chore(release): cut nexus v2.9.0 — the statusline lands (#486)

MINOR: consumers gain a capability. `eidolons harness install` now wires the
statusLine key for claude-code, so ECM's rung-1 telemetry feed is actually
plugged in. Before this, `eidolons statusline render` shipped in v2.7.0 and
NOTHING installed it — every consumer's meter sat at estimate_source=unknown
with the whole decision policy resolving to the fail-open `continue` floor.

Changelog audited against the diff, not memory (git log v2.8.0..main): the
copilot handoff-digest fix (#482) had NO entry and would have shipped
unannounced — exactly the 2.4.0 gap where bump-mcp shipped inside a squash with
nothing in the changelog. Added under ### Fixed.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Rynaro

CHANGELOG.md

@@ -8,10 +8,18 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Version
 
 ## [Unreleased]
 
+## [2.9.0] — 2026-07-12 — the statusline lands: ECM's telemetry feed, finally plugged in
+
 ### Added
 
 - **`eidolons harness install` now wires the `statusLine` key for claude-code (ESL change `ecm-statusline-rollout`, tier lite).** `eidolons statusline render` shipped in v2.7.0 as ECM's rung-1 telemetry feed, but its own spec explicitly deferred auto-wiring — "this change wires this repo's `.claude/settings.json` by hand" — and nothing ever closed that gap: `grep -rn 'statusLine' cli/src/harness_install.sh` returned zero matches, so every consumer project's meter sat at `estimate_source: "unknown"`, `zone: "unknown"`, with every ECM decision-policy rule resolving to the fail-open `continue` floor. `harness install` now writes `{"type":"command","command":"eidolons statusline render","padding":0,"refreshInterval":2}` into `.claude/settings.json` — gated on the same ECM opt-in (`context:` block) and claude-code being wired, mirroring `_write_compact_threshold`'s don't-clobber design exactly (`_write_status_line`, `cli/src/harness_install.sh`). The command is always the installed CLI on PATH, never an absolute path. A pre-existing foreign `statusLine` is left byte-unchanged and recorded as `eidolons.lock` `context.statusline_managed: false`; ours is `true`. `harness remove` strips the key only when `statusline_managed` is `true` (same discipline as the existing `compactThreshold` strip), leaving a foreign value untouched. `schemas/eidolons.lock.schema.json` gains `context.statusline_managed`. `cli/tests/harness.bats` gains AC-SL-1..6, including a don't-clobber/idempotency pair asserted by **sha256 content hash** (not a substring grep) and an end-to-end proof that the wired command actually promotes the ECM meter to `estimate_source: "host"` — closing the loop the v2.7.0 spec opened.
 
+### Fixed
+
+- **The copilot ECM block now renders the handoff digest it always promised (ESL change `ecm-p2-host-adapters`, closed at last).** ECM P2's frozen `AC-CP-2` required the copilot block to carry *"the pin digest **plus** the handoff digest"*. It shipped in **v2.3.0** carrying only the pins: `cli/src/harness_install.sh` called `_ecm_handoff_digest` **zero** times (`harness_hook.sh` called it three — the capability existed and worked, it was simply never wired). Copilot has no runtime hook channel, so install time is its only chance to render this; it therefore shipped roughly **half** of its declared ECM surface for five releases. Worse, the artifact **lied**: it told the reader to *"refresh via `eidolons harness install`"* — a command that never read a handoff record, so following the instruction could not possibly produce a digest. `_ecm_handoff_digest` is lifted from `harness_hook.sh` to `lib.sh` (shared) and wired into the copilot Track C writer; a present record renders real content, an absent one degrades to an honest line, and the fallback text is now *true* (record a handoff, re-run install, and it refreshes — because install finally reads it). Fail-open (ECM P0) preserved.
+
+  **Why it survived five releases, and the lesson:** `AC-CP-2`'s check was `grep -q 'Prior session handoff'` — **a string the implementation itself hardcoded**. The gate grepped for the placeholder that *was* the defect, so it could not fail. Green tests prove the code does what its *tests* say, never what its *spec* says; only the drift check (which had never run on this change) caught it. Three such gates were hardened in the same pass — `AC-CP-2` now asserts digest **content**; `AC-CR-2` asserts **inside** the cursor marker block rather than matching the front-matter it was accidentally satisfied by; `AC-CDX-4` drops an `if [[ -n "$output" ]]` guard that made an empty payload — its primary failure mode — a vacuous pass. Each was mutation-proven: revert the fix, and the hardened tests go red against the exact code the old ones passed. Two remaining weaknesses are **recorded rather than papered over** in the change's `spec.yaml` (`known_spec_defects`): the drift fence's own "byte-identical claude-code install" guard is unsatisfiable alongside `AC-LK-1`/`AC-LK-2`, which mandate the very lock fields it forbids (an authoring defect in the frozen spec, not implementation drift); and `AC-LK-3` overclaims schema *validation* this repo has no JSON-Schema validator to perform.
+
 ## [2.8.0] — 2026-07-12 — atomos closes its tool set: the ECM compose/verify executor is feature-complete
 
 ### Changed

VERSION

@@ -1 +1 @@
-2.8.0
+2.9.0