Record verified ngit publication of original 1.9.0 ISO

docs/SESSION-HANDOVER-20261007.md

@@ -530,3 +530,24 @@ and original paths retained as symlinks. This released496,544,104 tmpfs bytes;
 no build inputs, running services or wallet files changed. Indee's owned VM is
 being shut down at its transaction-idle boundary to relieve compilation pressure;
 its disk/evidence are retained for a dedicated4GB qualification window later.
+
+
+## Original1.9.0 ISO added to ngit release records
+
+Operator correctly reported missing ngit software release (Git tag alone was
+already mirrored). Published [1.9.0-alpha](https://gitworkshop.dev/nevent1qqsfy0xpwnn9y423x6vnxxqtfrplm0n3fyfz9fzcheru2a42gj368sqzyp6xqpkcw7daqn3jry69t99yfzdyy3h8gqv0zhjhte8azny4v6746qcyqqq82mc22hxen) with the original ISO and both
+checksums; both relays acknowledged, online readback resolves exact three assets.
+No new build, source ref, OTA/catalog or Gitea asset changed. Full local ISO hash
+and pinned signature pass. Direct URL attempt hit1800-second timeout; retained
+failure and used the established verified-asset-event workflow. Full receipts:
+`~/.local/state/archipelago/release-qualification/ngit-iso-190-20261007/`.
+
+Other latest checkpoints: artwork UI0c1d1b57 passes26 focused tests, app-project
+typecheck and Chromium A/B; native test60bd728a passesSDK28/35. APK57 unchanged;
+production UI build/physical artwork acceptance remain. Frozen707-input snapshot
+and build script:/tmp/archy-artwork-ui-build.py. HTTPS task17 evidence51694119
+retains22/24 full-navigation cases and12/12 response-only follow-up; normal trust
+and LAN-IP certificate match fail. Indee final lifecycle/health guard b0b95810 is
+under the combined isolated backend run, log
+`/tmp/archy-paid-indee-lifecycle-backend-20261007.log`; VM is off. Before its next
+boot, apply the documented GRUB manager mask and validate read-only exec context.

docs/release-1.9.0-acceptance.md

@@ -978,3 +978,41 @@ and companion0.5.34 APK all passed full download byte-count and SHA256 checks:
 locally verified pinned-root signatures. Promote those exact bytes to the live
 metadata paths; no artifact or signature changed. ISO upload and demo deployment
 are separate ongoing operations, not inferred passed from OTA asset publication.
+
+
+### Missing ngit ISO release entry published — 7 October 2026
+
+The operator correctly identified that the1.9.0 tag existed on ngit, but its
+software release entry did not. Gitea already contained the original ISO and both
+checksum assets. Published the missing [ngit1.9.0-alpha release](https://gitworkshop.dev/nevent1qqsfy0xpwnn9y423x6vnxxqtfrplm0n3fyfz9fzcheru2a42gj368sqzyp6xqpkcw7daqn3jry69t99yfzdyy3h8gqv0zhjhte8azny4v6746qcyqqq82mc22hxen) using the
+existing Archipelago application/publisher, original tag commit7abd04a7 and alpha
+channel. This adds release metadata; no ISO, signature, source ref or OTA/catalog
+bytes were replaced.
+
+Release event:`923cc174e6525551369933180b48c3fdbe71491222a458be47c576aa44a3a3c0`.
+Both `wss://relay.ngit.dev` and `wss://gitnostr.com` acknowledged the three asset
+records and release publication. Independent online `ngit release view` resolves
+all three files with exact hashes/sizes and no unresolved asset IDs:
+
+- ISO:2,695,954,432 bytes, SHA256`aad5f0350428976969043079a63b0e7a8264dcee2574526bd34719c798c750af`.
+- Plain checksum:121 bytes; exact existing public/local bytes.
+- Signed checksum:405 bytes; exact existing public/local bytes, pinned-root
+  signature verified again.
+
+The direct URL-backed ngit attempt failed its built-in1800-second acquisition
+timeout and published no release result. Retained that failure. Reused the
+established1.8.22 workflow: freshly hash the complete local ISO, verify its signed
+checksum, sign its public asset records using the existing configured identity,
+and attach those records with ngit's supported `--asset-event` interface. The
+previous complete public-download hash receipt remains separate from today's
+successful public range/sidecar checks; today's full URL attempt did not pass.
+
+Publication used an isolated repository whose local main and annotated release
+tag match both remote mirrors. Existing development main/candidate refs were
+not rewritten. The complete advertised audit inventories12 unrelated branch
+differences; main/release-tag parity does not establish full historical parity.
+
+Durable public receipts and failed-attempt evidence:
+`~/.local/state/archipelago/release-qualification/ngit-iso-190-20261007/`.
+Existing known limitations are retained in the release notes. Current IndeeHub,
+artwork and payment follow-ups are not included in this original ISO.