Configure golangci-lint v2 for the whole tree (brlapi/duckdb build tags, curated linters, documented exclusions) and resolve what it reports: dead code, wrapped-error comparisons and %w wrapping, unclosed websocket handshake bodies, staticcheck SA/S items, ineffectual assignments, and explicit _ = discards for best-effort teardown errors. Document the gate in CONTRIBUTING and AGENTS.
Add opt-in Tentacle protocol 1.1, explicit remote grants, lifecycle IPC and expiring core leases in both SDKs. Revoke access before update preparation, including failed updates.
Add transient secret entries, shared Braille cell export and isolated Xorg recovery experiments with focused tests and documented limitations. Production consent, desktop services and live interoperability remain pending.