diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c3c57a..b5d011f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,9 +50,9 @@ the engine generation, so it moves 0.14.1 → 0.15.0.
   use the same Microsoft.Extensions.AI client the engine standardized on. Same prompts, same
   temperatures, same behavior — but Desktop no longer depends on a framework the engine has
   removed. Snapshot recaps and note replies are the surfaces to sanity-check.
-- **Engine merge pin: `d9ad12a`** (engine 0.15.0), the merge commit from MandoCode CLI PR #79.
-  The large-root context guard is following in CLI PR #80; Desktop will move to that merge commit
-  before its PR lands so the reviewed host and engine stay together.
+- **Engine safety pin: `d084bbb`** (engine 0.15.0), the merge commit from MandoCode CLI PR #80.
+  This includes the full planner from PR #79 plus the large-root context guard verified through
+  Desktop against a real `@directory` request.
 
 ### Fixed
 - **Partial completion is no longer called a full success.** A plan that reaches the end after
diff --git a/MandoCode b/MandoCode
index d9ad12a..d084bbb 160000
--- a/MandoCode
+++ b/MandoCode
@@ -1 +1 @@
-Subproject commit d9ad12a0f10aae15538ca392a524c725cabc1145
+Subproject commit d084bbba6832eb8a3227132222246863e260dfdf