diff --git a/README.md b/README.md
index 1f54e71..8ec7df7 100644
--- a/README.md
+++ b/README.md
@@ -18,8 +18,8 @@ Today:
 - This repository keeps ORRO docs, product boundary, locks, thin wrapper package metadata, assurance contract checks, and integration-surface policy.
 - The runnable `orro` command is ORRO-owned and delegates to witnessd.
 - The ORRO product line is published on PyPI through 0.2.21, while this repository
-  packages the 0.2.23 release candidate. The post-release target state is: `orro`
-  0.2.23 is published on PyPI. It becomes true only after `v0.2.23` is tagged and
+  packages the 0.2.24 release candidate. The post-release target state is: `orro`
+  0.2.24 is published on PyPI. It becomes true only after `v0.2.24` is tagged and
   the Trusted-Publishing workflow completes. Until then, a normal
   `pip install orro` installs the latest published product-line release.
 - The local wrapper package exposes both `orro` and `orro-wrapper`.
@@ -33,7 +33,7 @@ Current focus:
 ## Can I use ORRO today?
 
 Yes. The published ORRO product line is installable from PyPI; see Current Status
-for the latest published version. Development dogfood can run the 0.2.23 source
+for the latest published version. Development dogfood can run the 0.2.24 source
 directly against pinned Depone and witnessd checkouts.
 
 Current split:
@@ -74,7 +74,7 @@ migration.
 Current command source: the `orro` command is exposed by this ORRO package and
 delegates to `python -m orro`.
 
-The 0.2.23 package metadata declares `witnessd>=2.37.0,<3.0.0` while keeping Depone and
+The 0.2.24 package metadata declares `witnessd>=2.40.0,<3.0.0` while keeping Depone and
 witnessd as separate engine repositories.
 
 ## Pinned Engine E2E
@@ -98,9 +98,9 @@ Engine-lock update discipline is documented in
 [`docs/engine-lock-update-process.md`](docs/engine-lock-update-process.md), and
 validated engine pairs are listed in
 [`docs/compatibility-matrix.md`](docs/compatibility-matrix.md). The published PyPI
-version is documented in Current Status; this repository sources 0.2.23,
+version is documented in Current Status; this repository sources 0.2.24,
 whose publication will be completed as a separate release step after the
-`v0.2.23` tag triggers the
+`v0.2.24` tag triggers the
 Trusted-Publishing workflow. Repository metadata changes do not publish or
 rewrite an artifact.
 
@@ -137,7 +137,7 @@ not assurance.
 
 The current command source is the ORRO-owned `orro` console script. The published
 PyPI version is documented in Current Status, and this repository prepares source
-version 0.2.23 with a `witnessd>=2.37.0,<3.0.0` dependency. The wrapper contains no
+version 0.2.24 with a `witnessd>=2.40.0,<3.0.0` dependency. The wrapper contains no
 engine code and must not
 implement proofrun, proofcheck, scheduler, observer, fan-in, team-ledger, or
 verifier logic.
diff --git a/docs/bootstrap.md b/docs/bootstrap.md
index a1e3618..2738460 100644
--- a/docs/bootstrap.md
+++ b/docs/bootstrap.md
@@ -94,10 +94,10 @@ that the installed metadata points to `orro_wrapper.cli:main`, `orro boundary`
 reports `contains_engine_logic: false`, `orro flowplan --help` delegates to
 witnessd, and both `orro-wrapper` and `python -m orro` remain usable.
 
-The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
-true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+The post-release target state is: `orro` 0.2.24 is published on PyPI. It becomes
+true only after `v0.2.24` is tagged and the Trusted-Publishing workflow completes;
 until then, PyPI contains the ORRO product line through 0.2.22. This repository is
-the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
+the canonical 0.2.24 source, whose metadata declares `witnessd>=2.40.0,<3.0.0`.
 
 The wrapper distribution smoke is separate from bootstrap:
 
diff --git a/docs/compatibility-matrix.md b/docs/compatibility-matrix.md
index a8eb8b7..c1b0f91 100644
--- a/docs/compatibility-matrix.md
+++ b/docs/compatibility-matrix.md
@@ -5,10 +5,10 @@ proof, not verifier truth, not approval, and not assurance. It does not replace
 Depone or witnessd engine tests, and it does not imply that unlisted future
 commits are compatible.
 
-The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
-true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+The post-release target state is: `orro` 0.2.24 is published on PyPI. It becomes
+true only after `v0.2.24` is tagged and the Trusted-Publishing workflow completes;
 until then, PyPI contains the ORRO product line through 0.2.22. This repository is
-the canonical 0.2.23 source.
+the canonical 0.2.24 source.
 
 ```text
 Depone verifies; witnessd executes; ORRO exposes the workflow.
@@ -16,13 +16,13 @@ Depone verifies; witnessd executes; ORRO exposes the workflow.
 
 | Matrix entry | ORRO repo commit | witnessd commit | Depone commit | e2e status | notes |
 | --- | --- | --- | --- | --- | --- |
-| depone-n-witnessd-n | n/a | `8ab96fc588ba6b43e90bfddc1d88f1867b4916ae` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Current locally validated engine pair; witnessd v2.37.0. |
+| depone-n-witnessd-n | n/a | `c9559008427ab16a12a9002ffc27c434f8e5c6d6` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Current locally validated engine pair; witnessd v2.40.0. |
 | depone-n-witnessd-n-1 | n/a | `d601fa86fd8b658e8f4a2cf7fa4b35bde26c554d` | `0e86a55ad10c464d35308a7b6315860a47bcf8a5` | warn | Declared downgrade row, not a release lock. |
 | depone-n-1-witnessd-n | n/a | `90d4bc77b71cecf464f1f8a820d9fe17b308211f` | `b203130b5720c6ef6fc9b7492f085ac5ee733786` | warn | Declared downgrade row, not a release lock. |
-| orro-rc-locked-triplet | `95ec4c3ae0eb67aaac830ddfff82353ac28d4ef0` | `8ab96fc588ba6b43e90bfddc1d88f1867b4916ae` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Matches witnessd v2.37.0, `engine-lock/orro-e2e-engine-lock.json`, `release/orro-release-manifest.v0.json`, and `release/compatibility-matrix.v0.json`. |
+| orro-rc-locked-triplet | `f93f31fa09f5eb6133c508547f8e0f5e0636b930` | `c9559008427ab16a12a9002ffc27c434f8e5c6d6` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Matches witnessd v2.40.0, `engine-lock/orro-e2e-engine-lock.json`, `release/orro-release-manifest.v0.json`, and `release/compatibility-matrix.v0.json`. |
 
-The locked witnessd revision is release `v2.37.0` (source version 2.37.0). It
-satisfies the ORRO 0.2.23 package requirement `witnessd>=2.37.0,<3.0.0`.
+The locked witnessd revision is release `v2.40.0` (source version 2.40.0). It
+satisfies the ORRO 0.2.24 package requirement `witnessd>=2.40.0,<3.0.0`.
 
 Related files:
 
diff --git a/docs/e2e-runner.md b/docs/e2e-runner.md
index bff09bb..4bbdfaa 100644
--- a/docs/e2e-runner.md
+++ b/docs/e2e-runner.md
@@ -78,4 +78,4 @@ separate pinned-engine e2e CI checks out the pinned witnessd and Depone commits
 from the e2e lock, then runs the full smoke.
 
 The ORRO product line is published on PyPI through 0.2.6. This pinned-engine
-smoke validates the 0.2.23 source package without publishing a new release.
+smoke validates the 0.2.24 source package without publishing a new release.
diff --git a/docs/install.md b/docs/install.md
index 9f1e6b1..2eedb97 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -1,17 +1,17 @@
 # Install
 
 The ORRO product line is published on PyPI through 0.2.22, while this repository
-packages 0.2.23. The post-release target state is: `orro` 0.2.23 is published on
-PyPI. It becomes true only after `v0.2.23` is tagged and the Trusted-Publishing
-workflow completes. The 0.2.23 package metadata declares `witnessd>=2.37.0,<3.0.0`, and
+packages 0.2.24. The post-release target state is: `orro` 0.2.24 is published on
+PyPI. It becomes true only after `v0.2.24` is tagged and the Trusted-Publishing
+workflow completes. The 0.2.24 package metadata declares `witnessd>=2.40.0,<3.0.0`, and
 the package exposes `orro` plus the `orro-wrapper` compatibility alias.
 
 ```bash
 python3 -m pip install orro
 ```
 
-Until the `v0.2.23` workflow completes, that command installs `orro` 0.2.22.
-Development dogfood may instead use the 0.2.23 source checkout and pinned engine
+Until the `v0.2.24` workflow completes, that command installs `orro` 0.2.22.
+Development dogfood may instead use the 0.2.24 source checkout and pinned engine
 repositories directly.
 
 For the shared pinned-engine development layout, run bootstrap with the shared
@@ -92,7 +92,7 @@ The smoke runner is an orchestration harness only. It calls the current engine
 commands and does not implement proofrun, proofcheck, or runtime logic.
 
 The source package provides one user-facing ORRO install and declares
-`witnessd>=2.37.0,<3.0.0`; pinned-engine e2e metadata continues to govern repository
+`witnessd>=2.40.0,<3.0.0`; pinned-engine e2e metadata continues to govern repository
 compatibility validation.
 
 ## Packaging Decision
@@ -102,7 +102,7 @@ The v0 packaging decision is documented in `docs/packaging-decision.md` and
 verifier truth, and not package publish.
 
 Current installs use the ORRO-owned thin `orro` command. The ORRO product line is
-published on PyPI through 0.2.22, this repository prepares source 0.2.23 for the
+published on PyPI through 0.2.22, this repository prepares source 0.2.24 for the
 tag-triggered workflow, and the wrapper continues to contain no engine code.
 
 ## Wrapper Distribution Smoke
diff --git a/docs/packaging-decision.md b/docs/packaging-decision.md
index e478b30..73780f4 100644
--- a/docs/packaging-decision.md
+++ b/docs/packaging-decision.md
@@ -12,15 +12,15 @@ ORRO will remain product/distribution/wrapper only while Depone and witnessd
 stay separate engine repositories.
 
 Current command source is the ORRO-owned `orro` console script, which delegates
-to witnessd. The post-release target state is: `orro` 0.2.23 is published on PyPI.
-It becomes true only after `v0.2.23` is tagged and the Trusted-Publishing workflow
+to witnessd. The post-release target state is: `orro` 0.2.24 is published on PyPI.
+It becomes true only after `v0.2.24` is tagged and the Trusted-Publishing workflow
 completes; until then, PyPI contains the ORRO product line through 0.2.22. This
-repository is the canonical 0.2.23 source, whose metadata declares
-`witnessd>=2.37.0,<3.0.0`.
+repository is the canonical 0.2.24 source, whose metadata declares
+`witnessd>=2.40.0,<3.0.0`.
 
 `published_package: true` means the ORRO product line has published PyPI
 releases; `published_package_scope: product-line` makes that scope explicit. It
-does not assert that the 0.2.23 source candidate is already published.
+does not assert that the 0.2.24 source candidate is already published.
 
 The package remains a thin wrapper that delegates to the existing engine
 command surface. It must contain no engine code.
@@ -58,7 +58,7 @@ The ORRO repository must not contain:
    `orro` and `orro-wrapper`, and contains no engine packages or engine
    implementation files.
 3. Published package: current phase. The ORRO product line is published through
-  0.2.1, and source 0.2.23 is prepared for the tag-triggered Trusted-Publishing
+  0.2.1, and source 0.2.24 is prepared for the tag-triggered Trusted-Publishing
    workflow. Any new release still requires pinned-engine e2e, boundary checks,
    bootstrap checks, and release metadata to remain green.
 
diff --git a/docs/pinned-engine-fallback.md b/docs/pinned-engine-fallback.md
index 38520fa..eab4b02 100644
--- a/docs/pinned-engine-fallback.md
+++ b/docs/pinned-engine-fallback.md
@@ -67,8 +67,8 @@ mismatched engines and point to bootstrap/setup commands, but it must not
 auto-select different engine commits or rewrite the engine lock outside an
 intentional update PR.
 
-The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
-true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+The post-release target state is: `orro` 0.2.24 is published on PyPI. It becomes
+true only after `v0.2.24` is tagged and the Trusted-Publishing workflow completes;
 until then, PyPI contains the ORRO product line through 0.2.22. This repository is
-the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`. The current
-engine lock pins witnessd 2.37.0 at tag `v2.37.0`, satisfying that dependency.
+the canonical 0.2.24 source, whose metadata declares `witnessd>=2.40.0,<3.0.0`. The current
+engine lock pins witnessd 2.40.0 at tag `v2.40.0`, satisfying that dependency.
diff --git a/docs/release-notes/0.2.23.md b/docs/release-notes/0.2.23.md
index 0f87ccf..6ebd217 100644
--- a/docs/release-notes/0.2.23.md
+++ b/docs/release-notes/0.2.23.md
@@ -1,10 +1,10 @@
-# ORRO 0.2.23
+# ORRO 0.2.24
 
-ORRO 0.2.23 advances the pinned engine pair used by the package and the
+ORRO 0.2.24 advances the pinned engine pair used by the package and the
 pinned-engine E2E metadata:
 
-- witnessd `2.37.0` at commit `8ab96fc588ba6b43e90bfddc1d88f1867b4916ae` (`v2.37.0`)
+- witnessd `2.40.0` at commit `8ab96fc588ba6b43e90bfddc1d88f1867b4916ae` (`v2.40.0`)
 - Depone `0.2.11` at commit `b471b47ceb8cc2460e7221375526f63553c18353` (`v0.2.11`)
 
-The package now requires `witnessd>=2.37.0,<3.0.0`, ensuring the documented
+The package now requires `witnessd>=2.40.0,<3.0.0`, ensuring the documented
 witnessd-delivered session surface is available.
diff --git a/docs/repository-strategy.md b/docs/repository-strategy.md
index 418fb5d..0ac9004 100644
--- a/docs/repository-strategy.md
+++ b/docs/repository-strategy.md
@@ -32,14 +32,14 @@ The release manifest and compatibility matrix are product/distribution
 metadata. They record which pinned engine pair has passed ORRO e2e CI, but they
 are not proof, not verifier truth, not approval, and not assurance. Engine-lock
 update process is intentional and PR-reviewed. The post-release target state is:
-`orro` 0.2.23 is published on PyPI. It becomes true only after `v0.2.23` is tagged
+`orro` 0.2.24 is published on PyPI. It becomes true only after `v0.2.24` is tagged
 and the Trusted-Publishing workflow completes; until then, PyPI contains the ORRO
-product line through 0.2.22. This repository is the canonical 0.2.23 source.
+product line through 0.2.22. This repository is the canonical 0.2.24 source.
 
 The packaging decision in `docs/packaging-decision.md` and
 `packaging/wrapper-package-plan.v0.json` is also product metadata, not package
 publish. It keeps the current command source ORRO-owned and subprocess-delegated
-to witnessd, declares `witnessd>=2.37.0,<3.0.0`, and requires the wrapper to contain no
+to witnessd, declares `witnessd>=2.40.0,<3.0.0`, and requires the wrapper to contain no
 engine code.
 
 The wrapper distribution smoke builds and installs a local wheel to verify
diff --git a/docs/thin-wrapper-plan.md b/docs/thin-wrapper-plan.md
index b91b314..3d27d79 100644
--- a/docs/thin-wrapper-plan.md
+++ b/docs/thin-wrapper-plan.md
@@ -1,9 +1,9 @@
 # Thin Wrapper Plan
 
-The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
-true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+The post-release target state is: `orro` 0.2.24 is published on PyPI. It becomes
+true only after `v0.2.24` is tagged and the Trusted-Publishing workflow completes;
 until then, PyPI contains the ORRO product line through 0.2.22. The ORRO repository
-is the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
+is the canonical 0.2.24 source, whose metadata declares `witnessd>=2.40.0,<3.0.0`.
 
 ## Current State
 
@@ -57,7 +57,7 @@ Depone verifies; witnessd executes; ORRO exposes the workflow.
 The packaging decision is recorded in `docs/packaging-decision.md` and
 `packaging/wrapper-package-plan.v0.json`. It is product metadata, not package
 publish. It records the published package reality, the ORRO-owned command, the
-`witnessd>=2.37.0,<3.0.0` dependency, and the requirement that the package contain no
+`witnessd>=2.40.0,<3.0.0` dependency, and the requirement that the package contain no
 engine code.
 
 The pinned-engine fallback is recorded in `docs/pinned-engine-fallback.md` and
diff --git a/docs/thin-wrapper.md b/docs/thin-wrapper.md
index 19a5f20..5ce80e6 100644
--- a/docs/thin-wrapper.md
+++ b/docs/thin-wrapper.md
@@ -46,10 +46,10 @@ the engine command the operator explicitly invoked. The wrapper only delegates.
 
 ## Relationship To Packaging
 
-The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
-true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+The post-release target state is: `orro` 0.2.24 is published on PyPI. It becomes
+true only after `v0.2.24` is tagged and the Trusted-Publishing workflow completes;
 until then, PyPI contains the ORRO product line through 0.2.22. This repository is
-the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
+the canonical 0.2.24 source, whose metadata declares `witnessd>=2.40.0,<3.0.0`.
 
 Package work must keep:
 
diff --git a/docs/wrapper-distribution.md b/docs/wrapper-distribution.md
index c7c46be..cd8a172 100644
--- a/docs/wrapper-distribution.md
+++ b/docs/wrapper-distribution.md
@@ -57,7 +57,7 @@ This is local distribution smoke only. It builds and installs a local wheel, but
 it does not publish a package, upload artifacts, create a marketplace release,
 or claim verifier truth.
 
-The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
-true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+The post-release target state is: `orro` 0.2.24 is published on PyPI. It becomes
+true only after `v0.2.24` is tagged and the Trusted-Publishing workflow completes;
 until then, PyPI contains the ORRO product line through 0.2.22. This repository is
-the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
+the canonical 0.2.24 source, whose metadata declares `witnessd>=2.40.0,<3.0.0`.
diff --git a/engine-lock/orro-e2e-engine-lock.json b/engine-lock/orro-e2e-engine-lock.json
index 87dd206..f77acf5 100644
--- a/engine-lock/orro-e2e-engine-lock.json
+++ b/engine-lock/orro-e2e-engine-lock.json
@@ -3,9 +3,9 @@
   "schema_version": "1.0",
   "witnessd": {
     "repository": "Moonweave-Systems/witnessd",
-    "commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
-    "version": "2.37.0",
-    "ref_name": "v2.37.0"
+    "commit": "c9559008427ab16a12a9002ffc27c434f8e5c6d6",
+    "version": "2.40.0",
+    "ref_name": "v2.40.0"
   },
   "depone": {
     "repository": "Moonweave-Systems/Depone",
diff --git a/packaging/plugin-manifest.draft.json b/packaging/plugin-manifest.draft.json
index 8ea84f2..b2ce83f 100644
--- a/packaging/plugin-manifest.draft.json
+++ b/packaging/plugin-manifest.draft.json
@@ -7,12 +7,12 @@
   "entrypoint_plan": {
     "current": "ORRO-owned orro console script delegating to witnessd",
     "compatibility_alias": "orro-wrapper",
-    "distribution": "orro 0.2.23 source package"
+    "distribution": "orro 0.2.24 source package"
   },
   "engine_dependencies": {
     "witnessd": {
       "repository": "Moonweave-Systems/witnessd",
-      "package_requirement": "witnessd>=2.37.0,<3.0.0"
+      "package_requirement": "witnessd>=2.40.0,<3.0.0"
     },
     "depone": "Moonweave-Systems/Depone"
   },
diff --git a/packaging/wrapper-package-plan.v0.json b/packaging/wrapper-package-plan.v0.json
index d79ea64..707915d 100644
--- a/packaging/wrapper-package-plan.v0.json
+++ b/packaging/wrapper-package-plan.v0.json
@@ -4,7 +4,7 @@
   "status": "release-candidate",
   "package_goal": "single user-facing ORRO install that prepares and invokes pinned Depone and witnessd engines",
   "distribution_name": "orro",
-  "source_version": "0.2.23",
+  "source_version": "0.2.24",
   "published_pypi_versions": [
     "0.0.1",
     "0.0.2",
@@ -60,7 +60,7 @@
     {
       "phase": "published-package",
       "status": "current",
-      "description": "Track the published ORRO product line through 0.2.22 and prepare source 0.2.23 for the tag-triggered Trusted-Publishing workflow.",
+      "description": "Track the published ORRO product line through 0.2.22 and prepare source 0.2.24 for the tag-triggered Trusted-Publishing workflow.",
       "contains_engine_logic": false
     }
   ],
@@ -68,7 +68,7 @@
     "witnessd": {
       "repository": "Moonweave-Systems/witnessd",
       "role": "execution engine",
-      "package_requirement": "witnessd>=2.37.0,<3.0.0"
+      "package_requirement": "witnessd>=2.40.0,<3.0.0"
     },
     "depone": {
       "repository": "Moonweave-Systems/Depone",
diff --git a/pyproject.toml b/pyproject.toml
index 58936d0..bd7280c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,11 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "orro"
-version = "0.2.23"
+version = "0.2.24"
 description = "Published ORRO product/distribution wrapper for pinned Depone and witnessd engines."
 readme = "README.md"
 requires-python = ">=3.10"
-dependencies = ["witnessd>=2.37.0,<3.0.0"]
+dependencies = ["witnessd>=2.40.0,<3.0.0"]
 
 [project.scripts]
 orro = "orro_wrapper.cli:main"
diff --git a/release/compatibility-matrix.v0.json b/release/compatibility-matrix.v0.json
index 9a93d7d..4b161d4 100644
--- a/release/compatibility-matrix.v0.json
+++ b/release/compatibility-matrix.v0.json
@@ -10,10 +10,10 @@
       "id": "depone-n-witnessd-n",
       "type": "engine-pair",
       "depone_commit": "b471b47ceb8cc2460e7221375526f63553c18353",
-      "witnessd_commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
+      "witnessd_commit": "c9559008427ab16a12a9002ffc27c434f8e5c6d6",
       "status": "pass",
       "notes": "Current locally validated engine pair; witnessd commit is published on the configured remote.",
-      "witnessd_version": "2.37.0"
+      "witnessd_version": "2.40.0"
     },
     {
       "id": "depone-n-witnessd-n-1",
@@ -34,14 +34,14 @@
     {
       "id": "orro-rc-locked-triplet",
       "type": "product-triplet",
-      "orro_commit": "95ec4c3ae0eb67aaac830ddfff82353ac28d4ef0",
+      "orro_commit": "f93f31fa09f5eb6133c508547f8e0f5e0636b930",
       "depone_commit": "b471b47ceb8cc2460e7221375526f63553c18353",
-      "witnessd_commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
+      "witnessd_commit": "c9559008427ab16a12a9002ffc27c434f8e5c6d6",
       "status": "pass",
       "engine_lock": "engine-lock/orro-e2e-engine-lock.json",
       "release_manifest": "release/orro-release-manifest.v0.json",
       "notes": "ORRO release-candidate base with the updated immutable engine triplet.",
-      "witnessd_version": "2.37.0"
+      "witnessd_version": "2.40.0"
     }
   ],
   "boundary": {
diff --git a/release/orro-release-manifest.v0.json b/release/orro-release-manifest.v0.json
index 6ac3d7f..fbd53ba 100644
--- a/release/orro-release-manifest.v0.json
+++ b/release/orro-release-manifest.v0.json
@@ -5,13 +5,13 @@
     "name": "ORRO",
     "full_name": "Observed Run & Review Orchestrator",
     "repository": "Moonweave-Systems/ORRO",
-    "commit": "95ec4c3ae0eb67aaac830ddfff82353ac28d4ef0"
+    "commit": "f93f31fa09f5eb6133c508547f8e0f5e0636b930"
   },
   "engines": {
     "witnessd": {
       "repository": "Moonweave-Systems/witnessd",
-      "commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
-      "version": "2.37.0",
+      "commit": "c9559008427ab16a12a9002ffc27c434f8e5c6d6",
+      "version": "2.40.0",
       "role": "execution engine"
     },
     "depone": {
diff --git a/scripts/check_orro_fallback_policy.py b/scripts/check_orro_fallback_policy.py
index 280e58f..4a0b8da 100644
--- a/scripts/check_orro_fallback_policy.py
+++ b/scripts/check_orro_fallback_policy.py
@@ -100,7 +100,7 @@ def check_docs() -> None:
     require_contains("fallback docs", text, "intentional engine-lock update PR")
     require_contains("fallback docs", text, "proofrun")
     require_contains("fallback docs", text, "proofcheck")
-    require_contains("fallback docs", text, "`orro` 0.2.23 is published on PyPI")
+    require_contains("fallback docs", text, "`orro` 0.2.24 is published on PyPI")
 
 
 def main() -> int:
diff --git a/scripts/check_orro_packaging_decision.py b/scripts/check_orro_packaging_decision.py
index ea78989..d03cd2f 100644
--- a/scripts/check_orro_packaging_decision.py
+++ b/scripts/check_orro_packaging_decision.py
@@ -17,7 +17,7 @@
 PLAN_PATH = ROOT / "packaging/wrapper-package-plan.v0.json"
 DOC_PATH = ROOT / "docs/packaging-decision.md"
 INVARIANT = "Depone verifies; witnessd executes; ORRO exposes the workflow"
-WITNESSD_REQUIREMENT = "witnessd>=2.37.0,<3.0.0"
+WITNESSD_REQUIREMENT = "witnessd>=2.40.0,<3.0.0"
 
 
 def fail(message: str) -> None:
@@ -67,8 +67,8 @@ def check_plan() -> None:
         fail("wrapper package plan status must be release-candidate")
     if plan.get("distribution_name") != "orro":
         fail("wrapper package plan distribution_name must be orro")
-    if plan.get("source_version") != "0.2.23":
-        fail("wrapper package plan source_version must be 0.2.23")
+    if plan.get("source_version") != "0.2.24":
+        fail("wrapper package plan source_version must be 0.2.24")
     if plan.get("current_command_source") != "ORRO-owned orro console script":
         fail("current command source must be ORRO-owned")
 
@@ -123,7 +123,7 @@ def check_docs() -> None:
     require_contains("packaging decision doc", text, "not package publish")
     require_contains("packaging decision doc", text, "witnessd-hosted")
     require_contains("packaging decision doc", text, "no engine code")
-    require_contains("packaging decision doc", text, "`orro` 0.2.23 is published on PyPI")
+    require_contains("packaging decision doc", text, "`orro` 0.2.24 is published on PyPI")
     require_contains("packaging decision doc", text, WITNESSD_REQUIREMENT)
     require_contains("packaging decision doc", text, "proofrun")
     require_contains("packaging decision doc", text, "proofcheck")
diff --git a/scripts/check_orro_release_state.py b/scripts/check_orro_release_state.py
index ca63e5e..7268276 100644
--- a/scripts/check_orro_release_state.py
+++ b/scripts/check_orro_release_state.py
@@ -334,30 +334,30 @@ def validate_release_state(state: dict[str, Any]) -> None:
 
 def self_test() -> int:
     parsed_version, parsed_requirement = parse_pyproject(
-        '[project]\nversion = "0.1.0"\ndependencies = [\n  "example>=1",\n  "witnessd>=2.37.0,<3.0.0",\n]\n'
+        '[project]\nversion = "0.1.0"\ndependencies = [\n  "example>=1",\n  "witnessd>=2.40.0,<3.0.0",\n]\n'
     )
     assert parsed_version == "0.1.0"
-    assert parsed_requirement == "witnessd>=2.37.0,<3.0.0"
+    assert parsed_requirement == "witnessd>=2.40.0,<3.0.0"
     base: dict[str, Any] = {
-        "pyproject_version": "0.2.23",
-        "setup_cfg_version": "0.2.23",
-        "pyproject_requirement": "witnessd>=2.37.0,<3.0.0",
-        "setup_cfg_requirement": "witnessd>=2.37.0,<3.0.0",
-        "package_plan_requirement": "witnessd>=2.37.0,<3.0.0",
-        "plugin_manifest_requirement": "witnessd>=2.37.0,<3.0.0",
+        "pyproject_version": "0.2.24",
+        "setup_cfg_version": "0.2.24",
+        "pyproject_requirement": "witnessd>=2.40.0,<3.0.0",
+        "setup_cfg_requirement": "witnessd>=2.40.0,<3.0.0",
+        "package_plan_requirement": "witnessd>=2.40.0,<3.0.0",
+        "plugin_manifest_requirement": "witnessd>=2.40.0,<3.0.0",
         "published_package": True,
         "published_package_scope": "product-line",
-        "engine_lock_witnessd_version": "2.37.0",
-        "engine_lock_witnessd_ref": "v2.37.0",
-        "manifest_witnessd_version": "2.37.0",
-        "package_plan_version": "0.2.23",
+        "engine_lock_witnessd_version": "2.40.0",
+        "engine_lock_witnessd_ref": "v2.40.0",
+        "manifest_witnessd_version": "2.40.0",
+        "package_plan_version": "0.2.24",
         "package_plan_status": "release-candidate",
         "package_plan_published_versions": ["0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21", "0.2.22"],
         "package_plan_published_package": True,
         "package_plan_published_package_scope": "product-line",
         "docs": {
             "README.md": (
-                "The post-release target state is: `orro` 0.2.23 is published on PyPI. "
+                "The post-release target state is: `orro` 0.2.24 is published on PyPI. "
                 "It becomes true only after Trusted Publishing completes."
             )
         },
@@ -369,7 +369,7 @@ def self_test() -> int:
         ("ambiguous wrapper publication scope", "published_package_scope", "source-version"),
         ("unsatisfied witnessd lock", "engine_lock_witnessd_version", "2.3.3"),
         ("witnessd lock at upper bound", "engine_lock_witnessd_version", "3.0.0"),
-        ("unbounded witnessd requirement", "pyproject_requirement", "witnessd>=2.37.0"),
+        ("unbounded witnessd requirement", "pyproject_requirement", "witnessd>=2.40.0"),
         (
             "mismatched package-plan witnessd requirement",
             "package_plan_requirement",
@@ -378,7 +378,7 @@ def self_test() -> int:
         (
             "mismatched plugin-manifest witnessd requirement",
             "plugin_manifest_requirement",
-            "witnessd>=2.37.0,<4.0.0",
+            "witnessd>=2.40.0,<4.0.0",
         ),
         ("mutable witnessd ref", "engine_lock_witnessd_ref", "main"),
         ("manifest version mismatch", "manifest_witnessd_version", "2.3.2"),
@@ -397,7 +397,7 @@ def self_test() -> int:
         (
             "unreleased source listed as published",
             "package_plan_published_versions",
-            ["0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21", "0.2.22", "0.2.23"],
+            ["0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21", "0.2.22", "0.2.24"],
         ),
         (
             "ambiguous package-plan publication scope",
@@ -413,7 +413,7 @@ def self_test() -> int:
             continue
         fail(f"self-test accepted forgery: {label}")
     forged_docs = copy.deepcopy(base)
-    forged_docs["docs"]["README.md"] = "`orro` 0.2.23 is published on PyPI."
+    forged_docs["docs"]["README.md"] = "`orro` 0.2.24 is published on PyPI."
     try:
         validate_release_state(forged_docs)
     except ReleaseStateError:
diff --git a/scripts/check_orro_repo_contract.py b/scripts/check_orro_repo_contract.py
index 74a9241..7325ea0 100644
--- a/scripts/check_orro_repo_contract.py
+++ b/scripts/check_orro_repo_contract.py
@@ -568,7 +568,7 @@ def check_release_discipline() -> None:
     require_contains("release docs", lower_text, "engine-lock update")
     require_contains("release docs", text, "not proof")
     require_contains("release docs", text, "not verifier truth")
-    require_contains("release docs", lower_text, "`orro` 0.2.23 is published on pypi")
+    require_contains("release docs", lower_text, "`orro` 0.2.24 is published on pypi")
 
 
 def check_os_support_matrix() -> None:
@@ -643,8 +643,8 @@ def check_packaging_decision() -> None:
     )
     require_contains("packaging decision docs", text, "packaging decision")
     require_contains("packaging decision docs", text, "not package publish")
-    require_contains("packaging decision docs", text, "`orro` 0.2.23 is published on PyPI")
-    require_contains("packaging decision docs", text, "witnessd>=2.37.0,<3.0.0")
+    require_contains("packaging decision docs", text, "`orro` 0.2.24 is published on PyPI")
+    require_contains("packaging decision docs", text, "witnessd>=2.40.0,<3.0.0")
     require_contains("packaging decision docs", text, "no engine code")
     require_contains("packaging decision docs", text, "witnessd-hosted")
     require_contains("packaging decision docs", text, INVARIANT)
diff --git a/scripts/check_orro_wrapper.py b/scripts/check_orro_wrapper.py
index 72572d7..0221f79 100644
--- a/scripts/check_orro_wrapper.py
+++ b/scripts/check_orro_wrapper.py
@@ -16,7 +16,7 @@
 PACKAGE_DIR = ROOT / "src/orro_wrapper"
 DOC_PATH = ROOT / "docs/thin-wrapper.md"
 INVARIANT = "Depone verifies; witnessd executes; ORRO exposes the workflow"
-WITNESSD_REQUIREMENT = "witnessd>=2.37.0,<3.0.0"
+WITNESSD_REQUIREMENT = "witnessd>=2.40.0,<3.0.0"
 
 
 def fail(message: str) -> None:
@@ -32,7 +32,7 @@ def require_contains(label: str, haystack: str, needle: str) -> None:
 def check_pyproject() -> None:
     text = PYPROJECT.read_text(encoding="utf-8")
     require_contains("pyproject.toml", text, 'name = "orro"')
-    require_contains("pyproject.toml", text, 'version = "0.2.23"')
+    require_contains("pyproject.toml", text, 'version = "0.2.24"')
     require_contains(
         "pyproject.toml", text, f'dependencies = ["{WITNESSD_REQUIREMENT}"]'
     )
@@ -43,7 +43,7 @@ def check_pyproject() -> None:
 def check_setup_cfg() -> None:
     text = SETUP_CFG.read_text(encoding="utf-8")
     require_contains("setup.cfg", text, "name = orro")
-    require_contains("setup.cfg", text, "version = 0.2.23")
+    require_contains("setup.cfg", text, "version = 0.2.24")
     require_contains("setup.cfg", text, WITNESSD_REQUIREMENT)
     require_contains("setup.cfg", text, "orro = orro_wrapper.cli:main")
     require_contains("setup.cfg", text, "orro-wrapper = orro_wrapper.cli:main")
diff --git a/setup.cfg b/setup.cfg
index eb61b0e..dc293ad 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = orro
-version = 0.2.23
+version = 0.2.24
 description = Published ORRO product/distribution wrapper for pinned Depone and witnessd engines.
 long_description = file: README.md
 long_description_content_type = text/markdown
@@ -11,7 +11,7 @@ package_dir =
 packages = find:
 python_requires = >=3.10
 install_requires =
-    witnessd>=2.37.0,<3.0.0
+    witnessd>=2.40.0,<3.0.0
 
 [options.packages.find]
 where = src