Changelog

v3.252.1 — 2026-08-12

Plugin

• /work Phase 2 exit now runs the TEST_GROUP shards the diff touches instead of the whole battery.
• /ship Phase 4 pinned to TEST_GROUP=all, named accurately (CI is the merge gate; Phase 4 is the last local checkpoint and the sole blocking gate for apps/web-platform/infra/), with rc=4 REFUSED added to its outcome enumeration.
• New conditional for projects with no CI-enforced full-suite gate, so self-hosted users keep today's behaviour.
• ADR-181's counted-DECLINE class folded into the reading contract — N/N is no longer the ordinary local green spelling.
• New guard plugins/soleur/test/fullsuite-merge-gate.test.ts, enrolled in the suite-integrity floor.
• ADR-183.

v3.252.0 — 2026-08-12

• fix(inngest): make the dedicated host's heartbeat prove :8288 instead of proving a timer fired

v3.251.0 — 2026-08-12

Registry host

• Ship zot container logs off soleur-registry to Better Stack Logs via a 5-minute cron one-shot, with a self-persisted journald cursor, fail-closed credential-header redaction, a rate cap that advances the cursor on decided rows, and a four-reason drop taxonomy.
• Raise the crash-class cap exemption to cover panic:, fatal error, runtime error and [signal, and drop RuntimeMaxUse=64M from the journald drop-in.

Architecture

• ADR-184 — the shipper: cron-vs-daemon reversibility argument and the cursor DELIVERED semantics.
• ADR-185 — registry user_data headroom policy: 8,000 B, single-sourced from the TS budget constant instead of a transcribed one-shot literal.

Tests

• zot-log-shipper.test.sh and test-zot-log-channel-probe.sh rebuilt on record-derived counters, a harness canary, and an EXIT-trap floor; new adversarial and non-vacuity fixtures.

v3.250.1 — 2026-08-12

• git-data's cloud-init template is now comment-stripped at render time, recovering ~30.5 kB of the 32,768 B Hetzner user_data cap
• The strip's magnitude and its application are both pinned by guards that mutation testing proves can fail
• The infra schema gate validates the document a host actually boots from, and fails closed when it cannot resolve the render wrap

Refs #7264. Found and filed: #7485, #7501. Split out: #7481. Deferred: #7460.

v3.250.0 — 2026-08-12

Plugin

• Install now uses a dedicated marketplace. claude plugin marketplace add jikig-ai/soleur-marketplace then claude plugin install soleur@soleur-marketplace. Installs the plugin subtree only (~10 MiB) instead of cloning the whole repository.
• Updates work again. Neither manifest carries a version key, so the CLI keys updates on the source commit SHA.
• The monorepo marketplace still works and is retained; it is demoted behind a disclosure that names the timeout, with --sparse .claude-plugin plugins as the mitigation (78 s at the default timeout, against 329 s plain).
• Removed a documented install command that does not exist: claude plugin install --url … returns unknown option '--url' on CLI 2.1.227. Both READMEs had documented it.
• Migration guidance for existing installs, including the orphaned-cache reclaim (~9.6 MiB survives uninstall + marketplace remove, with no CLI verb to reclaim it).
• The changelog FAQ no longer claims updates are automatic — false before this change and false after.

Web Platform

• Sentry cron monitor for the new drift check, so a schedule that stops firing is itself detectable.

Infra / CI

• jikig-ai/soleur-marketplace adopted into the existing infra/github/ Terraform root via an idempotent first-apply import.
• scheduled-marketplace-drift.yml — daily, unauthenticated, the sole control on a repo with no CI, no review and no CODEOWNERS.

v3.249.3 — 2026-08-12

Plugin

• /soleur:sync and /soleur:go now presence-guard every anchored producer invocation, emitting a named marker instead of dying on an unattributed interpreter error.
• The producer-missing message tells the operator what happened, that it is not their project, exactly which commands to run, what to do if those do not clear it, and what still succeeded — with a separate headless variant.
• ## Updating documentation added: updating the marketplace does not update an installed plugin, and the frozen 0.0.0-dev version sentinel means even plugin update may not converge a stale install.
• ADR-179 amended with Decision 7 (producer presence as a fourth precondition), recording that the guard is co-located rather than fail-closed-in-isolation, and why that trade is deliberate.

Web Platform

• WEDGE_RE now discriminates on source=probe-unreachable, so a probe that could not run is mirrored but not paged as a git wedge.

v3.249.2 — 2026-08-12

• fix(legal): eleven legal-corpus defects — dead guards, contradictions, and published-mirror under-disclosure

web-v0.253.0 — 2026-08-12

• fix(inngest): make the dedicated host's heartbeat prove :8288 instead of proving a timer fired

web-v0.252.0 — 2026-08-12

Registry host

• Ship zot container logs off soleur-registry to Better Stack Logs via a 5-minute cron one-shot, with a self-persisted journald cursor, fail-closed credential-header redaction, a rate cap that advances the cursor on decided rows, and a four-reason drop taxonomy.
• Raise the crash-class cap exemption to cover panic:, fatal error, runtime error and [signal, and drop RuntimeMaxUse=64M from the journald drop-in.

Architecture

• ADR-184 — the shipper: cron-vs-daemon reversibility argument and the cursor DELIVERED semantics.
• ADR-185 — registry user_data headroom policy: 8,000 B, single-sourced from the TS budget constant instead of a transcribed one-shot literal.

Tests

• zot-log-shipper.test.sh and test-zot-log-channel-probe.sh rebuilt on record-derived counters, a harness canary, and an EXIT-trap floor; new adversarial and non-vacuity fixtures.

web-v0.251.1 — 2026-08-12

• git-data's cloud-init template is now comment-stripped at render time, recovering ~30.5 kB of the 32,768 B Hetzner user_data cap
• The strip's magnitude and its application are both pinned by guards that mutation testing proves can fail
• The infra schema gate validates the document a host actually boots from, and fails closed when it cannot resolve the render wrap

Refs #7264. Found and filed: #7485, #7501. Split out: #7481. Deferred: #7460.

web-v0.251.0 — 2026-08-12

Plugin

• Install now uses a dedicated marketplace. claude plugin marketplace add jikig-ai/soleur-marketplace then claude plugin install soleur@soleur-marketplace. Installs the plugin subtree only (~10 MiB) instead of cloning the whole repository.
• Updates work again. Neither manifest carries a version key, so the CLI keys updates on the source commit SHA.
• The monorepo marketplace still works and is retained; it is demoted behind a disclosure that names the timeout, with --sparse .claude-plugin plugins as the mitigation (78 s at the default timeout, against 329 s plain).
• Removed a documented install command that does not exist: claude plugin install --url … returns unknown option '--url' on CLI 2.1.227. Both READMEs had documented it.
• Migration guidance for existing installs, including the orphaned-cache reclaim (~9.6 MiB survives uninstall + marketplace remove, with no CLI verb to reclaim it).
• The changelog FAQ no longer claims updates are automatic — false before this change and false after.

Web Platform

• Sentry cron monitor for the new drift check, so a schedule that stops firing is itself detectable.

Infra / CI

• jikig-ai/soleur-marketplace adopted into the existing infra/github/ Terraform root via an idempotent first-apply import.
• scheduled-marketplace-drift.yml — daily, unauthenticated, the sole control on a repo with no CI, no review and no CODEOWNERS.

web-v0.250.3 — 2026-08-12

Plugin

• /soleur:sync and /soleur:go now presence-guard every anchored producer invocation, emitting a named marker instead of dying on an unattributed interpreter error.
• The producer-missing message tells the operator what happened, that it is not their project, exactly which commands to run, what to do if those do not clear it, and what still succeeded — with a separate headless variant.
• ## Updating documentation added: updating the marketplace does not update an installed plugin, and the frozen 0.0.0-dev version sentinel means even plugin update may not converge a stale install.
• ADR-179 amended with Decision 7 (producer presence as a fourth precondition), recording that the guard is co-located rather than fail-closed-in-isolation, and why that trade is deliberate.

Web Platform

• WEDGE_RE now discriminates on source=probe-unreachable, so a probe that could not run is mirrored but not paged as a git wedge.

web-v0.250.2 — 2026-08-12

• fix(legal): eleven legal-corpus defects — dead guards, contradictions, and published-mirror under-disclosure

v3.249.1 — 2026-08-11

Test runner

• scripts/test-all.sh: suites can now be declined; declines are counted, named, and printed with a re-run command, and excluded from the pass numerator. Refuses a full-gate run under SOLEUR_SUBAGENT=1 (rc 4). Rename-aware diff detection (--name-status -M, so a rename SOURCE is visible). Exit-contract block updated.
• scripts/lib/test-relevance-paths.sh (new): the declared path predicates, as data.
• scripts/lib/test-contention.sh: adds tc_used_bytes, a per-mount used-bytes probe.
• scripts/lint-orphan-test-suites.sh: anti-rot checks over the predicate arrays.

Ship pipeline

• scripts/ship-incident-pir-gate.sh: boundary-guard prod and live in PROD_RE.

Docs and rules

• ADR-181 (new), ADR-133 addendum, ADR-177 addendum.
• cq-ac-must-not-depend-on-concurrent-sessions + plan-review standing check.
• Routed learnings into work, review, and architecture skills.

v3.249.0 — 2026-08-11

Plugin — skills

• /plan — new §2.12 Guard Contract Gate. When a deliverable includes a guard, gate, lint, drift-check or anti-vacuity control, the plan must declare per guard: (1) the property in one sentence, (2) the ASSEMBLY the property quantifies over — every code path, array, or file that contributes a member, and (3) a mutation matrix of ≥3 edits that must go RED. Members drift; assembly is structural. Field (2) is the one whose absence cost the five rounds.
• /plan templates — a ## Guard Contract section at all three detail levels in plan-issue-templates.md.
• /deepen-plan — new §4.11 Guard Contract Halt, conditional on a guard-shaped plan: halts when a guard entry carries a placeholder assembly or a matrix with fewer than three rows.
• /work — fix the CLASS, not the INSTANCE. When a finding says "X can be added at site A", enumerate all sites {A,B,C} before writing the fix. The mutation protocol validates a fix; it never tells you the fix's scope is right.
• /review — a structural-enumeration seat for guard-shaped PRs ("enumerate every path by which a mount / token / write reaches the sink") in place of N adversarial seats each finding one instance; plus a closure-assertion bullet and a fixture-cardinality bullet.
• /compound, /archive-kb — pointers recording that KB archival renames no longer need a secret-scan-allow-rename label.

New mechanical guards

• scripts/lint-guard-contract.py — validates ## Guard Contract sections: per guard entry, a non-placeholder assembly and a ≥3-row mutation matrix. 28/28, 7 mutation seams.
• scripts/lint-window-closure-assertion.py — a closure assertion (toEqual([…])) fed by a regex-extracted window helper must carry a per-helper // window-assembly: <name> — <justification> declaration. 24/24, 4 seams.
• scripts/rename-guard.test.sh — first-ever coverage for rename-guard.sh. 17/17, 5 seams.

Both new lints are wired into scripts/test-all.sh and both declare their residual limits in their docstrings rather than implying coverage they do not have.

Security

• apps/web-platform/scripts/rename-guard.sh — the allowlist→allowlist rename exemption, corrected from a boolean test to a scope-subset test, plus five closed evasions and fail-closed behaviour on an empty parser result.

Architecture

• ADR-180 — Guard Contract as a plan-time deliverable.

v3.248.12 — 2026-08-11

• /soleur:sync now runs on a customer repo for every area whose producer ships in the plugin payload, and refuses with a named reason instead of silently executing a same-named file from the customer's own tree for the one area that cannot.

v3.248.11 — 2026-08-11

Plugin

• Fixed: the session-state lock/lease library is now reachable from marketplace installs. It ships at plugins/soleur/scripts/lib/session-state.sh and resolves plugin-root-relative, so create acquires leases and cleanup-merged can reap on an installed user's machine for the first time.
• Fixed: ship, merge-pr, product-roadmap and schedule no longer wedge on a host without flock(1) — that case previously reported ">600s contention" on an uncontended lock and exited 1, forever.
• Fixed: pre-merge-rebase.sh no longer mis-extracts the PR number when a command contains more than one gh pr merge <number>, which made the review-evidence gate deny PRs that had evidence.
• Fixed: the manual-lease snippet in git-worktree documented the branch as the lease key; the reaper keys on the worktree directory slug, so a slash-bearing branch wrote no lease and said so only in a log file no agent reads.
• Added: a one-time dry pass the first time cleanup-merged can reap on a given store, so arming the reaper and exercising it are no longer the same event.
• Added: SOLEUR_WORKTREE_LEASE_LIB_OK (success signal, terminal-only) and SOLEUR_SESSION_STATE_UNAVAILABLE (mirrored; paged only at reason=worktree-UNLEASED-and-reapable).
• Added: ADR-178, recording where shared bash primitives live and how each consumer class resolves them.
• Coverage: two suites that had never gated CI now run — session-state.test.sh (34 KB, orphaned because shell globs do not cross /) and .claude/hooks/lib/freeze-lock.test.sh. Repo-wide, zero orphans remain in that class.

Web Platform

• SOLEUR_SESSION_STATE_UNAVAILABLE and SOLEUR_WORKTREE_REAPER_ARMED are mirrored by the git-lock marker telemetry, and its drift guard now derives SKILL.md from the skills directory — a SOLEUR_* sentinel authored in agent-executed prose was previously invisible to it forever.
• That widening is scoped to this telemetry's own domains (SOLEUR_GIT_ / SOLEUR_WORKTREE_ / SOLEUR_SESSION_STATE_). Unscoped, it demanded SOLEUR_PREFLIGHT_CHECK10_NOSANDBOX — preflight's sandbox diagnostic, landed by a sibling PR — be registered as a git-lock marker, which would have pressured the next author to mirror a foreign marker into telemetry nobody asked for just to get an unrelated PR green. The .sh half keeps its unscoped collection. Because a prefix filter can silently reduce the widening to a no-op and reopen the blindness while staying green, the SKILL.md scan is asserted non-empty; both directions are mutation-proven.

v3.248.10 — 2026-08-11

Test runner

• Third result class [KILLED] for signal-shaped suite exits; excluded from the failure count, named in a summary breakdown, surfaced as exit 3.
• run_suite now captures the suite exit code instead of testing it.
• Fail-closed handling for an unrecognized or aborting classifier: counted FAILED and warned, never silently passed.
• Declared wall-clock budgets, reported on the [KILLED] line.

Contention probe

• SIBLING_SUITE_DETECTED banner for worktrees running an individual suite. SIBLING_RUN_DETECTED semantics are byte-unchanged.
• Single /proc walk with ancestry/pgid cancellation, replacing a cwd set-difference that miscounted three measured ways.

Consumers

• main-health-monitor.yml: a killed run now names the terminated suite in the issue body, gets its own title/lede, per-arm Actions required that no longer prescribes a revert, and retitles + re-emits actions when commenting on an existing tracker.
• grok-pre-push-gate.sh: renders [UNRESOLVED] for exit 3 and forwards it, still non-zero.
• work / test-fix-loop / one-shot skills: taught that a killed suite is unresolved, not fixed. The test-fix-loop change is the sharpest — a suite that FAILED in iteration N and is KILLED in N+1 lowered the parsed count, which read as improvement, and the rebound in N+2 read as a regression triggering git reset --hard HEAD over real fixes.
• ADR-177 records the taxonomy, the 0/1/3 contract, and two real limits: exit 3 is top-level-only, and three wrappers absorb the signal shape so an OOM of the webplat vitest process still surfaces as [FAIL] (tracked as #7429).

v3.248.9 — 2026-08-11

• fix(security): follow-through verdicts must come from a repo member, not any GitHub user

v3.248.8 — 2026-08-11

Plugin

• plan: new pre-research phases 0.6b (mechanism minimality) and 0.6c (value-proposition measurement); Phase 1.7 now persists the Property List and Cut List into ## Research Insights.
• plan-review: the simplicity reviewer is prompted per mechanism against a requirement, not asked whether the plan is good.
• review: new design-risk signal on the Change Classification Gate that orders the panel (never shrinks it) with mandatory lens dedup; instrument-verification rule generalized to known-positive + known-negative.
• code-simplicity-reviewer: plan-review carve-out so ### Goal Verification runs instead of rendering N/A.
• test-design-reviewer: new "Auditing a Mutation Battery" section pointing at the canonical axis catalogue.

v3.248.7 — 2026-08-11

Infra test harness

• run-registered-suites.sh captures per-suite output and prints a bounded, marker-anchored excerpt on RED with rc, elapsed and start offset.
• Closes a false green: PASS + RED must equal the derived suite count; vanished suites are named UNACCOUNTED and their output dumped.
• Log dirs are reaped from the EXIT trap plus an age-reap of older siblings (ADR-133's reaper scopes to /tmp; this runner uses /var/tmp).
• New SOLEUR_INFRA_DIR / INFRA_ORPHAN_LIST test seams so fixtures never touch the live tree.
• credential-persist-home-guard.test.sh diffs against a frozen snapshot instead of the live source.

CI

• main-health-monitor.yml filters the diagnostic sentinel out of the public issue body, widens its anchor to name vanished suites, points the operator at the run log, and widens the redaction set.
• deploy-script-tests timeout re-derived 12 → 14 min (suite 3s → 67s).

Docs

• ADR-133 records two departures: this instrument is not observe-only (186 files/run), making it a confound for the very capacity hypothesis it measures; and the ships-ahead ordering was departed from while honouring the property that rule protects.

web-v0.250.1 — 2026-08-11

Test runner

• scripts/test-all.sh: suites can now be declined; declines are counted, named, and printed with a re-run command, and excluded from the pass numerator. Refuses a full-gate run under SOLEUR_SUBAGENT=1 (rc 4). Rename-aware diff detection (--name-status -M, so a rename SOURCE is visible). Exit-contract block updated.
• scripts/lib/test-relevance-paths.sh (new): the declared path predicates, as data.
• scripts/lib/test-contention.sh: adds tc_used_bytes, a per-mount used-bytes probe.
• scripts/lint-orphan-test-suites.sh: anti-rot checks over the predicate arrays.

Ship pipeline

• scripts/ship-incident-pir-gate.sh: boundary-guard prod and live in PROD_RE.

Docs and rules

• ADR-181 (new), ADR-133 addendum, ADR-177 addendum.
• cq-ac-must-not-depend-on-concurrent-sessions + plan-review standing check.
• Routed learnings into work, review, and architecture skills.

web-v0.250.0 — 2026-08-11

Infrastructure

• zot registry image pinned to v2.1.20 per arch, with an explicit version tag
• new zot-image-staleness.test.sh — 15 offline assertions, exit 0/10/2, anti-vacuity floor + positive control
• new zot-image-staleness-mutation.test.sh — 18 mutations, expected-rc + marker asserted, registered in CI
• new registry-userdata-budget.sh — offline templatefile()/base64gzip() byte measurement, no credentials
• new zot-image.provenance.md — config-compat analysis, non-adoption decisions, previous-known-good pin, bump procedure
• zot_image_digest added to the SOLEUR_ZOT_DISK heartbeat via the existing docker inspect

CI

• rule-audit.yml: upstream release poll + digest↔repository probe, one idempotent action-required issue
• infra-validation.yml: staleness gate, mutation battery, and a warn-only byte-budget job
• renovate.json5 removed

Docs

• ADR-096 "Pin freshness" amendment; projectZot added to the C4 model with its trust boundary
• zotRegistry corrected from cx33/7168m to cx23/derived 3072m

web-v0.249.9 — 2026-08-11

• fix(security): follow-through verdicts must come from a repo member, not any GitHub user

web-v0.249.8 — 2026-08-11

Plugin

• plan: new pre-research phases 0.6b (mechanism minimality) and 0.6c (value-proposition measurement); Phase 1.7 now persists the Property List and Cut List into ## Research Insights.
• plan-review: the simplicity reviewer is prompted per mechanism against a requirement, not asked whether the plan is good.
• review: new design-risk signal on the Change Classification Gate that orders the panel (never shrinks it) with mandatory lens dedup; instrument-verification rule generalized to known-positive + known-negative.
• code-simplicity-reviewer: plan-review carve-out so ### Goal Verification runs instead of rendering N/A.
• test-design-reviewer: new "Auditing a Mutation Battery" section pointing at the canonical axis catalogue.

web-v0.249.7 — 2026-08-11

Infra test harness

• run-registered-suites.sh captures per-suite output and prints a bounded, marker-anchored excerpt on RED with rc, elapsed and start offset.
• Closes a false green: PASS + RED must equal the derived suite count; vanished suites are named UNACCOUNTED and their output dumped.
• Log dirs are reaped from the EXIT trap plus an age-reap of older siblings (ADR-133's reaper scopes to /tmp; this runner uses /var/tmp).
• New SOLEUR_INFRA_DIR / INFRA_ORPHAN_LIST test seams so fixtures never touch the live tree.
• credential-persist-home-guard.test.sh diffs against a frozen snapshot instead of the live source.

CI

• main-health-monitor.yml filters the diagnostic sentinel out of the public issue body, widens its anchor to name vanished suites, points the operator at the run log, and widens the redaction set.
• deploy-script-tests timeout re-derived 12 → 14 min (suite 3s → 67s).

Docs

• ADR-133 records two departures: this instrument is not observe-only (186 files/run), making it a confound for the very capacity hypothesis it measures; and the ships-ahead ordering was departed from while honouring the property that rule protects.

web-v0.249.12 — 2026-08-11

• /soleur:sync now runs on a customer repo for every area whose producer ships in the plugin payload, and refuses with a named reason instead of silently executing a same-named file from the customer's own tree for the one area that cannot.

web-v0.249.11 — 2026-08-11

Plugin

• Fixed: the session-state lock/lease library is now reachable from marketplace installs. It ships at plugins/soleur/scripts/lib/session-state.sh and resolves plugin-root-relative, so create acquires leases and cleanup-merged can reap on an installed user's machine for the first time.
• Fixed: ship, merge-pr, product-roadmap and schedule no longer wedge on a host without flock(1) — that case previously reported ">600s contention" on an uncontended lock and exited 1, forever.
• Fixed: pre-merge-rebase.sh no longer mis-extracts the PR number when a command contains more than one gh pr merge <number>, which made the review-evidence gate deny PRs that had evidence.
• Fixed: the manual-lease snippet in git-worktree documented the branch as the lease key; the reaper keys on the worktree directory slug, so a slash-bearing branch wrote no lease and said so only in a log file no agent reads.
• Added: a one-time dry pass the first time cleanup-merged can reap on a given store, so arming the reaper and exercising it are no longer the same event.
• Added: SOLEUR_WORKTREE_LEASE_LIB_OK (success signal, terminal-only) and SOLEUR_SESSION_STATE_UNAVAILABLE (mirrored; paged only at reason=worktree-UNLEASED-and-reapable).
• Added: ADR-178, recording where shared bash primitives live and how each consumer class resolves them.
• Coverage: two suites that had never gated CI now run — session-state.test.sh (34 KB, orphaned because shell globs do not cross /) and .claude/hooks/lib/freeze-lock.test.sh. Repo-wide, zero orphans remain in that class.

Web Platform

• SOLEUR_SESSION_STATE_UNAVAILABLE and SOLEUR_WORKTREE_REAPER_ARMED are mirrored by the git-lock marker telemetry, and its drift guard now derives SKILL.md from the skills directory — a SOLEUR_* sentinel authored in agent-executed prose was previously invisible to it forever.
• That widening is scoped to this telemetry's own domains (SOLEUR_GIT_ / SOLEUR_WORKTREE_ / SOLEUR_SESSION_STATE_). Unscoped, it demanded SOLEUR_PREFLIGHT_CHECK10_NOSANDBOX — preflight's sandbox diagnostic, landed by a sibling PR — be registered as a git-lock marker, which would have pressured the next author to mirror a foreign marker into telemetry nobody asked for just to get an unrelated PR green. The .sh half keeps its unscoped collection. Because a prefix filter can silently reduce the widening to a no-op and reopen the blindness while staying green, the SKILL.md scan is asserted non-empty; both directions are mutation-proven.

web-v0.249.10 — 2026-08-11

Test runner

• Third result class [KILLED] for signal-shaped suite exits; excluded from the failure count, named in a summary breakdown, surfaced as exit 3.
• run_suite now captures the suite exit code instead of testing it.
• Fail-closed handling for an unrecognized or aborting classifier: counted FAILED and warned, never silently passed.
• Declared wall-clock budgets, reported on the [KILLED] line.

Contention probe

• SIBLING_SUITE_DETECTED banner for worktrees running an individual suite. SIBLING_RUN_DETECTED semantics are byte-unchanged.
• Single /proc walk with ancestry/pgid cancellation, replacing a cwd set-difference that miscounted three measured ways.

Consumers

• main-health-monitor.yml: a killed run now names the terminated suite in the issue body, gets its own title/lede, per-arm Actions required that no longer prescribes a revert, and retitles + re-emits actions when commenting on an existing tracker.
• grok-pre-push-gate.sh: renders [UNRESOLVED] for exit 3 and forwards it, still non-zero.
• work / test-fix-loop / one-shot skills: taught that a killed suite is unresolved, not fixed. The test-fix-loop change is the sharpest — a suite that FAILED in iteration N and is KILLED in N+1 lowered the parsed count, which read as improvement, and the rebound in N+2 read as a regression triggering git reset --hard HEAD over real fixes.
• ADR-177 records the taxonomy, the 0/1/3 contract, and two real limits: exit 3 is top-level-only, and three wrappers absorb the signal shape so an OOM of the webplat vitest process still surfaces as [FAIL] (tracked as #7429).

v3.248.6 — 2026-08-10

Plugin

• plan: new Phase 0.7 writes a skeleton plan file before the Phase 1 research fan-out; Phase 1.7 persists ## Research Insights in a single Edit; an interrupted run is continued in place rather than duplicated or overwritten.
• plan: filename derivation moves out of Step 2 into Phase 0.7 (one derivation site, before research). Save Tasks now stages the exact plan path with a :? guard instead of the plans/ directory.
• one-shot: plan-artifact recovery selects by frontmatter branch: (bounded, non-recursive, plans/archive/ excluded by construction) and branches on a single content predicate. Recovery runs at most once, then files an action-required issue.
• plan-issue-templates.md: documents the two-stage frontmatter lifecycle and drops the lane: pre-seeding that contradicted plan's own rule.
• Corrects a stale skill-description budget across brainstorm, plan, review, skill-creator, AGENTS.rules.md (injected into every session) and plugins/soleur/AGENTS.md: all asserted 1800 against a real cap of 2400. Each now names SKILL_DESCRIPTION_WORD_BUDGET rather than a literal. Also restores the correct ~2,500 agent-description figure that the first pass wrongly deleted.
• ADR-175 records the decision, including why the cursor was rejected.