[ScriptedAlchemy]

Merge #4478 first, followed by #4526, #4510, #4524, #4489, #4485, #4527, #4528, #4530, #4531, #4529, #4534, and #4541.

This PR is number 6 of 13, based on #4489. Merge #4527 next.

Use merge commits. After merging a parent PR, change its child's base to master before merging the child. Auto-merge is disabled.

Prepare release 1.0.0-beta.93.

---

1.0.0-beta.93 (2026-10-25)

Features

• edits: remove file undo and automatic restoration (#4472) (4098533)

Bug fixes

• automation: refuse incomplete stored job documents (#4468) (645131b)
• cli: hold init --wait while the first generation is in flight (#4494) (722f7cc)
• code-index: keep a read-reseated graph across parks (#4499) (e9a3355)
• cursor: apply diagnostic caps after lane selection (#4491) (96994d0)
• extension: make bridge shutdown terminal (#4486) (9b8789c)
• graph: preserve import evidence in caller traversal (#4509) (6ed67ce)
• graph: resolve node ids before waiting on a released catalog (#4498) (ba7493d)
• health: share SCC analysis and count cycle edges exactly (#4466) (69ece22)
• privacy: stop treating compound identifiers as secrets (36eedb3)
• privacy: stop treating compound identifiers as secrets (d869740), Refs #4451
• runtime: batch session skips and retain preparation writers (#4495) (fc598cb)
• sdk: bound SSE frames and scan fragmented lines once (#4501) (1d7e794)
• sdk: own JSON response bodies through cancellation (#4487) (ef2809e)
• sdk: refuse enrolled remote redirects (#4471) (c9b1d4c)
• sessions: measure catch-up backlog from source cursors (#4497) (f5078ee)
• sessions: mount detached checkouts' session retrieval (#4496) (10b5d95)
• sessions: resolve Codex scope once, off the polling worker (#4500) (4ff7319)
• source-edit: preserve concurrently created destinations (#4504) (5d1defa), Refs #4415
• source-edit: preserve reexports when moving symbols (#4493) (0c9337f)
• status: report resident memory no retained owner holds (#4503) (c75a45d)
• status: report why no GitHub source was observed (#4492) (9819426)
• test: complete daemon and HTTP fixture teardown (58949d0)

Performance improvements

• code-graph: reread only re-sealed segments when proving a seal (#4523) (a201387)

Reverts

• privacy: restore entropy redaction for compound identifiers (#4512) (b0c2a1d)

---

This PR was generated with Release Please. See documentation.

Validation on integrated release head 20fde4da149df8b4ebf0cf05dcf055cf1c8e678f:

• scripts/check-release-pr-integrity.sh 390bc3fa146a6cf8ba82482e4f2d2ed2bf886369 HEAD passed.
• Canonical bazel run //scripts:bazel/gen_builds.py -- --check passed: all 60 generated BUILD files current; invocation ceaaa67d-ba48-4af0-9848-dadd1aee9ab0.
• The delta from the SDK parent remains exactly nine release metadata files. SDK/extension inputs are unchanged from that parent's fresh SDK build and embedded comparison.
• Normal merge commit, clean checkout, and diff checks passed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7113441

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 1 new potential issue.

🐛 1 issue in files not directly in the diff

🐛 Beta.93 release retains beta.92 package identities

For beta.93, Cargo.lock still identifies all three version-inheriting crates as beta.92. The release integrity check rejects the mismatch, while stale Bazel targets would stamp beta.92 into the CLI.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 1 new potential issue.

🐛 1 issue in files not directly in the diff

🐛 Release binary rejects its product version

When Bazel builds beta.93, CARGO_PKG_VERSION for the CLI remains beta.92, so normal commands fail at startup. register_product_runtime rejects the CLI provider because the product library uses beta.93.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 1 new potential issue.

🐛 1 issue in files not directly in the diff

🐛 Release validation rejects mismatched crate versions

The beta.93 release fails validation because Cargo.lock records three workspace crates as beta.92. Cargo.toml still declares beta.93, which the release integrity check requires the lockfile to match.

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 1 new potential issue.

🐛 1 issue in files not directly in the diff

🐛 Release artifacts report the wrong version

For a beta.93 release, CARGO_PKG_VERSION in the shipped Bazel CLI remains beta.92. The project library shares that stale version, while the release tag and MCPB manifest say beta.93. The mismatched Cargo.lock entries also fail release integrity validation.

[devin-ai-integration]

Devin Review found 1 new potential issue.

🐛 1 issue in files not directly in the diff

🐛 Release binaries report the old version

A Bazel-built beta.93 CLI reports beta.92 because CARGO_PKG_VERSION comes from its generated target. The project library also embeds beta.92, while release metadata names beta.93.