@@ -0,0 +1,8 @@
+# 13M-1 integration receipt
+
+- Upstream checkpoint: `5689ea54ceac23d7e5bf59d54b9c718b59ae9ee0`. Merge `3a4fdb9b975106489b764556823d9528681301c2` is a true merge with parents fork `cf63fe667579482c7e3b73238b73d4ad2d01db97` and upstream checkpoint `5689ea54c`; the checkpoint contains 104 commits and 11 first-parent PR merges. Follow-up head: `c3c5271ab8f454287452f0df5eca9e38ffd250cf` on `sync/upstream-13m1-20261108`.
+- Retained and adapted: upstream benchmark runtime isolation (#2198) was ported with its contract test adapted to CLI argv; #1561 added truthful index freshness to `status --verbose`; #1430 added the `ignore_worktrees` hook gate and explicit index refusal through `--index-worktree`.
+- Follow-up repairs: `3cbefe210` fixed verbose status output because `cbm_git_context_resolve` returns zero on success and the pre-existing fork path never emitted the Git object. Jenkins #89 exposed an `index_policy` fixture using `th_mktempdir`'s shared static buffer for both repo and cache roots; fork commit `19f5bdfa8`'s cache-root guard correctly refused that layout. `c3c5271ab` gave the fixture distinct roots. The failure was pre-existing on main since `19f5bdfa8`; Jenkins #89 failed at `3cbefe210` with 3,044 passed and 1 failed.
+- Verification: local build with `-Werror`, memory-core lint (3,211 raw sites), strict Actions policy, targeted tests 18/18, and `index_policy` 12/12 passed. Jenkins: release-tooling #90 SUCCESS on exact head `c3c5271ab`. Merged to main via PR #33 (merge commit `929adfe36`).
+- Native Windows was not run. No push, PR publication, or GitHub Actions dispatch occurred for this receipt.
+
@@ -0,0 +1,8 @@
+# 13M-2 integration receipt
+
+- Upstream checkpoint: `e0c7a1da6c067149716afad5a06f2465c114840d`. Merge `bff6508606c296e3d96e5a01af44a9c35ae64049` is a true merge with parents 13M-1 merge `3a4fdb9b9` and upstream checkpoint `e0c7a1da6`; the checkpoint contains 73 commits and 7 first-parent PRs. The batch integrated 13M-1 follow-ups in merges `6ec8d5873` and `1c5f82a3a`; head `1c5f82a3a340ff5fa8069e4357d3177be8c48eab` on `sync/upstream-13m2-20261108`.
+- Retained #1724 resource-worker behavior through native `src/operations/index.{c,h}` and `index_supervisor`: `RESOURCE_FAILURE` disposition, request facts, resource response, and worker publish gate. Also retained #2395 Swift initialization and #2499 memory-lint changes.
+- Exclusion: #1784 MCP frontend recovery was MCP-only because `src/daemon/frontend.c` is deleted in the CLI fork; no MCP frontend was restored.
+- Verification: local build with `-Werror`, memory-core lint (3,201 raw sites, none grew), strict Actions policy, `index_supervisor` 21/21, daemon-application resource tests 6/6, and combined related checks 5/5 passed. Jenkins: release-tooling #91 failed on `1c5f82a3a` with 2 failures, both upstream Hermes hook cycle tests (from `e8f0f4a28`) that called the assets-only installer and named the binary `codebase-memory-mcp`. `0f1927fd3` runs them through `cbm_install_agent_hooks_for_testing` with the `codebase-memory-cli` binary name. Release-tooling #93 SUCCESS on exact head `0f1927fd3`.
+- Native Windows was not run. No push, PR publication, or GitHub Actions dispatch occurred for this receipt.
+
@@ -0,0 +1,7 @@
+# 13N integration receipt
+
+- Upstream checkpoint: `612eee2518ef84cc573e491fdee5fa5c90264cb5` (upstream main). Merge `2efba854891c7edbc8839c8cce0a7fb9fa7dec11` is a true merge with parents 13M-2 merge `6ec8d5873` and the exact upstream checkpoint; it contains 39 commits and 6 first-parent PRs. Follow-up `e4717235e` ports #2749 to `src/operations/source_search.c`: POSIX unscoped scans use argv `find`/`sort` stages and an in-process scan. `validate_search_args` continues to reject metacharacters in scopes and patterns, as upstream does. Merge `cf24b6a323f4944dd429820af0654bf6be29ccc0` integrated 13M-1 follow-ups. Head: `cf24b6a32` on `sync/upstream-13n-20261108`.
+- Retained #1862 install hook opt-out, #2667 Java external receiver, #2840 watcher cooldown, #2903 reserved `nul` handling, and #2911 dispatch-only FreeBSD workflow. MCP-only exclusions remain: `src/mcp/*`, `tests/test_mcp.c`, `src/daemon/frontend.*`, `tests/test_daemon_frontend.c`, `.github/workflows/pr.yml`, `.github/workflows/test-impact-artifact.yml`, and MCP registry steps in `release.yml` were not restored.
+- Verification: local build with `-Werror`, memory-core lint (3,201 raw sites, none grew), strict Actions policy, #1862 and #2840 tests 9/9, and source-search, integration, and index-policy tests 78/78 passed. Jenkins: release-tooling #92 on `cf24b6a32` was aborted because that head lacked the 13M-2 Hermes test fix. `98eab3ceb` merges 13M-2 into 13N; release-tooling #94 SUCCESS on exact head `98eab3ceb`. This ledger update lands as a docs-only commit on top.
+- Native Windows was not run; Windows-specific `nul` handling remains unverified natively. No push, PR publication, or GitHub Actions dispatch occurred for this receipt.
+
@@ -1,6 +1,6 @@
 # Continuation prompt
 
-> Current 2026-11-02 continuation: the pinned target `a5b248f47272413189746589b9a2c551c6b6c5ec` is integrated by true merge `8a686f225b2c64f81c0716f3129c36c50fb10ffe` on `sync/upstream-remainder-20261102`; see [13l.md](13l.md) and [ledger.json](ledger.json). The target is an ancestor with zero upstream-only remainder. Final Jenkins qualification, independent review, and host acceptance remain open. Do not chase later upstream commits, mutate stale PRs #28/#29, push main, or dispatch GitHub Actions.
+> Current 2026-11-08 continuation: baseline fork `cf63fe667579482c7e3b73238b73d4ad2d01db97` was 214 commits behind upstream checkpoint `612eee2518ef84cc573e491fdee5fa5c90264cb5` (merge base `a5b248f47272413189746589b9a2c551c6b6c5ec`). Stacked checkpoints 13M-1, 13M-2, and 13N end at `c3c5271ab8f454287452f0df5eca9e38ffd250cf`, `1c5f82a3a340ff5fa8069e4357d3177be8c48eab`, and `cf24b6a323f4944dd429820af0654bf6be29ccc0`; 13N is zero upstream commits behind. See [13m1.md](13m1.md), [13m2.md](13m2.md), [13n.md](13n.md), and [ledger.json](ledger.json). Jenkins qualification is pending for all three exact heads; native Windows was not run. Independent review and host acceptance remain separate gates. No push, PR publication, or GitHub Actions dispatch occurred.
 
 Continue the 2026-11-01 CLI-first upstream campaign. Read PLAN.md, ledger.json,
 13a.md and the canonical ../UPSTREAM_308_CANDIDATE_AUDIT_20260912.md first.
 
@@ -2,14 +2,14 @@
 
 ## Live continuation — 2026-11-02
 
-13A is on the authoritative fork main at `27b731cec45e2353303738ac6d8e77acbef42b7c`.
-The pinned continuation target is `a5b248f47272413189746589b9a2c551c6b6c5ec`.
-13B–13L are integrated provisionally in order. The final 13L merge is
-`8a686f225b2c64f81c0716f3129c36c50fb10ffe` with receipt [13l.md](13l.md); the
-pinned target is now an ancestor and no pinned upstream commits remain. Independent
-review, final Jenkins qualification, and host acceptance remain open. Current state is in
-[ledger.json](ledger.json); older campaign inventory and PR bases below are
-historical, and do not override the continuation run contract.
+13A–13L are historical checkpoints. The 2026-11-08 stacked continuation integrates
+13M-1, 13M-2, and 13N, ending at `98eab3ceb0666aee5521745414f5199acacba315`;
+the pinned upstream main `612eee2518ef84cc573e491fdee5fa5c90264cb5` is an ancestor
+with zero upstream-only commits. See [13m1.md](13m1.md), [13m2.md](13m2.md),
+[13n.md](13n.md), and [ledger.json](ledger.json). Jenkins full gate passed for exact heads
+`c3c5271ab` (#90, merged as PR #33), `0f1927fd3` (#93), and `98eab3ceb` (#94); native Windows was not run.
+Independent review and host acceptance remain open. Older campaign inventory and
+PR bases below are historical and do not override the continuation run contract.
 
 This campaign supplements the [canonical integration ledger](../UPSTREAM_308_CANDIDATE_AUDIT_20260912.md); it does not supersede older unresolved semantic dispositions. Machine status and per-checkpoint acceptance live in [ledger.json](ledger.json). [commits.tsv](commits.tsv) enumerates all 933 reachable campaign commits once, including 578 merges and 355 non-merges. Subsystem tags derive from changed paths; they are triage, not proof of implementation.
 
@@ -30,7 +30,7 @@ This campaign supplements the [canonical integration ledger](../UPSTREAM_308_CAN
 1. Finish narrow security/dependency fixes and verify actual advisories, versions and fork applicability. Preserve installer download/extraction limits and explicit workspace authorization.
 2. Harden the local/Jenkins Actions policy guard and add ancestry verification with positive/negative checks.
 3. Complete true merge of upstream `5dc83ac9fa363d51706a70977840b61ea59ce9db` (13A, 79 commits); reconcile reviewed hotfix/guard commits, retaining upstream merge ancestry. Publish only sanitized draft branches.
-4. Batches 13E–13L build sequentially on the latest provisional checkpoint. They remain dependent and unaccepted until independent review. Publish only sanitized stacked draft PRs with explicit dependencies; never base them on stale main.
+4. Batches 13E–13N build sequentially on the latest provisional checkpoint. They remain dependent and unaccepted until independent review. Publish only sanitized stacked draft PRs with explicit dependencies; never base them on stale main.
 5. Run focused checks after each completed batch, then full exact-SHA Jenkins qualification before recommending merge. Native Windows, >4 GiB SQLite offsets, graph determinism and sanitizer/recovery checks remain explicit gates when affected. Pending gates are not successful gates.
 
 Every batch must preserve CLI JSON/compact contracts, native HTTP, daemon ownership, durable storage and source provenance. No MCP server, transport/session registration or mandatory MCP dependencies. Retain useful shared changes via native CLI operations. Record every material exclusion/adaptation and schema migration in its batch receipt.
 
@@ -941,6 +941,115 @@
       ],
       "next_action": "Run the existing full release-tooling Jenkins job against the current committed candidate; then retain independent review and host acceptance as separate gates.",
       "publication_blocker": "GitHub push unavailable: git remote requires Username in this non-interactive executor; GitHub ref API update returned not_found. No stacked draft PRs published; stale PRs #28/#29 untouched."
+    },
+    {
+      "batch": "13M-1",
+      "upstream_start": "a5b248f47272413189746589b9a2c551c6b6c5ec",
+      "upstream_checkpoint": "5689ea54ceac23d7e5bf59d54b9c718b59ae9ee0",
+      "upstream_commits": 104,
+      "ancestry_validated": true,
+      "fork_base": "cf63fe667579482c7e3b73238b73d4ad2d01db97",
+      "depends_on": [
+        "13L"
+      ],
+      "state": "merged_to_main_pr33",
+      "branch": "sync/upstream-13m1-20261108",
+      "merge_commit": "3a4fdb9b975106489b764556823d9528681301c2",
+      "head": "c3c5271ab8f454287452f0df5eca9e38ffd250cf",
+      "receipt": "13m1.md",
+      "adaptations": [
+        "Ported #2198 benchmark runtime isolation; adapted contract test to CLI argv.",
+        "Ported #1561 truthful index freshness to status --verbose.",
+        "Ported #1430 ignore_worktrees hook gate and explicit --index-worktree refusal.",
+        "Fixed verbose status Git object emission and gave index_policy fixture distinct repo and cache roots."
+      ],
+      "exclusions": [],
+      "verification": {
+        "local": "scripts/build-dev.sh and build/c/test-runner with -Werror passed; lint-memory-core passed at 3211 raw sites; strict Actions policy passed; targeted checks 18/18 and index_policy 12/12 passed.",
+        "jenkins": "#90 SUCCESS on exact head c3c5271ab",
+        "windows": "not_run"
+      },
+      "upstream_prs": [
+        2198,
+        1561,
+        1430
+      ],
+      "qualification": "Jenkins release-tooling #90 SUCCESS on exact head c3c5271ab (full gate); merged to main via PR #33 as merge commit 929adfe36.",
+      "main_merge_commit": "929adfe36c5c36563637c83ab32007289ec4c271"
+    },
+    {
+      "batch": "13M-2",
+      "upstream_start": "5689ea54ceac23d7e5bf59d54b9c718b59ae9ee0",
+      "upstream_checkpoint": "e0c7a1da6c067149716afad5a06f2465c114840d",
+      "upstream_commits": 73,
+      "ancestry_validated": true,
+      "fork_base": "3a4fdb9b975106489b764556823d9528681301c2",
+      "depends_on": [
+        "13M-1"
+      ],
+      "state": "jenkins_passed_draft_pr_review_pending",
+      "branch": "sync/upstream-13m2-20261108",
+      "merge_commit": "bff6508606c296e3d96e5a01af44a9c35ae64049",
+      "head": "0f1927fd3cf872aa3d85719339af255fb1890394",
+      "receipt": "13m2.md",
+      "adaptations": [
+        "Ported #1724 resource-worker behavior to native operations/index and index_supervisor: RESOURCE_FAILURE disposition, request facts, resource response, and worker publish gate.",
+        "Retained #2395 Swift initialization and #2499 memory-lint changes.",
+        "Integrated 13M-1 follow-ups in merges 6ec8d5873 and 1c5f82a3a."
+      ],
+      "exclusions": [
+        "Excluded #1784 MCP frontend recovery because src/daemon/frontend.c is deleted in this CLI fork."
+      ],
+      "verification": {
+        "local": "scripts/build-dev.sh and build/c/test-runner with -Werror passed; lint-memory-core passed at 3201 raw sites with none grown; strict Actions policy passed; index_supervisor 21/21, daemon_application resource tests 6/6, and combined related checks 5/5 passed.",
+        "jenkins": "#91 FAILURE on 1c5f82a3a (2 Hermes hook tests, fixed in 0f1927fd3); #93 SUCCESS on exact head 0f1927fd3",
+        "windows": "not_run"
+      },
+      "upstream_prs": [
+        1724,
+        2395,
+        2499,
+        1784
+      ],
+      "qualification": "Jenkins release-tooling #91 FAILED on 1c5f82a3a (2 Hermes hook tests); fixed in 0f1927fd3; #93 SUCCESS on exact head 0f1927fd3 (full gate)."
+    },
+    {
+      "batch": "13N",
+      "upstream_start": "e0c7a1da6c067149716afad5a06f2465c114840d",
+      "upstream_checkpoint": "612eee2518ef84cc573e491fdee5fa5c90264cb5",
+      "upstream_commits": 39,
+      "ancestry_validated": true,
+      "fork_base": "0f1927fd3cf872aa3d85719339af255fb1890394",
+      "depends_on": [
+        "13M-2"
+      ],
+      "state": "jenkins_passed_draft_pr_review_pending",
+      "branch": "sync/upstream-13n-20261108",
+      "merge_commit": "2efba854891c7edbc8839c8cce0a7fb9fa7dec11",
+      "head": "98eab3ceb0666aee5521745414f5199acacba315",
+      "receipt": "13n.md",
+      "adaptations": [
+        "Ported #2749 to native source_search: unscoped POSIX scan uses argv find/sort stages and in-process scanning; metacharacters remain rejected by validate_search_args.",
+        "Retained #1862 hook opt-out, #2667 Java external receiver, #2840 watcher cooldown, #2903 reserved nul handling, and #2911 dispatch-only FreeBSD workflow.",
+        "Integrated 13M-1 follow-ups in cf24b6a32."
+      ],
+      "exclusions": [
+        "MCP-only files and release registry steps remain deleted; see 13n.md."
+      ],
+      "verification": {
+        "local": "scripts/build-dev.sh and build/c/test-runner with -Werror passed; lint-memory-core passed at 3201 raw sites with none grown; strict Actions policy passed; #1862 and #2840 tests 9/9, source_search, integration, and index_policy tests 78/78 passed.",
+        "jenkins": "#92 aborted (stale head cf24b6a32); #94 SUCCESS on exact head 98eab3ceb",
+        "windows": "not_run; reserved nul handling not natively verified"
+      },
+      "upstream_prs": [
+        1862,
+        2667,
+        2749,
+        2840,
+        2903,
+        2911
+      ],
+      "qualification": "Jenkins release-tooling #92 on cf24b6a32 aborted (stale head); #94 SUCCESS on exact head 98eab3ceb (full gate), which merges the 13M-2 fix."
     }
   ],
   "reconciliation": [
@@ -1660,22 +1769,18 @@
     }
   },
   "current_continuation": {
-    "baseline": "27b731cec45e2353303738ac6d8e77acbef42b7c",
-    "pinned_target": "a5b248f47272413189746589b9a2c551c6b6c5ec",
-    "integrated_through": "a5b248f47272413189746589b9a2c551c6b6c5ec",
-    "current_merge_commit": "8a686f225b2c64f81c0716f3129c36c50fb10ffe",
+    "baseline": "cf63fe667579482c7e3b73238b73d4ad2d01db97",
+    "upstream_baseline": "612eee2518ef84cc573e491fdee5fa5c90264cb5",
+    "merge_base": "a5b248f47272413189746589b9a2c551c6b6c5ec",
+    "integrated_through": "612eee2518ef84cc573e491fdee5fa5c90264cb5",
+    "current_merge_commit": "2efba854891c7edbc8839c8cce0a7fb9fa7dec11",
+    "current_head": "98eab3ceb0666aee5521745414f5199acacba315",
     "upstream_commits_remaining": 0,
-    "status": "full_jenkins_success_independent_review_and_acceptance_pending",
-    "candidate_commit": "214b87b84a40e170fd8b3db2c603ab651ba5fe2c",
-    "full_jenkins": {
-      "job": "codebase-memory-cli-release-tooling",
-      "build": 88,
-      "result": "SUCCESS",
-      "source_commit": "214b87b84a40e170fd8b3db2c603ab651ba5fe2c",
-      "url": "http://192.168.88.146:8080/job/codebase-memory-cli-release-tooling/88/",
-      "production_binary_sha256": "c86570af70bd2dfb655a5c2a82d2ab7669e9e76b6ea95fab6af9badc9fd7877f",
-      "test_summary": "4141 passed, 0 failed, 2 skipped; 188 suites, 9 jobs"
-    }
+    "baseline_upstream_commits_behind": 214,
+    "status": "jenkins_passed_13m1_merged_13m2_13n_review_pending",
+    "jenkins_qualification": "PASSED: #90 c3c5271ab, #93 0f1927fd3, #94 98eab3ceb",
+    "native_windows": "not_run; #2903 nul handling remains unverified natively",
+    "publication": "no push, no PR, no Actions dispatch at time of writing"
   },
   "upstream_commits_remaining": 0
 }