@adia-ai/adia-ui-forge 0.8.62 → 0.8.63

package/CHANGELOG.md

@@ -1,6 +1,31 @@
-# Changelog — adia-ui-kit-forge
+# Changelog, adia-ui-kit-forge
 
-## [0.8.62] — 2026-09-10
+## [0.8.63] — 2026-09-12
+
+### Changed
+
+- chore: accept release_gate G15 (harness overlay convention mismatch) per conductor ruling, file tickets 10035/10036 (ticket 10026) (#4403)
+- chore: bulk em dash removal across the plugin (em-dash-clean, 3059 findings), mechanical rewrite via sdlc's em_dash_sweep.py, no logic change (#4388)
+
+### Fixed
+
+- fix: add missing component-md-authoring row to the plugin README's skill inventory (release-gate G10) (#4387)
+
+### Docs
+
+- docs: updated the ssr-compatibility skill's failure-shapes/guard-patterns/test-without-linkedom reference docs so their quoted describe() names stay byte-identical to the renamed web-components test names, and removed a residual prose em dash (ticket 10029) (local ticket 10029)
+
+### Maintenance
+- **`.claude-plugin/plugin.json` version bump**: moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`): carried by the entries above.
+- **`agent-intents/` touched in this release window** (3 file(s), e.g. `agent-intents/a2ui-planner-agent.intent.md`): carried by the entries above.
+- **`agents/` touched in this release window** (14 file(s), e.g. `agents/a2ui-maintenance-agent.corpus.json`): carried by the entries above.
+- **`commands/` touched in this release window** (2 file(s), e.g. `commands/gen-ui-review.md`): carried by the entries above.
+- **`prompts/` touched in this release window** (2 file(s), e.g. `prompts/gen-ui-review.md`): carried by the entries above.
+- **`references/` touched in this release window** (3 file(s), e.g. `contracts/a2ui-mcp-surface.md`): carried by the entries above.
+- **`skills/` touched in this release window** (113 file(s), e.g. `a2ui-maintenance/SKILL.md`): carried by the entries above.
+
+## [0.8.62], 2026-09-10
 
 ### Changed
 - chore: .claude-plugin, .codex-plugin and plugin.yaml manifests stamped 0.8.62 with the lockstep bump; no skill or script change
@@ -10,7 +35,7 @@
 - **`.claude-plugin/plugin.json` version bump**: moves in lockstep with package.json (the `/plugin update` cache key).
 - **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`): carried by the entries above.
 
-## [0.8.61] — 2026-09-10
+## [0.8.61], 2026-09-10
 
 ### Changed
 
@@ -50,7 +75,7 @@
 - **`.claude-plugin/plugin.json` version bump**: moves in lockstep with package.json (the `/plugin update` cache key).
 - **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`): carried by the entries above.
 
-## [0.8.60] — 2026-09-06
+## [0.8.60], 2026-09-06
 
 ### Changed
 
@@ -72,46 +97,46 @@
 - docs: cut-procedure step 4a-pre notes the changes/gh-<issue>.md fragment form and how assembly credits it to the merging PR (gh#3638) (#3653)
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
-- **`references/` touched in this release window** (1 file(s), e.g. `contracts/a2ui-mcp-surface.md`) — carried by the entries above.
-- **`scripts/` touched in this release window** (1 file(s), e.g. `scripts/lint-rules.generated.mjs`) — carried by the entries above.
-- **`skills/` touched in this release window** (8 file(s), e.g. `references/pipeline-overview.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
+- **`references/` touched in this release window** (1 file(s), e.g. `contracts/a2ui-mcp-surface.md`), carried by the entries above.
+- **`scripts/` touched in this release window** (1 file(s), e.g. `scripts/lint-rules.generated.mjs`), carried by the entries above.
+- **`skills/` touched in this release window** (8 file(s), e.g. `references/pipeline-overview.md`), carried by the entries above.
 
-## [0.8.59] — 2026-09-04
+## [0.8.59], 2026-09-04
 
 ### Added
-- **`package-release`'s cut procedure gains Step 4a-pre: assemble `changes/<pr>.md` fragments into the right CHANGELOG's `[Unreleased]` before promotion (gh#2931).** New repo-root `scripts/release/assemble-changelog-fragments.mjs` (own selftest) reads every queued fragment, routes it to a package's own CHANGELOG (via an optional `(<package>)` parenthetical naming a `PACKAGE_ROSTER` entry) or the repo-root CHANGELOG.md (the plain, no-parenthetical form — every fragment filed to date), appends under the kind-mapped Keep-a-Changelog subsection (feature→Added, fix→Fixed, chore→Changed, docs→Docs), then deletes the consumed fragments. `references/cut-procedure.md` gains the new step (table row + detail + resume-path note); no new pre-cut roster gate — pending fragments are a normal between-PRs state, not a freshness defect a standing gate should flag.
+- **`package-release`'s cut procedure gains Step 4a-pre: assemble `changes/<pr>.md` fragments into the right CHANGELOG's `[Unreleased]` before promotion (gh#2931).** New repo-root `scripts/release/assemble-changelog-fragments.mjs` (own selftest) reads every queued fragment, routes it to a package's own CHANGELOG (via an optional `(<package>)` parenthetical naming a `PACKAGE_ROSTER` entry) or the repo-root CHANGELOG.md (the plain, no-parenthetical form, every fragment filed to date), appends under the kind-mapped Keep-a-Changelog subsection (feature→Added, fix→Fixed, chore→Changed, docs→Docs), then deletes the consumed fragments. `references/cut-procedure.md` gains the new step (table row + detail + resume-path note); no new pre-cut roster gate, pending fragments are a normal between-PRs state, not a freshness defect a standing gate should flag.
 
 ### Fixed
 - **`package-release` skill's `release-pack.mjs` rejects any `--substantive-packages`/`--stub-packages` name whose `scripts/package-paths.mjs` `PACKAGE_ROSTER` entry is unknown or `lockstep: false`, at parse time, before Step 1 runs (gh#2894).** The 0.8.58 cut passed `adia-plugins` (lockstep:false, gh#1133) in `--substantive-packages`, letting `promote-unreleased.mjs` rewrite that package's `[Unreleased]` header to a version it never ships; the cut only caught it at Step 5.6's unstaged-tracked-files guard, after the 34-gate pre-flight had already run. `selftest()` gains two new cases (a non-lockstep name, an unknown name); `references/cut-procedure.md` §Step 4a notes the guard.
-- fix: check-changelog-pr-gate.mjs refuses a direct package [Unreleased] edit — require a changes/<pr>.md fragment tagged (<package>) instead; validate every changes/*.md fragment's grammar unconditionally (kind, roster scope) rather than only on the coverage path; cut-procedure.md doc refresh (gh#3123, gh#3132) (#3148)
+- fix: check-changelog-pr-gate.mjs refuses a direct package [Unreleased] edit, require a changes/<pr>.md fragment tagged (<package>) instead; validate every changes/*.md fragment's grammar unconditionally (kind, roster scope) rather than only on the coverage path; cut-procedure.md doc refresh (gh#3123, gh#3132) (#3148)
 - fix: package-release's bump script now rewrites icons-cdn.js's PACKAGE_VERSION literal (the jsDelivr manifest-fallback URL pin, gh#3228) on every lockstep bump, alongside the existing .mcp.json/README pins (gh#3240) (#3250)
 
 ### Added
 - **`package-release`'s pre-cut roster gains gate 36 (gh#2912, plan-top-priority-verification.md item 4): `npm run check:treeshake`, the single-import build matrix (esbuild+rollup) over 10 representative `@adia-ai/web-components` components.** `gate-roster.mjs` appended (identities never renumber); `references/cut-procedure.md` §3.1 transcribed to match. See the root CHANGELOG and gh#2912's PR body for what the gate checks and its current known-red cells.
-- **`package-release` skill's pre-cut roster gains gate 37, `check:lint-efficacy` (gh#2911)** — the repo root's new seeded-violation/false-positive/mutation-hardening lint-bank gate (`scripts/verify/check-lint-efficacy.mjs`, not itself part of this package). `gate-roster.mjs` and `references/cut-procedure.md` §3.1 both updated; not wired into `npm run check` (the false-positive sweep alone measured ~100s, over the 60s bar — see repo-root CHANGELOG.md for the gate's own detail).
+- **`package-release` skill's pre-cut roster gains gate 37, `check:lint-efficacy` (gh#2911)**, the repo root's new seeded-violation/false-positive/mutation-hardening lint-bank gate (`scripts/verify/check-lint-efficacy.mjs`, not itself part of this package). `gate-roster.mjs` and `references/cut-procedure.md` §3.1 both updated; not wired into `npm run check` (the false-positive sweep alone measured ~100s, over the 60s bar, see repo-root CHANGELOG.md for the gate's own detail).
 
 ### Changed
-- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated after gh#2939's EXAMPLE-PROP-CONTRACT `data-*` exemption and GENUI-DOC-CONFLICT self-scope fix landed in the shared rule sources.** Derived-only, no source change in this package; the vendored bank picks up both predicate narrowings — full-corpus warn count 1413 → 1410 (see repo-root CHANGELOG.md for the gate's own detail).
-- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated after gh#2937's `tagTree()` memoization landed in `scripts/lint/engine/primitives.mjs` (root).** Derived-only, no source change in this package; the vendored bank picks up the shared engine's single-slot memo, so the 48 generated `COMPOSITION-*` rules now share one tag-tree parse per file instead of each re-parsing it — full golden-corpus `check:lint-efficacy`: 110.9s → 9.45s. Byte-identical rule semantics (38/38 seeded-fixture catch rate, 0 error-severity across 438 files, unchanged).
+- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated after gh#2939's EXAMPLE-PROP-CONTRACT `data-*` exemption and GENUI-DOC-CONFLICT self-scope fix landed in the shared rule sources.** Derived-only, no source change in this package; the vendored bank picks up both predicate narrowings, full-corpus warn count 1413 → 1410 (see repo-root CHANGELOG.md for the gate's own detail).
+- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated after gh#2937's `tagTree()` memoization landed in `scripts/lint/engine/primitives.mjs` (root).** Derived-only, no source change in this package; the vendored bank picks up the shared engine's single-slot memo, so the 48 generated `COMPOSITION-*` rules now share one tag-tree parse per file instead of each re-parsing it, full golden-corpus `check:lint-efficacy`: 110.9s → 9.45s. Byte-identical rule semantics (38/38 seeded-fixture catch rate, 0 error-severity across 438 files, unchanged).
 - **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated to carry `enum_meta` tier data for gh#2831 batch 2's 9 components** (feed-item-ui, inline-message-ui, link-ui, loading-overlay-ui, mark-ui, menu-item-ui, nav-group-ui, nav-item-ui, nav-ui). Derived-only, no source change in this package; the vendored bank follows the yaml `enum_meta` authored in `@adia-ai/web-components`.
 - **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated to carry `enum_meta` tier data for gh#2831 batch 3's 13 components** (pagination-ui, preview-ui, rating-ui, select-ui, shader-texture-ui, spinner-ui, table-toolbar-ui, tabs-ui, tag-ui, text-ui, timeline-item-ui, toast-ui, toggle-scheme-ui). Derived-only, no source change in this package; the vendored bank follows the yaml `enum_meta` authored in `@adia-ai/web-components`. Closes the 31-component sweep (gh#2831).
 - chore: cut-procedure.md §Step 3 cross-references the new read-only preflight-dry-run.mjs runner as the no-cut alternative to a real release pre-flight (gh#3063) (#3203)
-- chore: demo-audit mode 5 now censuses `<chat-shell>` / `<editor-shell>` anatomy alongside `<admin-shell>` — closes the blind spot where `apps/genui` (chat-shell + editor-shell only, no admin-shell) was never mechanically swept (gh#3207) (#3207)
+- chore: demo-audit mode 5 now censuses `<chat-shell>` / `<editor-shell>` anatomy alongside `<admin-shell>`, closes the blind spot where `apps/genui` (chat-shell + editor-shell only, no admin-shell) was never mechanically swept (gh#3207) (#3207)
 
 ### Docs
 
-- docs: a2ui-maintenance pipeline-overview names registry.js as Class R (gh#3055) — new components enter through their yaml, aliases through registry.exceptions.json, never a hand edit (#3194)
+- docs: a2ui-maintenance pipeline-overview names registry.js as Class R (gh#3055), new components enter through their yaml, aliases through registry.exceptions.json, never a hand edit (#3194)
 - docs: add admin-roster-ui and table-toolbar-ui rows to demo-audit's app-shell-pitfalls.md composite table, and document audit-app-shells.mjs's new --playgrounds flag (gh#3197) (#3214)
 - docs: repair stale check:component-md-fresh PR-blocking claims in component-md-authoring skill (gh#3223) (#3226)
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
-- **`skills/` touched in this release window** (11 file(s), e.g. `references/pipeline-overview.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
+- **`skills/` touched in this release window** (11 file(s), e.g. `references/pipeline-overview.md`), carried by the entries above.
 
-## [0.8.58] — 2026-09-02
+## [0.8.58], 2026-09-02
 ### Fixed
 - **`forge-lint.mjs`'s PostToolUse hook gains a `timeout: 90` key (gh#2709), matching its Python siblings (`sidecar-prewrite-guard`, `release-pretag-docs-gate`) that already carry one.** Both `hooks.json` and the derived `adapters/claude/hooks.json` mirror updated.
 - **ATTR-TYPO/LLM-KEY-IN-CLIENT/NATIVE-PRIMITIVE matcher hardening (gh#2708)**, propagated to this plugin's vendored `scripts/lint-rules.generated.mjs` via `npm run build:lint-rules`, byte-identical to the shared lint-rule bank, no change to `forge-lint`'s own hook contract.
@@ -138,35 +163,35 @@
 - **Author email in `package.json` updated to `kim.granlund@adia.ai`** (was a stale personal address).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
-- **`skills/` touched in this release window** (13 file(s), e.g. `references/pipeline-overview.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
+- **`skills/` touched in this release window** (13 file(s), e.g. `references/pipeline-overview.md`), carried by the entries above.
 
-## [0.8.57] — 2026-09-01
+## [0.8.57], 2026-09-01
 
 ### Removed
 - **`package-release`'s release-roster gate 19 (`verify:site-a2ui`) retired with the site-a2ui mechanism itself (ADR-0072 Decision 2, gh#2410 active drain).** `gate-roster.mjs` drops the gate 19 entry (33 gates → 32; gate number left unassigned rather than renumbering 20+, per the roster's own no-renumber discipline for gate identities cited in shipped release notes); `cut-procedure.md` §3.1's transcription and its `.examples.html`-generator trigger prose updated to match. The `site-postwrite-derivation-gate` hook's fragment-staleness half (the site-a2ui regeneration nudge) is removed; its sitemap-staleness half (`site/sitemap.json` → `build:llms`/`build:patterns-index`), unrelated to site-a2ui, is unchanged. `a2ui-maintenance`'s `pipeline-overview.md` and `site-docs-authoring`'s `SKILL.md`/`primitive-authoring`'s `yaml-contract.md` no longer instruct regenerating a compiled A2UI artifact that no longer exists.
 
 ### Fixed
-- **Plugin passes `author-cross-harness-plugins`'s cross-harness validator, modulo one documented, permanent, irreconcilable exception (gh#2668).** `${CLAUDE_PLUGIN_ROOT}`/`$ARGUMENTS`/the `` !`command` `` auto-injection syntax removed from shared `gen-ui-review/SKILL.md`, the four `commands/*.md` bodies, and their linked reference docs (`demo-audit/references/visual-probe-triage.md`, `package-release/references/{cut-procedure,changelog-discipline,gates-catalog,recovery-paths}.md`, `gen-ui-review/references/loop-protocol.md`) — portable `<plugin-root>` prose / "named in the current request" phrasing throughout; command frontmatter, including `package-release`/`site-deployment`'s deliberate `disable-model-invocation: true` (AGENTS.md-ruled), is untouched since the validator never scans command frontmatter. `hooks/hooks.json` moved to `adapters/claude/hooks.json` (unchanged, `${CLAUDE_PLUGIN_ROOT}`-based); new root `hooks.json` mirrors the same event/matcher/action signature with monorepo-root-relative command paths for Codex's convention-discovered hook surface — an unverified-but-honest fallback documented in `HARNESS-NOTES.md`. **The one exception:** every skill's `disable-model-invocation:`/`user-invocable:` frontmatter — required, explicitly, by this repo's own blocking `check:skills` gate (`plugin-estate-v2.md`'s species-pinning charter) — collides head-on with the validator's opposite requirement on the exact same file, and Codex is hard-pinned to read root `skills/` directly (no adapter escape). The repo's own charter is not weakened; `npm run check:cross-harness-plugins` (`scripts/verify/check-cross-harness-plugins.mjs`, wrapping the vendored `scripts/verify/vendor/validate_cross_harness.py`) treats only this one exact finding shape as accepted (logged as INFO) and still fails on every other portability class. Full reasoning in `HARNESS-NOTES.md`.
+- **Plugin passes `author-cross-harness-plugins`'s cross-harness validator, modulo one documented, permanent, irreconcilable exception (gh#2668).** `${CLAUDE_PLUGIN_ROOT}`/`$ARGUMENTS`/the `` !`command` `` auto-injection syntax removed from shared `gen-ui-review/SKILL.md`, the four `commands/*.md` bodies, and their linked reference docs (`demo-audit/references/visual-probe-triage.md`, `package-release/references/{cut-procedure,changelog-discipline,gates-catalog,recovery-paths}.md`, `gen-ui-review/references/loop-protocol.md`), portable `<plugin-root>` prose / "named in the current request" phrasing throughout; command frontmatter, including `package-release`/`site-deployment`'s deliberate `disable-model-invocation: true` (AGENTS.md-ruled), is untouched since the validator never scans command frontmatter. `hooks/hooks.json` moved to `adapters/claude/hooks.json` (unchanged, `${CLAUDE_PLUGIN_ROOT}`-based); new root `hooks.json` mirrors the same event/matcher/action signature with monorepo-root-relative command paths for Codex's convention-discovered hook surface, an unverified-but-honest fallback documented in `HARNESS-NOTES.md`. **The one exception:** every skill's `disable-model-invocation:`/`user-invocable:` frontmatter, required, explicitly, by this repo's own blocking `check:skills` gate (`plugin-estate-v2.md`'s species-pinning charter), collides head-on with the validator's opposite requirement on the exact same file, and Codex is hard-pinned to read root `skills/` directly (no adapter escape). The repo's own charter is not weakened; `npm run check:cross-harness-plugins` (`scripts/verify/check-cross-harness-plugins.mjs`, wrapping the vendored `scripts/verify/vendor/validate_cross_harness.py`) treats only this one exact finding shape as accepted (logged as INFO) and still fails on every other portability class. Full reasoning in `HARNESS-NOTES.md`.
 
 ### Changed
-- **`forge-lint` rewritten as a thin Node CLI (`forge-lint.mjs`) consuming a shared generated lint-rule bank, retiring the Python script (gh#2638, LLD-0016, ADR-0099).** The framework-authoring structural checks (SHADOW-DOM, SLOTTED, RAW-COLOR, RAW-PX, SCOPE-EXTENT, DEAD-FONT-TOKEN, BOOL-DEFAULT-TRUE, ATTR-TYPO, NATIVE-PRIMITIVE, LEGACY-SHELL, MISSING-SCOPE) now live as individually-fixtured rule modules under `scripts/lint/rules/` in the repo root, built into `scripts/lint/generated/rule-bank.mjs` and vendored byte-identically into this plugin, `adia-ui-factory`, and the gen-ui MCP's factory vendor tree (`npm run build:lint-rules`, freshness gated by `npm run check:lint-rules-fresh`). `hooks/hooks.json`'s PostToolUse command changes from `python3 ".../forge-lint" --hook` to `node ".../forge-lint.mjs" --hook`; the CLI contract, exit codes, and PostToolUse never-block invariant are unchanged. `npm run check:lint-rules-selftest` proves finding-parity against the retired script's own `selftest()` fixtures. New `npm run lint` (`scripts/lint/lint-repo.mjs`) runs the full bank against every git-tracked lintable file — standalone for now, not yet wired into `npm run check` (a first repo-wide run surfaced 330 error-severity pre-existing findings that need triage first — gh#2646). The suppression comment (`/* adia-lint-disable <rule-id> — <reason> */`) is now load-bearing, not cosmetic: it drops the matching finding, and a bare disable with no reason is itself a finding (`SUPPRESS-NO-REASON`).
+- **`forge-lint` rewritten as a thin Node CLI (`forge-lint.mjs`) consuming a shared generated lint-rule bank, retiring the Python script (gh#2638, LLD-0016, ADR-0099).** The framework-authoring structural checks (SHADOW-DOM, SLOTTED, RAW-COLOR, RAW-PX, SCOPE-EXTENT, DEAD-FONT-TOKEN, BOOL-DEFAULT-TRUE, ATTR-TYPO, NATIVE-PRIMITIVE, LEGACY-SHELL, MISSING-SCOPE) now live as individually-fixtured rule modules under `scripts/lint/rules/` in the repo root, built into `scripts/lint/generated/rule-bank.mjs` and vendored byte-identically into this plugin, `adia-ui-factory`, and the gen-ui MCP's factory vendor tree (`npm run build:lint-rules`, freshness gated by `npm run check:lint-rules-fresh`). `hooks/hooks.json`'s PostToolUse command changes from `python3 ".../forge-lint" --hook` to `node ".../forge-lint.mjs" --hook`; the CLI contract, exit codes, and PostToolUse never-block invariant are unchanged. `npm run check:lint-rules-selftest` proves finding-parity against the retired script's own `selftest()` fixtures. New `npm run lint` (`scripts/lint/lint-repo.mjs`) runs the full bank against every git-tracked lintable file, standalone for now, not yet wired into `npm run check` (a first repo-wide run surfaced 330 error-severity pre-existing findings that need triage first, gh#2646). The suppression comment (`/* adia-lint-disable <rule-id>, <reason> */`) is now load-bearing, not cosmetic: it drops the matching finding, and a bare disable with no reason is itself a finding (`SUPPRESS-NO-REASON`).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
-- **`prompts/` touched in this release window** (4 file(s), e.g. `prompts/demo-audit.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
+- **`prompts/` touched in this release window** (4 file(s), e.g. `prompts/demo-audit.md`), carried by the entries above.
 
-## [0.8.56] — 2026-08-31
+## [0.8.56], 2026-08-31
 
 ### Added
-- **New `component-md-authoring` skill (gh#2615).** Authors the two judgment sections of a component's `component.md` — Screen-reader spec and Behavioral spec — typed directly into the yaml's new `screenReader:`/`behavioral:` fields (component.md itself is a generated shell, never hand-edited). Sits next to `primitive-authoring` in `packages/plugins/adia-ui-forge/skills/`; Codex (`agents/openai.yaml`) and Hermes/Pi (`__init__.py`) manifests regenerated to register it.
-- **`primitive-authoring`'s `yaml-contract.md` gains a semantic-id grammar for `examples[].a2ui` component ids (gh#2492 Phase 1).** The `.claude/docs/specs/a2ui-editor.md:170` "free-form" id convention was written for editor-generated ids only, not authored yaml examples — reading it as license for both produced a corpus-wide drift toward cryptic, positional ids (`q`, `k1`, `k1v`) reported against `blockquote.yaml`, `badge.yaml`, `aside.yaml`, `alert.yaml`, and `anchor-bar.yaml`. New `## examples: field` section documents the grammar (kebab-case, role-descriptive, unique per example, a short-real-word root/wrapper exception) with before/after examples; `a2ui-editor.md:170` amended to scope its own claim to editor-generated ids and cross-reference the new grammar. Phase 2 (a separate dispatch) sweeps the corpus to match.
-- **Phase 2 (gh#2492): the corpus-wide sweep landed and `check-example-ids.mjs` flips from advisory to `npm run check:example-ids:strict` in the `npm run check` chain.** 526 violations across 48 yamls (`packages/web-components`, `packages/web-modules`) renamed to the Phase 1 grammar — see `packages/web-components/CHANGELOG.md` and `packages/web-modules/CHANGELOG.md` for the file list. `yaml-contract.md`'s `## examples: field` section updated to describe the gate as enforced, plus a noted known gap (the checker's positional regex doesn't catch a `letter-digit-letter-digit` chain like `g1i1`, out of scope for this sweep since nothing flagged it). `check-example-ids.mjs` itself gained an entrypoint guard (`if (import.meta.url === ...)`) — the CLI's `main()` was running as a side effect of importing `checkExampleIds` as a library function, which the sweep tooling does.
+- **New `component-md-authoring` skill (gh#2615).** Authors the two judgment sections of a component's `component.md`, Screen-reader spec and Behavioral spec, typed directly into the yaml's new `screenReader:`/`behavioral:` fields (component.md itself is a generated shell, never hand-edited). Sits next to `primitive-authoring` in `packages/plugins/adia-ui-forge/skills/`; Codex (`agents/openai.yaml`) and Hermes/Pi (`__init__.py`) manifests regenerated to register it.
+- **`primitive-authoring`'s `yaml-contract.md` gains a semantic-id grammar for `examples[].a2ui` component ids (gh#2492 Phase 1).** The `.claude/docs/specs/a2ui-editor.md:170` "free-form" id convention was written for editor-generated ids only, not authored yaml examples, reading it as license for both produced a corpus-wide drift toward cryptic, positional ids (`q`, `k1`, `k1v`) reported against `blockquote.yaml`, `badge.yaml`, `aside.yaml`, `alert.yaml`, and `anchor-bar.yaml`. New `## examples: field` section documents the grammar (kebab-case, role-descriptive, unique per example, a short-real-word root/wrapper exception) with before/after examples; `a2ui-editor.md:170` amended to scope its own claim to editor-generated ids and cross-reference the new grammar. Phase 2 (a separate dispatch) sweeps the corpus to match.
+- **Phase 2 (gh#2492): the corpus-wide sweep landed and `check-example-ids.mjs` flips from advisory to `npm run check:example-ids:strict` in the `npm run check` chain.** 526 violations across 48 yamls (`packages/web-components`, `packages/web-modules`) renamed to the Phase 1 grammar, see `packages/web-components/CHANGELOG.md` and `packages/web-modules/CHANGELOG.md` for the file list. `yaml-contract.md`'s `## examples: field` section updated to describe the gate as enforced, plus a noted known gap (the checker's positional regex doesn't catch a `letter-digit-letter-digit` chain like `g1i1`, out of scope for this sweep since nothing flagged it). `check-example-ids.mjs` itself gained an entrypoint guard (`if (import.meta.url === ...)`): the CLI's `main()` was running as a side effect of importing `checkExampleIds` as a library function, which the sweep tooling does.
 
 ### Fixed
-- **`package-release`'s Step 5 staging allowlist was missing the factory README's own prose echo of the generation-MCP pin — bump.mjs's `A2UI_MCP_PIN` rewrites both `adia-ui-factory/.mcp.json` and its README, but Step 5 only ever staged `.mcp.json`, so the README edit rode uncommitted through every cut (gh#2473).** `release-pack.mjs`'s Step 5 now also stages `packages/plugins/adia-ui-factory/README.md`. Added a new Step 5.6 unstaged-tracked-files guard right after staging (numbered 5.6, not 5.5 — `cut-procedure.md`'s own §Step 5.5 already names a different, pre-existing manual freshness trip-wire): it fails the cut loudly if any tracked file bump.mjs or a cut-hygiene step touched is still modified-in-the-worktree after Step 5's allowlist ran, so the next allowlist gap is caught at cut time instead of discovered by hand later. `selftest` extended with a direct unit test of the new `unstagedTrackedLeftovers()` parser (plain modifies/deletes, staged-only and untracked exclusions, C-quoted paths, rename/copy new-side reporting) plus a marker asserting the guard's `--dry` code path runs.
+- **`package-release`'s Step 5 staging allowlist was missing the factory README's own prose echo of the generation-MCP pin, bump.mjs's `A2UI_MCP_PIN` rewrites both `adia-ui-factory/.mcp.json` and its README, but Step 5 only ever staged `.mcp.json`, so the README edit rode uncommitted through every cut (gh#2473).** `release-pack.mjs`'s Step 5 now also stages `packages/plugins/adia-ui-factory/README.md`. Added a new Step 5.6 unstaged-tracked-files guard right after staging (numbered 5.6, not 5.5, `cut-procedure.md`'s own §Step 5.5 already names a different, pre-existing manual freshness trip-wire): it fails the cut loudly if any tracked file bump.mjs or a cut-hygiene step touched is still modified-in-the-worktree after Step 5's allowlist ran, so the next allowlist gap is caught at cut time instead of discovered by hand later. `selftest` extended with a direct unit test of the new `unstagedTrackedLeftovers()` parser (plain modifies/deletes, staged-only and untracked exclusions, C-quoted paths, rename/copy new-side reporting) plus a marker asserting the guard's `--dry` code path runs.
 
 ### Changed
 - **`package-release`: gate 4 retries once on host-contention timeout (Mode A, gh#2195, #2362)**; `cut-procedure.md` fails fast on a pnpm-shaped `node_modules` in Step 1 and adds Step 12 (restore the pnpm dev layout after a cut) (#2197, #2202); `gates-catalog.md` follows.
@@ -175,67 +200,67 @@
 - **`HARNESS-NOTES.md`** pointer for non-Claude harnesses (gh#2449).
 
 ### Fixed
-- **`generate-release-notes.mjs` (gh#2474): two bugs found and hand-fixed live during the v0.8.56 cut, now fixed at the source.** (1) When a CHANGELOG `[X.Y.Z]` section carries two same-named `### Changed`/`### Fixed` blocks (one at cut time, another added by a later hand-fix), the generator now merges them into one heading in first-occurrence order before demoting to `####` — the duplicate `####` heading that tripped CodeRabbit's MD024 (db13eaebb) can't recur. (2) The Slack post's per-package headline now prefers a bullet starting with `- **BREAKING` over document order, falling back to the first bullet only when none is BREAKING (b378b5fd9). Added `mergeDuplicateHeadings()`, unit coverage in `scripts/release/generate-release-notes.test.js`, and `selftest` regression cases for both. `scripts/release/generate-release-notes.mjs`.
+- **`generate-release-notes.mjs` (gh#2474): two bugs found and hand-fixed live during the v0.8.56 cut, now fixed at the source.** (1) When a CHANGELOG `[X.Y.Z]` section carries two same-named `### Changed`/`### Fixed` blocks (one at cut time, another added by a later hand-fix), the generator now merges them into one heading in first-occurrence order before demoting to `####`, the duplicate `####` heading that tripped CodeRabbit's MD024 (db13eaebb) can't recur. (2) The Slack post's per-package headline now prefers a bullet starting with `- **BREAKING` over document order, falling back to the first bullet only when none is BREAKING (b378b5fd9). Added `mergeDuplicateHeadings()`, unit coverage in `scripts/release/generate-release-notes.test.js`, and `selftest` regression cases for both. `scripts/release/generate-release-notes.mjs`.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
-- **`skills/` touched in this release window** (14 file(s), e.g. `a2ui-maintenance/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
+- **`skills/` touched in this release window** (14 file(s), e.g. `a2ui-maintenance/SKILL.md`), carried by the entries above.
 
-## [0.8.55] — 2026-08-28
+## [0.8.55], 2026-08-28
 
 ### Changed
-- **`.codex-plugin/` regenerated for the release window** — `.codex-plugin/plugin.json`'s embedded `version` moves with the lockstep bump (derived from `.claude-plugin/plugin.json`, not an independent edit).
+- **`.codex-plugin/` regenerated for the release window**, `.codex-plugin/plugin.json`'s embedded `version` moves with the lockstep bump (derived from `.claude-plugin/plugin.json`, not an independent edit).
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.55 work shipped in button-ui flex-shrink:0 default fix (gh#2180/gh#2181). See `packages/web-components/CHANGELOG.md#0855--2026-08-28` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.54] — 2026-08-27
+## [0.8.54], 2026-08-27
 
 ### Fixed
-- **`package-release`'s cut pipeline was missing a post-bump regen step for both plugins' Hermes/Pi manifest tree — the same gap gh#1899 already closed for the Codex tree (discovered live during the v0.8.53 release PR #2138: it shipped stale `plugin.yaml`/`__init__.py`, caught by CI's `check:harness-manifests-fresh` and fixed by hand on the release branch).** `release-pack.mjs`'s Step 4 now runs `scripts/build/harness-manifests.mjs` after the version bump and verifies with `npm run check:harness-manifests-fresh` before continuing (`skills/package-release/scripts/release-pack.mjs`); Step 5's staging pathspec now carries both plugins' `plugin.yaml`, `__init__.py`, `prompts/*.md`, and (adia-ui-factory only) `hermes-mcp.yaml`, so the regen actually lands in the release commit instead of riding untracked. `selftest` extended to assert the new step and its staging pathspec.
-- **`patterns-index.md` (both `@adia-ai/mcp`'s `factory/resources/` copy and `adia-ui-factory`'s `skills/pattern-catalog/references/` copy) had no freshness gate at all — it went undetected-stale through the entire v0.8.53 cut, only regenerated as a side effect of an unrelated F-N1 CHANGELOG-coverage fix, never because a gate asserted it.** Added gate 33 (`npm run verify:patterns-index`) to the pre-flight roster, appended after gate 32 with the same numbering discipline as gates 30-32 (`skills/package-release/scripts/gate-roster.mjs`).
+- **`package-release`'s cut pipeline was missing a post-bump regen step for both plugins' Hermes/Pi manifest tree, the same gap gh#1899 already closed for the Codex tree (discovered live during the v0.8.53 release PR #2138: it shipped stale `plugin.yaml`/`__init__.py`, caught by CI's `check:harness-manifests-fresh` and fixed by hand on the release branch).** `release-pack.mjs`'s Step 4 now runs `scripts/build/harness-manifests.mjs` after the version bump and verifies with `npm run check:harness-manifests-fresh` before continuing (`skills/package-release/scripts/release-pack.mjs`); Step 5's staging pathspec now carries both plugins' `plugin.yaml`, `__init__.py`, `prompts/*.md`, and (adia-ui-factory only) `hermes-mcp.yaml`, so the regen actually lands in the release commit instead of riding untracked. `selftest` extended to assert the new step and its staging pathspec.
+- **`patterns-index.md` (both `@adia-ai/mcp`'s `factory/resources/` copy and `adia-ui-factory`'s `skills/pattern-catalog/references/` copy) had no freshness gate at all, it went undetected-stale through the entire v0.8.53 cut, only regenerated as a side effect of an unrelated F-N1 CHANGELOG-coverage fix, never because a gate asserted it.** Added gate 33 (`npm run verify:patterns-index`) to the pre-flight roster, appended after gate 32 with the same numbering discipline as gates 30-32 (`skills/package-release/scripts/gate-roster.mjs`).
 
 ### Docs
-- **`a2ui-maintenance/references/pipeline-overview.md`'s Critical Rule #5 stated a stale, now-superseded claim that A2UI never carries CSS — corrected per ADR-0022's 2026-08-24 amendment.** `UpdateStylesMessage`/`RemoveStylesMessage` are ratified protocol scope (a first-class CSS channel, not a carve-out); what still holds is narrower — compose/zettel LLM-synthesis itself never emits `updateStyles`, so the GENERATION-pipeline claim stays correct while the PROTOCOL-scope claim needed the fix. `skills/a2ui-maintenance/references/pipeline-overview.md`.
-- **`gen-ui-review/references/corpus-html-patterns.md` carried the same stale ADR-0022 claim as a secondary citation — corrected alongside the primary fix above.** `skills/gen-ui-review/references/corpus-html-patterns.md`.
-- **`primitive-authoring/references/yaml-contract.md`'s `category:` field documentation was missing ADR-0065's ratified 12-value canonical category vocabulary entirely (`action|agent|container|data|display|feedback|form|input|layout|navigation|shells|utility`) — added as a new passage, including the fold table for the 6 one-off drift values ADR-0065 retired.** `skills/primitive-authoring/references/yaml-contract.md`.
-- **`primitive-authoring/references/lifecycle-patterns.md`'s `slot="caret"` compliant-component list corrected twice this cycle, net result: `drilldown-ui` added.** ADR-0085 first added `drilldown-ui` to the exemption list (kept `slot="chevron"`); ADR-0092 then reversed that ruling (gh#1977 — migrate, don't exempt) and drilldown-ui's row chevron actually migrated to `slot="caret"` (see `@adia-ai/web-components`'s own 0.8.54 entry) — this file now lists `drilldown-ui` as compliant alongside `tree-item-ui`, `pane-ui`, `accordion-item-ui`, `nav-group-ui`, `select-ui`, citing ADR-0036 + ADR-0092. `skills/primitive-authoring/references/lifecycle-patterns.md`.
-- **`primitive-authoring/references/module-promotion.md` was missing a second, distinct ADR-0012 correction: ADR-0015 (ADR-0087) reclassifies 6 nav elements from modules-tier to primitives-tier (consolidated to 3 — `nav-ui`/`nav-group-ui`/`nav-item-ui`) and retires 4 legacy element names — added near the file's existing, unrelated ADR-0012 citation so a future reader classifying nav elements doesn't land them in the wrong tier.** `skills/primitive-authoring/references/module-promotion.md`.
+- **`a2ui-maintenance/references/pipeline-overview.md`'s Critical Rule #5 stated a stale, now-superseded claim that A2UI never carries CSS, corrected per ADR-0022's 2026-08-24 amendment.** `UpdateStylesMessage`/`RemoveStylesMessage` are ratified protocol scope (a first-class CSS channel, not a carve-out); what still holds is narrower, compose/zettel LLM-synthesis itself never emits `updateStyles`, so the GENERATION-pipeline claim stays correct while the PROTOCOL-scope claim needed the fix. `skills/a2ui-maintenance/references/pipeline-overview.md`.
+- **`gen-ui-review/references/corpus-html-patterns.md` carried the same stale ADR-0022 claim as a secondary citation, corrected alongside the primary fix above.** `skills/gen-ui-review/references/corpus-html-patterns.md`.
+- **`primitive-authoring/references/yaml-contract.md`'s `category:` field documentation was missing ADR-0065's ratified 12-value canonical category vocabulary entirely (`action|agent|container|data|display|feedback|form|input|layout|navigation|shells|utility`), added as a new passage, including the fold table for the 6 one-off drift values ADR-0065 retired.** `skills/primitive-authoring/references/yaml-contract.md`.
+- **`primitive-authoring/references/lifecycle-patterns.md`'s `slot="caret"` compliant-component list corrected twice this cycle, net result: `drilldown-ui` added.** ADR-0085 first added `drilldown-ui` to the exemption list (kept `slot="chevron"`); ADR-0092 then reversed that ruling (gh#1977, migrate, don't exempt) and drilldown-ui's row chevron actually migrated to `slot="caret"` (see `@adia-ai/web-components`'s own 0.8.54 entry), this file now lists `drilldown-ui` as compliant alongside `tree-item-ui`, `pane-ui`, `accordion-item-ui`, `nav-group-ui`, `select-ui`, citing ADR-0036 + ADR-0092. `skills/primitive-authoring/references/lifecycle-patterns.md`.
+- **`primitive-authoring/references/module-promotion.md` was missing a second, distinct ADR-0012 correction: ADR-0015 (ADR-0087) reclassifies 6 nav elements from modules-tier to primitives-tier (consolidated to 3, `nav-ui`/`nav-group-ui`/`nav-item-ui`) and retires 4 legacy element names, added near the file's existing, unrelated ADR-0012 citation so a future reader classifying nav elements doesn't land them in the wrong tier.** `skills/primitive-authoring/references/module-promotion.md`.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump only** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump only**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
 
-## [0.8.53] — 2026-08-26
+## [0.8.53], 2026-08-26
 
 ### Changed
-- **`.claude-plugin/plugin.json` version bump only** — moves in lockstep with package.json (the `/plugin update` cache key). No skill/agent/hook content changed in this package this cut; substantive v0.8.53 work shipped in `@adia-ai/web-components`/`web-modules`/`gen-ui` — see `packages/web-components/CHANGELOG.md#0853--2026-08-26`.
+- **`.claude-plugin/plugin.json` version bump only**, moves in lockstep with package.json (the `/plugin update` cache key). No skill/agent/hook content changed in this package this cut; substantive v0.8.53 work shipped in `@adia-ai/web-components`/`web-modules`/`gen-ui`, see `packages/web-components/CHANGELOG.md#0853--2026-08-26`.
 
 ### Maintenance
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
 
-## [0.8.52] — 2026-08-25
+## [0.8.52], 2026-08-25
 
 ### Added
-- **`cross-harness-authoring-standards` (renamed from `writing-harness-install-instructions`, which had only ever existed as uncommitted worktree content) + new sibling skill `cross-harness-compatibility-standards` (gh#1975, PR #2003).** The rename is byte-faithful aside from the three self-referential mentions (frontmatter name, H1, one in-body reference). The new skill is the upstream engineering standard for actually building a capability that works across Claude Code, Codex, Pi, and Hermes — distinct from the renamed sibling's downstream consumer-facing install-docs concern — extracted from ADR-0091 and the four PRs (#1997-#2000) that built and shipped it: the skill-vs-thin-adapter classification rule, verify-before-coding per harness, one authored skill body with every runtime as a thin consumer, one contract grammar (record-lint family) instead of a schema per runtime, and naming distribution channels distinctly. Codex and Hermes derived manifests regenerated for both skills; README/`AGENTS.md` skill-roster and count updated.
+- **`cross-harness-authoring-standards` (renamed from `writing-harness-install-instructions`, which had only ever existed as uncommitted worktree content) + new sibling skill `cross-harness-compatibility-standards` (gh#1975, PR #2003).** The rename is byte-faithful aside from the three self-referential mentions (frontmatter name, H1, one in-body reference). The new skill is the upstream engineering standard for actually building a capability that works across Claude Code, Codex, Pi, and Hermes, distinct from the renamed sibling's downstream consumer-facing install-docs concern, extracted from ADR-0091 and the four PRs (#1997-#2000) that built and shipped it: the skill-vs-thin-adapter classification rule, verify-before-coding per harness, one authored skill body with every runtime as a thin consumer, one contract grammar (record-lint family) instead of a schema per runtime, and naming distribution channels distinctly. Codex and Hermes derived manifests regenerated for both skills; README/`AGENTS.md` skill-roster and count updated.
 
 ### Changed
-- **`package-release`'s pre-cut roster runs in three phases instead of one serial for-loop (gh#2006, follow-up from gh#1987's audit)** — `release-pack.mjs`'s `step3PreFlight()` now runs gate 4 (`test:unit:serial`) solo, the eval-health chain (gates 16 → 27 → 28 — a real CSS-before-JS-shaped file-write ordering dependency: gate 28 reads whichever `evals/mcp/runs/` directory sorts lexically last, so gate 27's free-form run must land uninterrupted) strictly in order, and every other gate in a concurrency-capped pool (`PREFLIGHT_CONCURRENCY`, default 4) — all concurrent with the chain. Cuts real wall-clock with zero coverage loss: no gate dropped, none renumbered, none silently skipped. `--dry` previews are unchanged (still the original flat serial walk, byte-for-byte, so `selftest`'s exact-output assertions keep passing).
+- **`package-release`'s pre-cut roster runs in three phases instead of one serial for-loop (gh#2006, follow-up from gh#1987's audit)**, `release-pack.mjs`'s `step3PreFlight()` now runs gate 4 (`test:unit:serial`) solo, the eval-health chain (gates 16 → 27 → 28, a real CSS-before-JS-shaped file-write ordering dependency: gate 28 reads whichever `evals/mcp/runs/` directory sorts lexically last, so gate 27's free-form run must land uninterrupted) strictly in order, and every other gate in a concurrency-capped pool (`PREFLIGHT_CONCURRENCY`, default 4), all concurrent with the chain. Cuts real wall-clock with zero coverage loss: no gate dropped, none renumbered, none silently skipped. `--dry` previews are unchanged (still the original flat serial walk, byte-for-byte, so `selftest`'s exact-output assertions keep passing).
 - **All agent seats pinned to `sonnet` + `xhigh` reasoning effort, replacing the prior fable/opus ceiling-ladder pins (PR #1999).** Operator's direct standing instruction, applied across `a2ui-maintenance-agent`, `a2ui-planner-agent`, `demo-audit-agent`, `framework-checker`, `framework-planner-agent`, `gen-ui-review-agent`, `package-release-agent`, `primitive-authoring-agent`. See root `CHANGELOG.md` for the cross-plugin note.
 
 ### Fixed
-- **`__init__.py`'s Hermes manifest generator's `register_skill` call passed a plain string where the runtime requires a `pathlib.Path` (calls `path.exists()`) — wrapped, discovered incidentally while building `adia-ui-factory`'s Hermes `delegate_task` command (PR #2000).**
+- **`__init__.py`'s Hermes manifest generator's `register_skill` call passed a plain string where the runtime requires a `pathlib.Path` (calls `path.exists()`), wrapped, discovered incidentally while building `adia-ui-factory`'s Hermes `delegate_task` command (PR #2000).**
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
 
-## [0.8.51] — 2026-08-24
+## [0.8.51], 2026-08-24
 
 ### Added
-- Hermes + Pi external-distribution manifests (gh#1954) — `plugin.yaml` +
+- Hermes + Pi external-distribution manifests (gh#1954), `plugin.yaml` +
   `__init__.py` (Hermes) and `prompts/*.md` + a `"pi"` field in
   `package.json` (Pi), derived from `.claude-plugin/plugin.json` +
   `skills/` + `commands/` via `npm run build:harness-manifests`
@@ -244,42 +269,42 @@
   neither harness's MCP story applies to it.
 
 ### Maintenance
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
 
-## [0.8.50] — 2026-08-23
+## [0.8.50], 2026-08-23
 
 ### Maintenance
-- **Lockstep bump riding the v0.8.50 cut** (`scripts/release/check-lockstep.mjs`); the headline v0.8.50 work ships in @adia-ai/web-components (prose/verse sheet removal gh#1885 / PR #1918, input/search fill-default posture gh#1856 — see `packages/web-components/CHANGELOG.md#0850--2026-08-23`). Package-local changes are listed below.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
+- **Lockstep bump riding the v0.8.50 cut** (`scripts/release/check-lockstep.mjs`); the headline v0.8.50 work ships in @adia-ai/web-components (prose/verse sheet removal gh#1885 / PR #1918, input/search fill-default posture gh#1856, see `packages/web-components/CHANGELOG.md#0850--2026-08-23`). Package-local changes are listed below.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`), carried by the entries above.
 
 ### Fixed
-- **`skills/package-release` regenerates Codex plugin manifests in Step 4 (gh#1899, PR #1917)** — `release-pack.mjs` + `cut-procedure.md` gain the post-bump `build:codex-manifests` regen so `check:codex-manifests-fresh` stays green through a cut; `a2ui-maintenance` (`mcp-pipeline-ops.md`) and `primitive-authoring` (`api-contract.md`) references refreshed in the same window.
+- **`skills/package-release` regenerates Codex plugin manifests in Step 4 (gh#1899, PR #1917)**, `release-pack.mjs` + `cut-procedure.md` gain the post-bump `build:codex-manifests` regen so `check:codex-manifests-fresh` stays green through a cut; `a2ui-maintenance` (`mcp-pipeline-ops.md`) and `primitive-authoring` (`api-contract.md`) references refreshed in the same window.
 
-## [0.8.48] — 2026-08-23
+## [0.8.48], 2026-08-23
 
 ### Added
-- OpenAI Codex plugin manifest (gh#1888) — `.codex-plugin/plugin.json` +
+- OpenAI Codex plugin manifest (gh#1888), `.codex-plugin/plugin.json` +
   a per-skill `skills/<name>/agents/openai.yaml`, derived from
   `.claude-plugin/plugin.json` via `npm run build:codex-manifests`
   (`check:codex-manifests-fresh` gates freshness). Additive: the Claude Code
   plugin surface is unchanged.
 
-## [0.8.47] — 2026-08-22
+## [0.8.47], 2026-08-22
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.47 work shipped in table-toolbar size/chrome fixes, anchor popover reuse guard, token-layer light-dark cleanup (gh#1852), side-by-side docs demos. See `packages/web-components/CHANGELOG.md#0847--2026-08-22` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.46] — 2026-08-22
+## [0.8.46], 2026-08-22
 
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`agents/` touched in this release window** (4 file(s), e.g. `agents/demo-audit-agent.corpus.json`) — carried by the entries above.
-- **`skills/` touched in this release window** (2 file(s), e.g. `references/authoring-cycle.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`agents/` touched in this release window** (4 file(s), e.g. `agents/demo-audit-agent.corpus.json`), carried by the entries above.
+- **`skills/` touched in this release window** (2 file(s), e.g. `references/authoring-cycle.md`), carried by the entries above.
 
-## [0.8.45] — 2026-08-20
+## [0.8.45], 2026-08-20
 
 ### Changed
 - **`framework-reviewer` split into `demo-audit-agent` + `gen-ui-review-agent` (gh#1733), retiring the `naming.manifest.json` exemption it carried since the ADR-0011 D10 rename wave.** The retired agent preloaded both `demo-audit` and `gen-ui-review` under one read-only critic; each new agent preloads exactly one, keeping the same no-Write/no-Edit critic wall and `fable`+`high` review-row pin. Every live cross-reference re-keyed: `README.md`, `.claude/docs/specs/plugin-estate-v2.md`'s agent roster table, `agents/routing-corpus.json`'s expected-agent labels, the sibling `framework-checker`/`demo-audit`/`site-docs-authoring` bodies, the `a2ui-maintenance-agent`/`primitive-authoring-agent` corpus sidecars' sibling-territory mentions, and three active plan docs (`plan-charts-2-0-waves.md`, `plan-table-toolbar-compaction.md`, `plan-form-control-sizing.md`). `site/pages/getting-started/forge-plugin.html`'s gated agent roster (count + set, `check:plugin-count-claims`) updated and its derived `site-a2ui` row regenerated. Two fresh M2 sidecar corpora (`demo-audit-agent.corpus.json`, `gen-ui-review-agent.corpus.json`) split from `framework-reviewer.corpus.json`'s positives, marked unmeasured pending their own `routing_eval.py` pass. Closes #1733.
@@ -288,19 +313,19 @@
   `package-release` (was routing DEAD in the blind-judge sim). Closes #1731.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (9 file(s), e.g. `demo-audit/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (9 file(s), e.g. `demo-audit/SKILL.md`), carried by the entries above.
 
-## [0.8.44] — 2026-08-20
+## [0.8.44], 2026-08-20
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.44 work shipped in charts y-domain pins, table-toolbar compaction ladder, text mono roles, pagination SSR adoption. See `packages/web-components/CHANGELOG.md#0844--2026-08-20` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`agent-intents/` touched in this release window** (2 file(s), e.g. `agent-intents/framework-checker.intent.md`) — carried by the entries above.
-- **`agents/` touched in this release window** (5 file(s), e.g. `agents/a2ui-maintenance-agent.md`) — carried by the entries above.
-- **`skills/` touched in this release window** (26 file(s), e.g. `a2ui-maintenance/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`agent-intents/` touched in this release window** (2 file(s), e.g. `agent-intents/framework-checker.intent.md`), carried by the entries above.
+- **`agents/` touched in this release window** (5 file(s), e.g. `agents/a2ui-maintenance-agent.md`), carried by the entries above.
+- **`skills/` touched in this release window** (26 file(s), e.g. `a2ui-maintenance/SKILL.md`), carried by the entries above.
 
-## [0.8.43] — 2026-08-18
+## [0.8.43], 2026-08-18
 
 ### Changed
 - Knowledge packs harvested for ADR-0061..0074: surface-lifecycle reference (a2ui-maintenance), site-package-registry playbook, attribute-grammar/role-class/tier-model sections, disabled-state token convention (gh#1564, #1609, #1625).
@@ -308,66 +333,66 @@
 - token-selection references regenerated for the `--a-ui-bg-disabled` container-low retarget (gh#1596, #1599).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (5 file(s), e.g. `references/corpus-html-patterns.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (5 file(s), e.g. `references/corpus-html-patterns.md`), carried by the entries above.
 
-## [0.8.42] — 2026-08-17
+## [0.8.42], 2026-08-17
 
 ### Maintenance
 - Knowledge packs harvest the ADR-0061..0070 ratifications (PR #1564: gen-ui-wiring + wave-coordination corpora); rename-wave W2 doc migration (PR #1567).
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (7 file(s), e.g. `a2ui-maintenance/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (7 file(s), e.g. `a2ui-maintenance/SKILL.md`), carried by the entries above.
 
-## [0.8.41] — 2026-08-17
+## [0.8.41], 2026-08-17
 
 ### Added
-- **`primitive-authoring` gains `references/svg-authoring.md` (#1401)** — chart/SVG-specific quirks (viewBox scaling, token-driven stroke/fill, text measurement) that kept recurring in chart-family reviews.
-- **`primitive-authoring` harvests ADR-0052/0055/0056/0057 into references (#1407)** — leading-scale, native-input conformance, `[selected]` convention, and attribute-grammar decisions now load with the skill instead of living only in the ADR tree.
+- **`primitive-authoring` gains `references/svg-authoring.md` (#1401)**, chart/SVG-specific quirks (viewBox scaling, token-driven stroke/fill, text measurement) that kept recurring in chart-family reviews.
+- **`primitive-authoring` harvests ADR-0052/0055/0056/0057 into references (#1407)**, leading-scale, native-input conformance, `[selected]` convention, and attribute-grammar decisions now load with the skill instead of living only in the ADR tree.
 
 ### Changed
-- **`package-release` tracks the 0.8.41-window release-machinery changes.** `scripts/gate-roster.mjs` gains `check:catalog-tiers` (gh#1494); `scripts/release-pack.mjs`'s Step 4d.5 regen list adds catalog-tiers + a conditional corpus chunk re-harvest (#1396); gate 17 (`dogfood:status`) tolerates the npm-ci layout gate 9 needs (gh#1359); `references/cut-procedure.md` + `references/gates-catalog.md` transcribe the ADR-0069 regen-on-main gate split (derived Class-R artifacts re-derive on main, `dist/` stays committed — #1477) and the `docs/releases` → `docs/ops/releases` move (#1532/#1539), which `scripts/release-pretag-docs-gate` now enforces against the new path.
-- **`ssr-compatibility` references updated to the gh#1430/gh#1436 shape-1 sweep's state** — `guard-patterns.md` (feature-detect over `typeof window`; `isNode()`/`isElement()` over bare `instanceof`), `failure-shapes.md`, `status-ledger.md`, `consumer-workarounds.md`, `test-without-linkedom.md`, and SKILL.md route SSR reports through the new `ssr-seam-report` issue template + `ssr` label (#1404) and the `scripts/dev/ssr-linkedom-smoke.mjs` gate first.
-- **`a2ui-maintenance` — stale `packages/gen-ui/a2ui/corpus` paths corrected to the engine's `corpus/` home (#1392), and the zettel-engine eval floor file is committed so `eval:diff --engine zettel` has a baseline (gh#1391)**; `chunk-authoring.md`/`eval-diagnostics.md`/`mcp-pipeline-ops.md`/`pipeline-overview.md` track the same paths.
+- **`package-release` tracks the 0.8.41-window release-machinery changes.** `scripts/gate-roster.mjs` gains `check:catalog-tiers` (gh#1494); `scripts/release-pack.mjs`'s Step 4d.5 regen list adds catalog-tiers + a conditional corpus chunk re-harvest (#1396); gate 17 (`dogfood:status`) tolerates the npm-ci layout gate 9 needs (gh#1359); `references/cut-procedure.md` + `references/gates-catalog.md` transcribe the ADR-0069 regen-on-main gate split (derived Class-R artifacts re-derive on main, `dist/` stays committed, #1477) and the `docs/releases` → `docs/ops/releases` move (#1532/#1539), which `scripts/release-pretag-docs-gate` now enforces against the new path.
+- **`ssr-compatibility` references updated to the gh#1430/gh#1436 shape-1 sweep's state**, `guard-patterns.md` (feature-detect over `typeof window`; `isNode()`/`isElement()` over bare `instanceof`), `failure-shapes.md`, `status-ledger.md`, `consumer-workarounds.md`, `test-without-linkedom.md`, and SKILL.md route SSR reports through the new `ssr-seam-report` issue template + `ssr` label (#1404) and the `scripts/dev/ssr-linkedom-smoke.mjs` gate first.
+- **`a2ui-maintenance`, stale `packages/gen-ui/a2ui/corpus` paths corrected to the engine's `corpus/` home (#1392), and the zettel-engine eval floor file is committed so `eval:diff --engine zettel` has a baseline (gh#1391)**; `chunk-authoring.md`/`eval-diagnostics.md`/`mcp-pipeline-ops.md`/`pipeline-overview.md` track the same paths.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (28 file(s), e.g. `a2ui-maintenance/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (28 file(s), e.g. `a2ui-maintenance/SKILL.md`), carried by the entries above.
 
-## [0.8.40] — 2026-08-15
+## [0.8.40], 2026-08-15
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.40 work shipped in the ADR-0052/0053/0054/0056 attribute-grammar and token-convention breaking wave. See `packages/web-components/CHANGELOG.md#0840--2026-08-15` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.39] — 2026-08-15
+## [0.8.39], 2026-08-15
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.39 work shipped in overnight board-clear: tiered catalogs complete, modal close root fix, ADR-0025 input conformance, [selected] convergence, nav collapse-on-select, caret family sizing. See `packages/web-components/CHANGELOG.md#0839--2026-08-15` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`agent-intents/` touched in this release window** (3 file(s), e.g. `agent-intents/a2ui-planner-agent.intent.md`) — carried by the entries above.
-- **`agents/` touched in this release window** (3 file(s), e.g. `agents/a2ui-planner-agent.md`) — carried by the entries above.
-- **`references/` touched in this release window** (1 file(s), e.g. `contracts/a2ui-mcp-surface.md`) — carried by the entries above.
-- **`skills/` touched in this release window** (5 file(s), e.g. `references/mcp-tool-reference.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`agent-intents/` touched in this release window** (3 file(s), e.g. `agent-intents/a2ui-planner-agent.intent.md`), carried by the entries above.
+- **`agents/` touched in this release window** (3 file(s), e.g. `agents/a2ui-planner-agent.md`), carried by the entries above.
+- **`references/` touched in this release window** (1 file(s), e.g. `contracts/a2ui-mcp-surface.md`), carried by the entries above.
+- **`skills/` touched in this release window** (5 file(s), e.g. `references/mcp-tool-reference.md`), carried by the entries above.
 
-## [0.8.38] — 2026-08-15
+## [0.8.38], 2026-08-15
 
 ### Removed
-- **ADR-0048 P7 close-out — the estate-split bridge leaves the release skill (the cut-procedure §0.8.37 follow-up PR).** `package-paths.mjs` drops the six `shim: true` roster rows (lockstep roster 16 → 10) and `resolvePackageDir`'s dead `shims/` + `a2ui/<x>` fallbacks; `cut-procedure.md` deletes its §The 0.8.37 estate-split cut section (per its own "ONE cut, then delete this section" contract — §The 0.8.38 cut stays until that cut lands).
+- **ADR-0048 P7 close-out, the estate-split bridge leaves the release skill (the cut-procedure §0.8.37 follow-up PR).** `package-paths.mjs` drops the six `shim: true` roster rows (lockstep roster 16 → 10) and `resolvePackageDir`'s dead `shims/` + `a2ui/<x>` fallbacks; `cut-procedure.md` deletes its §The 0.8.37 estate-split cut section (per its own "ONE cut, then delete this section" contract, §The 0.8.38 cut stays until that cut lands).
 
 ### Changed
-- **`bump.mjs`'s invariant-8 generation-MCP pin pattern narrowed back to the single live name `@adia-ai/mcp`** (matching `lockstep-checks.mjs`'s `MCP_PIN_RE`) — a retired bridge name in the factory pin is no longer bumped along; it fails the lockstep gate loudly. Selftests updated to the post-flip fixtures plus a retired-name negative control.
+- **`bump.mjs`'s invariant-8 generation-MCP pin pattern narrowed back to the single live name `@adia-ai/mcp`** (matching `lockstep-checks.mjs`'s `MCP_PIN_RE`), a retired bridge name in the factory pin is no longer bumped along; it fails the lockstep gate loudly. Selftests updated to the post-flip fixtures plus a retired-name negative control.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`references/` touched in this release window** (1 file(s), e.g. `contracts/a2ui-mcp-surface.md`) — carried by the entries above.
-- **`skills/` touched in this release window** (36 file(s), e.g. `a2ui-maintenance/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`references/` touched in this release window** (1 file(s), e.g. `contracts/a2ui-mcp-surface.md`), carried by the entries above.
+- **`skills/` touched in this release window** (36 file(s), e.g. `a2ui-maintenance/SKILL.md`), carried by the entries above.
 
-## [0.8.37] — 2026-08-14
+## [0.8.37], 2026-08-14
 
 ### Changed
-- **ADR-0048 P5 — `adia-release` carries the estate-split roster (`scripts/`, `skills/`, `references/`).**
+- **ADR-0048 P5, `adia-release` carries the estate-split roster (`scripts/`, `skills/`, `references/`).**
   `PACKAGE_ROSTER` gains `a2ui`, `gen-ui`, `gen-ui-mcp` and re-marks the six old
-  names `shim: true` (the retirement marker P7 deletes by) — 17 lockstep for the
+  names `shim: true` (the retirement marker P7 deletes by), 17 lockstep for the
   migration cut, 11 after. `bump.mjs`'s invariant-8 pin pattern and
   `lockstep-checks.mjs`'s `MCP_PIN_RE` now match EITHER generation-MCP name so
   the P7 name flip is gate-clean in both directions. `cut-procedure.md` gains
@@ -377,360 +402,360 @@
   of the hand-typed list that had gone stale against ADR-0048.
 
 ### Fixed
-- **`references/contracts/a2ui-mcp-surface.md` gains a `plan_app_state` row (REQ-03, gh#1208).** The consumer-load-bearing subset table named `generate_ui`/`refine_ui` and five other tools but not `plan_app_state` — the agent operator's (P4's) only Reasoning Ladder surface — even though it feeds `generate_ui` directly. Also notes the `experience.shell` enum's reconciliation with the Orientation Record's Shell axis (a breaking change under this contract's own stability rule). Re-landed on `packages/gen-ui-mcp/` after ADR-0048 P2 moved the server there. Twin copy in `adia-ui-factory` updated identically.
-- **`release-pack.mjs` Step 5 now stages gate 28's committed health record (gh#1197).** `evals/health/<version>.json` (write-eval-health.mjs, gate 28) rode through pre-flight uncommitted on both the v0.8.35 and v0.8.36 cuts — Step 5's staging pathspec never named it, so it sat untracked in the working tree until a session close-out swept it by hand (PR #1196). Added to the `git add` list, named after `args.version` (gate 28 is a `targetVersionArg` gate, so it always writes at the cut version). `release-pack.mjs selftest` now asserts the file appears in the assembled `--mode cut --dry` plan.
+- **`references/contracts/a2ui-mcp-surface.md` gains a `plan_app_state` row (REQ-03, gh#1208).** The consumer-load-bearing subset table named `generate_ui`/`refine_ui` and five other tools but not `plan_app_state`, the agent operator's (P4's) only Reasoning Ladder surface, even though it feeds `generate_ui` directly. Also notes the `experience.shell` enum's reconciliation with the Orientation Record's Shell axis (a breaking change under this contract's own stability rule). Re-landed on `packages/gen-ui-mcp/` after ADR-0048 P2 moved the server there. Twin copy in `adia-ui-factory` updated identically.
+- **`release-pack.mjs` Step 5 now stages gate 28's committed health record (gh#1197).** `evals/health/<version>.json` (write-eval-health.mjs, gate 28) rode through pre-flight uncommitted on both the v0.8.35 and v0.8.36 cuts, Step 5's staging pathspec never named it, so it sat untracked in the working tree until a session close-out swept it by hand (PR #1196). Added to the `git add` list, named after `args.version` (gate 28 is a `targetVersionArg` gate, so it always writes at the cut version). `release-pack.mjs selftest` now asserts the file appears in the assembled `--mode cut --dry` plan.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`agents/` touched in this release window** (8 file(s), e.g. `agents/a2ui-maintenance-agent.corpus.json`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`agents/` touched in this release window** (8 file(s), e.g. `agents/a2ui-maintenance-agent.corpus.json`), carried by the entries above.
 
-## [0.8.36] — 2026-08-13
+## [0.8.36], 2026-08-13
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.36 work shipped in a2ui chain standalone-installable (gh#1186: unpublishable dep removed, 143 packed-import escapes fixed, packed-imports gate + boot probe) + ui-architect coordinator agent + MCP doc consolidation. See `packages/a2ui/mcp/CHANGELOG.md#0836--2026-08-13` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (6 file(s), e.g. `adia-release/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (6 file(s), e.g. `adia-release/SKILL.md`), carried by the entries above.
 
-## [0.8.35] — 2026-08-13
+## [0.8.35], 2026-08-13
 
 ### Added
-- **Release pre-flight gains its 27th and 28th gates (gh#1135, WS-4 SPEC REQ-06): committed pipeline health per cut.** `npm run eval:diff -- --engine free-form` (gate 27) refreshes the eval artifact `write-eval-health.mjs` (gate 28) reads; the latter commits `evals/health/<version>.json` — `{version, date, rubricVersion, engines: {free-form: {coverage, avgF1WhenEmitted, avgScoreWhenEmitted}}, acceptance: {gateWiredAssertion, negativeTestAssertion}}` — with the `acceptance` assertions produced by actually running `auto-acceptance.test.js`'s AC-01/AC-02 cases, never inferred from an earlier gate's success. `gate-roster.mjs` grows a `targetVersionArg` flag (distinct from `versionArg`, gate 24's pre/post-bump claim-validation concern): this gate always names the file after the cut's target version from the start. Roster: 25 → 28 gates across this window (gate 26, `check-dx-sweep-freshness.mjs`, landed separately — below).
-- **Gate 26 — `check-dx-sweep-freshness.mjs`: the DX sweep record must be fresh and not a regression-RED before a cut.** Passes on a RED-but-not-regression baseline by design (the honest-floors case); authored without a live adia-release sign-off and flagged as such in its own header — the flag stands until a cut confirms it.
+- **Release pre-flight gains its 27th and 28th gates (gh#1135, WS-4 SPEC REQ-06): committed pipeline health per cut.** `npm run eval:diff -- --engine free-form` (gate 27) refreshes the eval artifact `write-eval-health.mjs` (gate 28) reads; the latter commits `evals/health/<version>.json`, `{version, date, rubricVersion, engines: {free-form: {coverage, avgF1WhenEmitted, avgScoreWhenEmitted}}, acceptance: {gateWiredAssertion, negativeTestAssertion}}`, with the `acceptance` assertions produced by actually running `auto-acceptance.test.js`'s AC-01/AC-02 cases, never inferred from an earlier gate's success. `gate-roster.mjs` grows a `targetVersionArg` flag (distinct from `versionArg`, gate 24's pre/post-bump claim-validation concern): this gate always names the file after the cut's target version from the start. Roster: 25 → 28 gates across this window (gate 26, `check-dx-sweep-freshness.mjs`, landed separately, below).
+- **Gate 26, `check-dx-sweep-freshness.mjs`: the DX sweep record must be fresh and not a regression-RED before a cut.** Passes on a RED-but-not-regression baseline by design (the honest-floors case); authored without a live adia-release sign-off and flagged as such in its own header, the flag stands until a cut confirms it.
 - **Class-B (independently-versioned) packages join the roster model (gh#1133/gh#1160).** `package-paths.mjs` carries `lockstep: false` members (first: `@adia-ai/adia-plugins`, the npm marketplace-manifest package); every lockstep consumer (`bump`/`check-lockstep`/`tag-lockstep`/`dispatch-publish`/`release-pack`) filters them out, `release-pretag-docs-gate` learns per-package class-B tag routing via `--tag-prefix` (with class-B inference when the cached hook omits it), and `check-release.mjs` alone keeps the full unfiltered roster (the one consumer that must recognize class-B tags).
 
 ### Fixed
 - **`pr-bridge` retries transient network failures and pushes a local-ahead branch instead of failing the cycle** (this window's release-tooling hardening).
-- **`promote-unreleased` is now truly idempotent** — a re-run after a completed promotion no-ops instead of double-promoting.
-- **`forge-lint` strips comments before scanning and anchors its web-components/web-modules scope check** — ends a false-positive class on commented-out imports.
-- **humanQA retires per-cycle (REQ-11)** — a stale humanQA verdict from a prior cycle can no longer satisfy the current one.
+- **`promote-unreleased` is now truly idempotent**, a re-run after a completed promotion no-ops instead of double-promoting.
+- **`forge-lint` strips comments before scanning and anchors its web-components/web-modules scope check**, ends a false-positive class on commented-out imports.
+- **humanQA retires per-cycle (REQ-11)**, a stale humanQA verdict from a prior cycle can no longer satisfy the current one.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`agents/` touched in this release window** (4 file(s), e.g. `agents/a2ui-builder.md`) — carried by the entries above.
-- **`commands/` touched in this release window** (4 file(s), e.g. `commands/deploy.md`) — carried by the entries above.
-- **`scripts/` touched in this release window** (2 file(s), e.g. `scripts/forge-lint`) — carried by the entries above.
-- **`skills/` touched in this release window** (35 file(s), e.g. `adia-a2ui/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`agents/` touched in this release window** (4 file(s), e.g. `agents/a2ui-builder.md`), carried by the entries above.
+- **`commands/` touched in this release window** (4 file(s), e.g. `commands/deploy.md`), carried by the entries above.
+- **`scripts/` touched in this release window** (2 file(s), e.g. `scripts/forge-lint`), carried by the entries above.
+- **`skills/` touched in this release window** (35 file(s), e.g. `adia-a2ui/SKILL.md`), carried by the entries above.
 
-## [0.8.34] — 2026-08-11
+## [0.8.34], 2026-08-11
 
 ### Fixed
-- **Top-level `bin/` directory renamed to `scripts/` — claude.ai-hosted plugin validation was rejecting this plugin outright (gh#934).** claude.ai auto-adds any plugin's top-level `bin/` to PATH on the CLI, which isn't shown on the admin approval surface, so hosted validation refused to approve the plugin at all ("2 plugins found, 2 failed validation" alongside `adia-ui-kit-factory`, same defect). `bin/demo-postwrite-pattern-gate`, `bin/forge-lint`, `bin/release-pretag-docs-gate`, `bin/sidecar-prewrite-guard`, `bin/site-postwrite-derivation-gate` moved to `scripts/` with executable bits preserved; `hooks/hooks.json`'s `${CLAUDE_PLUGIN_ROOT}/bin/...` commands and `scripts/forge-lint`'s cross-reference to the factory plugin's vendored lint copy updated to `scripts/...`; `package.json`'s `files` array updated so the published tarball ships the renamed directory. Hook gates still fire the same scripts, just from a non-PATH-reserved location.
+- **Top-level `bin/` directory renamed to `scripts/`, claude.ai-hosted plugin validation was rejecting this plugin outright (gh#934).** claude.ai auto-adds any plugin's top-level `bin/` to PATH on the CLI, which isn't shown on the admin approval surface, so hosted validation refused to approve the plugin at all ("2 plugins found, 2 failed validation" alongside `adia-ui-kit-factory`, same defect). `bin/demo-postwrite-pattern-gate`, `bin/forge-lint`, `bin/release-pretag-docs-gate`, `bin/sidecar-prewrite-guard`, `bin/site-postwrite-derivation-gate` moved to `scripts/` with executable bits preserved; `hooks/hooks.json`'s `${CLAUDE_PLUGIN_ROOT}/bin/...` commands and `scripts/forge-lint`'s cross-reference to the factory plugin's vendored lint copy updated to `scripts/...`; `package.json`'s `files` array updated so the published tarball ships the renamed directory. Hook gates still fire the same scripts, just from a non-PATH-reserved location.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (1 file(s), e.g. `references/canonical-pattern-index.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (1 file(s), e.g. `references/canonical-pattern-index.md`), carried by the entries above.
 
-## [0.8.33] — 2026-08-11
+## [0.8.33], 2026-08-11
 
 ### Fixed
-- **adia-release `release-pack.mjs` resume completes missing stubs, defers versionArg gates, warns on stale cache copy.** The half-cut-tree resume path (all 13 package versions already bumped) previously assumed Step 4a's promote/stub pass had also fully completed — but a stub package's `[Unreleased]` reads empty either way, so a resume after an abort mid-stub silently skipped it rather than completing it, leaving that package's `[X.Y.Z]` section missing entirely at tag time. Resume now re-runs `insert-stub.mjs` for any package still missing its `[X.Y.Z]` heading before continuing to the idempotent substeps, defers gates that need the CUT-version hygiene check until after that repair, and warns when the plugin's own bundled copy of this script differs from the repo's live one (a stale marketplace cache silently running old release logic). `cut-procedure.md`'s 4-resume section documents the corrected sequencing.
-- **`adia-gen-review`'s corpus-HTML pattern reference no longer teaches the retired `badge-ui variant="accent"` (gh#873-876).** Its worked example used the value the variant/color/tone convention cut retired in favor of `primary` — updated so the reference doesn't contradict the shipped contract.
-- **adia-release `release-pack.mjs` Step 5 now stages `catalog-data.js`, the third file `derive-genui-catalog.mjs` writes.** Found live during this cut: Step 4d.5 regenerates `base.json`/`adia-pack.json`/`catalog-data.js` together (the latter is the browser-safe ES-module projection of the first two), but the Step 5 file allowlist (gh#617) only ever named the first two — `catalog-data.js` sat modified-but-uncommitted in the release commit, invisible in a local working tree (the file exists, just stale) but caught immediately by CI's fresh checkout via `check:genui-catalog`'s drift check. Added to the allowlist alongside its siblings.
+- **adia-release `release-pack.mjs` resume completes missing stubs, defers versionArg gates, warns on stale cache copy.** The half-cut-tree resume path (all 13 package versions already bumped) previously assumed Step 4a's promote/stub pass had also fully completed, but a stub package's `[Unreleased]` reads empty either way, so a resume after an abort mid-stub silently skipped it rather than completing it, leaving that package's `[X.Y.Z]` section missing entirely at tag time. Resume now re-runs `insert-stub.mjs` for any package still missing its `[X.Y.Z]` heading before continuing to the idempotent substeps, defers gates that need the CUT-version hygiene check until after that repair, and warns when the plugin's own bundled copy of this script differs from the repo's live one (a stale marketplace cache silently running old release logic). `cut-procedure.md`'s 4-resume section documents the corrected sequencing.
+- **`adia-gen-review`'s corpus-HTML pattern reference no longer teaches the retired `badge-ui variant="accent"` (gh#873-876).** Its worked example used the value the variant/color/tone convention cut retired in favor of `primary`, updated so the reference doesn't contradict the shipped contract.
+- **adia-release `release-pack.mjs` Step 5 now stages `catalog-data.js`, the third file `derive-genui-catalog.mjs` writes.** Found live during this cut: Step 4d.5 regenerates `base.json`/`adia-pack.json`/`catalog-data.js` together (the latter is the browser-safe ES-module projection of the first two), but the Step 5 file allowlist (gh#617) only ever named the first two, `catalog-data.js` sat modified-but-uncommitted in the release commit, invisible in a local working tree (the file exists, just stale) but caught immediately by CI's fresh checkout via `check:genui-catalog`'s drift check. Added to the allowlist alongside its siblings.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (3 file(s), e.g. `references/corpus-html-patterns.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (3 file(s), e.g. `references/corpus-html-patterns.md`), carried by the entries above.
 
-## [0.8.32] — 2026-08-09
+## [0.8.32], 2026-08-09
 
 ### Fixed
-- **adia-release `release-pack.mjs` deploy-settle wait tracks the dispatched run, requires success, and names the blocking run (gh#762).** The handoff's "waiting for the deploy workflow to settle" loop polled the NEWEST run's status in silence — it could settle on the previous completed run before the dispatch registered, accepted failure/cancelled as settled, and gave no signal while a forgotten run WAITING at the `production-site` gate held the `deploy-site` concurrency group (56h on Aug 5–8). Now: the newest run id is captured before dispatch, the handoff waits for the NEW run to appear, polls that run by id, requires `conclusion=success` (anything else fails the handoff), and each poll reports the gate-waiting blocker's id, wait-start, and URL ("BLOCKED BEHIND run X — approve or cancel it"). Pairs with the repo-level `reap-stale-deploy-gate.yml` auto-cancel (root CHANGELOG).
-- **adia-release `release-pack.mjs` from-scratch guard rails (gh#765).** Three fixes from the v0.8.29 cut's failure modes: (1) a parse-time guard — `--mode from-scratch` whose `--substantive-packages` ∪ `--stub-packages` doesn't cover the 13-package roster now fails immediately, naming the ride-alongs that would be missing a `[VERSION]` CHANGELOG section, instead of dying at Step 4e after the ~15-min pre-flight (mirrors the handoff `--gh-notes-file` guard); (2) `sh()`/`shQuiet()` failures now print the failing command, exit status, and the inner command's captured stdout/stderr instead of a bare execSync stack; (3) a half-cut tree (all versions bumped + CHANGELOGs promoted by an aborted Step-4 run) is detected before pre-flight and the run RESUMES — hygiene gates validate at the cut version and Step 4 skips promote/stub/bump — instead of false-failing gate 24; a mixed partial bump hard-stops with a recovery pointer.
-- **adia-release `dispatch-publish.mjs --verify-triggered` is conclusion-aware and registry-gated (gh#763).** The verify used to count ANY run for the tag as "triggered" — after the v0.8.29 runner-starvation wave stamped 5 publish runs `cancelled`, it would have reported all 13 packages fine and refused to re-dispatch the dead ones. Now: a run satisfies the check only on `conclusion: success`; in-progress/queued runs get a bounded wait (6 × 20s rechecks); cancelled/failed/timed-out runs and missing runs are re-dispatch candidates. Every re-dispatch is additionally gated behind `npm view <pkg>@<version>` — a version already on the registry is published regardless of run conclusion (the v0.8.29 compose run published, then got stamped cancelled by the 10m job clock), so re-dispatching over it would only 403. Registry remains the final arbiter; workflow conclusions are explicitly not publish truth. Selftest extended with negative controls for both the run-classification and the registry-gate decision tables.
+- **adia-release `release-pack.mjs` deploy-settle wait tracks the dispatched run, requires success, and names the blocking run (gh#762).** The handoff's "waiting for the deploy workflow to settle" loop polled the NEWEST run's status in silence, it could settle on the previous completed run before the dispatch registered, accepted failure/cancelled as settled, and gave no signal while a forgotten run WAITING at the `production-site` gate held the `deploy-site` concurrency group (56h on Aug 5–8). Now: the newest run id is captured before dispatch, the handoff waits for the NEW run to appear, polls that run by id, requires `conclusion=success` (anything else fails the handoff), and each poll reports the gate-waiting blocker's id, wait-start, and URL ("BLOCKED BEHIND run X, approve or cancel it"). Pairs with the repo-level `reap-stale-deploy-gate.yml` auto-cancel (root CHANGELOG).
+- **adia-release `release-pack.mjs` from-scratch guard rails (gh#765).** Three fixes from the v0.8.29 cut's failure modes: (1) a parse-time guard, `--mode from-scratch` whose `--substantive-packages` ∪ `--stub-packages` doesn't cover the 13-package roster now fails immediately, naming the ride-alongs that would be missing a `[VERSION]` CHANGELOG section, instead of dying at Step 4e after the ~15-min pre-flight (mirrors the handoff `--gh-notes-file` guard); (2) `sh()`/`shQuiet()` failures now print the failing command, exit status, and the inner command's captured stdout/stderr instead of a bare execSync stack; (3) a half-cut tree (all versions bumped + CHANGELOGs promoted by an aborted Step-4 run) is detected before pre-flight and the run RESUMES, hygiene gates validate at the cut version and Step 4 skips promote/stub/bump, instead of false-failing gate 24; a mixed partial bump hard-stops with a recovery pointer.
+- **adia-release `dispatch-publish.mjs --verify-triggered` is conclusion-aware and registry-gated (gh#763).** The verify used to count ANY run for the tag as "triggered", after the v0.8.29 runner-starvation wave stamped 5 publish runs `cancelled`, it would have reported all 13 packages fine and refused to re-dispatch the dead ones. Now: a run satisfies the check only on `conclusion: success`; in-progress/queued runs get a bounded wait (6 × 20s rechecks); cancelled/failed/timed-out runs and missing runs are re-dispatch candidates. Every re-dispatch is additionally gated behind `npm view <pkg>@<version>`, a version already on the registry is published regardless of run conclusion (the v0.8.29 compose run published, then got stamped cancelled by the 10m job clock), so re-dispatching over it would only 403. Registry remains the final arbiter; workflow conclusions are explicitly not publish truth. Selftest extended with negative controls for both the run-classification and the registry-gate decision tables.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (13 file(s), e.g. `adia-author/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (13 file(s), e.g. `adia-author/SKILL.md`), carried by the entries above.
 
-## [0.8.31] — 2026-08-07
+## [0.8.31], 2026-08-07
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.31 work shipped in post-0.8.30 fix wave: double-submit boundaries, list-item render gate, segmented allow-empty + adapter kebab-case booleans, MCP multi-session + idle TTL, feedback signal:none, swatch auto-contrast, tabs strip-gap spacing + vertical clearance. See `packages/web-components/CHANGELOG.md#0831--2026-08-07` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.30] — 2026-08-07
+## [0.8.30], 2026-08-07
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.30 work shipped in agent-harness v1 wave: MCP-client mode, guardrails/tracing/memory hardening, auto engine, chat agent-event rendering, human feedback loop. See `packages/agent/CHANGELOG.md#0830--2026-08-07` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (1 file(s), e.g. `references/mcp-pipeline-ops.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (1 file(s), e.g. `references/mcp-pipeline-ops.md`), carried by the entries above.
 
-## [0.8.29] — 2026-08-06
+## [0.8.29], 2026-08-06
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.29 work shipped in web-components (icon-ui tone prop gh#652) + web-modules (plan-envelope chrome gh#648) + a2ui-runtime (registry drift fix gh#645) + a2ui-compose (plan-turn executor gh#648) + a2ui-corpus (chunk re-harvest). See `0829--2026-08-06` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.28] — 2026-08-05
+## [0.8.28], 2026-08-05
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.28 work shipped in sideEffects tree-shaking fix + CSS barrel regen (gh#625/632). See `0828--2026-08-05` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.27] — 2026-08-05
+## [0.8.27], 2026-08-05
 
 ### Changed
-- **Agent seats pin explicit models** — no seat rides the caller's tier (gh#618, PR #620).
+- **Agent seats pin explicit models**, no seat rides the caller's tier (gh#618, PR #620).
 - Release tooling: Step 4d.5 regenerates the derived genui catalog post-bump (gh#617, PR #619); publish workflows for `@adia-ai/agent`/`@adia-ai/persona` with tag↔manifest guards (v0.8.26 recovery, PR #624); `tag-lockstep` selftest derives its count from the roster.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`agents/` touched in this release window** (3 file(s), e.g. `agents/a2ui-builder.md`) — carried by the entries above.
-- **`skills/` touched in this release window** (2 file(s), e.g. `references/cut-procedure.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`agents/` touched in this release window** (3 file(s), e.g. `agents/a2ui-builder.md`), carried by the entries above.
+- **`skills/` touched in this release window** (2 file(s), e.g. `references/cut-procedure.md`), carried by the entries above.
 
-## [0.8.26] — 2026-08-05
+## [0.8.26], 2026-08-05
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.26 work shipped in WCH chat-harness wave + genui conformance train; first publish of @adia-ai/agent + @adia-ai/persona. See `packages/web-modules/CHANGELOG.md#0826--2026-08-05` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (7 file(s), e.g. `adia-release/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (7 file(s), e.g. `adia-release/SKILL.md`), carried by the entries above.
 
-## [0.8.25] — 2026-07-31
+## [0.8.25], 2026-07-31
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the 11-package version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.25 work shipped in theme-panel scoped-target [parametric] density/radius fix (gh#570) + System scheme option; anchor-bar-ui; stat-ui band chart layout; chart-ui dots/series-emphasis. See `packages/web-components/CHANGELOG.md#0825--2026-07-31` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (1 file(s), e.g. `references/common-gotchas.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (1 file(s), e.g. `references/common-gotchas.md`), carried by the entries above.
 
-## [0.8.24] — 2026-07-30
+## [0.8.24], 2026-07-30
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the 11-package version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.24 work shipped in requiredIcons drift cleared across 16 components + checker comment handling (gh#550), worktree bootstrap workspace-link hardening + retrieval corpus-pin fix (gh#554), list-item two-line icon centering (gh#558), card footer bottom-pinning (gh#559). See `packages/web-components/CHANGELOG.md#0824--2026-07-30` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.23] — 2026-07-30
+## [0.8.23], 2026-07-30
 
 ### Changed
-- **Plugin renamed: `adia-forge` → `adia-ui-kit-forge`** (gh#520, operator ruling 2026-07-30). The in-repo marketplace renames `adia` → `adia-ui-kit`; the install pattern becomes `adia-ui-kit-forge@adia-ui-kit`. Directory and npm package identity (`@adia-ai/…`) unchanged. A new manifest name means a FRESH install — consumers re-add the marketplace under the new key and re-enable `adia-ui-kit-forge@adia-ui-kit`; old `adia-forge@adia` refs no longer resolve.
+- **Plugin renamed: `adia-forge` → `adia-ui-kit-forge`** (gh#520, operator ruling 2026-07-30). The in-repo marketplace renames `adia` → `adia-ui-kit`; the install pattern becomes `adia-ui-kit-forge@adia-ui-kit`. Directory and npm package identity (`@adia-ai/…`) unchanged. A new manifest name means a FRESH install, consumers re-add the marketplace under the new key and re-enable `adia-ui-kit-forge@adia-ui-kit`; old `adia-forge@adia` refs no longer resolve.
 
 ### Changed
-- **`bump.mjs` moves web-modules' exact peer pins each cut** (gh#489) — a `PINNED_REFS` entry rewrites the three `@adia-ai/*` peers alongside the version fields, with a mutation-free pre-flight and selftest coverage (digit-safe package-name matcher; no prefix-match on longer versions). Pairs with `check:lockstep`'s new `peer-exact-mismatch` rule so a pin left a cut behind fails the gate instead of shipping.
+- **`bump.mjs` moves web-modules' exact peer pins each cut** (gh#489), a `PINNED_REFS` entry rewrites the three `@adia-ai/*` peers alongside the version fields, with a mutation-free pre-flight and selftest coverage (digit-safe package-name matcher; no prefix-match on longer versions). Pairs with `check:lockstep`'s new `peer-exact-mismatch` rule so a pin left a cut behind fails the gate instead of shipping.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (1 file(s), e.g. `scripts/bump.mjs`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (1 file(s), e.g. `scripts/bump.mjs`), carried by the entries above.
 
-## [0.8.22] — 2026-07-29
+## [0.8.22], 2026-07-29
 
 ### Fixed
-- **`release-pack.mjs` Step 10 failures name their reason** — `shOk` discarded stderr, so a release-create that failed twice reported "could not be created" with an expired gh token, a network reset, and a bad notes file all indistinguishable. Create calls now pass `{ report: true }` (stderr surfaced, first 3 lines); existence probes stay silent since their failure is the answer.
-- **`release-pack.mjs` Step 10 is idempotent and resumable** — the GH-release loop called `gh release create` unconditionally, so ONE network blip aborted the whole handoff. The v0.8.21 cut hit exactly that: `connection reset by peer` with 4 of 11 releases made, *after* tags were pushed and all 9 packages published — the irreversible half done, the bookkeeping half stranded, and a plain re-run then failing on "release already exists" for the first 4 (repaired by hand). Now: a non-throwing `shOk()` probe skips releases that already exist, one retry absorbs a transient reset, and a genuine failure reports created/skipped/failed counts plus the fact that tags and publishes are unaffected — re-running the same handoff command finishes the job. Verified against the live v0.8.21 releases: 11 detected as existing, 0 would be re-created, and the probe returns false for a bogus tag (no false-positive skips).
+- **`release-pack.mjs` Step 10 failures name their reason**, `shOk` discarded stderr, so a release-create that failed twice reported "could not be created" with an expired gh token, a network reset, and a bad notes file all indistinguishable. Create calls now pass `{ report: true }` (stderr surfaced, first 3 lines); existence probes stay silent since their failure is the answer.
+- **`release-pack.mjs` Step 10 is idempotent and resumable**, the GH-release loop called `gh release create` unconditionally, so ONE network blip aborted the whole handoff. The v0.8.21 cut hit exactly that: `connection reset by peer` with 4 of 11 releases made, *after* tags were pushed and all 9 packages published, the irreversible half done, the bookkeeping half stranded, and a plain re-run then failing on "release already exists" for the first 4 (repaired by hand). Now: a non-throwing `shOk()` probe skips releases that already exist, one retry absorbs a transient reset, and a genuine failure reports created/skipped/failed counts plus the fact that tags and publishes are unaffected, re-running the same handoff command finishes the job. Verified against the live v0.8.21 releases: 11 detected as existing, 0 would be re-created, and the probe returns false for a bogus tag (no false-positive skips).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (1 file(s), e.g. `scripts/release-pack.mjs`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (1 file(s), e.g. `scripts/release-pack.mjs`), carried by the entries above.
 
-## [0.8.21] — 2026-07-28
+## [0.8.21], 2026-07-28
 
 ### Fixed
-- **Pre-cut gate roster 23 → 24** (`skills/package-release/scripts/gate-roster.mjs`) — adds `check:brand-assets` (the Adia mark must be token-driven, never a baked `agent-ui-*.svg`; gh#473). `cut-procedure.md` §3.1's transcribed table and the SKILL/gates-catalog counts moved with it, and the cut-hygiene gate renumbered 23 → 24; doc-vs-module equality re-verified programmatically (24/24 in sync, contiguous numbering).
+- **Pre-cut gate roster 23 → 24** (`skills/package-release/scripts/gate-roster.mjs`), adds `check:brand-assets` (the Adia mark must be token-driven, never a baked `agent-ui-*.svg`; gh#473). `cut-procedure.md` §3.1's transcribed table and the SKILL/gates-catalog counts moved with it, and the cut-hygiene gate renumbered 23 → 24; doc-vs-module equality re-verified programmatically (24/24 in sync, contiguous numbering).
 
-- **`release-pack.mjs` stages the root CHANGELOG it promotes** — the gh#453 machinery renamed root `[Unreleased]` → `[X.Y.Z]` at Step 4 but the Step 5 stage roster predated it, so the v0.8.20 cut promoted the heading and shipped without it (main kept `[Unreleased]`; the rename sat uncommitted in the cutter's working tree). `CHANGELOG.md` joins `releaseFiles`; the stranded v0.8.20 rename rides this same PR.
+- **`release-pack.mjs` stages the root CHANGELOG it promotes**, the gh#453 machinery renamed root `[Unreleased]` → `[X.Y.Z]` at Step 4 but the Step 5 stage roster predated it, so the v0.8.20 cut promoted the heading and shipped without it (main kept `[Unreleased]`; the rename sat uncommitted in the cutter's working tree). `CHANGELOG.md` joins `releaseFiles`; the stranded v0.8.20 rename rides this same PR.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.20] — 2026-07-28
+## [0.8.20], 2026-07-28
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the 11-package version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.20 work shipped in form/ subpath exports (gh#457) + tarball test-file hygiene, 7 packages (gh#462). See `packages/web-modules/CHANGELOG.md#0820--2026-07-28` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.19] — 2026-07-27
+## [0.8.19], 2026-07-27
 
 ### Fixed
-- **`adia-release` promotes the repo-root CHANGELOG at cut time** (operator directive 2026-07-27). The cut promoted the 11 package changelogs but never the root one, so repo-level entries accumulated under `[Unreleased]` across five release windows (0.8.7 → 0.8.18) until an operator caught the pile-up in the site's Changelog panel. `promote-unreleased.mjs` gains the special target `root` (repo-root `CHANGELOG.md`, deliberately outside `PACKAGE_ROSTER` — the roster feeds publish/tag consumers); `release-pack.mjs` adds `root` to the promote list by detection whenever that file's `[Unreleased]` carries content — no flag, since root entries are optional per window — and the post-promotion loud guard now sweeps `root` too, which also catches a duplicate `[Unreleased]` heading (the promote swaps only the first; the second trips the guard).
+- **`adia-release` promotes the repo-root CHANGELOG at cut time** (operator directive 2026-07-27). The cut promoted the 11 package changelogs but never the root one, so repo-level entries accumulated under `[Unreleased]` across five release windows (0.8.7 → 0.8.18) until an operator caught the pile-up in the site's Changelog panel. `promote-unreleased.mjs` gains the special target `root` (repo-root `CHANGELOG.md`, deliberately outside `PACKAGE_ROSTER`, the roster feeds publish/tag consumers); `release-pack.mjs` adds `root` to the promote list by detection whenever that file's `[Unreleased]` carries content, no flag, since root entries are optional per window, and the post-promotion loud guard now sweeps `root` too, which also catches a duplicate `[Unreleased]` heading (the promote swaps only the first; the second trips the guard).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (3 file(s), e.g. `references/changelog-discipline.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (3 file(s), e.g. `references/changelog-discipline.md`), carried by the entries above.
 
-## [0.8.18] — 2026-07-27
+## [0.8.18], 2026-07-27
 
 ### Added
-- **`adia-author` writes down the tag-naming rule across tiers** (`references/code-style.md`) — primitives and standalone feature composites carry `-ui`; shell/bespoke-cluster children and runtime roots are bare, namespaced by their cluster prefix. Ratified when `form-popover` shipped as the only unsuffixed standalone composite (renamed `form-popover-ui` the next release); `theme-panel` is explicitly grandfathered, not precedent.
+- **`adia-author` writes down the tag-naming rule across tiers** (`references/code-style.md`), primitives and standalone feature composites carry `-ui`; shell/bespoke-cluster children and runtime roots are bare, namespaced by their cluster prefix. Ratified when `form-popover` shipped as the only unsuffixed standalone composite (renamed `form-popover-ui` the next release); `theme-panel` is explicitly grandfathered, not precedent.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (1 file(s), e.g. `references/code-style.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (1 file(s), e.g. `references/code-style.md`), carried by the entries above.
 
-## [0.8.17] — 2026-07-27
+## [0.8.17], 2026-07-27
 
 ### Changed
-- **Pre-cut gate roster 22 → 23** (`skills/package-release/scripts/gate-roster.mjs`) — adds `check:demo-routes` (demo surfaces routed + patterns indexed; operator directive 2026-07-27). `cut-procedure.md` §3.1's transcribed table and the SKILL/gates-catalog counts moved with it; doc-vs-module equality re-verified programmatically (23/23 in sync).
+- **Pre-cut gate roster 22 → 23** (`skills/package-release/scripts/gate-roster.mjs`), adds `check:demo-routes` (demo surfaces routed + patterns indexed; operator directive 2026-07-27). `cut-procedure.md` §3.1's transcribed table and the SKILL/gates-catalog counts moved with it; doc-vs-module equality re-verified programmatically (23/23 in sync).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.16] — 2026-07-26
+## [0.8.16], 2026-07-26
 
 ### Fixed
-- **The cut's harvest preamble now names `.examples.html` and the two generators it feeds** (`skills/package-release/references/cut-procedure.md` §3.0; gh#421) — the trigger list covered component yaml, `.a2ui.json`, `*.contents.html`, and `data-chunk-*`-annotated pages, so an `.examples.html` edit read as out of scope. It isn't: it feeds `.examples.md`, the `site-a2ui` converted rows, **and** the chunk harvest's source hashes. The v0.8.14 cut edited two components' `.examples.html`, ran every freshness gate the doc named, saw them clean, and still lost a CI round-trip to `🔴 stale /site/components/{menu,popover}` plus two changed-since-harvest sources. The regen block now lists `generate-examples-md.mjs`, `site-a2ui.mjs --stale`, and `check-token-semantics-sync.mjs --fix`, and the trigger list adds `styles/colors/*`.
+- **The cut's harvest preamble now names `.examples.html` and the two generators it feeds** (`skills/package-release/references/cut-procedure.md` §3.0; gh#421), the trigger list covered component yaml, `.a2ui.json`, `*.contents.html`, and `data-chunk-*`-annotated pages, so an `.examples.html` edit read as out of scope. It isn't: it feeds `.examples.md`, the `site-a2ui` converted rows, **and** the chunk harvest's source hashes. The v0.8.14 cut edited two components' `.examples.html`, ran every freshness gate the doc named, saw them clean, and still lost a CI round-trip to `🔴 stale /site/components/{menu,popover}` plus two changed-since-harvest sources. The regen block now lists `generate-examples-md.mjs`, `site-a2ui.mjs --stale`, and `check-token-semantics-sync.mjs --fix`, and the trigger list adds `styles/colors/*`.
 
 ### Changed
-- **The pre-cut gate roster grows 18 → 22** (`skills/package-release/scripts/gate-roster.mjs`) — `check:examples-md-fresh`, `verify:site-a2ui`, `verify:contrast`, and `check:token-semantics-sync` all shipped in the `npm run check` aggregate but were never in the release roster, so a gate added to CI silently never reached a cut. `verify:contrast` matters most: gh#427 widened it from 42 to 90 pairs, and without it in the roster a sub-AA token could ship past a green pre-flight. `cut-procedure.md` §3.1's transcribed table and the SKILL/gates-catalog counts moved with it — verified programmatically that the doc table and the module list are entry-for-entry identical.
+- **The pre-cut gate roster grows 18 → 22** (`skills/package-release/scripts/gate-roster.mjs`), `check:examples-md-fresh`, `verify:site-a2ui`, `verify:contrast`, and `check:token-semantics-sync` all shipped in the `npm run check` aggregate but were never in the release roster, so a gate added to CI silently never reached a cut. `verify:contrast` matters most: gh#427 widened it from 42 to 90 pairs, and without it in the roster a sub-AA token could ship past a green pre-flight. `cut-procedure.md` §3.1's transcribed table and the SKILL/gates-catalog counts moved with it, verified programmatically that the doc table and the module list are entry-for-entry identical.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.15] — 2026-07-26
+## [0.8.15], 2026-07-26
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the 11-package version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.15 work shipped in hover darkens in both schemes (600/550 role + filled-button wiring); find-unused adoption skill + measured routing evals. See `packages/web-components/CHANGELOG.md#0815--2026-07-26` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.14] — 2026-07-25
+## [0.8.14], 2026-07-25
 
 ### Fixed
-- **The in-repo plugin marketplace resolves again** (`.claude-plugin/marketplace.json`, relocated to the repo root; PR #412) — `claude plugin marketplace add` looks for the manifest at the checkout **root** unconditionally (the `owner/repo` shorthand and a git URL alike, `--sparse` or not; `--sparse` only limits which directories are checked out, it does not relocate the lookup). The old `packages/plugins/.claude-plugin/marketplace.json` location never resolved, so the documented install command had never worked. The manifest's two `source` fields were repointed at `./packages/plugins/adia-ui-{factory,forge}`.
-- **`.claude/settings.json`'s directory marketplace repointed at the repo root** — it still pointed at `./packages/plugins` after that relocation, so the repo's own dogfood plugins silently stopped loading (which is what the hooks and skills in this plugin are served through). The manifest's `name` is `adia`, so the enabled ids are `adia-forge@adia` / `adia-factory@adia`.
-- **`release-pack.mjs` generates and stages `docs/releases/vX.Y.Z.md` during the cut** (gh#399; PR #415) — the cut/from-scratch modes never produced the release-notes doc, and `check-cut-hygiene`'s success message claimed it was present without ever checking, so the gap surfaced a full cycle later at `release-pretag-docs-gate`. The v0.8.11 cut paid for it with a second PR and v0.8.13 hit the identical stop. New Step 4e runs `generate-release-notes.mjs --write` right after the bump (so the doc reads post-bump state) and Step 5 stages it; `check-cut-hygiene.mjs` gained a real `checkReleaseNotesPresent()` existence check.
+- **The in-repo plugin marketplace resolves again** (`.claude-plugin/marketplace.json`, relocated to the repo root; PR #412), `claude plugin marketplace add` looks for the manifest at the checkout **root** unconditionally (the `owner/repo` shorthand and a git URL alike, `--sparse` or not; `--sparse` only limits which directories are checked out, it does not relocate the lookup). The old `packages/plugins/.claude-plugin/marketplace.json` location never resolved, so the documented install command had never worked. The manifest's two `source` fields were repointed at `./packages/plugins/adia-ui-{factory,forge}`.
+- **`.claude/settings.json`'s directory marketplace repointed at the repo root**, it still pointed at `./packages/plugins` after that relocation, so the repo's own dogfood plugins silently stopped loading (which is what the hooks and skills in this plugin are served through). The manifest's `name` is `adia`, so the enabled ids are `adia-forge@adia` / `adia-factory@adia`.
+- **`release-pack.mjs` generates and stages `docs/releases/vX.Y.Z.md` during the cut** (gh#399; PR #415), the cut/from-scratch modes never produced the release-notes doc, and `check-cut-hygiene`'s success message claimed it was present without ever checking, so the gap surfaced a full cycle later at `release-pretag-docs-gate`. The v0.8.11 cut paid for it with a second PR and v0.8.13 hit the identical stop. New Step 4e runs `generate-release-notes.mjs --write` right after the bump (so the doc reads post-bump state) and Step 5 stages it; `check-cut-hygiene.mjs` gained a real `checkReleaseNotesPresent()` existence check.
 
 ### Added
-- **`adia-author` records the LightningCSS remote-`@import` failure** (`skills/primitive-authoring/references/authoring-cycle.md`; PR #418) — `bundleAsync` resolves every `@import` as a local file, `http(s)` URLs included, with no option to skip or externalize one, so a CSS-level `@import` of a Google Fonts URL breaks `npm run build:bundle-css`. It bit the 12-theme work twice; the note lives in the bundle-regen paragraph, where the failure actually surfaces.
+- **`adia-author` records the LightningCSS remote-`@import` failure** (`skills/primitive-authoring/references/authoring-cycle.md`; PR #418), `bundleAsync` resolves every `@import` as a local file, `http(s)` URLs included, with no option to skip or externalize one, so a CSS-level `@import` of a Google Fonts URL breaks `npm run build:bundle-css`. It bit the 12-theme work twice; the note lives in the bundle-regen paragraph, where the failure actually surfaces.
 
 ### Maintenance
-- **Plugin README version footer corrected** — it read v0.8.5 against a 0.8.13 manifest. Known gap, deliberately not fixed here: `check-cut-hygiene`'s doc-currency regex does not match that line's phrasing, which is why it drifted silently past every prior cut.
+- **Plugin README version footer corrected**, it read v0.8.5 against a 0.8.13 manifest. Known gap, deliberately not fixed here: `check-cut-hygiene`'s doc-currency regex does not match that line's phrasing, which is why it drifted silently past every prior cut.
 
-## [0.8.13] — 2026-07-25
+## [0.8.13], 2026-07-25
 
 ### Maintenance
 - **Lockstep version bump only.** No source changes in this package; bumped to maintain the 11-package version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.13 work shipped in 12 named theme identities + select-menu Theme row in theme-panel; fixes scale.css wiring, Preset/Reset UX, and a Theme-select XSS finding. See `packages/web-modules/CHANGELOG.md#0813--2026-07-25` for details.
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.12] — 2026-07-24
+## [0.8.12], 2026-07-24
 
 ### Fixed
-- **`AGENTS.md`, `adia-author/SKILL.md`, `adia-author/references/code-style.md`: primitive count corrected 127 → 125** — the actual `packages/web-components/components/*/` directory count (excluding `index.js`/`index.d.ts`/`overview.*`); `AGENTS.md` had two separate stale mentions, one already partially corrected in a prior pass and one missed.
+- **`AGENTS.md`, `adia-author/SKILL.md`, `adia-author/references/code-style.md`: primitive count corrected 127 → 125**, the actual `packages/web-components/components/*/` directory count (excluding `index.js`/`index.d.ts`/`overview.*`); `AGENTS.md` had two separate stale mentions, one already partially corrected in a prior pass and one missed.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (2 file(s), e.g. `adia-author/SKILL.md`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (2 file(s), e.g. `adia-author/SKILL.md`), carried by the entries above.
 
-## [0.8.11] — 2026-07-23
+## [0.8.11], 2026-07-23
 
 ### Fixed
-- **`adia-author`: dist-bundle regen joins the structural-gate sequence** (`skills/primitive-authoring/SKILL.md`, `references/authoring-cycle.md`) — a new/changed component CSS `@import` or barrel export drifts `dist/` bundles, and the skill's verify sequence never said so; gh#390's PR failed CI's `check:css-bundles-fresh`/`check:js-bundles-fresh` exactly this way. The gate sequence and the barrel-registration step now both name `build:bundle-css`/`build:bundle-js` + the two freshness checks.
-- **`adia-release`: `release-pack.mjs --mode handoff` validates `--gh-notes-file` at parse time** — the flag was only checked at Step 10 (GH releases), AFTER tags and npm publish were irreversible; the v0.8.10 cut died there live. Selftest case added.
-- **`adia-release`: mid-Step-4 resume path documented** (`references/cut-procedure.md` §4-resume) — once any CHANGELOG promotion lands, re-invoking the orchestrator hard-errors on the idempotency guard ("already has ## [X.Y.Z]") forever; the doc now names the standalone-pieces sequence (bump → lockfile → lockstep → 4f → 4e → Step 5/5.7) instead of leaving the operator to reverse-engineer it mid-cut.
-- **`adia-release`: stub-package ownership rule** (`references/changelog-discipline.md` §Stubs) — `insert-stub.mjs` inserts, never promotes; a hand-written `[Unreleased]` in a `--stub-packages` target survives as an orphaned second block and fails the loud guard (v0.8.10 lost a cycle to this across 6 packages). Rule: the tool owns stub packages; hand-written content means the package belongs in `--substantive-packages`.
-- **`release-pretag-docs-gate`: a `cd <path> && …` command prefix now resolves the gate against THAT checkout, not the session cwd** (`bin/release-pretag-docs-gate`) — a session pinned to a stale worktree (own copy of the gate script, branch without the release's CHANGELOG sections) false-FAILed the v0.8.10 handoff even though the command explicitly cd'd to the clean primary checkout. Selftest fixtures added for the prefix resolution.
+- **`adia-author`: dist-bundle regen joins the structural-gate sequence** (`skills/primitive-authoring/SKILL.md`, `references/authoring-cycle.md`), a new/changed component CSS `@import` or barrel export drifts `dist/` bundles, and the skill's verify sequence never said so; gh#390's PR failed CI's `check:css-bundles-fresh`/`check:js-bundles-fresh` exactly this way. The gate sequence and the barrel-registration step now both name `build:bundle-css`/`build:bundle-js` + the two freshness checks.
+- **`adia-release`: `release-pack.mjs --mode handoff` validates `--gh-notes-file` at parse time**: the flag was only checked at Step 10 (GH releases), AFTER tags and npm publish were irreversible; the v0.8.10 cut died there live. Selftest case added.
+- **`adia-release`: mid-Step-4 resume path documented** (`references/cut-procedure.md` §4-resume), once any CHANGELOG promotion lands, re-invoking the orchestrator hard-errors on the idempotency guard ("already has ## [X.Y.Z]") forever; the doc now names the standalone-pieces sequence (bump → lockfile → lockstep → 4f → 4e → Step 5/5.7) instead of leaving the operator to reverse-engineer it mid-cut.
+- **`adia-release`: stub-package ownership rule** (`references/changelog-discipline.md` §Stubs), `insert-stub.mjs` inserts, never promotes; a hand-written `[Unreleased]` in a `--stub-packages` target survives as an orphaned second block and fails the loud guard (v0.8.10 lost a cycle to this across 6 packages). Rule: the tool owns stub packages; hand-written content means the package belongs in `--substantive-packages`.
+- **`release-pretag-docs-gate`: a `cd <path> && …` command prefix now resolves the gate against THAT checkout, not the session cwd** (`bin/release-pretag-docs-gate`), a session pinned to a stale worktree (own copy of the gate script, branch without the release's CHANGELOG sections) false-FAILed the v0.8.10 handoff even though the command explicitly cd'd to the clean primary checkout. Selftest fixtures added for the prefix resolution.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.10] — 2026-07-20
+## [0.8.10], 2026-07-20
 
 ### Added
-- **`evals/evals.json` behavioral test-case files for 8 skills** (gh#369) — the file `release_gate.py`'s G7 coverage check actually reads (a schema distinct from `evals/routing-corpus.json`). Derived from each skill's already-vetted `routing-corpus.json` phrases, with real judgment applied — the forge side required genuine authoring since its corpus phrases are terse fragments, not natural-language prompts (independently reviewed, sampled).
+- **`evals/evals.json` behavioral test-case files for 8 skills** (gh#369), the file `release_gate.py`'s G7 coverage check actually reads (a schema distinct from `evals/routing-corpus.json`). Derived from each skill's already-vetted `routing-corpus.json` phrases, with real judgment applied, the forge side required genuine authoring since its corpus phrases are terse fragments, not natural-language prompts (independently reviewed, sampled).
 
 ### Fixed
-- **`evals/routing-corpus.json` unified onto one schema across all skills** (gh#355) — converged forge's `{positives,negatives}` shape and factory's `{phrases}` shape onto the `{phrases:[...]}` form `scripts/skills/run-skill-evals.mjs` actually reads. `run-skill-evals.mjs` extended to aggregate the global corpus with every per-skill corpus (per-skill wins on id collision) instead of reading only the 97-phrase global file; added a `selftest` subcommand. Does NOT touch `routing_eval.py`/`release_gate.py` — those live in an externally-installed marketplace plugin, out of this repo's reach; gh#369 is the separate, real fix for G7's actual coverage check.
+- **`evals/routing-corpus.json` unified onto one schema across all skills** (gh#355), converged forge's `{positives,negatives}` shape and factory's `{phrases}` shape onto the `{phrases:[...]}` form `scripts/skills/run-skill-evals.mjs` actually reads. `run-skill-evals.mjs` extended to aggregate the global corpus with every per-skill corpus (per-skill wins on id collision) instead of reading only the 97-phrase global file; added a `selftest` subcommand. Does NOT touch `routing_eval.py`/`release_gate.py`, those live in an externally-installed marketplace plugin, out of this repo's reach; gh#369 is the separate, real fix for G7's actual coverage check.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.9] — 2026-07-19
+## [0.8.9], 2026-07-19
 
 ### Fixed
-- **`release-pack.mjs` now actually creates `release/vX.Y.Z`** before staging — `step5Commit()` previously committed on whatever branch was checked out (the v0.8.8 cut landed its release commit on local `main`, caught and recovered by hand). Idempotent (checkout if the branch exists — a resumed run — create with `-b` otherwise); `step1ReBaseline()` now asserts the starting branch is `main` or the release branch itself for cut modes. Guarded: checking out an *existing* release branch on a dirty tree now fails with a real diagnostic (which files, what to do) instead of an opaque git error.
-- **Step 9's settle-wait polls the registry itself**, not one proxy workflow — the old code waited for `publish-a2ui-validator.yml` alone as a stand-in for all 11 publishes; a straggler on any other package made the immediately-following fail-closed registry check abort on a pure timing false alarm (hit live on the v0.8.8 cut). Now polls all 11 packages + `latest` directly, every 15s up to ~10-18min, per the skill's own doctrine ("the registry is the verify target, never a workflow's green check"). The existing fail-closed check remains as a final confirmation.
-- **`pr-bridge.mjs` refuses to merge a DRAFT PR** — a real incident: it attempted to merge an author-marked draft, which GitHub's API rejects, and the old code (no `isDraft` check anywhere) crashed uncaught. `bridgeDecision()` now treats `isDraft` as an unconditional stop; the `gh pr merge` call and the top-level `main().catch` are both wrapped so no rejection reason — draft or otherwise — can crash invisibly under the script's own documented `grep -E "pr-bridge" | tail -N` usage pattern.
+- **`release-pack.mjs` now actually creates `release/vX.Y.Z`** before staging, `step5Commit()` previously committed on whatever branch was checked out (the v0.8.8 cut landed its release commit on local `main`, caught and recovered by hand). Idempotent (checkout if the branch exists, a resumed run, create with `-b` otherwise); `step1ReBaseline()` now asserts the starting branch is `main` or the release branch itself for cut modes. Guarded: checking out an *existing* release branch on a dirty tree now fails with a real diagnostic (which files, what to do) instead of an opaque git error.
+- **Step 9's settle-wait polls the registry itself**, not one proxy workflow, the old code waited for `publish-a2ui-validator.yml` alone as a stand-in for all 11 publishes; a straggler on any other package made the immediately-following fail-closed registry check abort on a pure timing false alarm (hit live on the v0.8.8 cut). Now polls all 11 packages + `latest` directly, every 15s up to ~10-18min, per the skill's own doctrine ("the registry is the verify target, never a workflow's green check"). The existing fail-closed check remains as a final confirmation.
+- **`pr-bridge.mjs` refuses to merge a DRAFT PR**, a real incident: it attempted to merge an author-marked draft, which GitHub's API rejects, and the old code (no `isDraft` check anywhere) crashed uncaught. `bridgeDecision()` now treats `isDraft` as an unconditional stop; the `gh pr merge` call and the top-level `main().catch` are both wrapped so no rejection reason, draft or otherwise, can crash invisibly under the script's own documented `grep -E "pr-bridge" | tail -N` usage pattern.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
-- **`skills/` touched in this release window** (2 file(s), e.g. `scripts/pr-bridge.mjs`) — carried by the entries above.
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (2 file(s), e.g. `scripts/pr-bridge.mjs`), carried by the entries above.
 
-## [0.8.8] — 2026-07-19
+## [0.8.8], 2026-07-19
 
 ### Added
-- **`pr-bridge.mjs`** (adia-release `skills/package-release/scripts/`): the cut's two-phase PR bridge, mechanized — pushes the release branch, opens/reuses the PR, polls CI, and admin-merges ONLY on all-non-fail-soft-checks-green + zero unresolved review threads + no changes-requested + MERGEABLE; anything else waits or stops with full evidence (`--dry` previews the decision). Independently reviewed and hardened pre-ship: never merges on an empty gating-check set ("nothing failed" ≠ "something passed"); operator-supplied args go through `execFileSync` arg arrays (no shell); the merge-landing proof never skips silently. 14-case selftest; registered in CI's Plugin bin selftests; battle-tested on 8 real merges before first release use. cut-procedure §5.7 documents both the mechanized and manual forms.
+- **`pr-bridge.mjs`** (adia-release `skills/package-release/scripts/`): the cut's two-phase PR bridge, mechanized, pushes the release branch, opens/reuses the PR, polls CI, and admin-merges ONLY on all-non-fail-soft-checks-green + zero unresolved review threads + no changes-requested + MERGEABLE; anything else waits or stops with full evidence (`--dry` previews the decision). Independently reviewed and hardened pre-ship: never merges on an empty gating-check set ("nothing failed" ≠ "something passed"); operator-supplied args go through `execFileSync` arg arrays (no shell); the merge-landing proof never skips silently. 14-case selftest; registered in CI's Plugin bin selftests; battle-tested on 8 real merges before first release use. cut-procedure §5.7 documents both the mechanized and manual forms.
 
 ### Changed
-- **`package-paths.mjs` is now the single source of the 11-package roster** (`PACKAGE_ROSTER` + `PACKAGE_NAMES`/`PACKAGE_DIRS`): the lockstep list was re-declared in 8 scripts (bump, tag-lockstep, dispatch-publish, release-pack, and the repo-side check-release/check-lockstep/check-release-docs/generate-release-notes), each with its own projection — the same list-drift class the gate-roster incident proved out. Skill-side home is deliberate: cache-executed skill scripts can't import repo modules; repo scripts import the skill module by its stable in-repo path.
-- **`gate-roster.mjs` grew gate 18** (`check-cut-hygiene --version X.Y.Z`, via the new `versionArg` field release-pack substitutes) and **gate 4 now runs `test:unit:serial`** (`vitest --no-file-parallelism` — gates-catalog §Cat 8's documented source of truth IS now the gate). References updated same-change: cut-procedure §3.1 (18-gate table), gates-catalog Cat 1/7/8/9.
+- **`package-paths.mjs` is now the single source of the 11-package roster** (`PACKAGE_ROSTER` + `PACKAGE_NAMES`/`PACKAGE_DIRS`): the lockstep list was re-declared in 8 scripts (bump, tag-lockstep, dispatch-publish, release-pack, and the repo-side check-release/check-lockstep/check-release-docs/generate-release-notes), each with its own projection, the same list-drift class the gate-roster incident proved out. Skill-side home is deliberate: cache-executed skill scripts can't import repo modules; repo scripts import the skill module by its stable in-repo path.
+- **`gate-roster.mjs` grew gate 18** (`check-cut-hygiene --version X.Y.Z`, via the new `versionArg` field release-pack substitutes) and **gate 4 now runs `test:unit:serial`** (`vitest --no-file-parallelism`, gates-catalog §Cat 8's documented source of truth IS now the gate). References updated same-change: cut-procedure §3.1 (18-gate table), gates-catalog Cat 1/7/8/9.
 
 ### Fixed
-- **`bump.mjs` moves every cross-file version reference in the same pass**: the factory `.mcp.json` `@adia-ai/a2ui-mcp@X.Y.Z` pin (invariant 8 — hand-fixed on BOTH the 0.8.6 and 0.8.7 cuts; `check:lockstep` now guards it too) and the root README "Current version" claim (`REPO_PINNED_REFS` — gate 18 exact-matches it, so a hand-set value fails the next cut by construction). All pins pre-flight-validated alongside `validateAllAtFrom`, so a doomed bump writes NOTHING (reviewer finding: the mid-loop check fired only after two files were already written).
+- **`bump.mjs` moves every cross-file version reference in the same pass**: the factory `.mcp.json` `@adia-ai/a2ui-mcp@X.Y.Z` pin (invariant 8, hand-fixed on BOTH the 0.8.6 and 0.8.7 cuts; `check:lockstep` now guards it too) and the root README "Current version" claim (`REPO_PINNED_REFS`, gate 18 exact-matches it, so a hand-set value fails the next cut by construction). All pins pre-flight-validated alongside `validateAllAtFrom`, so a doomed bump writes NOTHING (reviewer finding: the mid-loop check fired only after two files were already written).
 - **adia-release docs**: SKILL.md Mechanization + cut-procedure §5.7/§3.1 + gates-catalog reflect pr-bridge, the 18-gate roster, the umbrella tag's `info` classification (the repo-side `check-release.mjs` fix that killed the Step-7 false-stop which forced manual handoffs on 0.8.6/0.8.7), and the deleted superseded `check-changelog-coverage` gate.
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.7] — 2026-07-19
+## [0.8.7], 2026-07-19
 
 ### Added
-- **`site-postwrite-derivation-gate` hook** (`bin/`, registered PostToolUse·Write|Edit in `hooks/hooks.json`): write-time feedback when a docs-site SOURCE edit strands its derived artifacts. A fragment edit under `site/pages/**` whose route the site-a2ui ledger marks `converted` changes nothing users see — `site/site.js` keeps serving the now-stale `site-a2ui/pages/<slug>.a2ui.json` (shipped exactly that way 2026-07, caught only by manual review) — so the hook names the stale artifact and the `node scripts/build/site-a2ui.mjs --page <route>` regeneration; `site/sitemap.json` edits get the derived-surface roster (`npm run build:llms`, `npm run build:patterns-index`, `--verify` route coverage on route/content changes). Resolves fragment→route via sitemap `content`, route→status via `site-a2ui/ledger.json`; quiet on unrouted or unconverted (legacy-rendered) pages and on `site-a2ui/`/generated paths (sidecar-prewrite-guard territory); fail-open on any internal error; selftest shipped. The hard repo-wide gate is the site-a2ui verify wired separately.
+- **`site-postwrite-derivation-gate` hook** (`bin/`, registered PostToolUse·Write|Edit in `hooks/hooks.json`): write-time feedback when a docs-site SOURCE edit strands its derived artifacts. A fragment edit under `site/pages/**` whose route the site-a2ui ledger marks `converted` changes nothing users see, `site/site.js` keeps serving the now-stale `site-a2ui/pages/<slug>.a2ui.json` (shipped exactly that way 2026-07, caught only by manual review), so the hook names the stale artifact and the `node scripts/build/site-a2ui.mjs --page <route>` regeneration; `site/sitemap.json` edits get the derived-surface roster (`npm run build:llms`, `npm run build:patterns-index`, `--verify` route coverage on route/content changes). Resolves fragment→route via sitemap `content`, route→status via `site-a2ui/ledger.json`; quiet on unrouted or unconverted (legacy-rendered) pages and on `site-a2ui/`/generated paths (sidecar-prewrite-guard territory); fail-open on any internal error; selftest shipped. The hard repo-wide gate is the site-a2ui verify wired separately.
 
 ### Changed
-- **`bin/sidecar-prewrite-guard`** (PreToolUse deny hook) — extended the GENERATED-artifact allowlist to the new patterns/templates index (`site/patterns-index.json`, `site/pages/patterns/index.html`, `adia-patterns/references/pattern-index.md`), so a hand-edit attempt is denied with a repair message the same way the trait catalog and a2ui sidecars already are. Selftest extended with matching/non-matching cases (annotations.yaml stays editable).
-- **`skills/demo-audit/SKILL.md`, `references/visual-probe-triage.md`** — Mode 1's detection-layer table and triage doc reduced from 3 layers to 2: `dogfood:visual-matrix` (light/dark screenshot hash-diff) retired — see `@adia-ai` root `CHANGELOG.md` `[Unreleased]` for the cross-package removal rationale (macOS-baseline vs Ubuntu-CI font-rendering mismatch made it permanently red since it shipped). `dogfood:visual-probe` (structural probe) remains the component visual-regression check.
-- **Agent cross-references re-keyed** (`agents/routing-corpus.json`, `references/contracts/a2ui-mcp-surface.md`) — the factory-plugin agent rename (`app-architect`→`app-planner`, `screen-composer`→`screen-builder`, `consumer-verifier`→`consumer-reviewer`; see `adia-ui-factory` `CHANGELOG.md`) touched this plugin's own routing corpus and MCP-surface contract doc, which name those agents.
-- **A2UI/GenUI terminology detangle** (`agents/framework-reviewer.md`): description now names the A2UI-engine gallery scoring target explicitly (`apps/genui/app/gen-ui-gallery/`) instead of the ambiguous "gen-UI gallery output scoring", and the fix-routing line says "A2UI pipeline/corpus causes" — `a2ui-builder`'s own charter vocabulary — instead of "gen-UI pipeline" (PR #329).
+- **`bin/sidecar-prewrite-guard`** (PreToolUse deny hook), extended the GENERATED-artifact allowlist to the new patterns/templates index (`site/patterns-index.json`, `site/pages/patterns/index.html`, `adia-patterns/references/pattern-index.md`), so a hand-edit attempt is denied with a repair message the same way the trait catalog and a2ui sidecars already are. Selftest extended with matching/non-matching cases (annotations.yaml stays editable).
+- **`skills/demo-audit/SKILL.md`, `references/visual-probe-triage.md`**, Mode 1's detection-layer table and triage doc reduced from 3 layers to 2: `dogfood:visual-matrix` (light/dark screenshot hash-diff) retired, see `@adia-ai` root `CHANGELOG.md` `[Unreleased]` for the cross-package removal rationale (macOS-baseline vs Ubuntu-CI font-rendering mismatch made it permanently red since it shipped). `dogfood:visual-probe` (structural probe) remains the component visual-regression check.
+- **Agent cross-references re-keyed** (`agents/routing-corpus.json`, `references/contracts/a2ui-mcp-surface.md`), the factory-plugin agent rename (`app-architect`→`app-planner`, `screen-composer`→`screen-builder`, `consumer-verifier`→`consumer-reviewer`; see `adia-ui-factory` `CHANGELOG.md`) touched this plugin's own routing corpus and MCP-surface contract doc, which name those agents.
+- **A2UI/GenUI terminology detangle** (`agents/framework-reviewer.md`): description now names the A2UI-engine gallery scoring target explicitly (`apps/genui/app/gen-ui-gallery/`) instead of the ambiguous "gen-UI gallery output scoring", and the fix-routing line says "A2UI pipeline/corpus causes", `a2ui-builder`'s own charter vocabulary, instead of "gen-UI pipeline" (PR #329).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.6] — 2026-07-18
+## [0.8.6], 2026-07-18
 
 ### Changed
-- **`adia-release` moves to the single-authorization model** (`skills/package-release/SKILL.md`, `references/{cut-procedure,changelog-discipline,independent-package-release}.md`, `scripts/release-pack.mjs`, `agents/release-engineer.md`; operator ruling 2026-07-17): the operator's initiating instruction covers the entire cycle (tag → push → publish → deploy dispatch); the 4-checkpoint per-step sign-off ceremony and the consent-relay doctrine are retired — the v0.8.5 cut spent ~40 minutes on approval relays that produced zero safety while every real protection (release-pretag-docs-gate hook, pre-push F-N1 trip-wire, one-tag-per-push, registry verify) fired deterministically. Releases run INLINE in the operator's session; `release-engineer` is refocused as the unattended seat (scheduled/batch/CI) where the dispatch carries the authorization, with an explicit serial-seat rule (a resumed dispatch continues the same cut, never forks a parallel worker — 3 raced the v0.8.5 worktree). New `release-pack.mjs --go` flag auto-confirms all checkpoints; evidence blocks still print as the audit log; the F-N1 error hard-stop and warn-blocks-auto-confirm rules remain non-skippable.
-- **F-N1 coverage mechanized at cut time** (`scripts/release/check-release.mjs --pending-version X.Y.Z [--fix]`, repo-side; wired into `release-pack.mjs` cut modes as Step 4f): the authoritative matcher — same `changelogMentions` patterns, all 11 packages — now runs pre-PR against the working tree and `--fix` auto-appends `### Maintenance` bullets it re-verifies against its own matcher before writing. Kills the post-tag enrichment retag loop (v0.8.5: 3 enrichment PRs + 3 delete/retag rounds, caused by hand-authored prose that read correctly but lacked the literal substrings, and by the drifted 9-package `check-changelog-coverage.mjs` — now marked superseded for cut-time use). Selftest extended with the section-finder, bullet-generator, and append fixtures including the `.claude-plugin` leading-dot case.
-- **Release-script permission allowlist** (`.claude/settings.json`): the bundled release scripts + `git tag` are allowlisted so the executing session isn't hard-blocked mid-cut by the permission classifier (bit the v0.8.5 checkpoint 1 — the agent was denied even a `--dry` run). `git push` deliberately stays under the normal permission flow.
-- **gh#268 modernization campaign, W0–W3** (PRs #312, #313, #317): the retried 5-auditor deep sweep's findings applied across the whole plugin. `agents/` renamed to the registered role vocabulary — `a2ui-engineer`→`a2ui-builder`, `release-engineer`→`release-builder`, `framework-verifier`→`framework-reviewer` — with every live cross-reference re-keyed (routing corpora both plugins, README, skill bodies) and per-agent sidecar corpora checked in. All 9 `skills/` gained a `routing_eval.py`-schema routing corpus with a measured `_measured` block; descriptions rewrote to the trigger vocabulary the tool named; content-currency fixes landed in adia-llm-internals (stale key-fallback/stopReason/stub claims), adia-gen-review (5 missing TAG_TO_COMPONENT tags — coverage 140/140 — exit-gate claim made honest, 2 cause codes routed), adia-site-docs (stale TKT-0011 claim, named critic), adia-a2ui (stale count, rotted line anchors → grep anchors, new Pipeline Change Record), adia-dogfood (severity twin aligned to the enforcing script, AskUserQuestion escalation template), adia-author (yaml-SoT Step 4b — `yaml-contract.md` was reachable from nothing — real 9-file anatomy in the worked example, @adia-ai/llm territory ceded to adia-llm-internals), adia-release (Cut Record output contract, 11-package stub text, honest selftest count), adia-deploy (real Deploy Record example replacing a placeholder, live-verified environment-gate status), adia-ssr (gh#284/#288 resync to the shipped fixes). `commands/release.md` no longer teaches the retired per-step sign-off model. `README.md` skills table 7→9 + version footer; `cut-procedure.md` gains §Plugin cache (content merged between lockstep cuts is cache-invisible until the next bump).
+- **`adia-release` moves to the single-authorization model** (`skills/package-release/SKILL.md`, `references/{cut-procedure,changelog-discipline,independent-package-release}.md`, `scripts/release-pack.mjs`, `agents/release-engineer.md`; operator ruling 2026-07-17): the operator's initiating instruction covers the entire cycle (tag → push → publish → deploy dispatch); the 4-checkpoint per-step sign-off ceremony and the consent-relay doctrine are retired, the v0.8.5 cut spent ~40 minutes on approval relays that produced zero safety while every real protection (release-pretag-docs-gate hook, pre-push F-N1 trip-wire, one-tag-per-push, registry verify) fired deterministically. Releases run INLINE in the operator's session; `release-engineer` is refocused as the unattended seat (scheduled/batch/CI) where the dispatch carries the authorization, with an explicit serial-seat rule (a resumed dispatch continues the same cut, never forks a parallel worker, 3 raced the v0.8.5 worktree). New `release-pack.mjs --go` flag auto-confirms all checkpoints; evidence blocks still print as the audit log; the F-N1 error hard-stop and warn-blocks-auto-confirm rules remain non-skippable.
+- **F-N1 coverage mechanized at cut time** (`scripts/release/check-release.mjs --pending-version X.Y.Z [--fix]`, repo-side; wired into `release-pack.mjs` cut modes as Step 4f): the authoritative matcher, same `changelogMentions` patterns, all 11 packages, now runs pre-PR against the working tree and `--fix` auto-appends `### Maintenance` bullets it re-verifies against its own matcher before writing. Kills the post-tag enrichment retag loop (v0.8.5: 3 enrichment PRs + 3 delete/retag rounds, caused by hand-authored prose that read correctly but lacked the literal substrings, and by the drifted 9-package `check-changelog-coverage.mjs`, now marked superseded for cut-time use). Selftest extended with the section-finder, bullet-generator, and append fixtures including the `.claude-plugin` leading-dot case.
+- **Release-script permission allowlist** (`.claude/settings.json`): the bundled release scripts + `git tag` are allowlisted so the executing session isn't hard-blocked mid-cut by the permission classifier (bit the v0.8.5 checkpoint 1: the agent was denied even a `--dry` run). `git push` deliberately stays under the normal permission flow.
+- **gh#268 modernization campaign, W0–W3** (PRs #312, #313, #317): the retried 5-auditor deep sweep's findings applied across the whole plugin. `agents/` renamed to the registered role vocabulary, `a2ui-engineer`→`a2ui-builder`, `release-engineer`→`release-builder`, `framework-verifier`→`framework-reviewer`, with every live cross-reference re-keyed (routing corpora both plugins, README, skill bodies) and per-agent sidecar corpora checked in. All 9 `skills/` gained a `routing_eval.py`-schema routing corpus with a measured `_measured` block; descriptions rewrote to the trigger vocabulary the tool named; content-currency fixes landed in adia-llm-internals (stale key-fallback/stopReason/stub claims), adia-gen-review (5 missing TAG_TO_COMPONENT tags, coverage 140/140, exit-gate claim made honest, 2 cause codes routed), adia-site-docs (stale TKT-0011 claim, named critic), adia-a2ui (stale count, rotted line anchors → grep anchors, new Pipeline Change Record), adia-dogfood (severity twin aligned to the enforcing script, AskUserQuestion escalation template), adia-author (yaml-SoT Step 4b, `yaml-contract.md` was reachable from nothing, real 9-file anatomy in the worked example, @adia-ai/llm territory ceded to adia-llm-internals), adia-release (Cut Record output contract, 11-package stub text, honest selftest count), adia-deploy (real Deploy Record example replacing a placeholder, live-verified environment-gate status), adia-ssr (gh#284/#288 resync to the shipped fixes). `commands/release.md` no longer teaches the retired per-step sign-off model. `README.md` skills table 7→9 + version footer; `cut-procedure.md` gains §Plugin cache (content merged between lockstep cuts is cache-invisible until the next bump).
 
 ### Maintenance
-- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.claude-plugin/plugin.json` version bump**, moves in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.5] — 2026-07-17
+## [0.8.5], 2026-07-17
 
 ### Fixed
-- **`adia-ssr` skill's gh#284 status corrected — narrowed, not fixed, not open** (`skills/ssr-compatibility/`, 2026-07-17): verified against 0.8.4 that every component named in the issue (`nav-ui`, `admin-shell`, `admin-sidebar`, `text-ui`, `badge-ui`, `avatar-ui`) has `static template = () => null`, so `connectedCallback`'s destructive `stamp()` never runs against their light-DOM children — a framework-wide survey (150 components) found every component WITH a non-null template derives content from properties only, never light-DOM children. Zero shipped components are exposed to the originally-reported symptom. Rather than patching `stamp()`/`connectedCallback` (rejected as disproportionate — changes every primitive's render lifecycle for a currently-zero-instance risk), shipped a forward-looking static audit, `scripts/dev/audit-template-child-conflict.mjs` (in `@adia-ai/web-components`, wired into `adia-author`'s structural-gate sequence), that flags a FUTURE component reintroducing the conflict shape. `SKILL.md`'s worked example, `references/failure-shapes.md` §2, `references/guard-patterns.md` §2, `references/status-ledger.md`, and `references/consumer-workarounds.md` all updated — the worked example previously answered "yes, known issue" for the exact `<text-ui>` case that no longer reproduces, which would have misled a future consult.
+- **`adia-ssr` skill's gh#284 status corrected, narrowed, not fixed, not open** (`skills/ssr-compatibility/`, 2026-07-17): verified against 0.8.4 that every component named in the issue (`nav-ui`, `admin-shell`, `admin-sidebar`, `text-ui`, `badge-ui`, `avatar-ui`) has `static template = () => null`, so `connectedCallback`'s destructive `stamp()` never runs against their light-DOM children, a framework-wide survey (150 components) found every component WITH a non-null template derives content from properties only, never light-DOM children. Zero shipped components are exposed to the originally-reported symptom. Rather than patching `stamp()`/`connectedCallback` (rejected as disproportionate, changes every primitive's render lifecycle for a currently-zero-instance risk), shipped a forward-looking static audit, `scripts/dev/audit-template-child-conflict.mjs` (in `@adia-ai/web-components`, wired into `adia-author`'s structural-gate sequence), that flags a FUTURE component reintroducing the conflict shape. `SKILL.md`'s worked example, `references/failure-shapes.md` §2, `references/guard-patterns.md` §2, `references/status-ledger.md`, and `references/consumer-workarounds.md` all updated, the worked example previously answered "yes, known issue" for the exact `<text-ui>` case that no longer reproduces, which would have misled a future consult.
 
 ### Added
-- **`adia-ssr` knowledge skill** (`skills/ssr-compatibility/`: `SKILL.md`, `references/{failure-shapes,guard-patterns,consumer-workarounds,status-ledger,test-without-linkedom}.md`, `evals/{routing-corpus.json,audit-report.md}`; PR #293): NEW consumer-facing skill answering SSR-support questions for AdiaUI — the gh#284 narrowing above is this skill's flagship finding, corrected before the skill's first ship rather than after.
-- **gh#268 campaign W1+W2 (forge estate)** — adia-release periphery surgery (`skills/package-release/scripts/{promote-unreleased,bump,tag-lockstep,insert-stub,release-pack,dispatch-publish}.mjs`, `references/cut-procedure.md`: promote-unreleased in cut mode + the unpromoted-[Unreleased] guard; --yes scoped to checkpoint 1 with dedicated --push/--publish; evidence-first reordered checkpoints; site deploy via workflow dispatch, raw rsync gone; --mode batch hard-rejects; the 17-gate roster data-driven from `scripts/gate-roster.mjs`; retired --amend teachings replaced with the PR→retag flow); selftests on all 6 release scripts + check-release + the embeddings gate (content-hash freshness) (`skills/package-release/evals/evals.json`), wired into CI; adia-author's fictional `Adia*` grammar (24 occurrences) and nonexistent-token worked example corrected to the real `UI*`/token surface (`skills/primitive-authoring/references/{anti-patterns,worked-example,api-contract,authoring-cycle,code-style,lifecycle-patterns,token-contract,yaml-contract}.md`); adia-a2ui's corpus manifest now written by the harvest + gated, eval floors re-grounded to their gate scripts, reserved engine list corrected (also in AGENTS.md) (`skills/a2ui-maintenance/SKILL.md`, `references/pipeline-overview.md`); adia-dogfood scope reconciled with its aggregator (Mode 7) and the perl -i auto-fix rows made BUILDER-ONLY with the framework-verifier seat's mutating-Bash prohibition (generator≠critic) (`skills/demo-audit/SKILL.md`, `agents/framework-verifier.md`); typed records (Dogfood Findings, Gen-Review Scorecard, Deploy Record) + the deploy-freshness cadence rule (`skills/{adia-dogfood,adia-gen-review,adia-deploy}/SKILL.md`); routing/eval corpora for release, deploy, dogfood, gen-review, llm-internals (`skills/{adia-release,adia-deploy,adia-dogfood,adia-gen-review,adia-llm-internals}/evals/routing-corpus.json`).
-- **`release-pretag-docs-gate` hook** (`bin/`, registered PreToolUse·Bash in `hooks/hooks.json`): denies irreversible release commands (tag-lockstep without `--delete`, release-tag pushes, `dispatch-publish`, `release-pack --mode handoff`) until the repo's `scripts/release/check-release-docs.mjs` passes — every lockstep CHANGELOG carries the version's section with no leftover `[Unreleased]` content, entry READMEs exist, and the generated team notes (`docs/releases/vX.Y.Z.md`) are present. Quiet outside the monorepo and on reversible commands; selftest shipped. Born from the v0.8.4 near-miss (tarballs shipped with unpromoted CHANGELOG headers). `skills/package-release` cut procedure gains Step 4e (docs review + notes generation) accordingly.
+- **`adia-ssr` knowledge skill** (`skills/ssr-compatibility/`: `SKILL.md`, `references/{failure-shapes,guard-patterns,consumer-workarounds,status-ledger,test-without-linkedom}.md`, `evals/{routing-corpus.json,audit-report.md}`; PR #293): NEW consumer-facing skill answering SSR-support questions for AdiaUI: the gh#284 narrowing above is this skill's flagship finding, corrected before the skill's first ship rather than after.
+- **gh#268 campaign W1+W2 (forge estate)**, adia-release periphery surgery (`skills/package-release/scripts/{promote-unreleased,bump,tag-lockstep,insert-stub,release-pack,dispatch-publish}.mjs`, `references/cut-procedure.md`: promote-unreleased in cut mode + the unpromoted-[Unreleased] guard; --yes scoped to checkpoint 1 with dedicated --push/--publish; evidence-first reordered checkpoints; site deploy via workflow dispatch, raw rsync gone; --mode batch hard-rejects; the 17-gate roster data-driven from `scripts/gate-roster.mjs`; retired --amend teachings replaced with the PR→retag flow); selftests on all 6 release scripts + check-release + the embeddings gate (content-hash freshness) (`skills/package-release/evals/evals.json`), wired into CI; adia-author's fictional `Adia*` grammar (24 occurrences) and nonexistent-token worked example corrected to the real `UI*`/token surface (`skills/primitive-authoring/references/{anti-patterns,worked-example,api-contract,authoring-cycle,code-style,lifecycle-patterns,token-contract,yaml-contract}.md`); adia-a2ui's corpus manifest now written by the harvest + gated, eval floors re-grounded to their gate scripts, reserved engine list corrected (also in AGENTS.md) (`skills/a2ui-maintenance/SKILL.md`, `references/pipeline-overview.md`); adia-dogfood scope reconciled with its aggregator (Mode 7) and the perl -i auto-fix rows made BUILDER-ONLY with the framework-verifier seat's mutating-Bash prohibition (generator≠critic) (`skills/demo-audit/SKILL.md`, `agents/framework-verifier.md`); typed records (Dogfood Findings, Gen-Review Scorecard, Deploy Record) + the deploy-freshness cadence rule (`skills/{adia-dogfood,adia-gen-review,adia-deploy}/SKILL.md`); routing/eval corpora for release, deploy, dogfood, gen-review, llm-internals (`skills/{adia-release,adia-deploy,adia-dogfood,adia-gen-review,adia-llm-internals}/evals/routing-corpus.json`).
+- **`release-pretag-docs-gate` hook** (`bin/`, registered PreToolUse·Bash in `hooks/hooks.json`): denies irreversible release commands (tag-lockstep without `--delete`, release-tag pushes, `dispatch-publish`, `release-pack --mode handoff`) until the repo's `scripts/release/check-release-docs.mjs` passes, every lockstep CHANGELOG carries the version's section with no leftover `[Unreleased]` content, entry READMEs exist, and the generated team notes (`docs/releases/vX.Y.Z.md`) are present. Quiet outside the monorepo and on reversible commands; selftest shipped. Born from the v0.8.4 near-miss (tarballs shipped with unpromoted CHANGELOG headers). `skills/package-release` cut procedure gains Step 4e (docs review + notes generation) accordingly.
 
 ### Maintenance
 - **Lockstep version bump** (`.claude-plugin/plugin.json` version field, 0.8.4 → 0.8.5).
 
 
-## [0.8.4] — 2026-07-16
+## [0.8.4], 2026-07-16
 
 ### Changed
 - **`adia-llm-internals` references re-synced to the shipped fixes** (`skills/llm-client-maintenance/references/`, `.claude-plugin/plugin.json` version): `bridge-facade.md` documents the new provider-resolution precedence (model id outranks env detection, `detectProviderFromModel`), `browser-proxy-boundary.md` documents origin-only passthrough URL swapping + the provider-prefix proxy map, `adapter-contract.md`/`model-registry.md`/`add-a-provider.md` carry the gemini raw-stopReason and keys-must-match-registry invariants.
 
-## [0.8.3] — 2026-07-16
+## [0.8.3], 2026-07-16
 
 ### Fixed
-- **`skills/package-release` reconciled with invariant 3** (release commits land via PR): `scripts/release-pack.mjs` is now two-phase — the cut modes STOP at the release commit; `--mode handoff` runs tag→publish→deploy from post-merge main; `git push origin main` is gone from the flow. Also fixed a latent Step-5 staging bug (the plugins mapped to wrong paths; both `plugin.json` files + the factory `.mcp.json` were never staged — an orchestrated cut would have committed an incomplete release).
+- **`skills/package-release` reconciled with invariant 3** (release commits land via PR): `scripts/release-pack.mjs` is now two-phase, the cut modes STOP at the release commit; `--mode handoff` runs tag→publish→deploy from post-merge main; `git push origin main` is gone from the flow. Also fixed a latent Step-5 staging bug (the plugins mapped to wrong paths; both `plugin.json` files + the factory `.mcp.json` were never staged, an orchestrated cut would have committed an incomplete release).
 - **`commands/release.md` + `agents/release-engineer.md`**: the retired "9-package lockstep + independent plugins" framing → the 11-package reality.
-- **Skill descriptions language-passed** (`skills/a2ui-maintenance` 499→325 chars — the estate's last listing-budget warn — plus gen-review/llm-internals/release): canonical "Use when…" trigger form, no fence lost. `check:skills` now reports 0 errors, 0 warns estate-wide.
+- **Skill descriptions language-passed** (`skills/a2ui-maintenance` 499→325 chars, the estate's last listing-budget warn, plus gen-review/llm-internals/release): canonical "Use when…" trigger form, no fence lost. `check:skills` now reports 0 errors, 0 warns estate-wide.
 
 ### Maintenance
 - `packages/plugins/adia-ui-forge/.claude-plugin/plugin.json` moves in lockstep (the `/plugin update` cache key).
-## [0.8.2] — 2026-07-16
+## [0.8.2], 2026-07-16
 
 ### Maintenance
-- **Lockstep version bump only** (`packages/plugins/adia-ui-forge/.claude-plugin/plugin.json` moves with package.json — the `/plugin update` cache key). No source changes this cut; the v0.8.2 substance is the sibling adia-ui-factory's modernization campaign (gh#259) and @adia-ai/web-components' button-ellipsis fix.
-## [0.8.1] — 2026-07-15
+- **Lockstep version bump only** (`packages/plugins/adia-ui-forge/.claude-plugin/plugin.json` moves with package.json, the `/plugin update` cache key). No source changes this cut; the v0.8.2 substance is the sibling adia-ui-factory's modernization campaign (gh#259) and @adia-ai/web-components' button-ellipsis fix.
+## [0.8.1], 2026-07-15
 
 ### Fixed
-- **`skills/package-release`: fail-closed registry verification.** `release-pack.mjs` Step 9 now compares every package's published version AND `dist-tags.latest` against the cut version and aborts before GH releases/deploy on any miss (was print-only with suppressed npm errors — a missing or stale package sailed through).
-- **`skills/package-release`: stale 9/10-package references swept to 11/12.** `release-pack.mjs`'s own `PACKAGES` array was still 9 entries — a cut run through the orchestrator would have left the 2 plugins behind, the exact drift the 2026-07-15 lockstep-join closes. Plus SKILL.md verify targets + description, gates-catalog, notes templates, and the tag/dispatch checkpoint strings (10→12 tags, 9→11 publishes).
+- **`skills/package-release`: fail-closed registry verification.** `release-pack.mjs` Step 9 now compares every package's published version AND `dist-tags.latest` against the cut version and aborts before GH releases/deploy on any miss (was print-only with suppressed npm errors, a missing or stale package sailed through).
+- **`skills/package-release`: stale 9/10-package references swept to 11/12.** `release-pack.mjs`'s own `PACKAGES` array was still 9 entries, a cut run through the orchestrator would have left the 2 plugins behind, the exact drift the 2026-07-15 lockstep-join closes. Plus SKILL.md verify targets + description, gates-catalog, notes templates, and the tag/dispatch checkpoint strings (10→12 tags, 9→11 publishes).
 
 ### Maintenance
 - **`packages/plugins/adia-ui-forge/.claude-plugin/plugin.json` version → 0.8.1** in lockstep with package.json (the `/plugin update` cache key).
 
-## [0.8.0] — 2026-07-15
+## [0.8.0], 2026-07-15
 
-### Changed — joins the @adia-ai lockstep (policy change, operator ruling 2026-07-15)
-- **Version jumps 0.1.0 → 0.8.0 to adopt the lockstep version line.** The plugins were class-B (independently versioned) — which left npm serving the pre-harness-reset `adia-ui-forge@0.1.3` content while the repo's rewritten estate sat unpublished at a REGRESSED 0.1.0. Plugins now bump, tag, and publish with every lockstep cut (release-policy change in `scripts/release/check-lockstep.mjs` + the adia-release skill), so the shipped plugin can never silently drift from the framework it teaches.
-- **Token teachings updated for the v0.8.0 Material color-token adoption** — `adia-author`'s SKILL + 6 references no longer teach the removed `--a-accent-*` vocabulary (swept to `--a-primary-*`); the stale "accent-fg resolves near-black" rationale corrected (post-adoption the on-color is fixed-light).
-- **npm consumers jumping from `adia-ui-forge@0.1.3`:** this version also delivers the full harness-reset estate rewrite documented under `[0.1.0]` below — the `skills/`, `agents/`, `commands/`, `hooks/`, and `reviews/` trees were all replaced wholesale (design: `.claude/docs/specs/plugin-estate-v2.md`). Read `[0.1.0]` for that scope; `[0.8.0]` adds only the items above.
+### Changed, joins the @adia-ai lockstep (policy change, operator ruling 2026-07-15)
+- **Version jumps 0.1.0 → 0.8.0 to adopt the lockstep version line.** The plugins were class-B (independently versioned), which left npm serving the pre-harness-reset `adia-ui-forge@0.1.3` content while the repo's rewritten estate sat unpublished at a REGRESSED 0.1.0. Plugins now bump, tag, and publish with every lockstep cut (release-policy change in `scripts/release/check-lockstep.mjs` + the adia-release skill), so the shipped plugin can never silently drift from the framework it teaches.
+- **Token teachings updated for the v0.8.0 Material color-token adoption**, `adia-author`'s SKILL + 6 references no longer teach the removed `--a-accent-*` vocabulary (swept to `--a-primary-*`); the stale "accent-fg resolves near-black" rationale corrected (post-adoption the on-color is fixed-light).
+- **npm consumers jumping from `adia-ui-forge@0.1.3`:** this version also delivers the full harness-reset estate rewrite documented under `[0.1.0]` below, the `skills/`, `agents/`, `commands/`, `hooks/`, and `reviews/` trees were all replaced wholesale (design: `.claude/docs/specs/plugin-estate-v2.md`). Read `[0.1.0]` for that scope; `[0.8.0]` adds only the items above.
 
-## 0.1.0 — 2026-07-10
+## 0.1.0, 2026-07-10
 
 Initial cut, replacing `adia-ui-forge@0.1.3` (harness reset Phase 2; design:
 `.claude/docs/specs/plugin-estate-v2.md`).
@@ -741,10 +766,10 @@ Initial cut, replacing `adia-ui-forge@0.1.3` (harness reset Phase 2; design:
   `adia-llm-internals` (kills the cross-plugin name collision).
 - Estate-wide: §Teach/§SelfAudit/PEV meta-machinery deleted; both invocation
   dials explicit; descriptions ≤350 chars; canonical eval floors restored
-  (zettel cov≥87 — the source stated cov≥40).
+  (zettel cov≥87, the source stated cov≥40).
 - Agents 7 → 4 thin shells with `skills:` preloads (tech-lead, spec-architect,
   repo-steward retired with the multi-agent claim protocol).
 - Hooks 1 → 3: + `sidecar-prewrite-guard`, + `demo-postwrite-pattern-gate`
   (former prose rules, now enforced).
-- New `references/contracts/` — producer↔consumer contract for the MIGRATION
+- New `references/contracts/`, producer↔consumer contract for the MIGRATION
   GUIDE format + a2ui MCP surface (the 2026-06 red-team's strategic gap).