chore(release): prepare Engraphis 1.7.4 (#222)

* chore(release): prepare Engraphis 1.7.4

* fix(review): harden release and maintenance determinism

* fix(release): reject ignored runtime source and bytecode

* fix(review): close executable and fork identity gaps

* fix(evidence): refresh public fixture after ULID hardening

* fix(readiness): inspect ignored build entrypoints

Author: Coding-Dev-Tools

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "engraphis-memory",
       "source": "./",
       "description": "Discipline for giving agents durable, scoped, explainable memory across sessions and repos with the Engraphis MCP tools.",
-      "version": "1.7.3"
+      "version": "1.7.4"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engraphis-memory",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "description": "Give agents durable, scoped, explainable memory across sessions and repos via the Engraphis MCP tools. Use when you learn something worth keeping, need prior context before acting, or ask why/how a fact changed. Covers remember/recall, why/timeline, forget/pin/correct, sessions, and code search.",
   "author": {
     "name": "The Engraphis Authors",

.claude-plugin/skill-assets.sha256

@@ -1,5 +1,5 @@
-1731b35c796e5ac26d7e4c7c9b77b2640d6e7478006d2c67a155f66df70bb50a  .claude-plugin/marketplace.json
-4b2453788ff35f0c46eb8d0cd4c2491ca9352fc4bae96ee81a4c330f2709ac77  .claude-plugin/plugin.json
+e2e08499a70d8d62ef22797cda0bb07d46cd1c6a79e5e18c1103b6c3c755b6d5  .claude-plugin/marketplace.json
+36c560916ba42634cc50dc4f81b49955cc49b72152452eef67b49b6b2a2957d5  .claude-plugin/plugin.json
 4bc8979b9ffeb97190960e551dbf4ddc6f7aeeb7b86894fd2298a59ff0001efa  skills/engraphis-memory/SKILL.md
 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
 62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md

BENCHMARKS.md

@@ -9,14 +9,14 @@ For the locked operator sequence for a public canonical run, see
 ### Public numeric evidence registry
 
 Every exact public aggregate retained below comes from the checked-in, public-safe
-[`offline-fixtures-v3.json`](docs/benchmark-evidence/offline-fixtures-v3.json) artifact. Its
+[`offline-fixtures-v9.json`](docs/benchmark-evidence/offline-fixtures-v9.json) artifact. Its
 SHA-256 is
-`2d6b4fab9e75edc91d105d49877f9225f28ffe4d366e40a44e931f19cb13f498`, also recorded in the
+`455fc9d32a236e582a49aaaf9b84f30cae2573dc6ed982f4dd7dd845afcaf24c`, also recorded in the
 adjacent `.sha256` file. The artifact contains no raw questions, answers, prompts, customer data,
 or per-record content fingerprints.
 
 The fixture-suite digest is
-`95c233e3fb79a1618bf40f0daefb36d3d1772b1f332d281d6f4c5d6cc902455b`. The artifact defines
+`c8976cf0989e82f57810b99bf19f2ee3f860d07726bcb28479a319a19f00f94f`. The artifact defines
 the digest algorithm and records the SHA-256 of every suite and dataset file. Each evidence ID
 also binds its exact command through `sha256(UTF-8 exact command)`:
 

CHANGELOG.md

@@ -5,6 +5,8 @@ All notable changes to Engraphis are documented here. Format loosely follows
 
 ## [Unreleased]
 
+## [1.7.4] - 2026-09-13
+
 - Writable SQLite files now default to WAL plus FULL synchronization, with an explicit
   balanced option and effective-policy diagnostics. Disposable fault tests cover abrupt
   process exit and database-full rollback; hardware power loss remains unverified.
@@ -36,9 +38,8 @@ All notable changes to Engraphis are documented here. Format loosely follows
 - Added content-free diagnostics and build/capability information, strict coding
   acceptance validation and a file-backed independent-process capacity harness.
   These provide measurement infrastructure, not verified 100k capacity claims.
-- Preload the optional `sentence-transformers` dependency before Windows stdio MCP
-  accepts JSON-RPC, avoiding the observed native import/thread startup stall while
-  preserving deterministic fallback and exact-backend policy.
+- MCP stdio startup accepts the JSON-RPC handshake before optional semantic-model
+  warmup, while retaining deterministic fallback and exact-backend policy.
 
 ## [1.7.3] - 2026-09-07
 

README.md

@@ -77,9 +77,9 @@ its counting boundary explicit.
 | Packed prompt-context usage in the same 26-question CodeMem sample pass | Hard budget: **1,500** tokens; observed mean: **85.38**; observed maximum: **108** | A hard cap prevents a recall from exceeding its configured context budget | This is usage accounting, not a before/after savings comparison |
 
 These values are evidence IDs `offline-chunking` and `offline-performance` in
-[`offline-fixtures-v3.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v3.json),
+[`offline-fixtures-v9.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v9.json),
 SHA-256
-`2d6b4fab9e75edc91d105d49877f9225f28ffe4d366e40a44e931f19cb13f498`.
+`455fc9d32a236e582a49aaaf9b84f30cae2573dc6ed982f4dd7dd845afcaf24c`.
 [`BENCHMARKS.md`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/BENCHMARKS.md#public-numeric-evidence-registry)
 records the matching suite digest, exact commands, and per-command config digests. External,
 model-dependent, consolidation, productivity, and latency results remain unpublished until the

docs/REWORK_EXECUTION.md

@@ -161,7 +161,7 @@ scope/time regression coverage. Original user edits were not rewritten.
 | Capacity acceptance | Lifecycle RSS includes startup, backlog is sampled and recomputed, and the complete matrix validator enforces prebound hosts, WAL/FULL, all scheduled outcomes, RAM and the required 100k latency limits. | No primary 48-cell matrix was executed. The separate 16 GiB reference host remains necessary. |
 | Installed journeys | A packaged stdlib runner performs actual MCP/HTTP writes, restart recall, correction and historical reads. PR CI and release jobs cover Windows, macOS and Linux, with artifact/dependency identities retained. | Cached Windows source semantic startup passed in four fresh processes, taking 20-23 seconds. This is not semantic qualification of all installed platforms. |
 | Evidence and publication | Candidate ledger validation checks identities, hashes, dependencies, outcomes and selected evaluation booleans. All four publication/repair writes require [owner qualification](RELEASE_QUALIFICATION.md). | Owner-protected environment/authority setup, final approval and all missing mandatory evidence remain open. |
-| Public claims | Fresh [offline fixture evidence](benchmark-evidence/offline-fixtures-v3.json) reproduces retained public aggregates and binds the current engine/eval source. Historical v1 evidence is preserved. | Planner variants still require successful promotion gates; no retrieval default or leadership claim is promoted. |
+| Public claims | Fresh [offline fixture evidence](benchmark-evidence/offline-fixtures-v9.json) reproduces retained public aggregates and binds the current engine/eval source. Historical v1 evidence is preserved. | Planner variants still require successful promotion gates; no retrieval default or leadership claim is promoted. |
 | Website contract | Active commercial/MCP/install guidance is generated and checked against a selected shipped public contract in the website candidate. | The live portal, authenticated provider journeys and combined deployed identities require attended acceptance. |
 
 Final commits, distributions, dependency inventories, raw execution results and gate
@@ -203,7 +203,7 @@ ignore until compatibility is demonstrated. Patched Pi Hono remains in place.
 
 Private Cloud/Team PR #74 is the integrated application delivery; the independent
 R2 backup addition remains PR #72. Website PR #15 incorporates the useful older
-measurement, offer and artifact checks while retaining the shipped v1.7.3 contract.
+measurement, offer and artifact checks while retaining the shipped v1.7.4 contract.
 Final source identities and new CI results must be recorded separately from the
 earlier release package. Consolidation and passing source checks do not complete
 the outstanding capacity, recovery, hosted, human-acceptance or pilot gates.