-memory 3.1.4 still uses both the
+removed option and `AgentContext.systemPrompt` in its observer, reflector and
+dropper workers — measured in `src/agents/*/agent.ts` on both the baked 3.1.3
+tree and upstream `master`: `shouldStopAfterTurn` once per worker, `finishTurn`
+zero. Its `peerDependencies` are `*`, so nothing at install time would refuse;
+under 0.87 the workers would lose their turn caps and their specialised prompts
+at runtime. Upstream tracks it as pi-observational-memory
+[#82](https://github.com/elpapi42/pi-observational-memory/issues/82) with fix PR
+[#83](https://github.com/elpapi42/pi-observational-memory/pull/83) — opened
+2026-09-21, mergeable, **not merged** at this writing. Bump pi and pi-obsmem
+together once #83 ships in a release.
+
+The other extensions were checked against the 0.86.0 and 0.87.0 breaking lists
+and are clean: `ssh-controlmaster`'s `user_bash` handler already returns
+`undefined | { operations }` (0.86.0's fail-closed contract), and its four
+`registerTool` calls spread the built-in tools so they carry parameter schemas
+(#9300). 0.86.1 as an intermediate was not tested — not worth the pty matrix for
+a stop that #83 makes moot.
+
+### Still open
+
+- **Feeder against the 3.9.0 hub** — run `mempalace-pi-session` from the built
+  v1.9.4 image against synlig (dry-run first) before tagging. The palace-path
+  adaptation was measured with the wheel, not the image; the recreate acceptance
+  on the first device should confirm `~/.mempalace/palace/chroma.sqlite3` still
+  passes in `recreate-sanity-check.sh` and that `~/.config/mempalace` does not
+  appear.
+- **synlig upgrade to 3.10.0** after v1.9.4 is accepted on one device:
+  `uv tool upgrade mempalace`, restart `mempalace-serve.service`, verify one
+  search and one `event_list`.
+- **pi 0.87.x + pi-observational-memory ≥ 3.1.5** together, when #83 has shipped.
 
 ### pi-observational-memory 3.1.3 → 3.1.4 (`cba0334` → `e7d77dc`)